744 files changed, 35080 insertions, 19738 deletions

diff --git a/net/802/garp.c b/net/802/garp.c
index 1dcb0660c49d..9ed7c0e7dc17 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -14,6 +14,7 @@
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/llc.h>
+#include <linux/slab.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
 #include <net/garp.h>
diff --git a/net/802/p8022.c b/net/802/p8022.c
index 2530f35241cd..7f353c4f437a 100644
--- a/net/802/p8022.c
+++ b/net/802/p8022.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/datalink.h>
 #include <linux/mm.h>
 #include <linux/in.h>
diff --git a/net/802/p8023.c b/net/802/p8023.c
index 6ab1835041a7..1256a40da43c 100644
--- a/net/802/p8023.c
+++ b/net/802/p8023.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include <net/datalink.h>
 #include <net/p8022.h>
diff --git a/net/802/psnap.c b/net/802/psnap.c
index 6fea0750662b..21cde8fd5795 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/datalink.h>
 #include <net/llc.h>
 #include <net/psnap.h>
diff --git a/net/802/stp.c b/net/802/stp.c
index 0b7a24452d11..53c8f77f0ccd 100644
--- a/net/802/stp.c
+++ b/net/802/stp.c
@@ -11,6 +11,7 @@
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
 #include <linux/llc.h>
+#include <linux/slab.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
 #include <net/stp.h>
diff --git a/net/802/tr.c b/net/802/tr.c
index e874447ad144..1c6e596074df 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -36,6 +36,7 @@
 #include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
+#include <linux/slab.h>
 #include <net/arp.h>
 #include <net/net_namespace.h>
 
@@ -635,19 +636,18 @@ struct net_device *alloc_trdev(int sizeof_priv)
 #ifdef CONFIG_SYSCTL
 static struct ctl_table tr_table[] = {
         {
-                .ctl_name       = NET_TR_RIF_TIMEOUT,
                 .procname       = "rif_timeout",
                 .data           = &sysctl_tr_rif_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { 0 },
+        { },
 };
 
 static __initdata struct ctl_path tr_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "token-ring", .ctl_name = NET_TR, },
+        { .procname = "net", },
+        { .procname = "token-ring", },
         { }
 };
 #endif
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index a29c5ab5815c..97da977c2a23 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/rculist.h>
 #include <net/p8022.h>
@@ -41,7 +42,7 @@
 
 /* Global VLAN variables */
 
-int vlan_net_id;
+int vlan_net_id __read_mostly;
 
 /* Our listing of VLAN group(s) */
 static struct hlist_head vlan_group_hash[VLAN_GRP_HASH_SIZE];
@@ -140,7 +141,7 @@ static void vlan_rcu_free(struct rcu_head *rcu)
         vlan_group_free(container_of(rcu, struct vlan_group, rcu));
 }
 
-void unregister_vlan_dev(struct net_device *dev)
+void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 {
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         struct net_device *real_dev = vlan->real_dev;
@@ -159,12 +160,13 @@ void unregister_vlan_dev(struct net_device *dev)
         if (real_dev->features & NETIF_F_HW_VLAN_FILTER)
                 ops->ndo_vlan_rx_kill_vid(real_dev, vlan_id);
 
-        vlan_group_set_device(grp, vlan_id, NULL);
         grp->nr_vlans--;
 
-        synchronize_net();
+        vlan_group_set_device(grp, vlan_id, NULL);
+        if (!grp->killall)
+                synchronize_net();
 
-        unregister_netdevice(dev);
+        unregister_netdevice_queue(dev, head);
 
         /* If the group is now empty, kill off the group. */
         if (grp->nr_vlans == 0) {
@@ -183,27 +185,6 @@ void unregister_vlan_dev(struct net_device *dev)
         dev_put(real_dev);
 }
 
-static void vlan_transfer_operstate(const struct net_device *dev,
-                                    struct net_device *vlandev)
-{
-        /* Have to respect userspace enforced dormant state
-         * of real device, also must allow supplicant running
-         * on VLAN device
-         */
-        if (dev->operstate == IF_OPER_DORMANT)
-                netif_dormant_on(vlandev);
-        else
-                netif_dormant_off(vlandev);
-
-        if (netif_carrier_ok(dev)) {
-                if (!netif_carrier_ok(vlandev))
-                        netif_carrier_on(vlandev);
-        } else {
-                if (netif_carrier_ok(vlandev))
-                        netif_carrier_off(vlandev);
-        }
-}
-
 int vlan_check_real_dev(struct net_device *real_dev, u16 vlan_id)
 {
         const char *name = real_dev->name;
@@ -261,7 +242,7 @@ int register_vlan_dev(struct net_device *dev)
         /* Account for reference in struct vlan_dev_info */
         dev_hold(real_dev);
 
-        vlan_transfer_operstate(real_dev, dev);
+        netif_stacked_transfer_operstate(real_dev, dev);
         linkwatch_fire_event(dev); /* _MUST_ call rfc2863_policy() */
 
         /* So, got the sucker initialized, now lets place
@@ -398,6 +379,8 @@ static void vlan_transfer_features(struct net_device *dev,
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
         vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
 #endif
+        vlandev->real_num_tx_queues = dev->real_num_tx_queues;
+        BUG_ON(vlandev->real_num_tx_queues > vlandev->num_tx_queues);
 
         if (old_features != vlandev->features)
                 netdev_features_change(vlandev);
@@ -430,6 +413,8 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
         struct vlan_group *grp;
         int i, flgs;
         struct net_device *vlandev;
+        struct vlan_dev_info *vlan;
+        LIST_HEAD(list);
 
         if (is_vlan_dev(dev))
                 __vlan_device_event(dev, event);
@@ -450,7 +435,7 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                         if (!vlandev)
                                 continue;
 
-                        vlan_transfer_operstate(dev, vlandev);
+                        netif_stacked_transfer_operstate(dev, vlandev);
                 }
                 break;
 
@@ -505,8 +490,10 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                         if (!(flgs & IFF_UP))
                                 continue;
 
-                        dev_change_flags(vlandev, flgs & ~IFF_UP);
-                        vlan_transfer_operstate(dev, vlandev);
+                        vlan = vlan_dev_info(vlandev);
+                        if (!(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
+                                dev_change_flags(vlandev, flgs & ~IFF_UP);
+                        netif_stacked_transfer_operstate(dev, vlandev);
                 }
                 break;
 
@@ -521,13 +508,17 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                         if (flgs & IFF_UP)
                                 continue;
 
-                        dev_change_flags(vlandev, flgs | IFF_UP);
-                        vlan_transfer_operstate(dev, vlandev);
+                        vlan = vlan_dev_info(vlandev);
+                        if (!(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
+                                dev_change_flags(vlandev, flgs | IFF_UP);
+                        netif_stacked_transfer_operstate(dev, vlandev);
                 }
                 break;
 
         case NETDEV_UNREGISTER:
                 /* Delete all VLANs for this dev. */
+                grp->killall = 1;
+
                 for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
                         vlandev = vlan_group_get_device(grp, i);
                         if (!vlandev)
@@ -538,8 +529,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                         if (grp->nr_vlans == 1)
                                 i = VLAN_GROUP_ARRAY_LEN;
 
-                        unregister_vlan_dev(vlandev);
+                        unregister_vlan_dev(vlandev, &list);
                 }
+                unregister_netdevice_many(&list);
                 break;
         }
 
@@ -645,7 +637,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
                 err = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
-                unregister_vlan_dev(dev);
+                unregister_vlan_dev(dev, NULL);
                 err = 0;
                 break;
 
@@ -674,49 +666,28 @@ out:
         return err;
 }
 
-static int vlan_init_net(struct net *net)
+static int __net_init vlan_init_net(struct net *net)
 {
+        struct vlan_net *vn = net_generic(net, vlan_net_id);
         int err;
-        struct vlan_net *vn;
-
-        err = -ENOMEM;
-        vn = kzalloc(sizeof(struct vlan_net), GFP_KERNEL);
-        if (vn == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, vlan_net_id, vn);
-        if (err < 0)
-                goto err_assign;
 
         vn->name_type = VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD;
 
         err = vlan_proc_init(net);
-        if (err < 0)
-                goto err_proc;
-
-        return 0;
 
-err_proc:
-        /* nothing */
-err_assign:
-        kfree(vn);
-err_alloc:
         return err;
 }
 
-static void vlan_exit_net(struct net *net)
+static void __net_exit vlan_exit_net(struct net *net)
 {
-        struct vlan_net *vn;
-
-        vn = net_generic(net, vlan_net_id);
-        rtnl_kill_links(net, &vlan_link_ops);
         vlan_proc_cleanup(net);
-        kfree(vn);
 }
 
 static struct pernet_operations vlan_net_ops = {
         .init = vlan_init_net,
         .exit = vlan_exit_net,
+        .id   = &vlan_net_id,
+        .size = sizeof(struct vlan_net),
 };
 
 static int __init vlan_proto_init(void)
@@ -726,7 +697,7 @@ static int __init vlan_proto_init(void)
         pr_info("%s v%s %s\n", vlan_fullname, vlan_version, vlan_copyright);
         pr_info("All bugs added by %s\n", vlan_buggyright);
 
-        err = register_pernet_gen_device(&vlan_net_id, &vlan_net_ops);
+        err = register_pernet_subsys(&vlan_net_ops);
         if (err < 0)
                 goto err0;
 
@@ -751,7 +722,7 @@ err4:
 err3:
         unregister_netdevice_notifier(&vlan_notifier_block);
 err2:
-        unregister_pernet_gen_device(vlan_net_id, &vlan_net_ops);
+        unregister_pernet_subsys(&vlan_net_ops);
 err0:
         return err;
 }
@@ -771,7 +742,7 @@ static void __exit vlan_cleanup_module(void)
         for (i = 0; i < VLAN_GRP_HASH_SIZE; i++)
                 BUG_ON(!hlist_empty(&vlan_group_hash[i]));
 
-        unregister_pernet_gen_device(vlan_net_id, &vlan_net_ops);
+        unregister_pernet_subsys(&vlan_net_ops);
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
 
         vlan_gvrp_uninit();
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 82570bc2a180..6abdcac1b2e8 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -16,6 +16,21 @@ struct vlan_priority_tci_mapping {
         struct vlan_priority_tci_mapping        *next;
 };
 
+
+/**
+ *      struct vlan_rx_stats - VLAN percpu rx stats
+ *      @rx_packets: number of received packets
+ *      @rx_bytes: number of received bytes
+ *      @multicast: number of received multicast packets
+ *      @rx_errors: number of errors
+ */
+struct vlan_rx_stats {
+        unsigned long rx_packets;
+        unsigned long rx_bytes;
+        unsigned long multicast;
+        unsigned long rx_errors;
+};
+
 /**
  *      struct vlan_dev_info - VLAN private device data
  *      @nr_ingress_mappings: number of ingress priority mappings
@@ -29,6 +44,7 @@ struct vlan_priority_tci_mapping {
  *      @dent: proc dir entry
  *      @cnt_inc_headroom_on_tx: statistic - number of skb expansions on TX
  *      @cnt_encap_on_xmit: statistic - number of skb encapsulations on TX
+ *      @vlan_rx_stats: ptr to percpu rx stats
  */
 struct vlan_dev_info {
         unsigned int                            nr_ingress_mappings;
@@ -45,6 +61,7 @@ struct vlan_dev_info {
         struct proc_dir_entry                   *dent;
         unsigned long                           cnt_inc_headroom_on_tx;
         unsigned long                           cnt_encap_on_xmit;
+        struct vlan_rx_stats __percpu           *vlan_rx_stats;
 };
 
 static inline struct vlan_dev_info *vlan_dev_info(const struct net_device *dev)
@@ -82,14 +99,14 @@ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result);
 int vlan_check_real_dev(struct net_device *real_dev, u16 vlan_id);
 void vlan_setup(struct net_device *dev);
 int register_vlan_dev(struct net_device *dev);
-void unregister_vlan_dev(struct net_device *dev);
+void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
 
 static inline u32 vlan_get_ingress_priority(struct net_device *dev,
                                             u16 vlan_tci)
 {
         struct vlan_dev_info *vip = vlan_dev_info(dev);
 
-        return vip->ingress_priority_map[(vlan_tci >> 13) & 0x7];
+        return vip->ingress_priority_map[(vlan_tci >> VLAN_PRIO_SHIFT) & 0x7];
 }
 
 #ifdef CONFIG_VLAN_8021Q_GVRP
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 7f7de1a04de6..c584a0af77d3 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -11,10 +11,11 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
         if (netpoll_rx(skb))
                 return NET_RX_DROP;
 
-        if (skb_bond_should_drop(skb))
+        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
                 goto drop;
 
-        skb->vlan_tci = vlan_tci;
+        skb->skb_iif = skb->dev->ifindex;
+        __vlan_hwaccel_put_tag(skb, vlan_tci);
         skb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
 
         if (!skb->dev)
@@ -31,7 +32,7 @@ EXPORT_SYMBOL(__vlan_hwaccel_rx);
 int vlan_hwaccel_do_receive(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
-        struct net_device_stats *stats;
+        struct vlan_rx_stats     *rx_stats;
 
         skb->dev = vlan_dev_info(dev)->real_dev;
         netif_nit_deliver(skb);
@@ -40,15 +41,17 @@ int vlan_hwaccel_do_receive(struct sk_buff *skb)
         skb->priority = vlan_get_ingress_priority(dev, skb->vlan_tci);
         skb->vlan_tci = 0;
 
-        stats = &dev->stats;
-        stats->rx_packets++;
-        stats->rx_bytes += skb->len;
+        rx_stats = per_cpu_ptr(vlan_dev_info(dev)->vlan_rx_stats,
+                               smp_processor_id());
+
+        rx_stats->rx_packets++;
+        rx_stats->rx_bytes += skb->len;
 
         switch (skb->pkt_type) {
         case PACKET_BROADCAST:
                 break;
         case PACKET_MULTICAST:
-                stats->multicast++;
+                rx_stats->multicast++;
                 break;
         case PACKET_OTHERHOST:
                 /* Our lower layer thinks this is not local, let's make sure.
@@ -74,15 +77,17 @@ u16 vlan_dev_vlan_id(const struct net_device *dev)
 }
 EXPORT_SYMBOL(vlan_dev_vlan_id);
 
-static int vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
-                           unsigned int vlan_tci, struct sk_buff *skb)
+static gro_result_t
+vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
+                unsigned int vlan_tci, struct sk_buff *skb)
 {
         struct sk_buff *p;
 
-        if (skb_bond_should_drop(skb))
+        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
                 goto drop;
 
-        skb->vlan_tci = vlan_tci;
+        skb->skb_iif = skb->dev->ifindex;
+        __vlan_hwaccel_put_tag(skb, vlan_tci);
         skb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
 
         if (!skb->dev)
@@ -101,11 +106,12 @@ drop:
         return GRO_DROP;
 }
 
-int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
-                     unsigned int vlan_tci, struct sk_buff *skb)
+gro_result_t vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
+                              unsigned int vlan_tci, struct sk_buff *skb)
 {
         if (netpoll_rx_on(skb))
-                return vlan_hwaccel_receive_skb(skb, grp, vlan_tci);
+                return vlan_hwaccel_receive_skb(skb, grp, vlan_tci)
+                        ? GRO_DROP : GRO_NORMAL;
 
         skb_gro_reset_offset(skb);
 
@@ -113,17 +119,18 @@ int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
 }
 EXPORT_SYMBOL(vlan_gro_receive);
 
-int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
-                   unsigned int vlan_tci)
+gro_result_t vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
+                            unsigned int vlan_tci)
 {
         struct sk_buff *skb = napi_frags_skb(napi);
 
         if (!skb)
-                return NET_RX_DROP;
+                return GRO_DROP;
 
         if (netpoll_rx_on(skb)) {
                 skb->protocol = eth_type_trans(skb, skb->dev);
-                return vlan_hwaccel_receive_skb(skb, grp, vlan_tci);
+                return vlan_hwaccel_receive_skb(skb, grp, vlan_tci)
+                        ? GRO_DROP : GRO_NORMAL;
         }
 
         return napi_frags_finish(napi, skb,
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4198ec5c8abc..29b6348c8d4d 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -21,6 +21,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -140,7 +141,7 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
                   struct packet_type *ptype, struct net_device *orig_dev)
 {
         struct vlan_hdr *vhdr;
-        struct net_device_stats *stats;
+        struct vlan_rx_stats *rx_stats;
         u16 vlan_id;
         u16 vlan_tci;
 
@@ -163,9 +164,10 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
                 goto err_unlock;
         }
 
-        stats = &skb->dev->stats;
-        stats->rx_packets++;
-        stats->rx_bytes += skb->len;
+        rx_stats = per_cpu_ptr(vlan_dev_info(skb->dev)->vlan_rx_stats,
+                               smp_processor_id());
+        rx_stats->rx_packets++;
+        rx_stats->rx_bytes += skb->len;
 
         skb_pull_rcsum(skb, VLAN_HLEN);
 
@@ -180,7 +182,7 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
                 break;
 
         case PACKET_MULTICAST:
-                stats->multicast++;
+                rx_stats->multicast++;
                 break;
 
         case PACKET_OTHERHOST:
@@ -200,7 +202,7 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
 
         skb = vlan_check_reorder_header(skb);
         if (!skb) {
-                stats->rx_errors++;
+                rx_stats->rx_errors++;
                 goto err_unlock;
         }
 
@@ -262,11 +264,10 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
                 vhdr->h_vlan_TCI = htons(vlan_tci);
 
                 /*
-                 *  Set the protocol type. For a packet of type ETH_P_802_3 we
-                 *  put the length in here instead. It is up to the 802.2
-                 *  layer to carry protocol information.
+                 *  Set the protocol type. For a packet of type ETH_P_802_3/2 we
+                 *  put the length in here instead.
                  */
-                if (type != ETH_P_802_3)
+                if (type != ETH_P_802_3 && type != ETH_P_802_2)
                         vhdr->h_vlan_encapsulated_proto = htons(type);
                 else
                         vhdr->h_vlan_encapsulated_proto = htons(len);
@@ -322,7 +323,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
         }
 
 
-        skb->dev = vlan_dev_info(dev)->real_dev;
+        skb_set_dev(skb, vlan_dev_info(dev)->real_dev);
         len = skb->len;
         ret = dev_queue_xmit(skb);
 
@@ -332,7 +333,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
         } else
                 txq->tx_dropped++;
 
-        return NETDEV_TX_OK;
+        return ret;
 }
 
 static netdev_tx_t vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb,
@@ -358,7 +359,15 @@ static netdev_tx_t vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb,
         } else
                 txq->tx_dropped++;
 
-        return NETDEV_TX_OK;
+        return ret;
+}
+
+static u16 vlan_dev_select_queue(struct net_device *dev, struct sk_buff *skb)
+{
+        struct net_device *rdev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = rdev->netdev_ops;
+
+        return ops->ndo_select_queue(rdev, skb);
 }
 
 static int vlan_dev_change_mtu(struct net_device *dev, int new_mtu)
@@ -393,7 +402,7 @@ int vlan_dev_set_egress_priority(const struct net_device *dev,
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         struct vlan_priority_tci_mapping *mp = NULL;
         struct vlan_priority_tci_mapping *np;
-        u32 vlan_qos = (vlan_prio << 13) & 0xE000;
+        u32 vlan_qos = (vlan_prio << VLAN_PRIO_SHIFT) & VLAN_PRIO_MASK;
 
         /* See if a priority mapping exists.. */
         mp = vlan->egress_priority_map[skb_prio & 0xF];
@@ -430,7 +439,8 @@ int vlan_dev_change_flags(const struct net_device *dev, u32 flags, u32 mask)
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         u32 old_flags = vlan->flags;
 
-        if (mask & ~(VLAN_FLAG_REORDER_HDR | VLAN_FLAG_GVRP))
+        if (mask & ~(VLAN_FLAG_REORDER_HDR | VLAN_FLAG_GVRP |
+                     VLAN_FLAG_LOOSE_BINDING))
                 return -EINVAL;
 
         vlan->flags = (old_flags & ~mask) | (flags & mask);
@@ -455,7 +465,8 @@ static int vlan_dev_open(struct net_device *dev)
         struct net_device *real_dev = vlan->real_dev;
         int err;
 
-        if (!(real_dev->flags & IFF_UP))
+        if (!(real_dev->flags & IFF_UP) &&
+            !(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
                 return -ENETDOWN;
 
         if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr)) {
@@ -626,6 +637,17 @@ static int vlan_dev_fcoe_disable(struct net_device *dev)
                 rc = ops->ndo_fcoe_disable(real_dev);
         return rc;
 }
+
+static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
+{
+        struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
+        int rc = -EINVAL;
+
+        if (ops->ndo_fcoe_get_wwn)
+                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
+        return rc;
+}
 #endif
 
 static void vlan_dev_change_rx_flags(struct net_device *dev, int change)
@@ -675,7 +697,8 @@ static const struct header_ops vlan_header_ops = {
         .parse   = eth_header_parse,
 };
 
-static const struct net_device_ops vlan_netdev_ops, vlan_netdev_accel_ops;
+static const struct net_device_ops vlan_netdev_ops, vlan_netdev_accel_ops,
+                    vlan_netdev_ops_sq, vlan_netdev_accel_ops_sq;
 
 static int vlan_dev_init(struct net_device *dev)
 {
@@ -709,17 +732,28 @@ static int vlan_dev_init(struct net_device *dev)
         if (real_dev->features & NETIF_F_HW_VLAN_TX) {
                 dev->header_ops      = real_dev->header_ops;
                 dev->hard_header_len = real_dev->hard_header_len;
-                dev->netdev_ops         = &vlan_netdev_accel_ops;
+                if (real_dev->netdev_ops->ndo_select_queue)
+                        dev->netdev_ops = &vlan_netdev_accel_ops_sq;
+                else
+                        dev->netdev_ops = &vlan_netdev_accel_ops;
         } else {
                 dev->header_ops      = &vlan_header_ops;
                 dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
-                dev->netdev_ops         = &vlan_netdev_ops;
+                if (real_dev->netdev_ops->ndo_select_queue)
+                        dev->netdev_ops = &vlan_netdev_ops_sq;
+                else
+                        dev->netdev_ops = &vlan_netdev_ops;
         }
 
         if (is_vlan_dev(real_dev))
                 subclass = 1;
 
         vlan_dev_set_lockdep_class(dev, subclass);
+
+        vlan_dev_info(dev)->vlan_rx_stats = alloc_percpu(struct vlan_rx_stats);
+        if (!vlan_dev_info(dev)->vlan_rx_stats)
+                return -ENOMEM;
+
         return 0;
 }
 
@@ -729,6 +763,8 @@ static void vlan_dev_uninit(struct net_device *dev)
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         int i;
 
+        free_percpu(vlan->vlan_rx_stats);
+        vlan->vlan_rx_stats = NULL;
         for (i = 0; i < ARRAY_SIZE(vlan->egress_priority_map); i++) {
                 while ((pm = vlan->egress_priority_map[i]) != NULL) {
                         vlan->egress_priority_map[i] = pm->next;
@@ -764,6 +800,31 @@ static u32 vlan_ethtool_get_flags(struct net_device *dev)
         return dev_ethtool_get_flags(vlan->real_dev);
 }
 
+static struct net_device_stats *vlan_dev_get_stats(struct net_device *dev)
+{
+        struct net_device_stats *stats = &dev->stats;
+
+        dev_txq_stats_fold(dev, stats);
+
+        if (vlan_dev_info(dev)->vlan_rx_stats) {
+                struct vlan_rx_stats *p, rx = {0};
+                int i;
+
+                for_each_possible_cpu(i) {
+                        p = per_cpu_ptr(vlan_dev_info(dev)->vlan_rx_stats, i);
+                        rx.rx_packets += p->rx_packets;
+                        rx.rx_bytes   += p->rx_bytes;
+                        rx.rx_errors  += p->rx_errors;
+                        rx.multicast  += p->multicast;
+                }
+                stats->rx_packets = rx.rx_packets;
+                stats->rx_bytes   = rx.rx_bytes;
+                stats->rx_errors  = rx.rx_errors;
+                stats->multicast  = rx.multicast;
+        }
+        return stats;
+}
+
 static const struct ethtool_ops vlan_ethtool_ops = {
         .get_settings           = vlan_ethtool_get_settings,
         .get_drvinfo            = vlan_ethtool_get_drvinfo,
@@ -786,11 +847,13 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
         .ndo_do_ioctl           = vlan_dev_ioctl,
         .ndo_neigh_setup        = vlan_dev_neigh_setup,
+        .ndo_get_stats          = vlan_dev_get_stats,
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
         .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
         .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
         .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
         .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
 #endif
 };
 
@@ -808,11 +871,63 @@ static const struct net_device_ops vlan_netdev_accel_ops = {
         .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
         .ndo_do_ioctl           = vlan_dev_ioctl,
         .ndo_neigh_setup        = vlan_dev_neigh_setup,
+        .ndo_get_stats          = vlan_dev_get_stats,
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
+        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
+        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
+        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
+#endif
+};
+
+static const struct net_device_ops vlan_netdev_ops_sq = {
+        .ndo_select_queue       = vlan_dev_select_queue,
+        .ndo_change_mtu         = vlan_dev_change_mtu,
+        .ndo_init               = vlan_dev_init,
+        .ndo_uninit             = vlan_dev_uninit,
+        .ndo_open               = vlan_dev_open,
+        .ndo_stop               = vlan_dev_stop,
+        .ndo_start_xmit =  vlan_dev_hard_start_xmit,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = vlan_dev_set_mac_address,
+        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
+        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
+        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
+        .ndo_do_ioctl           = vlan_dev_ioctl,
+        .ndo_neigh_setup        = vlan_dev_neigh_setup,
+        .ndo_get_stats          = vlan_dev_get_stats,
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
+        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
+        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
+        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
+#endif
+};
+
+static const struct net_device_ops vlan_netdev_accel_ops_sq = {
+        .ndo_select_queue       = vlan_dev_select_queue,
+        .ndo_change_mtu         = vlan_dev_change_mtu,
+        .ndo_init               = vlan_dev_init,
+        .ndo_uninit             = vlan_dev_uninit,
+        .ndo_open               = vlan_dev_open,
+        .ndo_stop               = vlan_dev_stop,
+        .ndo_start_xmit =  vlan_dev_hwaccel_hard_start_xmit,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = vlan_dev_set_mac_address,
+        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
+        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
+        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
+        .ndo_do_ioctl           = vlan_dev_ioctl,
+        .ndo_neigh_setup        = vlan_dev_neigh_setup,
+        .ndo_get_stats          = vlan_dev_get_stats,
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
         .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
         .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
         .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
         .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
 #endif
 };
 
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index a91504850195..ddc105734af7 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -60,7 +60,8 @@ static int vlan_validate(struct nlattr *tb[], struct nlattr *data[])
         if (data[IFLA_VLAN_FLAGS]) {
                 flags = nla_data(data[IFLA_VLAN_FLAGS]);
                 if ((flags->flags & flags->mask) &
-                    ~(VLAN_FLAG_REORDER_HDR | VLAN_FLAG_GVRP))
+                    ~(VLAN_FLAG_REORDER_HDR | VLAN_FLAG_GVRP |
+                      VLAN_FLAG_LOOSE_BINDING))
                         return -EINVAL;
         }
 
@@ -119,7 +120,7 @@ static int vlan_get_tx_queues(struct net *net,
         return 0;
 }
 
-static int vlan_newlink(struct net_device *dev,
+static int vlan_newlink(struct net *src_net, struct net_device *dev,
                         struct nlattr *tb[], struct nlattr *data[])
 {
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
@@ -131,7 +132,7 @@ static int vlan_newlink(struct net_device *dev,
 
         if (!tb[IFLA_LINK])
                 return -EINVAL;
-        real_dev = __dev_get_by_index(dev_net(dev), nla_get_u32(tb[IFLA_LINK]));
+        real_dev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
         if (!real_dev)
                 return -ENODEV;
 
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index 6262c335f3c2..afead353e215 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -140,7 +140,7 @@ void vlan_proc_cleanup(struct net *net)
  *      Create /proc/net/vlan entries
  */
 
-int vlan_proc_init(struct net *net)
+int __net_init vlan_proc_init(struct net *net)
 {
         struct vlan_net *vn = net_generic(net, vlan_net_id);
 
@@ -201,18 +201,17 @@ int vlan_proc_rem_dev(struct net_device *vlandev)
 
 /* start read of /proc/net/vlan/config */
 static void *vlan_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(rcu)
 {
         struct net_device *dev;
         struct net *net = seq_file_net(seq);
         loff_t i = 1;
 
-        read_lock(&dev_base_lock);
-
+        rcu_read_lock();
         if (*pos == 0)
                 return SEQ_START_TOKEN;
 
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
                 if (!is_vlan_dev(dev))
                         continue;
 
@@ -234,7 +233,7 @@ static void *vlan_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         if (v == SEQ_START_TOKEN)
                 dev = net_device_entry(&net->dev_base_head);
 
-        for_each_netdev_continue(net, dev) {
+        for_each_netdev_continue_rcu(net, dev) {
                 if (!is_vlan_dev(dev))
                         continue;
 
@@ -245,9 +244,9 @@ static void *vlan_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void vlan_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(rcu)
 {
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int vlan_seq_show(struct seq_file *seq, void *v)
diff --git a/net/9p/client.c b/net/9p/client.c
index 8af95b2dddd6..0aa79faa9850 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -29,6 +29,7 @@
 #include <linux/poll.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/uaccess.h>
 #include <net/9p/9p.h>
@@ -46,6 +47,7 @@ enum {
         Opt_msize,
         Opt_trans,
         Opt_legacy,
+        Opt_version,
         Opt_err,
 };
 
@@ -53,9 +55,43 @@ static const match_table_t tokens = {
         {Opt_msize, "msize=%u"},
         {Opt_legacy, "noextend"},
         {Opt_trans, "trans=%s"},
+        {Opt_version, "version=%s"},
         {Opt_err, NULL},
 };
 
+inline int p9_is_proto_dotl(struct p9_client *clnt)
+{
+        return (clnt->proto_version == p9_proto_2000L);
+}
+EXPORT_SYMBOL(p9_is_proto_dotl);
+
+inline int p9_is_proto_dotu(struct p9_client *clnt)
+{
+        return (clnt->proto_version == p9_proto_2000u);
+}
+EXPORT_SYMBOL(p9_is_proto_dotu);
+
+/* Interpret mount option for protocol version */
+static int get_protocol_version(const substring_t *name)
+{
+        int version = -EINVAL;
+
+        if (!strncmp("9p2000", name->from, name->to-name->from)) {
+                version = p9_proto_legacy;
+                P9_DPRINTK(P9_DEBUG_9P, "Protocol version: Legacy\n");
+        } else if (!strncmp("9p2000.u", name->from, name->to-name->from)) {
+                version = p9_proto_2000u;
+                P9_DPRINTK(P9_DEBUG_9P, "Protocol version: 9P2000.u\n");
+        } else if (!strncmp("9p2000.L", name->from, name->to-name->from)) {
+                version = p9_proto_2000L;
+                P9_DPRINTK(P9_DEBUG_9P, "Protocol version: 9P2000.L\n");
+        } else {
+                P9_DPRINTK(P9_DEBUG_ERROR, "Unknown protocol version %s. ",
+                                                        name->from);
+        }
+        return version;
+}
+
 static struct p9_req_t *
 p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
 
@@ -69,24 +105,25 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
 
 static int parse_opts(char *opts, struct p9_client *clnt)
 {
-        char *options;
+        char *options, *tmp_options;
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int option;
         int ret = 0;
 
-        clnt->dotu = 1;
+        clnt->proto_version = p9_proto_2000u;
         clnt->msize = 8192;
 
         if (!opts)
                 return 0;
 
-        options = kstrdup(opts, GFP_KERNEL);
-        if (!options) {
+        tmp_options = kstrdup(opts, GFP_KERNEL);
+        if (!tmp_options) {
                 P9_DPRINTK(P9_DEBUG_ERROR,
                                 "failed to allocate copy of option string\n");
                 return -ENOMEM;
         }
+        options = tmp_options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -108,16 +145,30 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                         break;
                 case Opt_trans:
                         clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
+                        if(clnt->trans_mod == NULL) {
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                   "Could not find request transport: %s\n",
+                                   (char *) &args[0]);
+                                ret = -EINVAL;
+                                goto free_and_return;
+                        }
                         break;
                 case Opt_legacy:
-                        clnt->dotu = 0;
+                        clnt->proto_version = p9_proto_legacy;
+                        break;
+                case Opt_version:
+                        ret = get_protocol_version(&args[0]);
+                        if (ret == -EINVAL)
+                                goto free_and_return;
+                        clnt->proto_version = ret;
                         break;
                 default:
                         continue;
                 }
         }
 
-        kfree(options);
+free_and_return:
+        kfree(tmp_options);
         return ret;
 }
 
@@ -401,14 +452,15 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
                 int ecode;
                 char *ename;
 
-                err = p9pdu_readf(req->rc, c->dotu, "s?d", &ename, &ecode);
+                err = p9pdu_readf(req->rc, c->proto_version, "s?d",
+                                                        &ename, &ecode);
                 if (err) {
                         P9_DPRINTK(P9_DEBUG_ERROR, "couldn't parse error%d\n",
                                                                         err);
                         return err;
                 }
 
-                if (c->dotu)
+                if (p9_is_proto_dotu(c))
                         err = -ecode;
 
                 if (!err || !IS_ERR_VALUE(err))
@@ -483,7 +535,12 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
 
         P9_DPRINTK(P9_DEBUG_MUX, "client %p op %d\n", c, type);
 
-        if (c->status != Connected)
+        /* we allow for any status other than disconnected */
+        if (c->status == Disconnected)
+                return ERR_PTR(-EIO);
+
+        /* if status is begin_disconnected we allow only clunk request */
+        if ((c->status == BeginDisconnect) && (type != P9_TCLUNK))
                 return ERR_PTR(-EIO);
 
         if (signal_pending(current)) {
@@ -506,7 +563,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
         /* marshall the data */
         p9pdu_prepare(req->tc, tag, type);
         va_start(ap, fmt);
-        err = p9pdu_vwritef(req->tc, c->dotu, fmt, ap);
+        err = p9pdu_vwritef(req->tc, c->proto_version, fmt, ap);
         va_end(ap);
         p9pdu_finalize(req->tc);
 
@@ -618,14 +675,31 @@ int p9_client_version(struct p9_client *c)
         char *version;
         int msize;
 
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TVERSION msize %d extended %d\n",
-                                                        c->msize, c->dotu);
-        req = p9_client_rpc(c, P9_TVERSION, "ds", c->msize,
-                                c->dotu ? "9P2000.u" : "9P2000");
+        P9_DPRINTK(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n",
+                                                c->msize, c->proto_version);
+
+        switch (c->proto_version) {
+        case p9_proto_2000L:
+                req = p9_client_rpc(c, P9_TVERSION, "ds",
+                                        c->msize, "9P2000.L");
+                break;
+        case p9_proto_2000u:
+                req = p9_client_rpc(c, P9_TVERSION, "ds",
+                                        c->msize, "9P2000.u");
+                break;
+        case p9_proto_legacy:
+                req = p9_client_rpc(c, P9_TVERSION, "ds",
+                                        c->msize, "9P2000");
+                break;
+        default:
+                return -EINVAL;
+                break;
+        }
+
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
-        err = p9pdu_readf(req->rc, c->dotu, "ds", &msize, &version);
+        err = p9pdu_readf(req->rc, c->proto_version, "ds", &msize, &version);
         if (err) {
                 P9_DPRINTK(P9_DEBUG_9P, "version error %d\n", err);
                 p9pdu_dump(1, req->rc);
@@ -633,10 +707,12 @@ int p9_client_version(struct p9_client *c)
         }
 
         P9_DPRINTK(P9_DEBUG_9P, "<<< RVERSION msize %d %s\n", msize, version);
-        if (!memcmp(version, "9P2000.u", 8))
-                c->dotu = 1;
-        else if (!memcmp(version, "9P2000", 6))
-                c->dotu = 0;
+        if (!strncmp(version, "9P2000.L", 8))
+                c->proto_version = p9_proto_2000L;
+        else if (!strncmp(version, "9P2000.u", 8))
+                c->proto_version = p9_proto_2000u;
+        else if (!strncmp(version, "9P2000", 6))
+                c->proto_version = p9_proto_legacy;
         else {
                 err = -EREMOTEIO;
                 goto error;
@@ -667,18 +743,12 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         clnt->trans = NULL;
         spin_lock_init(&clnt->lock);
         INIT_LIST_HEAD(&clnt->fidlist);
-        clnt->fidpool = p9_idpool_create();
-        if (IS_ERR(clnt->fidpool)) {
-                err = PTR_ERR(clnt->fidpool);
-                clnt->fidpool = NULL;
-                goto error;
-        }
 
         p9_tag_init(clnt);
 
         err = parse_opts(options, clnt);
         if (err < 0)
-                goto error;
+                goto free_client;
 
         if (!clnt->trans_mod)
                 clnt->trans_mod = v9fs_get_default_trans();
@@ -687,27 +757,40 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
                 err = -EPROTONOSUPPORT;
                 P9_DPRINTK(P9_DEBUG_ERROR,
                                 "No transport defined or default transport\n");
-                goto error;
+                goto free_client;
+        }
+
+        clnt->fidpool = p9_idpool_create();
+        if (IS_ERR(clnt->fidpool)) {
+                err = PTR_ERR(clnt->fidpool);
+                clnt->fidpool = NULL;
+                goto put_trans;
         }
 
-        P9_DPRINTK(P9_DEBUG_MUX, "clnt %p trans %p msize %d dotu %d\n",
-                clnt, clnt->trans_mod, clnt->msize, clnt->dotu);
+        P9_DPRINTK(P9_DEBUG_MUX, "clnt %p trans %p msize %d protocol %d\n",
+                clnt, clnt->trans_mod, clnt->msize, clnt->proto_version);
 
         err = clnt->trans_mod->create(clnt, dev_name, options);
         if (err)
-                goto error;
+                goto destroy_fidpool;
 
         if ((clnt->msize+P9_IOHDRSZ) > clnt->trans_mod->maxsize)
                 clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ;
 
         err = p9_client_version(clnt);
         if (err)
-                goto error;
+                goto close_trans;
 
         return clnt;
 
-error:
-        p9_client_destroy(clnt);
+close_trans:
+        clnt->trans_mod->close(clnt);
+destroy_fidpool:
+        p9_idpool_destroy(clnt->fidpool);
+put_trans:
+        v9fs_put_trans(clnt->trans_mod);
+free_client:
+        kfree(clnt);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL(p9_client_create);
@@ -723,8 +806,10 @@ void p9_client_destroy(struct p9_client *clnt)
 
         v9fs_put_trans(clnt->trans_mod);
 
-        list_for_each_entry_safe(fid, fidptr, &clnt->fidlist, flist)
+        list_for_each_entry_safe(fid, fidptr, &clnt->fidlist, flist) {
+                printk(KERN_INFO "Found fid %d not clunked\n", fid->fid);
                 p9_fid_destroy(fid);
+        }
 
         if (clnt->fidpool)
                 p9_idpool_destroy(clnt->fidpool);
@@ -742,6 +827,13 @@ void p9_client_disconnect(struct p9_client *clnt)
 }
 EXPORT_SYMBOL(p9_client_disconnect);
 
+void p9_client_begin_disconnect(struct p9_client *clnt)
+{
+        P9_DPRINTK(P9_DEBUG_9P, "clnt %p\n", clnt);
+        clnt->status = BeginDisconnect;
+}
+EXPORT_SYMBOL(p9_client_begin_disconnect);
+
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
         char *uname, u32 n_uname, char *aname)
 {
@@ -768,7 +860,7 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "Q", &qid);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "Q", &qid);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 p9_free_req(clnt, req);
@@ -817,7 +909,7 @@ p9_client_auth(struct p9_client *clnt, char *uname, u32 n_uname, char *aname)
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "Q", &qid);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "Q", &qid);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 p9_free_req(clnt, req);
@@ -875,7 +967,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "R", &nwqids, &wqids);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "R", &nwqids, &wqids);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 p9_free_req(clnt, req);
@@ -936,7 +1028,7 @@ int p9_client_open(struct p9_fid *fid, int mode)
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "Qd", &qid, &iounit);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", &qid, &iounit);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 goto free_and_error;
@@ -981,7 +1073,7 @@ int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "Qd", &qid, &iounit);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", &qid, &iounit);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 goto free_and_error;
@@ -1082,7 +1174,7 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "D", &count, &dataptr);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "D", &count, &dataptr);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 goto free_and_error;
@@ -1143,7 +1235,7 @@ p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "d", &count);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "d", &count);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 goto free_and_error;
@@ -1183,7 +1275,7 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                 goto error;
         }
 
-        err = p9pdu_readf(req->rc, clnt->dotu, "wS", &ignored, ret);
+        err = p9pdu_readf(req->rc, clnt->proto_version, "wS", &ignored, ret);
         if (err) {
                 p9pdu_dump(1, req->rc);
                 p9_free_req(clnt, req);
@@ -1210,14 +1302,15 @@ error:
 }
 EXPORT_SYMBOL(p9_client_stat);
 
-static int p9_client_statsize(struct p9_wstat *wst, int optional)
+static int p9_client_statsize(struct p9_wstat *wst, int proto_version)
 {
         int ret;
 
+        /* NOTE: size shouldn't include its own length */
         /* size[2] type[2] dev[4] qid[13] */
         /* mode[4] atime[4] mtime[4] length[8]*/
         /* name[s] uid[s] gid[s] muid[s] */
-        ret = 2+2+4+13+4+4+4+8+2+2+2+2;
+        ret = 2+4+13+4+4+4+8+2+2+2+2;
 
         if (wst->name)
                 ret += strlen(wst->name);
@@ -1228,7 +1321,7 @@ static int p9_client_statsize(struct p9_wstat *wst, int optional)
         if (wst->muid)
                 ret += strlen(wst->muid);
 
-        if (optional) {
+        if (proto_version == p9_proto_2000u) {
                 ret += 2+4+4+4; /* extension[s] n_uid[4] n_gid[4] n_muid[4] */
                 if (wst->extension)
                         ret += strlen(wst->extension);
@@ -1245,7 +1338,7 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
 
         err = 0;
         clnt = fid->clnt;
-        wst->size = p9_client_statsize(wst, clnt->dotu);
+        wst->size = p9_client_statsize(wst, clnt->proto_version);
         P9_DPRINTK(P9_DEBUG_9P, ">>> TWSTAT fid %d\n", fid->fid);
         P9_DPRINTK(P9_DEBUG_9P,
                 "     sz=%x type=%x dev=%x qid=%x.%llx.%x\n"
@@ -1258,7 +1351,7 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                 wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                 wst->n_uid, wst->n_gid, wst->n_muid);
 
-        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size, wst);
+        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size+2, wst);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
                 goto error;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index fc70147c771e..e7541d5b0118 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -28,6 +28,7 @@
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/types.h>
 #include <net/9p/9p.h>
@@ -52,7 +53,7 @@
 #endif
 
 static int
-p9pdu_writef(struct p9_fcall *pdu, int optional, const char *fmt, ...);
+p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...);
 
 #ifdef CONFIG_NET_9P_DEBUG
 void
@@ -144,7 +145,8 @@ pdu_write_u(struct p9_fcall *pdu, const char __user *udata, size_t size)
 */
 
 static int
-p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
+p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
+        va_list ap)
 {
         const char *ptr;
         int errcode = 0;
@@ -194,7 +196,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 int16_t len;
                                 int size;
 
-                                errcode = p9pdu_readf(pdu, optional, "w", &len);
+                                errcode = p9pdu_readf(pdu, proto_version,
+                                                                "w", &len);
                                 if (errcode)
                                         break;
 
@@ -217,7 +220,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 struct p9_qid *qid =
                                     va_arg(ap, struct p9_qid *);
 
-                                errcode = p9pdu_readf(pdu, optional, "bdq",
+                                errcode = p9pdu_readf(pdu, proto_version, "bdq",
                                                       &qid->type, &qid->version,
                                                       &qid->path);
                         }
@@ -230,7 +233,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 stbuf->n_uid = stbuf->n_gid = stbuf->n_muid =
                                                                         -1;
                                 errcode =
-                                    p9pdu_readf(pdu, optional,
+                                    p9pdu_readf(pdu, proto_version,
                                                 "wwdQdddqssss?sddd",
                                                 &stbuf->size, &stbuf->type,
                                                 &stbuf->dev, &stbuf->qid,
@@ -250,7 +253,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 void **data = va_arg(ap, void **);
 
                                 errcode =
-                                    p9pdu_readf(pdu, optional, "d", count);
+                                    p9pdu_readf(pdu, proto_version, "d", count);
                                 if (!errcode) {
                                         *count =
                                             MIN(*count,
@@ -263,8 +266,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 int16_t *nwname = va_arg(ap, int16_t *);
                                 char ***wnames = va_arg(ap, char ***);
 
-                                errcode =
-                                    p9pdu_readf(pdu, optional, "w", nwname);
+                                errcode = p9pdu_readf(pdu, proto_version,
+                                                                "w", nwname);
                                 if (!errcode) {
                                         *wnames =
                                             kmalloc(sizeof(char *) * *nwname,
@@ -278,7 +281,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
 
                                         for (i = 0; i < *nwname; i++) {
                                                 errcode =
-                                                    p9pdu_readf(pdu, optional,
+                                                    p9pdu_readf(pdu,
+                                                                proto_version,
                                                                 "s",
                                                                 &(*wnames)[i]);
                                                 if (errcode)
@@ -306,7 +310,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 *wqids = NULL;
 
                                 errcode =
-                                    p9pdu_readf(pdu, optional, "w", nwqid);
+                                    p9pdu_readf(pdu, proto_version, "w", nwqid);
                                 if (!errcode) {
                                         *wqids =
                                             kmalloc(*nwqid *
@@ -321,7 +325,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
 
                                         for (i = 0; i < *nwqid; i++) {
                                                 errcode =
-                                                    p9pdu_readf(pdu, optional,
+                                                    p9pdu_readf(pdu,
+                                                                proto_version,
                                                                 "Q",
                                                                 &(*wqids)[i]);
                                                 if (errcode)
@@ -336,7 +341,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         }
                         break;
                 case '?':
-                        if (!optional)
+                        if (proto_version != p9_proto_2000u)
                                 return 0;
                         break;
                 default:
@@ -352,7 +357,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
 }
 
 int
-p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
+p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
+        va_list ap)
 {
         const char *ptr;
         int errcode = 0;
@@ -389,7 +395,8 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 if (sptr)
                                         len = MIN(strlen(sptr), USHORT_MAX);
 
-                                errcode = p9pdu_writef(pdu, optional, "w", len);
+                                errcode = p9pdu_writef(pdu, proto_version,
+                                                                "w", len);
                                 if (!errcode && pdu_write(pdu, sptr, len))
                                         errcode = -EFAULT;
                         }
@@ -398,7 +405,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 const struct p9_qid *qid =
                                     va_arg(ap, const struct p9_qid *);
                                 errcode =
-                                    p9pdu_writef(pdu, optional, "bdq",
+                                    p9pdu_writef(pdu, proto_version, "bdq",
                                                  qid->type, qid->version,
                                                  qid->path);
                         } break;
@@ -406,7 +413,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 const struct p9_wstat *stbuf =
                                     va_arg(ap, const struct p9_wstat *);
                                 errcode =
-                                    p9pdu_writef(pdu, optional,
+                                    p9pdu_writef(pdu, proto_version,
                                                  "wwdQdddqssss?sddd",
                                                  stbuf->size, stbuf->type,
                                                  stbuf->dev, &stbuf->qid,
@@ -421,8 +428,8 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 int32_t count = va_arg(ap, int32_t);
                                 const void *data = va_arg(ap, const void *);
 
-                                errcode =
-                                    p9pdu_writef(pdu, optional, "d", count);
+                                errcode = p9pdu_writef(pdu, proto_version, "d",
+                                                                        count);
                                 if (!errcode && pdu_write(pdu, data, count))
                                         errcode = -EFAULT;
                         }
@@ -431,8 +438,8 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 int32_t count = va_arg(ap, int32_t);
                                 const char __user *udata =
                                                 va_arg(ap, const void __user *);
-                                errcode =
-                                    p9pdu_writef(pdu, optional, "d", count);
+                                errcode = p9pdu_writef(pdu, proto_version, "d",
+                                                                        count);
                                 if (!errcode && pdu_write_u(pdu, udata, count))
                                         errcode = -EFAULT;
                         }
@@ -441,14 +448,15 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 int16_t nwname = va_arg(ap, int);
                                 const char **wnames = va_arg(ap, const char **);
 
-                                errcode =
-                                    p9pdu_writef(pdu, optional, "w", nwname);
+                                errcode = p9pdu_writef(pdu, proto_version, "w",
+                                                                        nwname);
                                 if (!errcode) {
                                         int i;
 
                                         for (i = 0; i < nwname; i++) {
                                                 errcode =
-                                                    p9pdu_writef(pdu, optional,
+                                                    p9pdu_writef(pdu,
+                                                                proto_version,
                                                                  "s",
                                                                  wnames[i]);
                                                 if (errcode)
@@ -462,14 +470,15 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                                 struct p9_qid *wqids =
                                     va_arg(ap, struct p9_qid *);
 
-                                errcode =
-                                    p9pdu_writef(pdu, optional, "w", nwqid);
+                                errcode = p9pdu_writef(pdu, proto_version, "w",
+                                                                        nwqid);
                                 if (!errcode) {
                                         int i;
 
                                         for (i = 0; i < nwqid; i++) {
                                                 errcode =
-                                                    p9pdu_writef(pdu, optional,
+                                                    p9pdu_writef(pdu,
+                                                                proto_version,
                                                                  "Q",
                                                                  &wqids[i]);
                                                 if (errcode)
@@ -479,7 +488,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         }
                         break;
                 case '?':
-                        if (!optional)
+                        if (proto_version != p9_proto_2000u)
                                 return 0;
                         break;
                 default:
@@ -494,32 +503,32 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
         return errcode;
 }
 
-int p9pdu_readf(struct p9_fcall *pdu, int optional, const char *fmt, ...)
+int p9pdu_readf(struct p9_fcall *pdu, int proto_version, const char *fmt, ...)
 {
         va_list ap;
         int ret;
 
         va_start(ap, fmt);
-        ret = p9pdu_vreadf(pdu, optional, fmt, ap);
+        ret = p9pdu_vreadf(pdu, proto_version, fmt, ap);
         va_end(ap);
 
         return ret;
 }
 
 static int
-p9pdu_writef(struct p9_fcall *pdu, int optional, const char *fmt, ...)
+p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...)
 {
         va_list ap;
         int ret;
 
         va_start(ap, fmt);
-        ret = p9pdu_vwritef(pdu, optional, fmt, ap);
+        ret = p9pdu_vwritef(pdu, proto_version, fmt, ap);
         va_end(ap);
 
         return ret;
 }
 
-int p9stat_read(char *buf, int len, struct p9_wstat *st, int dotu)
+int p9stat_read(char *buf, int len, struct p9_wstat *st, int proto_version)
 {
         struct p9_fcall fake_pdu;
         int ret;
@@ -529,7 +538,7 @@ int p9stat_read(char *buf, int len, struct p9_wstat *st, int dotu)
         fake_pdu.sdata = buf;
         fake_pdu.offset = 0;
 
-        ret = p9pdu_readf(&fake_pdu, dotu, "S", st);
+        ret = p9pdu_readf(&fake_pdu, proto_version, "S", st);
         if (ret) {
                 P9_DPRINTK(P9_DEBUG_9P, "<<< p9stat_read failed: %d\n", ret);
                 p9pdu_dump(1, &fake_pdu);
diff --git a/net/9p/protocol.h b/net/9p/protocol.h
index ccde462e7ac5..2431c0f38d56 100644
--- a/net/9p/protocol.h
+++ b/net/9p/protocol.h
@@ -25,9 +25,9 @@
  *
  */
 
-int
-p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap);
-int p9pdu_readf(struct p9_fcall *pdu, int optional, const char *fmt, ...);
+int p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
+                                                                va_list ap);
+int p9pdu_readf(struct p9_fcall *pdu, int proto_version, const char *fmt, ...);
 int p9pdu_prepare(struct p9_fcall *pdu, int16_t tag, int8_t type);
 int p9pdu_finalize(struct p9_fcall *pdu);
 void p9pdu_dump(int, struct p9_fcall *);
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 8d934dd7fd54..98ce9bcb0e15 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -38,10 +38,13 @@
 #include <linux/idr.h>
 #include <linux/file.h>
 #include <linux/parser.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include <net/9p/transport.h>
 
+#include <linux/syscalls.h> /* killme */
+
 #define P9_PORT 564
 #define MAX_SOCK_BUF (64*1024)
 #define MAXPOLLWADDR    2
@@ -633,8 +636,8 @@ static void p9_poll_mux(struct p9_conn *m)
         if (n & POLLOUT) {
                 set_bit(Wpending, &m->wsched);
                 P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can write\n", m);
-                if ((m->wsize || !list_empty(&m->unsent_req_list))
-                    && !test_and_set_bit(Wworksched, &m->wsched)) {
+                if ((m->wsize || !list_empty(&m->unsent_req_list)) &&
+                    !test_and_set_bit(Wworksched, &m->wsched)) {
                         P9_DPRINTK(P9_DEBUG_TRANS, "sched write work %p\n", m);
                         queue_work(p9_mux_wq, &m->wq);
                 }
@@ -712,7 +715,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int option;
-        char *options;
+        char *options, *tmp_options;
         int ret;
 
         opts->port = P9_PORT;
@@ -722,12 +725,13 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
         if (!params)
                 return 0;
 
-        options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        tmp_options = kstrdup(params, GFP_KERNEL);
+        if (!tmp_options) {
                 P9_DPRINTK(P9_DEBUG_ERROR,
                                 "failed to allocate copy of option string\n");
                 return -ENOMEM;
         }
+        options = tmp_options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -758,7 +762,8 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                         continue;
                 }
         }
-        kfree(options);
+
+        kfree(tmp_options);
         return 0;
 }
 
@@ -788,24 +793,41 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
 
 static int p9_socket_open(struct p9_client *client, struct socket *csocket)
 {
-        int fd, ret;
+        struct p9_trans_fd *p;
+        int ret, fd;
+
+        p = kmalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
 
         csocket->sk->sk_allocation = GFP_NOIO;
         fd = sock_map_fd(csocket, 0);
         if (fd < 0) {
                 P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to map fd\n");
+                sock_release(csocket);
+                kfree(p);
                 return fd;
         }
 
-        ret = p9_fd_open(client, fd, fd);
-        if (ret < 0) {
-                P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to open fd\n");
+        get_file(csocket->file);
+        get_file(csocket->file);
+        p->wr = p->rd = csocket->file;
+        client->trans = p;
+        client->status = Connected;
+
+        sys_close(fd);  /* still racy */
+
+        p->rd->f_flags |= O_NONBLOCK;
+
+        p->conn = p9_conn_create(client);
+        if (IS_ERR(p->conn)) {
+                ret = PTR_ERR(p->conn);
+                p->conn = NULL;
+                kfree(p);
+                sockfd_put(csocket);
                 sockfd_put(csocket);
                 return ret;
         }
-
-        ((struct p9_trans_fd *)client->trans)->rd->f_flags |= O_NONBLOCK;
-
         return 0;
 }
 
@@ -883,7 +905,6 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
         struct socket *csocket;
         struct sockaddr_in sin_server;
         struct p9_fd_opts opts;
-        struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
         err = parse_opts(args, &opts);
         if (err < 0)
@@ -897,12 +918,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
         sin_server.sin_family = AF_INET;
         sin_server.sin_addr.s_addr = in_aton(addr);
         sin_server.sin_port = htons(opts.port);
-        sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
+        err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
 
-        if (!csocket) {
+        if (err) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_tcp: problem creating socket\n");
-                err = -EIO;
-                goto error;
+                return err;
         }
 
         err = csocket->ops->connect(csocket,
@@ -912,30 +932,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
                 P9_EPRINTK(KERN_ERR,
                         "p9_trans_tcp: problem connecting socket to %s\n",
                         addr);
-                goto error;
-        }
-
-        err = p9_socket_open(client, csocket);
-        if (err < 0)
-                goto error;
-
-        p = (struct p9_trans_fd *) client->trans;
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                err = PTR_ERR(p->conn);
-                p->conn = NULL;
-                goto error;
-        }
-
-        return 0;
-
-error:
-        if (csocket)
                 sock_release(csocket);
+                return err;
+        }
 
-        kfree(p);
-
-        return err;
+        return p9_socket_open(client, csocket);
 }
 
 static int
@@ -944,49 +945,33 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
         int err;
         struct socket *csocket;
         struct sockaddr_un sun_server;
-        struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
         csocket = NULL;
 
         if (strlen(addr) > UNIX_PATH_MAX) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
                         addr);
-                err = -ENAMETOOLONG;
-                goto error;
+                return -ENAMETOOLONG;
         }
 
         sun_server.sun_family = PF_UNIX;
         strcpy(sun_server.sun_path, addr);
-        sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+        err = sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+        if (err < 0) {
+                P9_EPRINTK(KERN_ERR, "p9_trans_unix: problem creating socket\n");
+                return err;
+        }
         err = csocket->ops->connect(csocket, (struct sockaddr *)&sun_server,
                         sizeof(struct sockaddr_un) - 1, 0);
         if (err < 0) {
                 P9_EPRINTK(KERN_ERR,
                         "p9_trans_unix: problem connecting socket: %s: %d\n",
                         addr, err);
-                goto error;
-        }
-
-        err = p9_socket_open(client, csocket);
-        if (err < 0)
-                goto error;
-
-        p = (struct p9_trans_fd *) client->trans;
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                err = PTR_ERR(p->conn);
-                p->conn = NULL;
-                goto error;
-        }
-
-        return 0;
-
-error:
-        if (csocket)
                 sock_release(csocket);
+                return err;
+        }
 
-        kfree(p);
-        return err;
+        return p9_socket_open(client, csocket);
 }
 
 static int
@@ -994,7 +979,7 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 {
         int err;
         struct p9_fd_opts opts;
-        struct p9_trans_fd *p = NULL; /* this get allocated in p9_fd_open */
+        struct p9_trans_fd *p;
 
         parse_opts(args, &opts);
 
@@ -1005,21 +990,19 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 
         err = p9_fd_open(client, opts.rfd, opts.wfd);
         if (err < 0)
-                goto error;
+                return err;
 
         p = (struct p9_trans_fd *) client->trans;
         p->conn = p9_conn_create(client);
         if (IS_ERR(p->conn)) {
                 err = PTR_ERR(p->conn);
                 p->conn = NULL;
-                goto error;
+                fput(p->rd);
+                fput(p->wr);
+                return err;
         }
 
         return 0;
-
-error:
-        kfree(p);
-        return err;
 }
 
 static struct p9_trans_module p9_tcp_trans = {
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 65cb29db03f8..041101ab4aa5 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -40,6 +40,7 @@
 #include <linux/file.h>
 #include <linux/parser.h>
 #include <linux/semaphore.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include <net/9p/transport.h>
@@ -166,7 +167,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int option;
-        char *options;
+        char *options, *tmp_options;
         int ret;
 
         opts->port = P9_PORT;
@@ -177,12 +178,13 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
         if (!params)
                 return 0;
 
-        options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        tmp_options = kstrdup(params, GFP_KERNEL);
+        if (!tmp_options) {
                 P9_DPRINTK(P9_DEBUG_ERROR,
                            "failed to allocate copy of option string\n");
                 return -ENOMEM;
         }
+        options = tmp_options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -216,7 +218,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
         }
         /* RQ must be at least as large as the SQ */
         opts->rq_depth = max(opts->rq_depth, opts->sq_depth);
-        kfree(options);
+        kfree(tmp_options);
         return 0;
 }
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index ea1e3daabefe..7eb78ecc1618 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -37,6 +37,7 @@
 #include <linux/inet.h>
 #include <linux/idr.h>
 #include <linux/file.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <linux/parser.h>
 #include <net/9p/client.h>
@@ -49,8 +50,6 @@
 
 /* a single mutex to manage channel initialization and attachment */
 static DEFINE_MUTEX(virtio_9p_lock);
-/* global which tracks highest initialized channel */
-static int chan_index;
 
 /**
  * struct virtio_chan - per-instance transport information
@@ -68,8 +67,7 @@ static int chan_index;
  *
  */
 
-static struct virtio_chan {
-        bool initialized;
+struct virtio_chan {
         bool inuse;
 
         spinlock_t lock;
@@ -80,7 +78,17 @@ static struct virtio_chan {
 
         /* Scatterlist: can be too big for stack. */
         struct scatterlist sg[VIRTQUEUE_NUM];
-} channels[MAX_9P_CHAN];
+
+        int tag_len;
+        /*
+         * tag name to identify a mount Non-null terminated
+         */
+        char *tag;
+
+        struct list_head chan_list;
+};
+
+static struct list_head virtio_chan_list;
 
 /* How many bytes left in this page. */
 static unsigned int rest_of_page(void *data)
@@ -102,7 +110,8 @@ static void p9_virtio_close(struct p9_client *client)
         struct virtio_chan *chan = client->trans;
 
         mutex_lock(&virtio_9p_lock);
-        chan->inuse = false;
+        if (chan)
+                chan->inuse = false;
         mutex_unlock(&virtio_9p_lock);
 }
 
@@ -212,30 +221,38 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
         return 0;
 }
 
+static ssize_t p9_mount_tag_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct virtio_chan *chan;
+        struct virtio_device *vdev;
+
+        vdev = dev_to_virtio(dev);
+        chan = vdev->priv;
+
+        return snprintf(buf, chan->tag_len + 1, "%s", chan->tag);
+}
+
+static DEVICE_ATTR(mount_tag, 0444, p9_mount_tag_show, NULL);
+
 /**
  * p9_virtio_probe - probe for existence of 9P virtio channels
  * @vdev: virtio device to probe
  *
- * This probes for existing virtio channels.  At present only
- * a single channel is in use, so in the future more work may need
- * to be done here.
+ * This probes for existing virtio channels.
  *
  */
 
 static int p9_virtio_probe(struct virtio_device *vdev)
 {
+        __u16 tag_len;
+        char *tag;
         int err;
         struct virtio_chan *chan;
-        int index;
 
-        mutex_lock(&virtio_9p_lock);
-        index = chan_index++;
-        chan = &channels[index];
-        mutex_unlock(&virtio_9p_lock);
-
-        if (chan_index > MAX_9P_CHAN) {
-                printk(KERN_ERR "9p: virtio: Maximum channels exceeded\n");
-                BUG();
+        chan = kmalloc(sizeof(struct virtio_chan), GFP_KERNEL);
+        if (!chan) {
+                printk(KERN_ERR "9p: Failed to allocate virtio 9P channel\n");
                 err = -ENOMEM;
                 goto fail;
         }
@@ -254,15 +271,37 @@ static int p9_virtio_probe(struct virtio_device *vdev)
         sg_init_table(chan->sg, VIRTQUEUE_NUM);
 
         chan->inuse = false;
-        chan->initialized = true;
+        if (virtio_has_feature(vdev, VIRTIO_9P_MOUNT_TAG)) {
+                vdev->config->get(vdev,
+                                offsetof(struct virtio_9p_config, tag_len),
+                                &tag_len, sizeof(tag_len));
+        } else {
+                err = -EINVAL;
+                goto out_free_vq;
+        }
+        tag = kmalloc(tag_len, GFP_KERNEL);
+        if (!tag) {
+                err = -ENOMEM;
+                goto out_free_vq;
+        }
+        vdev->config->get(vdev, offsetof(struct virtio_9p_config, tag),
+                        tag, tag_len);
+        chan->tag = tag;
+        chan->tag_len = tag_len;
+        err = sysfs_create_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
+        if (err) {
+                kfree(tag);
+                goto out_free_vq;
+        }
+        mutex_lock(&virtio_9p_lock);
+        list_add_tail(&chan->chan_list, &virtio_chan_list);
+        mutex_unlock(&virtio_9p_lock);
         return 0;
 
 out_free_vq:
         vdev->config->del_vqs(vdev);
+        kfree(chan);
 fail:
-        mutex_lock(&virtio_9p_lock);
-        chan_index--;
-        mutex_unlock(&virtio_9p_lock);
         return err;
 }
 
@@ -279,38 +318,35 @@ fail:
  * We use a simple reference count mechanism to ensure that only a single
  * mount has a channel open at a time.
  *
- * Bugs: doesn't allow identification of a specific channel
- * to allocate, channels are allocated sequentially. This was
- * a pragmatic decision to get things rolling, but ideally some
- * way of identifying the channel to attach to would be nice
- * if we are going to support multiple channels.
- *
  */
 
 static int
 p9_virtio_create(struct p9_client *client, const char *devname, char *args)
 {
-        struct virtio_chan *chan = channels;
-        int index = 0;
+        struct virtio_chan *chan;
+        int ret = -ENOENT;
+        int found = 0;
 
         mutex_lock(&virtio_9p_lock);
-        while (index < MAX_9P_CHAN) {
-                if (chan->initialized && !chan->inuse) {
-                        chan->inuse = true;
-                        break;
-                } else {
-                        index++;
-                        chan = &channels[index];
+        list_for_each_entry(chan, &virtio_chan_list, chan_list) {
+                if (!strncmp(devname, chan->tag, chan->tag_len)) {
+                        if (!chan->inuse) {
+                                chan->inuse = true;
+                                found = 1;
+                                break;
+                        }
+                        ret = -EBUSY;
                 }
         }
         mutex_unlock(&virtio_9p_lock);
 
-        if (index >= MAX_9P_CHAN) {
+        if (!found) {
                 printk(KERN_ERR "9p: no channels available\n");
-                return -ENODEV;
+                return ret;
         }
 
         client->trans = (void *)chan;
+        client->status = Connected;
         chan->client = client;
 
         return 0;
@@ -327,11 +363,15 @@ static void p9_virtio_remove(struct virtio_device *vdev)
         struct virtio_chan *chan = vdev->priv;
 
         BUG_ON(chan->inuse);
+        vdev->config->del_vqs(vdev);
+
+        mutex_lock(&virtio_9p_lock);
+        list_del(&chan->chan_list);
+        mutex_unlock(&virtio_9p_lock);
+        sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
+        kfree(chan->tag);
+        kfree(chan);
 
-        if (chan->initialized) {
-                vdev->config->del_vqs(vdev);
-                chan->initialized = false;
-        }
 }
 
 static struct virtio_device_id id_table[] = {
@@ -339,13 +379,19 @@ static struct virtio_device_id id_table[] = {
         { 0 },
 };
 
+static unsigned int features[] = {
+        VIRTIO_9P_MOUNT_TAG,
+};
+
 /* The standard "struct lguest_driver": */
 static struct virtio_driver p9_virtio_drv = {
-        .driver.name =  KBUILD_MODNAME,
-        .driver.owner = THIS_MODULE,
-        .id_table =     id_table,
-        .probe =        p9_virtio_probe,
-        .remove =       p9_virtio_remove,
+        .feature_table  = features,
+        .feature_table_size = ARRAY_SIZE(features),
+        .driver.name    = KBUILD_MODNAME,
+        .driver.owner   = THIS_MODULE,
+        .id_table       = id_table,
+        .probe          = p9_virtio_probe,
+        .remove         = p9_virtio_remove,
 };
 
 static struct p9_trans_module p9_virtio_trans = {
@@ -362,10 +408,7 @@ static struct p9_trans_module p9_virtio_trans = {
 /* The standard init function */
 static int __init p9_virtio_init(void)
 {
-        int count;
-
-        for (count = 0; count < MAX_9P_CHAN; count++)
-                channels[count].initialized = false;
+        INIT_LIST_HEAD(&virtio_chan_list);
 
         v9fs_register_trans(&p9_virtio_trans);
         return register_virtio_driver(&p9_virtio_drv);
diff --git a/net/9p/util.c b/net/9p/util.c
index dc4ec05ad93d..e048701a72d2 100644
--- a/net/9p/util.c
+++ b/net/9p/util.c
@@ -30,6 +30,7 @@
 #include <linux/sched.h>
 #include <linux/parser.h>
 #include <linux/idr.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 
 /**
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index 9d4adfd22757..50dce7981321 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -30,6 +30,7 @@
  */
 
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/datalink.h>
 #include <net/psnap.h>
@@ -819,7 +820,7 @@ static int aarp_rcv(struct sk_buff *skb, struct net_device *dev,
                                 ma = &ifa->address;
                         else { /* We need to make a copy of the entry. */
                                 da.s_node = sa.s_node;
-                                da.s_net = da.s_net;
+                                da.s_net = sa.s_net;
                                 ma = &da;
                         }
 
diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
index 80caad1a31a5..6ef0e761e5de 100644
--- a/net/appletalk/atalk_proc.c
+++ b/net/appletalk/atalk_proc.c
@@ -144,40 +144,16 @@ out:
         return 0;
 }
 
-static __inline__ struct sock *atalk_get_socket_idx(loff_t pos)
-{
-        struct sock *s;
-        struct hlist_node *node;
-
-        sk_for_each(s, node, &atalk_sockets)
-                if (!pos--)
-                        goto found;
-        s = NULL;
-found:
-        return s;
-}
-
 static void *atalk_seq_socket_start(struct seq_file *seq, loff_t *pos)
         __acquires(atalk_sockets_lock)
 {
-        loff_t l = *pos;
-
         read_lock_bh(&atalk_sockets_lock);
-        return l ? atalk_get_socket_idx(--l) : SEQ_START_TOKEN;
+        return seq_hlist_start_head(&atalk_sockets, *pos);
 }
 
 static void *atalk_seq_socket_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct sock *i;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                i = sk_head(&atalk_sockets);
-                goto out;
-        }
-        i = sk_next(v);
-out:
-        return i;
+        return seq_hlist_next(v, &atalk_sockets, pos);
 }
 
 static void atalk_seq_socket_stop(struct seq_file *seq, void *v)
@@ -197,7 +173,7 @@ static int atalk_seq_socket_show(struct seq_file *seq, void *v)
                 goto out;
         }
 
-        s = v;
+        s = sk_entry(v);
         at = at_sk(s);
 
         seq_printf(seq, "%02X   %04X:%02X:%02X  %04X:%02X:%02X  %08X:%08X "
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index b1a4290996b5..7b02967fbbe7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -56,6 +56,8 @@
 #include <linux/if_arp.h>
 #include <linux/smp_lock.h>
 #include <linux/termios.h>      /* For TIOCOUTQ/INQ */
+#include <linux/compat.h>
+#include <linux/slab.h>
 #include <net/datalink.h>
 #include <net/psnap.h>
 #include <net/sock.h>
@@ -922,13 +924,8 @@ static unsigned long atalk_sum_partial(const unsigned char *data,
 {
         /* This ought to be unwrapped neatly. I'll trust gcc for now */
         while (len--) {
-                sum += *data;
-                sum <<= 1;
-                if (sum & 0x10000) {
-                        sum++;
-                        sum &= 0xffff;
-                }
-                data++;
+                sum += *data++;
+                sum = rol16(sum, 1);
         }
         return sum;
 }
@@ -1021,12 +1018,13 @@ static struct proto ddp_proto = {
  * Create a socket. Initialise the socket, blank the addresses
  * set the state.
  */
-static int atalk_create(struct net *net, struct socket *sock, int protocol)
+static int atalk_create(struct net *net, struct socket *sock, int protocol,
+                        int kern)
 {
         struct sock *sk;
         int rc = -ESOCKTNOSUPPORT;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         /*
@@ -1054,11 +1052,13 @@ static int atalk_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
 
+        lock_kernel();
         if (sk) {
                 sock_orphan(sk);
                 sock->sk = NULL;
                 atalk_destroy_socket(sk);
         }
+        unlock_kernel();
         return 0;
 }
 
@@ -1134,6 +1134,7 @@ static int atalk_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sockaddr_at *addr = (struct sockaddr_at *)uaddr;
         struct sock *sk = sock->sk;
         struct atalk_sock *at = at_sk(sk);
+        int err;
 
         if (!sock_flag(sk, SOCK_ZAPPED) ||
             addr_len != sizeof(struct sockaddr_at))
@@ -1142,37 +1143,44 @@ static int atalk_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr->sat_family != AF_APPLETALK)
                 return -EAFNOSUPPORT;
 
+        lock_kernel();
         if (addr->sat_addr.s_net == htons(ATADDR_ANYNET)) {
                 struct atalk_addr *ap = atalk_find_primary();
 
+                err = -EADDRNOTAVAIL;
                 if (!ap)
-                        return -EADDRNOTAVAIL;
+                        goto out;
 
                 at->src_net  = addr->sat_addr.s_net = ap->s_net;
                 at->src_node = addr->sat_addr.s_node= ap->s_node;
         } else {
+                err = -EADDRNOTAVAIL;
                 if (!atalk_find_interface(addr->sat_addr.s_net,
                                           addr->sat_addr.s_node))
-                        return -EADDRNOTAVAIL;
+                        goto out;
 
                 at->src_net  = addr->sat_addr.s_net;
                 at->src_node = addr->sat_addr.s_node;
         }
 
         if (addr->sat_port == ATADDR_ANYPORT) {
-                int n = atalk_pick_and_bind_port(sk, addr);
+                err = atalk_pick_and_bind_port(sk, addr);
 
-                if (n < 0)
-                        return n;
+                if (err < 0)
+                        goto out;
         } else {
                 at->src_port = addr->sat_port;
 
+                err = -EADDRINUSE;
                 if (atalk_find_or_insert_socket(sk, addr))
-                        return -EADDRINUSE;
+                        goto out;
         }
 
         sock_reset_flag(sk, SOCK_ZAPPED);
-        return 0;
+        err = 0;
+out:
+        unlock_kernel();
+        return err;
 }
 
 /* Set the address we talk to */
@@ -1182,6 +1190,7 @@ static int atalk_connect(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct atalk_sock *at = at_sk(sk);
         struct sockaddr_at *addr;
+        int err;
 
         sk->sk_state   = TCP_CLOSE;
         sock->state = SS_UNCONNECTED;
@@ -1206,12 +1215,15 @@ static int atalk_connect(struct socket *sock, struct sockaddr *uaddr,
 #endif
         }
 
+        lock_kernel();
+        err = -EBUSY;
         if (sock_flag(sk, SOCK_ZAPPED))
                 if (atalk_autobind(sk) < 0)
-                        return -EBUSY;
+                        goto out;
 
+        err = -ENETUNREACH;
         if (!atrtr_get_dev(&addr->sat_addr))
-                return -ENETUNREACH;
+                goto out;
 
         at->dest_port = addr->sat_port;
         at->dest_net  = addr->sat_addr.s_net;
@@ -1219,7 +1231,10 @@ static int atalk_connect(struct socket *sock, struct sockaddr *uaddr,
 
         sock->state  = SS_CONNECTED;
         sk->sk_state = TCP_ESTABLISHED;
-        return 0;
+        err = 0;
+out:
+        unlock_kernel();
+        return err;
 }
 
 /*
@@ -1232,17 +1247,21 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_at sat;
         struct sock *sk = sock->sk;
         struct atalk_sock *at = at_sk(sk);
+        int err;
 
+        lock_kernel();
+        err = -ENOBUFS;
         if (sock_flag(sk, SOCK_ZAPPED))
                 if (atalk_autobind(sk) < 0)
-                        return -ENOBUFS;
+                        goto out;
 
         *uaddr_len = sizeof(struct sockaddr_at);
         memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
 
         if (peer) {
+                err = -ENOTCONN;
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        return -ENOTCONN;
+                        goto out;
 
                 sat.sat_addr.s_net  = at->dest_net;
                 sat.sat_addr.s_node = at->dest_node;
@@ -1253,9 +1272,23 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                 sat.sat_port        = at->src_port;
         }
 
+        err = 0;
         sat.sat_family = AF_APPLETALK;
         memcpy(uaddr, &sat, sizeof(sat));
-        return 0;
+
+out:
+        unlock_kernel();
+        return err;
+}
+
+static unsigned int atalk_poll(struct file *file, struct socket *sock,
+                           poll_table *wait)
+{
+        int err;
+        lock_kernel();
+        err = datagram_poll(file, sock, wait);
+        unlock_kernel();
+        return err;
 }
 
 #if defined(CONFIG_IPDDP) || defined(CONFIG_IPDDP_MODULE)
@@ -1563,23 +1596,28 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         if (len > DDP_MAXSZ)
                 return -EMSGSIZE;
 
+        lock_kernel();
         if (usat) {
+                err = -EBUSY;
                 if (sock_flag(sk, SOCK_ZAPPED))
                         if (atalk_autobind(sk) < 0)
-                                return -EBUSY;
+                                goto out;
 
+                err = -EINVAL;
                 if (msg->msg_namelen < sizeof(*usat) ||
                     usat->sat_family != AF_APPLETALK)
-                        return -EINVAL;
+                        goto out;
 
+                err = -EPERM;
                 /* netatalk didn't implement this check */
                 if (usat->sat_addr.s_node == ATADDR_BCAST &&
                     !sock_flag(sk, SOCK_BROADCAST)) {
-                        return -EPERM;
+                        goto out;
                 }
         } else {
+                err = -ENOTCONN;
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        return -ENOTCONN;
+                        goto out;
                 usat = &local_satalk;
                 usat->sat_family      = AF_APPLETALK;
                 usat->sat_port        = at->dest_port;
@@ -1603,8 +1641,9 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
 
                 rt = atrtr_find(&at_hint);
         }
+        err = ENETUNREACH;
         if (!rt)
-                return -ENETUNREACH;
+                goto out;
 
         dev = rt->dev;
 
@@ -1614,7 +1653,7 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         size += dev->hard_header_len;
         skb = sock_alloc_send_skb(sk, size, (flags & MSG_DONTWAIT), &err);
         if (!skb)
-                return err;
+                goto out;
 
         skb->sk = sk;
         skb_reserve(skb, ddp_dl->header_length);
@@ -1637,7 +1676,8 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         if (err) {
                 kfree_skb(skb);
-                return -EFAULT;
+                err = -EFAULT;
+                goto out;
         }
 
         if (sk->sk_no_check == 1)
@@ -1676,7 +1716,8 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                         rt = atrtr_find(&at_lo);
                         if (!rt) {
                                 kfree_skb(skb);
-                                return -ENETUNREACH;
+                                err = -ENETUNREACH;
+                                goto out;
                         }
                         dev = rt->dev;
                         skb->dev = dev;
@@ -1696,7 +1737,9 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         }
         SOCK_DEBUG(sk, "SK %p: Done write (%Zd).\n", sk, len);
 
-        return len;
+out:
+        unlock_kernel();
+        return err ? : len;
 }
 
 static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
@@ -1708,10 +1751,13 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         int copied = 0;
         int offset = 0;
         int err = 0;
-        struct sk_buff *skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+        struct sk_buff *skb;
+
+        lock_kernel();
+        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                                 flags & MSG_DONTWAIT, &err);
         if (!skb)
-                return err;
+                goto out;
 
         /* FIXME: use skb->cb to be able to use shared skbs */
         ddp = ddp_hdr(skb);
@@ -1739,6 +1785,9 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         }
 
         skb_free_datagram(sk, skb);     /* Free the datagram. */
+
+out:
+        unlock_kernel();
         return err ? : copied;
 }
 
@@ -1810,24 +1859,26 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static int atalk_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         /*
-         * All Appletalk ioctls except SIOCATALKDIFADDR are standard.  And
-         * SIOCATALKDIFADDR is handled by upper layer as well, so there is
-         * nothing to do.  Eventually SIOCATALKDIFADDR should be moved
-         * here so there is no generic SIOCPROTOPRIVATE translation in the
-         * system.
+         * SIOCATALKDIFADDR is a SIOCPROTOPRIVATE ioctl number, so we
+         * cannot handle it in common code. The data we access if ifreq
+         * here is compatible, so we can simply call the native
+         * handler.
          */
+        if (cmd == SIOCATALKDIFADDR)
+                return atalk_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
+
         return -ENOIOCTLCMD;
 }
 #endif
 
 
-static struct net_proto_family atalk_family_ops = {
+static const struct net_proto_family atalk_family_ops = {
         .family         = PF_APPLETALK,
         .create         = atalk_create,
         .owner          = THIS_MODULE,
 };
 
-static const struct proto_ops SOCKOPS_WRAPPED(atalk_dgram_ops) = {
+static const struct proto_ops atalk_dgram_ops = {
         .family         = PF_APPLETALK,
         .owner          = THIS_MODULE,
         .release        = atalk_release,
@@ -1836,7 +1887,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(atalk_dgram_ops) = {
         .socketpair     = sock_no_socketpair,
         .accept         = sock_no_accept,
         .getname        = atalk_getname,
-        .poll           = datagram_poll,
+        .poll           = atalk_poll,
         .ioctl          = atalk_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = atalk_compat_ioctl,
@@ -1851,8 +1902,6 @@ static const struct proto_ops SOCKOPS_WRAPPED(atalk_dgram_ops) = {
         .sendpage       = sock_no_sendpage,
 };
 
-SOCKOPS_WRAP(atalk_dgram, PF_APPLETALK);
-
 static struct notifier_block ddp_notifier = {
         .notifier_call  = ddp_device_event,
 };
diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c
index 8d237b15183b..04e9c0da7aa9 100644
--- a/net/appletalk/sysctl_net_atalk.c
+++ b/net/appletalk/sysctl_net_atalk.c
@@ -12,25 +12,20 @@
 
 static struct ctl_table atalk_table[] = {
         {
-                .ctl_name       = NET_ATALK_AARP_EXPIRY_TIME,
                 .procname       = "aarp-expiry-time",
                 .data           = &sysctl_aarp_expiry_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_ATALK_AARP_TICK_TIME,
                 .procname       = "aarp-tick-time",
                 .data           = &sysctl_aarp_tick_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_ATALK_AARP_RETRANSMIT_LIMIT,
                 .procname       = "aarp-retransmit-limit",
                 .data           = &sysctl_aarp_retransmit_limit,
                 .maxlen         = sizeof(int),
@@ -38,20 +33,18 @@ static struct ctl_table atalk_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_ATALK_AARP_RESOLVE_TIME,
                 .procname       = "aarp-resolve-time",
                 .data           = &sysctl_aarp_resolve_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
-        { 0 },
+        { },
 };
 
 static struct ctl_path atalk_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "appletalk", .ctl_name = NET_ATALK, },
+        { .procname = "net", },
+        { .procname = "appletalk", },
         { }
 };
 
diff --git a/net/atm/addr.c b/net/atm/addr.c
index 82e85abc303d..dcda35c66f15 100644
--- a/net/atm/addr.c
+++ b/net/atm/addr.c
@@ -4,7 +4,8 @@
 
 #include <linux/atm.h>
 #include <linux/atmdev.h>
-#include <asm/uaccess.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
 
 #include "signaling.h"
 #include "addr.h"
diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
index 02cc7e71efea..fc63526d8695 100644
--- a/net/atm/atm_misc.c
+++ b/net/atm/atm_misc.c
@@ -2,37 +2,35 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL ICA */
 
-
 #include <linux/module.h>
 #include <linux/atm.h>
 #include <linux/atmdev.h>
 #include <linux/skbuff.h>
 #include <linux/sonet.h>
 #include <linux/bitops.h>
+#include <linux/errno.h>
 #include <asm/atomic.h>
-#include <asm/errno.h>
-
 
-int atm_charge(struct atm_vcc *vcc,int truesize)
+int atm_charge(struct atm_vcc *vcc, int truesize)
 {
-        atm_force_charge(vcc,truesize);
+        atm_force_charge(vcc, truesize);
         if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
                 return 1;
-        atm_return(vcc,truesize);
+        atm_return(vcc, truesize);
         atomic_inc(&vcc->stats->rx_drop);
         return 0;
 }
+EXPORT_SYMBOL(atm_charge);
 
-
-struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
-    gfp_t gfp_flags)
+struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
+                                 gfp_t gfp_flags)
 {
         struct sock *sk = sk_atm(vcc);
         int guess = atm_guess_pdu2truesize(pdu_size);
 
-        atm_force_charge(vcc,guess);
+        atm_force_charge(vcc, guess);
         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
-                struct sk_buff *skb = alloc_skb(pdu_size,gfp_flags);
+                struct sk_buff *skb = alloc_skb(pdu_size, gfp_flags);
 
                 if (skb) {
                         atomic_add(skb->truesize-guess,
@@ -40,10 +38,11 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
                         return skb;
                 }
         }
-        atm_return(vcc,guess);
+        atm_return(vcc, guess);
         atomic_inc(&vcc->stats->rx_drop);
         return NULL;
 }
+EXPORT_SYMBOL(atm_alloc_charge);
 
 
 /*
@@ -73,7 +72,6 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
  *       else *
  */
 
-
 int atm_pcr_goal(const struct atm_trafprm *tp)
 {
         if (tp->pcr && tp->pcr != ATM_MAX_PCR)
@@ -84,26 +82,20 @@ int atm_pcr_goal(const struct atm_trafprm *tp)
                 return -tp->max_pcr;
         return 0;
 }
+EXPORT_SYMBOL(atm_pcr_goal);
 
-
-void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
 {
 #define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
         __SONET_ITEMS
 #undef __HANDLE_ITEM
 }
+EXPORT_SYMBOL(sonet_copy_stats);
 
-
-void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
 {
-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
+#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
         __SONET_ITEMS
 #undef __HANDLE_ITEM
 }
-
-
-EXPORT_SYMBOL(atm_charge);
-EXPORT_SYMBOL(atm_alloc_charge);
-EXPORT_SYMBOL(atm_pcr_goal);
-EXPORT_SYMBOL(sonet_copy_stats);
 EXPORT_SYMBOL(sonet_subtract_stats);
diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index b5674dc2083d..799c631f0fed 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -1,6 +1,7 @@
 /* ATM driver model support. */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/kobject.h>
 #include <linux/atmdev.h>
@@ -42,13 +43,14 @@ static ssize_t show_atmaddress(struct device *cdev,
 
         spin_lock_irqsave(&adev->lock, flags);
         list_for_each_entry(aaddr, &adev->local, entry) {
-                for(i = 0, j = 0; i < ATM_ESA_LEN; ++i, ++j) {
+                for (i = 0, j = 0; i < ATM_ESA_LEN; ++i, ++j) {
                         if (j == *fmt) {
                                 pos += sprintf(pos, ".");
                                 ++fmt;
                                 j = 0;
                         }
-                        pos += sprintf(pos, "%02x", aaddr->addr.sas_addr.prv[i]);
+                        pos += sprintf(pos, "%02x",
+                                       aaddr->addr.sas_addr.prv[i]);
                 }
                 pos += sprintf(pos, "\n");
         }
@@ -78,17 +80,17 @@ static ssize_t show_link_rate(struct device *cdev,
 
         /* show the link rate, not the data rate */
         switch (adev->link_rate) {
-                case ATM_OC3_PCR:
-                        link_rate = 155520000;
-                        break;
-                case ATM_OC12_PCR:
-                        link_rate = 622080000;
-                        break;
-                case ATM_25_PCR:
-                        link_rate = 25600000;
-                        break;
-                default:
-                        link_rate = adev->link_rate * 8 * 53;
+        case ATM_OC3_PCR:
+                link_rate = 155520000;
+                break;
+        case ATM_OC12_PCR:
+                link_rate = 622080000;
+                break;
+        case ATM_25_PCR:
+                link_rate = 25600000;
+                break;
+        default:
+                link_rate = adev->link_rate * 8 * 53;
         }
         pos += sprintf(pos, "%d\n", link_rate);
 
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 26a646d4eb32..d6c7ceaf13e9 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -6,6 +6,8 @@
  *          Eric Kinzie, 2006-2007, US Naval Research Laboratory
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -15,7 +17,8 @@
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/ip.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
+#include <linux/slab.h>
 #include <net/arp.h>
 #include <linux/atm.h>
 #include <linux/atmdev.h>
@@ -26,20 +29,14 @@
 
 #include "common.h"
 
-#ifdef SKB_DEBUG
 static void skb_debug(const struct sk_buff *skb)
 {
+#ifdef SKB_DEBUG
 #define NUM2PRINT 50
-        char buf[NUM2PRINT * 3 + 1];    /* 3 chars per byte */
-        int i = 0;
-        for (i = 0; i < skb->len && i < NUM2PRINT; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
-        printk(KERN_DEBUG "br2684: skb: %s\n", buf);
-}
-#else
-#define skb_debug(skb)  do {} while (0)
+        print_hex_dump(KERN_DEBUG, "br2684: skb: ", DUMP_OFFSET,
+                       16, 1, skb->data, min(NUM2PRINT, skb->len), true);
 #endif
+}
 
 #define BR2684_ETHERTYPE_LEN    2
 #define BR2684_PAD_LEN          2
@@ -68,7 +65,7 @@ struct br2684_vcc {
         struct atm_vcc *atmvcc;
         struct net_device *device;
         /* keep old push, pop functions for chaining */
-        void (*old_push) (struct atm_vcc * vcc, struct sk_buff * skb);
+        void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb);
         void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
         enum br2684_encaps encaps;
         struct list_head brvccs;
@@ -148,7 +145,7 @@ static void br2684_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         struct br2684_vcc *brvcc = BR2684_VCC(vcc);
         struct net_device *net_dev = skb->dev;
 
-        pr_debug("br2684_pop(vcc %p ; net_dev %p )\n", vcc, net_dev);
+        pr_debug("(vcc %p ; net_dev %p )\n", vcc, net_dev);
         brvcc->old_pop(vcc, skb);
 
         if (!net_dev)
@@ -244,7 +241,7 @@ static netdev_tx_t br2684_start_xmit(struct sk_buff *skb,
         struct br2684_dev *brdev = BRPRIV(dev);
         struct br2684_vcc *brvcc;
 
-        pr_debug("br2684_start_xmit, skb_dst(skb)=%p\n", skb_dst(skb));
+        pr_debug("skb_dst(skb)=%p\n", skb_dst(skb));
         read_lock(&devs_lock);
         brvcc = pick_outgoing_vcc(skb, brdev);
         if (brvcc == NULL) {
@@ -300,7 +297,8 @@ static int br2684_setfilt(struct atm_vcc *atmvcc, void __user * arg)
                 struct br2684_dev *brdev;
                 read_lock(&devs_lock);
                 brdev = BRPRIV(br2684_find_dev(&fs.ifspec));
-                if (brdev == NULL || list_empty(&brdev->brvccs) || brdev->brvccs.next != brdev->brvccs.prev)    /* >1 VCC */
+                if (brdev == NULL || list_empty(&brdev->brvccs) ||
+                    brdev->brvccs.next != brdev->brvccs.prev)   /* >1 VCC */
                         brvcc = NULL;
                 else
                         brvcc = list_entry_brvcc(brdev->brvccs.next);
@@ -352,7 +350,7 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
         struct net_device *net_dev = brvcc->device;
         struct br2684_dev *brdev = BRPRIV(net_dev);
 
-        pr_debug("br2684_push\n");
+        pr_debug("\n");
 
         if (unlikely(skb == NULL)) {
                 /* skb==NULL means VCC is being destroyed */
@@ -376,29 +374,25 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         __skb_trim(skb, skb->len - 4);
 
                 /* accept packets that have "ipv[46]" in the snap header */
-                if ((skb->len >= (sizeof(llc_oui_ipv4)))
-                    &&
-                    (memcmp
-                     (skb->data, llc_oui_ipv4,
-                      sizeof(llc_oui_ipv4) - BR2684_ETHERTYPE_LEN) == 0)) {
-                        if (memcmp
-                            (skb->data + 6, ethertype_ipv6,
-                             sizeof(ethertype_ipv6)) == 0)
+                if ((skb->len >= (sizeof(llc_oui_ipv4))) &&
+                    (memcmp(skb->data, llc_oui_ipv4,
+                            sizeof(llc_oui_ipv4) - BR2684_ETHERTYPE_LEN) == 0)) {
+                        if (memcmp(skb->data + 6, ethertype_ipv6,
+                                   sizeof(ethertype_ipv6)) == 0)
                                 skb->protocol = htons(ETH_P_IPV6);
-                        else if (memcmp
-                                 (skb->data + 6, ethertype_ipv4,
-                                  sizeof(ethertype_ipv4)) == 0)
+                        else if (memcmp(skb->data + 6, ethertype_ipv4,
+                                        sizeof(ethertype_ipv4)) == 0)
                                 skb->protocol = htons(ETH_P_IP);
                         else
                                 goto error;
                         skb_pull(skb, sizeof(llc_oui_ipv4));
                         skb_reset_network_header(skb);
                         skb->pkt_type = PACKET_HOST;
-                        /*
-                         * Let us waste some time for checking the encapsulation.
-                         * Note, that only 7 char is checked so frames with a valid FCS
-                         * are also accepted (but FCS is not checked of course).
-                         */
+                /*
+                 * Let us waste some time for checking the encapsulation.
+                 * Note, that only 7 char is checked so frames with a valid FCS
+                 * are also accepted (but FCS is not checked of course).
+                 */
                 } else if ((skb->len >= sizeof(llc_oui_pid_pad)) &&
                            (memcmp(skb->data, llc_oui_pid_pad, 7) == 0)) {
                         skb_pull(skb, sizeof(llc_oui_pid_pad));
@@ -479,8 +473,7 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         write_lock_irq(&devs_lock);
         net_dev = br2684_find_dev(&be.ifspec);
         if (net_dev == NULL) {
-                printk(KERN_ERR
-                       "br2684: tried to attach to non-existant device\n");
+                pr_err("tried to attach to non-existant device\n");
                 err = -ENXIO;
                 goto error;
         }
@@ -494,17 +487,16 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
                 err = -EEXIST;
                 goto error;
         }
-        if (be.fcs_in != BR2684_FCSIN_NO || be.fcs_out != BR2684_FCSOUT_NO ||
-            be.fcs_auto || be.has_vpiid || be.send_padding || (be.encaps !=
-                                                               BR2684_ENCAPS_VC
-                                                               && be.encaps !=
-                                                               BR2684_ENCAPS_LLC)
-            || be.min_size != 0) {
+        if (be.fcs_in != BR2684_FCSIN_NO ||
+            be.fcs_out != BR2684_FCSOUT_NO ||
+            be.fcs_auto || be.has_vpiid || be.send_padding ||
+            (be.encaps != BR2684_ENCAPS_VC &&
+             be.encaps != BR2684_ENCAPS_LLC) ||
+            be.min_size != 0) {
                 err = -EINVAL;
                 goto error;
         }
-        pr_debug("br2684_regvcc vcc=%p, encaps=%d, brvcc=%p\n", atmvcc,
-                 be.encaps, brvcc);
+        pr_debug("vcc=%p, encaps=%d, brvcc=%p\n", atmvcc, be.encaps, brvcc);
         if (list_empty(&brdev->brvccs) && !brdev->mac_was_set) {
                 unsigned char *esi = atmvcc->dev->esi;
                 if (esi[0] | esi[1] | esi[2] | esi[3] | esi[4] | esi[5])
@@ -541,7 +533,8 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         }
         __module_get(THIS_MODULE);
         return 0;
-      error:
+
+error:
         write_unlock_irq(&devs_lock);
         kfree(brvcc);
         return err;
@@ -554,6 +547,12 @@ static const struct net_device_ops br2684_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
+static const struct net_device_ops br2684_netdev_ops_routed = {
+        .ndo_start_xmit         = br2684_start_xmit,
+        .ndo_set_mac_address    = br2684_mac_addr,
+        .ndo_change_mtu         = eth_change_mtu
+};
+
 static void br2684_setup(struct net_device *netdev)
 {
         struct br2684_dev *brdev = BRPRIV(netdev);
@@ -569,11 +568,10 @@ static void br2684_setup(struct net_device *netdev)
 static void br2684_setup_routed(struct net_device *netdev)
 {
         struct br2684_dev *brdev = BRPRIV(netdev);
-        brdev->net_dev = netdev;
 
+        brdev->net_dev = netdev;
         netdev->hard_header_len = 0;
-
-        netdev->netdev_ops = &br2684_netdev_ops;
+        netdev->netdev_ops = &br2684_netdev_ops_routed;
         netdev->addr_len = 0;
         netdev->mtu = 1500;
         netdev->type = ARPHRD_PPP;
@@ -582,7 +580,7 @@ static void br2684_setup_routed(struct net_device *netdev)
         INIT_LIST_HEAD(&brdev->brvccs);
 }
 
-static int br2684_create(void __user * arg)
+static int br2684_create(void __user *arg)
 {
         int err;
         struct net_device *netdev;
@@ -590,11 +588,10 @@ static int br2684_create(void __user * arg)
         struct atm_newif_br2684 ni;
         enum br2684_payload payload;
 
-        pr_debug("br2684_create\n");
+        pr_debug("\n");
 
-        if (copy_from_user(&ni, arg, sizeof ni)) {
+        if (copy_from_user(&ni, arg, sizeof ni))
                 return -EFAULT;
-        }
 
         if (ni.media & BR2684_FLAG_ROUTED)
                 payload = p_routed;
@@ -602,9 +599,8 @@ static int br2684_create(void __user * arg)
                 payload = p_bridged;
         ni.media &= 0xffff;     /* strip flags */
 
-        if (ni.media != BR2684_MEDIA_ETHERNET || ni.mtu != 1500) {
+        if (ni.media != BR2684_MEDIA_ETHERNET || ni.mtu != 1500)
                 return -EINVAL;
-        }
 
         netdev = alloc_netdev(sizeof(struct br2684_dev),
                               ni.ifname[0] ? ni.ifname : "nas%d",
@@ -619,7 +615,7 @@ static int br2684_create(void __user * arg)
         /* open, stop, do_ioctl ? */
         err = register_netdev(netdev);
         if (err < 0) {
-                printk(KERN_ERR "br2684_create: register_netdev failed\n");
+                pr_err("register_netdev failed\n");
                 free_netdev(netdev);
                 return err;
         }
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 64629c354343..313aba11316b 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -2,6 +2,8 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/kernel.h> /* for UINT_MAX */
@@ -28,12 +30,13 @@
 #include <linux/seq_file.h>
 #include <linux/rcupdate.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 #include <net/route.h> /* for struct rtable and routing */
 #include <net/icmp.h> /* icmp_send */
-#include <asm/param.h> /* for HZ */
+#include <linux/param.h> /* for HZ */
+#include <linux/uaccess.h>
 #include <asm/byteorder.h> /* for htons etc. */
 #include <asm/system.h> /* save/restore_flags */
-#include <asm/uaccess.h>
 #include <asm/atomic.h>
 
 #include "common.h"
@@ -51,13 +54,13 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
         struct atmarp_ctrl *ctrl;
         struct sk_buff *skb;
 
-        pr_debug("to_atmarpd(%d)\n", type);
+        pr_debug("(%d)\n", type);
         if (!atmarpd)
                 return -EUNATCH;
-        skb = alloc_skb(sizeof(struct atmarp_ctrl),GFP_ATOMIC);
+        skb = alloc_skb(sizeof(struct atmarp_ctrl), GFP_ATOMIC);
         if (!skb)
                 return -ENOMEM;
-        ctrl = (struct atmarp_ctrl *) skb_put(skb,sizeof(struct atmarp_ctrl));
+        ctrl = (struct atmarp_ctrl *)skb_put(skb, sizeof(struct atmarp_ctrl));
         ctrl->type = type;
         ctrl->itf_num = itf;
         ctrl->ip = ip;
@@ -71,8 +74,7 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
 
 static void link_vcc(struct clip_vcc *clip_vcc, struct atmarp_entry *entry)
 {
-        pr_debug("link_vcc %p to entry %p (neigh %p)\n", clip_vcc, entry,
-                entry->neigh);
+        pr_debug("%p to entry %p (neigh %p)\n", clip_vcc, entry, entry->neigh);
         clip_vcc->entry = entry;
         clip_vcc->xoff = 0;     /* @@@ may overrun buffer by one packet */
         clip_vcc->next = entry->vccs;
@@ -86,7 +88,7 @@ static void unlink_clip_vcc(struct clip_vcc *clip_vcc)
         struct clip_vcc **walk;
 
         if (!entry) {
-                printk(KERN_CRIT "!clip_vcc->entry (clip_vcc %p)\n", clip_vcc);
+                pr_crit("!clip_vcc->entry (clip_vcc %p)\n", clip_vcc);
                 return;
         }
         netif_tx_lock_bh(entry->neigh->dev);    /* block clip_start_xmit() */
@@ -106,13 +108,11 @@ static void unlink_clip_vcc(struct clip_vcc *clip_vcc)
                         error = neigh_update(entry->neigh, NULL, NUD_NONE,
                                              NEIGH_UPDATE_F_ADMIN);
                         if (error)
-                                printk(KERN_CRIT "unlink_clip_vcc: "
-                                       "neigh_update failed with %d\n", error);
+                                pr_crit("neigh_update failed with %d\n", error);
                         goto out;
                 }
-        printk(KERN_CRIT "ATMARP: unlink_clip_vcc failed (entry %p, vcc "
-               "0x%p)\n", entry, clip_vcc);
-      out:
+        pr_crit("ATMARP: failed (entry %p, vcc 0x%p)\n", entry, clip_vcc);
+out:
         netif_tx_unlock_bh(entry->neigh->dev);
 }
 
@@ -127,7 +127,7 @@ static int neigh_check_cb(struct neighbour *n)
 
                 if (cv->idle_timeout && time_after(jiffies, exp)) {
                         pr_debug("releasing vcc %p->%p of entry %p\n",
-                                cv, cv->vcc, entry);
+                                 cv, cv->vcc, entry);
                         vcc_release_async(cv->vcc, -ETIMEDOUT);
                 }
         }
@@ -139,7 +139,7 @@ static int neigh_check_cb(struct neighbour *n)
                 struct sk_buff *skb;
 
                 pr_debug("destruction postponed with ref %d\n",
-                        atomic_read(&n->refcnt));
+                         atomic_read(&n->refcnt));
 
                 while ((skb = skb_dequeue(&n->arp_queue)) != NULL)
                         dev_kfree_skb(skb);
@@ -163,7 +163,7 @@ static int clip_arp_rcv(struct sk_buff *skb)
 {
         struct atm_vcc *vcc;
 
-        pr_debug("clip_arp_rcv\n");
+        pr_debug("\n");
         vcc = ATM_SKB(skb)->vcc;
         if (!vcc || !atm_charge(vcc, skb->truesize)) {
                 dev_kfree_skb_any(skb);
@@ -188,7 +188,7 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         struct clip_vcc *clip_vcc = CLIP_VCC(vcc);
 
-        pr_debug("clip push\n");
+        pr_debug("\n");
         if (!skb) {
                 pr_debug("removing VCC %p\n", clip_vcc);
                 if (clip_vcc->entry)
@@ -206,12 +206,12 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
         }
         ATM_SKB(skb)->vcc = vcc;
         skb_reset_mac_header(skb);
-        if (!clip_vcc->encap
-            || skb->len < RFC1483LLC_LEN
-            || memcmp(skb->data, llc_oui, sizeof (llc_oui)))
+        if (!clip_vcc->encap ||
+            skb->len < RFC1483LLC_LEN ||
+            memcmp(skb->data, llc_oui, sizeof(llc_oui)))
                 skb->protocol = htons(ETH_P_IP);
         else {
-                skb->protocol = ((__be16 *) skb->data)[3];
+                skb->protocol = ((__be16 *)skb->data)[3];
                 skb_pull(skb, RFC1483LLC_LEN);
                 if (skb->protocol == htons(ETH_P_ARP)) {
                         skb->dev->stats.rx_packets++;
@@ -239,7 +239,7 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         int old;
         unsigned long flags;
 
-        pr_debug("clip_pop(vcc %p)\n", vcc);
+        pr_debug("(vcc %p)\n", vcc);
         clip_vcc->old_pop(vcc, skb);
         /* skb->dev == NULL in outbound ARP packets */
         if (!dev)
@@ -255,7 +255,7 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
 
 static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
-        pr_debug("clip_neigh_solicit (neigh %p, skb %p)\n", neigh, skb);
+        pr_debug("(neigh %p, skb %p)\n", neigh, skb);
         to_atmarpd(act_need, PRIV(neigh->dev)->number, NEIGH2ENTRY(neigh)->ip);
 }
 
@@ -284,7 +284,7 @@ static int clip_constructor(struct neighbour *neigh)
         struct in_device *in_dev;
         struct neigh_parms *parms;
 
-        pr_debug("clip_constructor (neigh %p, entry %p)\n", neigh, entry);
+        pr_debug("(neigh %p, entry %p)\n", neigh, entry);
         neigh->type = inet_addr_type(&init_net, entry->ip);
         if (neigh->type != RTN_UNICAST)
                 return -EINVAL;
@@ -369,9 +369,9 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
         int old;
         unsigned long flags;
 
-        pr_debug("clip_start_xmit (skb %p)\n", skb);
+        pr_debug("(skb %p)\n", skb);
         if (!skb_dst(skb)) {
-                printk(KERN_ERR "clip_start_xmit: skb_dst(skb) == NULL\n");
+                pr_err("skb_dst(skb) == NULL\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
@@ -385,7 +385,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
                         return 0;
                 }
 #endif
-                printk(KERN_ERR "clip_start_xmit: NO NEIGHBOUR !\n");
+                pr_err("NO NEIGHBOUR !\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
@@ -421,7 +421,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
         pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);
         old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
         if (old) {
-                printk(KERN_WARNING "clip_start_xmit: XOFF->XOFF transition\n");
+                pr_warning("XOFF->XOFF transition\n");
                 return NETDEV_TX_OK;
         }
         dev->stats.tx_packets++;
@@ -456,7 +456,7 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
         clip_vcc = kmalloc(sizeof(struct clip_vcc), GFP_KERNEL);
         if (!clip_vcc)
                 return -ENOMEM;
-        pr_debug("mkip clip_vcc %p vcc %p\n", clip_vcc, vcc);
+        pr_debug("%p vcc %p\n", clip_vcc, vcc);
         clip_vcc->vcc = vcc;
         vcc->user_back = clip_vcc;
         set_bit(ATM_VF_IS_CLIP, &vcc->flags);
@@ -506,16 +506,16 @@ static int clip_setentry(struct atm_vcc *vcc, __be32 ip)
         struct rtable *rt;
 
         if (vcc->push != clip_push) {
-                printk(KERN_WARNING "clip_setentry: non-CLIP VCC\n");
+                pr_warning("non-CLIP VCC\n");
                 return -EBADF;
         }
         clip_vcc = CLIP_VCC(vcc);
         if (!ip) {
                 if (!clip_vcc->entry) {
-                        printk(KERN_ERR "hiding hidden ATMARP entry\n");
+                        pr_err("hiding hidden ATMARP entry\n");
                         return 0;
                 }
-                pr_debug("setentry: remove\n");
+                pr_debug("remove\n");
                 unlink_clip_vcc(clip_vcc);
                 return 0;
         }
@@ -529,9 +529,9 @@ static int clip_setentry(struct atm_vcc *vcc, __be32 ip)
         entry = NEIGH2ENTRY(neigh);
         if (entry != clip_vcc->entry) {
                 if (!clip_vcc->entry)
-                        pr_debug("setentry: add\n");
+                        pr_debug("add\n");
                 else {
-                        pr_debug("setentry: update\n");
+                        pr_debug("update\n");
                         unlink_clip_vcc(clip_vcc);
                 }
                 link_vcc(clip_vcc, entry);
@@ -614,16 +614,16 @@ static int clip_device_event(struct notifier_block *this, unsigned long event,
 
         switch (event) {
         case NETDEV_UP:
-                pr_debug("clip_device_event NETDEV_UP\n");
+                pr_debug("NETDEV_UP\n");
                 to_atmarpd(act_up, PRIV(dev)->number, 0);
                 break;
         case NETDEV_GOING_DOWN:
-                pr_debug("clip_device_event NETDEV_DOWN\n");
+                pr_debug("NETDEV_DOWN\n");
                 to_atmarpd(act_down, PRIV(dev)->number, 0);
                 break;
         case NETDEV_CHANGE:
         case NETDEV_CHANGEMTU:
-                pr_debug("clip_device_event NETDEV_CHANGE*\n");
+                pr_debug("NETDEV_CHANGE*\n");
                 to_atmarpd(act_change, PRIV(dev)->number, 0);
                 break;
         }
@@ -645,7 +645,6 @@ static int clip_inet_event(struct notifier_block *this, unsigned long event,
         return clip_device_event(this, NETDEV_CHANGE, in_dev->dev);
 }
 
-
 static struct notifier_block clip_dev_notifier = {
         .notifier_call = clip_device_event,
 };
@@ -660,7 +659,7 @@ static struct notifier_block clip_inet_notifier = {
 
 static void atmarpd_close(struct atm_vcc *vcc)
 {
-        pr_debug("atmarpd_close\n");
+        pr_debug("\n");
 
         rtnl_lock();
         atmarpd = NULL;
@@ -671,7 +670,6 @@ static void atmarpd_close(struct atm_vcc *vcc)
         module_put(THIS_MODULE);
 }
 
-
 static struct atmdev_ops atmarpd_dev_ops = {
         .close = atmarpd_close
 };
@@ -693,11 +691,11 @@ static int atm_init_atmarp(struct atm_vcc *vcc)
                 return -EADDRINUSE;
         }
 
-        mod_timer(&idle_timer, jiffies+CLIP_CHECK_INTERVAL*HZ);
+        mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
 
         atmarpd = vcc;
-        set_bit(ATM_VF_META,&vcc->flags);
-        set_bit(ATM_VF_READY,&vcc->flags);
+        set_bit(ATM_VF_META, &vcc->flags);
+        set_bit(ATM_VF_READY, &vcc->flags);
             /* allow replies and avoid getting closed if signaling dies */
         vcc->dev = &atmarpd_dev;
         vcc_insert_socket(sk_atm(vcc));
@@ -950,8 +948,7 @@ static int __init atm_clip_init(void)
 
                 p = proc_create("arp", S_IRUGO, atm_proc_root, &arp_seq_fops);
                 if (!p) {
-                        printk(KERN_ERR "Unable to initialize "
-                               "/proc/net/atm/arp\n");
+                        pr_err("Unable to initialize /proc/net/atm/arp\n");
                         atm_clip_exit_noproc();
                         return -ENOMEM;
                 }
diff --git a/net/atm/common.c b/net/atm/common.c
index 950bd16d2383..97ed94aa0cbc 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/module.h>
 #include <linux/kmod.h>
@@ -17,12 +18,12 @@
 #include <linux/skbuff.h>
 #include <linux/bitops.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/sock.h>           /* struct sock */
+#include <linux/uaccess.h>
+#include <linux/poll.h>
 
-#include <asm/uaccess.h>
 #include <asm/atomic.h>
-#include <asm/poll.h>
-
 
 #include "resources.h"          /* atm_find_dev */
 #include "common.h"             /* prototypes */
@@ -31,13 +32,15 @@
 #include "signaling.h"          /* for WAITING and sigd_attach */
 
 struct hlist_head vcc_hash[VCC_HTABLE_SIZE];
+EXPORT_SYMBOL(vcc_hash);
+
 DEFINE_RWLOCK(vcc_sklist_lock);
+EXPORT_SYMBOL(vcc_sklist_lock);
 
 static void __vcc_insert_socket(struct sock *sk)
 {
         struct atm_vcc *vcc = atm_sk(sk);
-        struct hlist_head *head = &vcc_hash[vcc->vci &
-                                        (VCC_HTABLE_SIZE - 1)];
+        struct hlist_head *head = &vcc_hash[vcc->vci & (VCC_HTABLE_SIZE - 1)];
         sk->sk_hash = vcc->vci & (VCC_HTABLE_SIZE - 1);
         sk_add_node(sk, head);
 }
@@ -48,6 +51,7 @@ void vcc_insert_socket(struct sock *sk)
         __vcc_insert_socket(sk);
         write_unlock_irq(&vcc_sklist_lock);
 }
+EXPORT_SYMBOL(vcc_insert_socket);
 
 static void vcc_remove_socket(struct sock *sk)
 {
@@ -56,37 +60,32 @@ static void vcc_remove_socket(struct sock *sk)
         write_unlock_irq(&vcc_sklist_lock);
 }
 
-
-static struct sk_buff *alloc_tx(struct atm_vcc *vcc,unsigned int size)
+static struct sk_buff *alloc_tx(struct atm_vcc *vcc, unsigned int size)
 {
         struct sk_buff *skb;
         struct sock *sk = sk_atm(vcc);
 
         if (sk_wmem_alloc_get(sk) && !atm_may_send(vcc, size)) {
                 pr_debug("Sorry: wmem_alloc = %d, size = %d, sndbuf = %d\n",
-                        sk_wmem_alloc_get(sk), size,
-                        sk->sk_sndbuf);
+                         sk_wmem_alloc_get(sk), size, sk->sk_sndbuf);
                 return NULL;
         }
         while (!(skb = alloc_skb(size, GFP_KERNEL)))
                 schedule();
-        pr_debug("AlTx %d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
+        pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
         return skb;
 }
 
-
-EXPORT_SYMBOL(vcc_hash);
-EXPORT_SYMBOL(vcc_sklist_lock);
-EXPORT_SYMBOL(vcc_insert_socket);
-
 static void vcc_sock_destruct(struct sock *sk)
 {
         if (atomic_read(&sk->sk_rmem_alloc))
-                printk(KERN_DEBUG "vcc_sock_destruct: rmem leakage (%d bytes) detected.\n", atomic_read(&sk->sk_rmem_alloc));
+                printk(KERN_DEBUG "%s: rmem leakage (%d bytes) detected.\n",
+                       __func__, atomic_read(&sk->sk_rmem_alloc));
 
         if (atomic_read(&sk->sk_wmem_alloc))
-                printk(KERN_DEBUG "vcc_sock_destruct: wmem leakage (%d bytes) detected.\n", atomic_read(&sk->sk_wmem_alloc));
+                printk(KERN_DEBUG "%s: wmem leakage (%d bytes) detected.\n",
+                       __func__, atomic_read(&sk->sk_wmem_alloc));
 }
 
 static void vcc_def_wakeup(struct sock *sk)
@@ -142,8 +141,8 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
 
         vcc = atm_sk(sk);
         vcc->dev = NULL;
-        memset(&vcc->local,0,sizeof(struct sockaddr_atmsvc));
-        memset(&vcc->remote,0,sizeof(struct sockaddr_atmsvc));
+        memset(&vcc->local, 0, sizeof(struct sockaddr_atmsvc));
+        memset(&vcc->remote, 0, sizeof(struct sockaddr_atmsvc));
         vcc->qos.txtp.max_sdu = 1 << 16; /* for meta VCs */
         atomic_set(&sk->sk_wmem_alloc, 1);
         atomic_set(&sk->sk_rmem_alloc, 0);
@@ -156,7 +155,6 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
         return 0;
 }
 
-
 static void vcc_destroy_socket(struct sock *sk)
 {
         struct atm_vcc *vcc = atm_sk(sk);
@@ -171,7 +169,7 @@ static void vcc_destroy_socket(struct sock *sk)
                         vcc->push(vcc, NULL); /* atmarpd has no push */
 
                 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        atm_return(vcc,skb->truesize);
+                        atm_return(vcc, skb->truesize);
                         kfree_skb(skb);
                 }
 
@@ -182,7 +180,6 @@ static void vcc_destroy_socket(struct sock *sk)
         vcc_remove_socket(sk);
 }
 
-
 int vcc_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -197,7 +194,6 @@ int vcc_release(struct socket *sock)
         return 0;
 }
 
-
 void vcc_release_async(struct atm_vcc *vcc, int reply)
 {
         struct sock *sk = sk_atm(vcc);
@@ -208,8 +204,6 @@ void vcc_release_async(struct atm_vcc *vcc, int reply)
         clear_bit(ATM_VF_WAITING, &vcc->flags);
         sk->sk_state_change(sk);
 }
-
-
 EXPORT_SYMBOL(vcc_release_async);
 
 
@@ -235,37 +229,37 @@ void atm_dev_release_vccs(struct atm_dev *dev)
         write_unlock_irq(&vcc_sklist_lock);
 }
 
-
-static int adjust_tp(struct atm_trafprm *tp,unsigned char aal)
+static int adjust_tp(struct atm_trafprm *tp, unsigned char aal)
 {
         int max_sdu;
 
-        if (!tp->traffic_class) return 0;
+        if (!tp->traffic_class)
+                return 0;
         switch (aal) {
-                case ATM_AAL0:
-                        max_sdu = ATM_CELL_SIZE-1;
-                        break;
-                case ATM_AAL34:
-                        max_sdu = ATM_MAX_AAL34_PDU;
-                        break;
-                default:
-                        printk(KERN_WARNING "ATM: AAL problems ... "
-                            "(%d)\n",aal);
-                        /* fall through */
-                case ATM_AAL5:
-                        max_sdu = ATM_MAX_AAL5_PDU;
+        case ATM_AAL0:
+                max_sdu = ATM_CELL_SIZE-1;
+                break;
+        case ATM_AAL34:
+                max_sdu = ATM_MAX_AAL34_PDU;
+                break;
+        default:
+                pr_warning("AAL problems ... (%d)\n", aal);
+                /* fall through */
+        case ATM_AAL5:
+                max_sdu = ATM_MAX_AAL5_PDU;
         }
-        if (!tp->max_sdu) tp->max_sdu = max_sdu;
-        else if (tp->max_sdu > max_sdu) return -EINVAL;
-        if (!tp->max_cdv) tp->max_cdv = ATM_MAX_CDV;
+        if (!tp->max_sdu)
+                tp->max_sdu = max_sdu;
+        else if (tp->max_sdu > max_sdu)
+                return -EINVAL;
+        if (!tp->max_cdv)
+                tp->max_cdv = ATM_MAX_CDV;
         return 0;
 }
 
-
 static int check_ci(const struct atm_vcc *vcc, short vpi, int vci)
 {
-        struct hlist_head *head = &vcc_hash[vci &
-                                        (VCC_HTABLE_SIZE - 1)];
+        struct hlist_head *head = &vcc_hash[vci & (VCC_HTABLE_SIZE - 1)];
         struct hlist_node *node;
         struct sock *s;
         struct atm_vcc *walk;
@@ -289,7 +283,6 @@ static int check_ci(const struct atm_vcc *vcc, short vpi, int vci)
         return 0;
 }
 
-
 static int find_ci(const struct atm_vcc *vcc, short *vpi, int *vci)
 {
         static short p;        /* poor man's per-device cache */
@@ -327,14 +320,13 @@ static int find_ci(const struct atm_vcc *vcc, short *vpi, int *vci)
                 if ((c == ATM_NOT_RSV_VCI || *vci != ATM_VCI_ANY) &&
                     *vpi == ATM_VPI_ANY) {
                         p++;
-                        if (p >= 1 << vcc->dev->ci_range.vpi_bits) p = 0;
+                        if (p >= 1 << vcc->dev->ci_range.vpi_bits)
+                                p = 0;
                 }
-        }
-        while (old_p != p || old_c != c);
+        } while (old_p != p || old_c != c);
         return -EADDRINUSE;
 }
 
-
 static int __vcc_connect(struct atm_vcc *vcc, struct atm_dev *dev, short vpi,
                          int vci)
 {
@@ -362,37 +354,46 @@ static int __vcc_connect(struct atm_vcc *vcc, struct atm_dev *dev, short vpi,
         __vcc_insert_socket(sk);
         write_unlock_irq(&vcc_sklist_lock);
         switch (vcc->qos.aal) {
-                case ATM_AAL0:
-                        error = atm_init_aal0(vcc);
-                        vcc->stats = &dev->stats.aal0;
-                        break;
-                case ATM_AAL34:
-                        error = atm_init_aal34(vcc);
-                        vcc->stats = &dev->stats.aal34;
-                        break;
-                case ATM_NO_AAL:
-                        /* ATM_AAL5 is also used in the "0 for default" case */
-                        vcc->qos.aal = ATM_AAL5;
-                        /* fall through */
-                case ATM_AAL5:
-                        error = atm_init_aal5(vcc);
-                        vcc->stats = &dev->stats.aal5;
-                        break;
-                default:
-                        error = -EPROTOTYPE;
+        case ATM_AAL0:
+                error = atm_init_aal0(vcc);
+                vcc->stats = &dev->stats.aal0;
+                break;
+        case ATM_AAL34:
+                error = atm_init_aal34(vcc);
+                vcc->stats = &dev->stats.aal34;
+                break;
+        case ATM_NO_AAL:
+                /* ATM_AAL5 is also used in the "0 for default" case */
+                vcc->qos.aal = ATM_AAL5;
+                /* fall through */
+        case ATM_AAL5:
+                error = atm_init_aal5(vcc);
+                vcc->stats = &dev->stats.aal5;
+                break;
+        default:
+                error = -EPROTOTYPE;
         }
-        if (!error) error = adjust_tp(&vcc->qos.txtp,vcc->qos.aal);
-        if (!error) error = adjust_tp(&vcc->qos.rxtp,vcc->qos.aal);
+        if (!error)
+                error = adjust_tp(&vcc->qos.txtp, vcc->qos.aal);
+        if (!error)
+                error = adjust_tp(&vcc->qos.rxtp, vcc->qos.aal);
         if (error)
                 goto fail;
-        pr_debug("VCC %d.%d, AAL %d\n",vpi,vci,vcc->qos.aal);
-        pr_debug("  TX: %d, PCR %d..%d, SDU %d\n",vcc->qos.txtp.traffic_class,
-            vcc->qos.txtp.min_pcr,vcc->qos.txtp.max_pcr,vcc->qos.txtp.max_sdu);
-        pr_debug("  RX: %d, PCR %d..%d, SDU %d\n",vcc->qos.rxtp.traffic_class,
-            vcc->qos.rxtp.min_pcr,vcc->qos.rxtp.max_pcr,vcc->qos.rxtp.max_sdu);
+        pr_debug("VCC %d.%d, AAL %d\n", vpi, vci, vcc->qos.aal);
+        pr_debug("  TX: %d, PCR %d..%d, SDU %d\n",
+                 vcc->qos.txtp.traffic_class,
+                 vcc->qos.txtp.min_pcr,
+                 vcc->qos.txtp.max_pcr,
+                 vcc->qos.txtp.max_sdu);
+        pr_debug("  RX: %d, PCR %d..%d, SDU %d\n",
+                 vcc->qos.rxtp.traffic_class,
+                 vcc->qos.rxtp.min_pcr,
+                 vcc->qos.rxtp.max_pcr,
+                 vcc->qos.rxtp.max_sdu);
 
         if (dev->ops->open) {
-                if ((error = dev->ops->open(vcc)))
+                error = dev->ops->open(vcc);
+                if (error)
                         goto fail;
         }
         return 0;
@@ -406,14 +407,13 @@ fail_module_put:
         return error;
 }
 
-
 int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
 {
         struct atm_dev *dev;
         struct atm_vcc *vcc = ATM_SD(sock);
         int error;
 
-        pr_debug("vcc_connect (vpi %d, vci %d)\n",vpi,vci);
+        pr_debug("(vpi %d, vci %d)\n", vpi, vci);
         if (sock->state == SS_CONNECTED)
                 return -EISCONN;
         if (sock->state != SS_UNCONNECTED)
@@ -422,30 +422,33 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
                 return -EINVAL;
 
         if (vpi != ATM_VPI_UNSPEC && vci != ATM_VCI_UNSPEC)
-                clear_bit(ATM_VF_PARTIAL,&vcc->flags);
+                clear_bit(ATM_VF_PARTIAL, &vcc->flags);
         else
-                if (test_bit(ATM_VF_PARTIAL,&vcc->flags))
+                if (test_bit(ATM_VF_PARTIAL, &vcc->flags))
                         return -EINVAL;
-        pr_debug("vcc_connect (TX: cl %d,bw %d-%d,sdu %d; "
-            "RX: cl %d,bw %d-%d,sdu %d,AAL %s%d)\n",
-            vcc->qos.txtp.traffic_class,vcc->qos.txtp.min_pcr,
-            vcc->qos.txtp.max_pcr,vcc->qos.txtp.max_sdu,
-            vcc->qos.rxtp.traffic_class,vcc->qos.rxtp.min_pcr,
-            vcc->qos.rxtp.max_pcr,vcc->qos.rxtp.max_sdu,
-            vcc->qos.aal == ATM_AAL5 ? "" : vcc->qos.aal == ATM_AAL0 ? "" :
-            " ??? code ",vcc->qos.aal == ATM_AAL0 ? 0 : vcc->qos.aal);
+        pr_debug("(TX: cl %d,bw %d-%d,sdu %d; "
+                 "RX: cl %d,bw %d-%d,sdu %d,AAL %s%d)\n",
+                 vcc->qos.txtp.traffic_class, vcc->qos.txtp.min_pcr,
+                 vcc->qos.txtp.max_pcr, vcc->qos.txtp.max_sdu,
+                 vcc->qos.rxtp.traffic_class, vcc->qos.rxtp.min_pcr,
+                 vcc->qos.rxtp.max_pcr, vcc->qos.rxtp.max_sdu,
+                 vcc->qos.aal == ATM_AAL5 ? "" :
+                 vcc->qos.aal == ATM_AAL0 ? "" : " ??? code ",
+                 vcc->qos.aal == ATM_AAL0 ? 0 : vcc->qos.aal);
         if (!test_bit(ATM_VF_HASQOS, &vcc->flags))
                 return -EBADFD;
         if (vcc->qos.txtp.traffic_class == ATM_ANYCLASS ||
             vcc->qos.rxtp.traffic_class == ATM_ANYCLASS)
                 return -EINVAL;
         if (likely(itf != ATM_ITF_ANY)) {
-                dev = try_then_request_module(atm_dev_lookup(itf), "atm-device-%d", itf);
+                dev = try_then_request_module(atm_dev_lookup(itf),
+                                              "atm-device-%d", itf);
         } else {
                 dev = NULL;
                 mutex_lock(&atm_dev_mutex);
                 if (!list_empty(&atm_devs)) {
-                        dev = list_entry(atm_devs.next, struct atm_dev, dev_list);
+                        dev = list_entry(atm_devs.next,
+                                         struct atm_dev, dev_list);
                         atm_dev_hold(dev);
                 }
                 mutex_unlock(&atm_dev_mutex);
@@ -458,13 +461,12 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
                 return error;
         }
         if (vpi == ATM_VPI_UNSPEC || vci == ATM_VCI_UNSPEC)
-                set_bit(ATM_VF_PARTIAL,&vcc->flags);
-        if (test_bit(ATM_VF_READY,&ATM_SD(sock)->flags))
+                set_bit(ATM_VF_PARTIAL, &vcc->flags);
+        if (test_bit(ATM_VF_READY, &ATM_SD(sock)->flags))
                 sock->state = SS_CONNECTED;
         return 0;
 }
 
-
 int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                 size_t size, int flags)
 {
@@ -478,8 +480,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (flags & ~MSG_DONTWAIT)              /* only handle MSG_DONTWAIT */
                 return -EOPNOTSUPP;
         vcc = ATM_SD(sock);
-        if (test_bit(ATM_VF_RELEASED,&vcc->flags) ||
-            test_bit(ATM_VF_CLOSE,&vcc->flags) ||
+        if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
+            test_bit(ATM_VF_CLOSE, &vcc->flags) ||
             !test_bit(ATM_VF_READY, &vcc->flags))
                 return 0;
 
@@ -496,14 +498,13 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         error = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
         if (error)
                 return error;
-        sock_recv_timestamp(msg, sk, skb);
-        pr_debug("RcvM %d -= %d\n", atomic_read(&sk->sk_rmem_alloc), skb->truesize);
+        sock_recv_ts_and_drops(msg, sk, skb);
+        pr_debug("%d -= %d\n", atomic_read(&sk->sk_rmem_alloc), skb->truesize);
         atm_return(vcc, skb->truesize);
         skb_free_datagram(sk, skb);
         return copied;
 }
 
-
 int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                 size_t total_len)
 {
@@ -511,7 +512,7 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
         DEFINE_WAIT(wait);
         struct atm_vcc *vcc;
         struct sk_buff *skb;
-        int eff,error;
+        int eff, error;
         const void __user *buff;
         int size;
 
@@ -550,7 +551,7 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
         eff = (size+3) & ~3; /* align to word boundary */
         prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
         error = 0;
-        while (!(skb = alloc_tx(vcc,eff))) {
+        while (!(skb = alloc_tx(vcc, eff))) {
                 if (m->msg_flags & MSG_DONTWAIT) {
                         error = -EAGAIN;
                         break;
@@ -560,9 +561,9 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                         error = -ERESTARTSYS;
                         break;
                 }
-                if (test_bit(ATM_VF_RELEASED,&vcc->flags) ||
-                    test_bit(ATM_VF_CLOSE,&vcc->flags) ||
-                    !test_bit(ATM_VF_READY,&vcc->flags)) {
+                if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
+                    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
+                    !test_bit(ATM_VF_READY, &vcc->flags)) {
                         error = -EPIPE;
                         send_sig(SIGPIPE, current, 0);
                         break;
@@ -574,20 +575,20 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                 goto out;
         skb->dev = NULL; /* for paths shared with net_device interfaces */
         ATM_SKB(skb)->atm_options = vcc->atm_options;
-        if (copy_from_user(skb_put(skb,size),buff,size)) {
+        if (copy_from_user(skb_put(skb, size), buff, size)) {
                 kfree_skb(skb);
                 error = -EFAULT;
                 goto out;
         }
-        if (eff != size) memset(skb->data+size,0,eff-size);
-        error = vcc->dev->ops->send(vcc,skb);
+        if (eff != size)
+                memset(skb->data + size, 0, eff-size);
+        error = vcc->dev->ops->send(vcc, skb);
         error = error ? error : size;
 out:
         release_sock(sk);
         return error;
 }
 
-
 unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
         struct sock *sk = sock->sk;
@@ -623,8 +624,7 @@ unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
         return mask;
 }
 
-
-static int atm_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
+static int atm_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
 {
         int error;
 
@@ -636,25 +636,31 @@ static int atm_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
             qos->rxtp.traffic_class != vcc->qos.rxtp.traffic_class ||
             qos->txtp.traffic_class != vcc->qos.txtp.traffic_class)
                 return -EINVAL;
-        error = adjust_tp(&qos->txtp,qos->aal);
-        if (!error) error = adjust_tp(&qos->rxtp,qos->aal);
-        if (error) return error;
-        if (!vcc->dev->ops->change_qos) return -EOPNOTSUPP;
+        error = adjust_tp(&qos->txtp, qos->aal);
+        if (!error)
+                error = adjust_tp(&qos->rxtp, qos->aal);
+        if (error)
+                return error;
+        if (!vcc->dev->ops->change_qos)
+                return -EOPNOTSUPP;
         if (sk_atm(vcc)->sk_family == AF_ATMPVC)
-                return vcc->dev->ops->change_qos(vcc,qos,ATM_MF_SET);
-        return svc_change_qos(vcc,qos);
+                return vcc->dev->ops->change_qos(vcc, qos, ATM_MF_SET);
+        return svc_change_qos(vcc, qos);
 }
 
-
 static int check_tp(const struct atm_trafprm *tp)
 {
         /* @@@ Should be merged with adjust_tp */
-        if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS) return 0;
+        if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS)
+                return 0;
         if (tp->traffic_class != ATM_UBR && !tp->min_pcr && !tp->pcr &&
-            !tp->max_pcr) return -EINVAL;
-        if (tp->min_pcr == ATM_MAX_PCR) return -EINVAL;
+            !tp->max_pcr)
+                return -EINVAL;
+        if (tp->min_pcr == ATM_MAX_PCR)
+                return -EINVAL;
         if (tp->min_pcr && tp->max_pcr && tp->max_pcr != ATM_MAX_PCR &&
-            tp->min_pcr > tp->max_pcr) return -EINVAL;
+            tp->min_pcr > tp->max_pcr)
+                return -EINVAL;
         /*
          * We allow pcr to be outside [min_pcr,max_pcr], because later
          * adjustment may still push it in the valid range.
@@ -662,7 +668,6 @@ static int check_tp(const struct atm_trafprm *tp)
         return 0;
 }
 
-
 static int check_qos(const struct atm_qos *qos)
 {
         int error;
@@ -672,9 +677,11 @@ static int check_qos(const struct atm_qos *qos)
         if (qos->txtp.traffic_class != qos->rxtp.traffic_class &&
             qos->txtp.traffic_class && qos->rxtp.traffic_class &&
             qos->txtp.traffic_class != ATM_ANYCLASS &&
-            qos->rxtp.traffic_class != ATM_ANYCLASS) return -EINVAL;
+            qos->rxtp.traffic_class != ATM_ANYCLASS)
+                return -EINVAL;
         error = check_tp(&qos->txtp);
-        if (error) return error;
+        if (error)
+                return error;
         return check_tp(&qos->rxtp);
 }
 
@@ -690,37 +697,41 @@ int vcc_setsockopt(struct socket *sock, int level, int optname,
 
         vcc = ATM_SD(sock);
         switch (optname) {
-                case SO_ATMQOS:
-                        {
-                                struct atm_qos qos;
-
-                                if (copy_from_user(&qos,optval,sizeof(qos)))
-                                        return -EFAULT;
-                                error = check_qos(&qos);
-                                if (error) return error;
-                                if (sock->state == SS_CONNECTED)
-                                        return atm_change_qos(vcc,&qos);
-                                if (sock->state != SS_UNCONNECTED)
-                                        return -EBADFD;
-                                vcc->qos = qos;
-                                set_bit(ATM_VF_HASQOS,&vcc->flags);
-                                return 0;
-                        }
-                case SO_SETCLP:
-                        if (get_user(value,(unsigned long __user *)optval))
-                                return -EFAULT;
-                        if (value) vcc->atm_options |= ATM_ATMOPT_CLP;
-                        else vcc->atm_options &= ~ATM_ATMOPT_CLP;
-                        return 0;
-                default:
-                        if (level == SOL_SOCKET) return -EINVAL;
-                        break;
+        case SO_ATMQOS:
+        {
+                struct atm_qos qos;
+
+                if (copy_from_user(&qos, optval, sizeof(qos)))
+                        return -EFAULT;
+                error = check_qos(&qos);
+                if (error)
+                        return error;
+                if (sock->state == SS_CONNECTED)
+                        return atm_change_qos(vcc, &qos);
+                if (sock->state != SS_UNCONNECTED)
+                        return -EBADFD;
+                vcc->qos = qos;
+                set_bit(ATM_VF_HASQOS, &vcc->flags);
+                return 0;
         }
-        if (!vcc->dev || !vcc->dev->ops->setsockopt) return -EINVAL;
-        return vcc->dev->ops->setsockopt(vcc,level,optname,optval,optlen);
+        case SO_SETCLP:
+                if (get_user(value, (unsigned long __user *)optval))
+                        return -EFAULT;
+                if (value)
+                        vcc->atm_options |= ATM_ATMOPT_CLP;
+                else
+                        vcc->atm_options &= ~ATM_ATMOPT_CLP;
+                return 0;
+        default:
+                if (level == SOL_SOCKET)
+                        return -EINVAL;
+                break;
+        }
+        if (!vcc->dev || !vcc->dev->ops->setsockopt)
+                return -EINVAL;
+        return vcc->dev->ops->setsockopt(vcc, level, optname, optval, optlen);
 }
 
-
 int vcc_getsockopt(struct socket *sock, int level, int optname,
                    char __user *optval, int __user *optlen)
 {
@@ -734,33 +745,33 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
 
         vcc = ATM_SD(sock);
         switch (optname) {
-                case SO_ATMQOS:
-                        if (!test_bit(ATM_VF_HASQOS,&vcc->flags))
-                                return -EINVAL;
-                        return copy_to_user(optval,&vcc->qos,sizeof(vcc->qos)) ?
-                            -EFAULT : 0;
-                case SO_SETCLP:
-                        return put_user(vcc->atm_options & ATM_ATMOPT_CLP ? 1 :
-                          0,(unsigned long __user *)optval) ? -EFAULT : 0;
-                case SO_ATMPVC:
-                        {
-                                struct sockaddr_atmpvc pvc;
-
-                                if (!vcc->dev ||
-                                    !test_bit(ATM_VF_ADDR,&vcc->flags))
-                                        return -ENOTCONN;
-                                pvc.sap_family = AF_ATMPVC;
-                                pvc.sap_addr.itf = vcc->dev->number;
-                                pvc.sap_addr.vpi = vcc->vpi;
-                                pvc.sap_addr.vci = vcc->vci;
-                                return copy_to_user(optval,&pvc,sizeof(pvc)) ?
-                                    -EFAULT : 0;
-                        }
-                default:
-                        if (level == SOL_SOCKET) return -EINVAL;
+        case SO_ATMQOS:
+                if (!test_bit(ATM_VF_HASQOS, &vcc->flags))
+                        return -EINVAL;
+                return copy_to_user(optval, &vcc->qos, sizeof(vcc->qos))
+                        ? -EFAULT : 0;
+        case SO_SETCLP:
+                return put_user(vcc->atm_options & ATM_ATMOPT_CLP ? 1 : 0,
+                                (unsigned long __user *)optval) ? -EFAULT : 0;
+        case SO_ATMPVC:
+        {
+                struct sockaddr_atmpvc pvc;
+
+                if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
+                        return -ENOTCONN;
+                pvc.sap_family = AF_ATMPVC;
+                pvc.sap_addr.itf = vcc->dev->number;
+                pvc.sap_addr.vpi = vcc->vpi;
+                pvc.sap_addr.vci = vcc->vci;
+                return copy_to_user(optval, &pvc, sizeof(pvc)) ? -EFAULT : 0;
+        }
+        default:
+                if (level == SOL_SOCKET)
+                        return -EINVAL;
                         break;
         }
-        if (!vcc->dev || !vcc->dev->ops->getsockopt) return -EINVAL;
+        if (!vcc->dev || !vcc->dev->ops->getsockopt)
+                return -EINVAL;
         return vcc->dev->ops->getsockopt(vcc, level, optname, optval, len);
 }
 
@@ -768,23 +779,27 @@ static int __init atm_init(void)
 {
         int error;
 
-        if ((error = proto_register(&vcc_proto, 0)) < 0)
+        error = proto_register(&vcc_proto, 0);
+        if (error < 0)
                 goto out;
-
-        if ((error = atmpvc_init()) < 0) {
-                printk(KERN_ERR "atmpvc_init() failed with %d\n", error);
+        error = atmpvc_init();
+        if (error < 0) {
+                pr_err("atmpvc_init() failed with %d\n", error);
                 goto out_unregister_vcc_proto;
         }
-        if ((error = atmsvc_init()) < 0) {
-                printk(KERN_ERR "atmsvc_init() failed with %d\n", error);
+        error = atmsvc_init();
+        if (error < 0) {
+                pr_err("atmsvc_init() failed with %d\n", error);
                 goto out_atmpvc_exit;
         }
-        if ((error = atm_proc_init()) < 0) {
-                printk(KERN_ERR "atm_proc_init() failed with %d\n",error);
+        error = atm_proc_init();
+        if (error < 0) {
+                pr_err("atm_proc_init() failed with %d\n", error);
                 goto out_atmsvc_exit;
         }
-        if ((error = atm_sysfs_init()) < 0) {
-                printk(KERN_ERR "atm_sysfs_init() failed with %d\n",error);
+        error = atm_sysfs_init();
+        if (error < 0) {
+                pr_err("atm_sysfs_init() failed with %d\n", error);
                 goto out_atmproc_exit;
         }
 out:
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 4da8892ced5f..62dc8bfe6fe7 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -3,6 +3,7 @@
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 /* 2003 John Levon  <levon@movementarian.org> */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/module.h>
 #include <linux/kmod.h>
@@ -36,6 +37,7 @@ void register_atm_ioctl(struct atm_ioctl *ioctl)
         list_add_tail(&ioctl->list, &ioctl_list);
         mutex_unlock(&ioctl_mutex);
 }
+EXPORT_SYMBOL(register_atm_ioctl);
 
 void deregister_atm_ioctl(struct atm_ioctl *ioctl)
 {
@@ -43,129 +45,128 @@ void deregister_atm_ioctl(struct atm_ioctl *ioctl)
         list_del(&ioctl->list);
         mutex_unlock(&ioctl_mutex);
 }
-
-EXPORT_SYMBOL(register_atm_ioctl);
 EXPORT_SYMBOL(deregister_atm_ioctl);
 
-static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg, int compat)
+static int do_vcc_ioctl(struct socket *sock, unsigned int cmd,
+                        unsigned long arg, int compat)
 {
         struct sock *sk = sock->sk;
         struct atm_vcc *vcc;
         int error;
-        struct list_head * pos;
+        struct list_head *pos;
         void __user *argp = (void __user *)arg;
 
         vcc = ATM_SD(sock);
         switch (cmd) {
-                case SIOCOUTQ:
-                        if (sock->state != SS_CONNECTED ||
-                            !test_bit(ATM_VF_READY, &vcc->flags)) {
-                                error =  -EINVAL;
-                                goto done;
-                        }
-                        error = put_user(sk->sk_sndbuf - sk_wmem_alloc_get(sk),
-                                         (int __user *) argp) ? -EFAULT : 0;
+        case SIOCOUTQ:
+                if (sock->state != SS_CONNECTED ||
+                    !test_bit(ATM_VF_READY, &vcc->flags)) {
+                        error =  -EINVAL;
+                        goto done;
+                }
+                error = put_user(sk->sk_sndbuf - sk_wmem_alloc_get(sk),
+                                 (int __user *)argp) ? -EFAULT : 0;
+                goto done;
+        case SIOCINQ:
+        {
+                struct sk_buff *skb;
+
+                if (sock->state != SS_CONNECTED) {
+                        error = -EINVAL;
                         goto done;
-                case SIOCINQ:
-                        {
-                                struct sk_buff *skb;
-
-                                if (sock->state != SS_CONNECTED) {
-                                        error = -EINVAL;
-                                        goto done;
-                                }
-                                skb = skb_peek(&sk->sk_receive_queue);
-                                error = put_user(skb ? skb->len : 0,
-                                                 (int __user *)argp) ? -EFAULT : 0;
-                                goto done;
-                        }
-                case SIOCGSTAMP: /* borrowed from IP */
+                }
+                skb = skb_peek(&sk->sk_receive_queue);
+                error = put_user(skb ? skb->len : 0,
+                                 (int __user *)argp) ? -EFAULT : 0;
+                goto done;
+        }
+        case SIOCGSTAMP: /* borrowed from IP */
 #ifdef CONFIG_COMPAT
-                        if (compat)
-                                error = compat_sock_get_timestamp(sk, argp);
-                        else
+                if (compat)
+                        error = compat_sock_get_timestamp(sk, argp);
+                else
 #endif
-                                error = sock_get_timestamp(sk, argp);
-                        goto done;
-                case SIOCGSTAMPNS: /* borrowed from IP */
+                        error = sock_get_timestamp(sk, argp);
+                goto done;
+        case SIOCGSTAMPNS: /* borrowed from IP */
 #ifdef CONFIG_COMPAT
-                        if (compat)
-                                error = compat_sock_get_timestampns(sk, argp);
-                        else
+                if (compat)
+                        error = compat_sock_get_timestampns(sk, argp);
+                else
 #endif
-                                error = sock_get_timestampns(sk, argp);
+                        error = sock_get_timestampns(sk, argp);
+                goto done;
+        case ATM_SETSC:
+                if (net_ratelimit())
+                        pr_warning("ATM_SETSC is obsolete; used by %s:%d\n",
+                                   current->comm, task_pid_nr(current));
+                error = 0;
+                goto done;
+        case ATMSIGD_CTRL:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
                         goto done;
-                case ATM_SETSC:
-                        if (net_ratelimit())
-                                printk(KERN_WARNING "ATM_SETSC is obsolete; used by %s:%d\n",
-                                       current->comm, task_pid_nr(current));
-                        error = 0;
+                }
+                /*
+                 * The user/kernel protocol for exchanging signalling
+                 * info uses kernel pointers as opaque references,
+                 * so the holder of the file descriptor can scribble
+                 * on the kernel... so we should make sure that we
+                 * have the same privileges that /proc/kcore needs
+                 */
+                if (!capable(CAP_SYS_RAWIO)) {
+                        error = -EPERM;
                         goto done;
-                case ATMSIGD_CTRL:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        /*
-                         * The user/kernel protocol for exchanging signalling
-                         * info uses kernel pointers as opaque references,
-                         * so the holder of the file descriptor can scribble
-                         * on the kernel... so we should make sure that we
-                         * have the same privileges that /proc/kcore needs
-                         */
-                        if (!capable(CAP_SYS_RAWIO)) {
-                                error = -EPERM;
-                                goto done;
-                        }
+                }
 #ifdef CONFIG_COMPAT
-                        /* WTF? I don't even want to _think_ about making this
-                           work for 32-bit userspace. TBH I don't really want
-                           to think about it at all. dwmw2. */
-                        if (compat) {
-                                if (net_ratelimit())
-                                        printk(KERN_WARNING "32-bit task cannot be atmsigd\n");
-                                error = -EINVAL;
-                                goto done;
-                        }
+                /* WTF? I don't even want to _think_ about making this
+                   work for 32-bit userspace. TBH I don't really want
+                   to think about it at all. dwmw2. */
+                if (compat) {
+                        if (net_ratelimit())
+                                pr_warning("32-bit task cannot be atmsigd\n");
+                        error = -EINVAL;
+                        goto done;
+                }
 #endif
-                        error = sigd_attach(vcc);
-                        if (!error)
-                                sock->state = SS_CONNECTED;
+                error = sigd_attach(vcc);
+                if (!error)
+                        sock->state = SS_CONNECTED;
+                goto done;
+        case ATM_SETBACKEND:
+        case ATM_NEWBACKENDIF:
+        {
+                atm_backend_t backend;
+                error = get_user(backend, (atm_backend_t __user *)argp);
+                if (error)
                         goto done;
-                case ATM_SETBACKEND:
-                case ATM_NEWBACKENDIF:
-                        {
-                                atm_backend_t backend;
-                                error = get_user(backend, (atm_backend_t __user *) argp);
-                                if (error)
-                                        goto done;
-                                switch (backend) {
-                                        case ATM_BACKEND_PPP:
-                                                request_module("pppoatm");
-                                                break;
-                                        case ATM_BACKEND_BR2684:
-                                                request_module("br2684");
-                                                break;
-                                }
-                        }
-                        break;
-                case ATMMPC_CTRL:
-                case ATMMPC_DATA:
-                        request_module("mpoa");
+                switch (backend) {
+                case ATM_BACKEND_PPP:
+                        request_module("pppoatm");
                         break;
-                case ATMARPD_CTRL:
-                        request_module("clip");
-                        break;
-                case ATMLEC_CTRL:
-                        request_module("lec");
+                case ATM_BACKEND_BR2684:
+                        request_module("br2684");
                         break;
+                }
+                break;
+        }
+        case ATMMPC_CTRL:
+        case ATMMPC_DATA:
+                request_module("mpoa");
+                break;
+        case ATMARPD_CTRL:
+                request_module("clip");
+                break;
+        case ATMLEC_CTRL:
+                request_module("lec");
+                break;
         }
 
         error = -ENOIOCTLCMD;
 
         mutex_lock(&ioctl_mutex);
         list_for_each(pos, &ioctl_list) {
-                struct atm_ioctl * ic = list_entry(pos, struct atm_ioctl, list);
+                struct atm_ioctl *ic = list_entry(pos, struct atm_ioctl, list);
                 if (try_module_get(ic->owner)) {
                         error = ic->ioctl(sock, cmd, arg);
                         module_put(ic->owner);
@@ -184,15 +185,187 @@ done:
         return error;
 }
 
-
 int vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         return do_vcc_ioctl(sock, cmd, arg, 0);
 }
 
 #ifdef CONFIG_COMPAT
-int vcc_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+/*
+ * FIXME:
+ * The compat_ioctl handling is duplicated, using both these conversion
+ * routines and the compat argument to the actual handlers. Both
+ * versions are somewhat incomplete and should be merged, e.g. by
+ * moving the ioctl number translation into the actual handlers and
+ * killing the conversion code.
+ *
+ * -arnd, November 2009
+ */
+#define ATM_GETLINKRATE32 _IOW('a', ATMIOC_ITF+1, struct compat_atmif_sioc)
+#define ATM_GETNAMES32    _IOW('a', ATMIOC_ITF+3, struct compat_atm_iobuf)
+#define ATM_GETTYPE32     _IOW('a', ATMIOC_ITF+4, struct compat_atmif_sioc)
+#define ATM_GETESI32      _IOW('a', ATMIOC_ITF+5, struct compat_atmif_sioc)
+#define ATM_GETADDR32     _IOW('a', ATMIOC_ITF+6, struct compat_atmif_sioc)
+#define ATM_RSTADDR32     _IOW('a', ATMIOC_ITF+7, struct compat_atmif_sioc)
+#define ATM_ADDADDR32     _IOW('a', ATMIOC_ITF+8, struct compat_atmif_sioc)
+#define ATM_DELADDR32     _IOW('a', ATMIOC_ITF+9, struct compat_atmif_sioc)
+#define ATM_GETCIRANGE32  _IOW('a', ATMIOC_ITF+10, struct compat_atmif_sioc)
+#define ATM_SETCIRANGE32  _IOW('a', ATMIOC_ITF+11, struct compat_atmif_sioc)
+#define ATM_SETESI32      _IOW('a', ATMIOC_ITF+12, struct compat_atmif_sioc)
+#define ATM_SETESIF32     _IOW('a', ATMIOC_ITF+13, struct compat_atmif_sioc)
+#define ATM_GETSTAT32     _IOW('a', ATMIOC_SARCOM+0, struct compat_atmif_sioc)
+#define ATM_GETSTATZ32    _IOW('a', ATMIOC_SARCOM+1, struct compat_atmif_sioc)
+#define ATM_GETLOOP32     _IOW('a', ATMIOC_SARCOM+2, struct compat_atmif_sioc)
+#define ATM_SETLOOP32     _IOW('a', ATMIOC_SARCOM+3, struct compat_atmif_sioc)
+#define ATM_QUERYLOOP32   _IOW('a', ATMIOC_SARCOM+4, struct compat_atmif_sioc)
+
+static struct {
+        unsigned int cmd32;
+        unsigned int cmd;
+} atm_ioctl_map[] = {
+        { ATM_GETLINKRATE32, ATM_GETLINKRATE },
+        { ATM_GETNAMES32,    ATM_GETNAMES },
+        { ATM_GETTYPE32,     ATM_GETTYPE },
+        { ATM_GETESI32,      ATM_GETESI },
+        { ATM_GETADDR32,     ATM_GETADDR },
+        { ATM_RSTADDR32,     ATM_RSTADDR },
+        { ATM_ADDADDR32,     ATM_ADDADDR },
+        { ATM_DELADDR32,     ATM_DELADDR },
+        { ATM_GETCIRANGE32,  ATM_GETCIRANGE },
+        { ATM_SETCIRANGE32,  ATM_SETCIRANGE },
+        { ATM_SETESI32,      ATM_SETESI },
+        { ATM_SETESIF32,     ATM_SETESIF },
+        { ATM_GETSTAT32,     ATM_GETSTAT },
+        { ATM_GETSTATZ32,    ATM_GETSTATZ },
+        { ATM_GETLOOP32,     ATM_GETLOOP },
+        { ATM_SETLOOP32,     ATM_SETLOOP },
+        { ATM_QUERYLOOP32,   ATM_QUERYLOOP },
+};
+
+#define NR_ATM_IOCTL ARRAY_SIZE(atm_ioctl_map)
+
+static int do_atm_iobuf(struct socket *sock, unsigned int cmd,
+                        unsigned long arg)
+{
+        struct atm_iobuf __user *iobuf;
+        struct compat_atm_iobuf __user *iobuf32;
+        u32 data;
+        void __user *datap;
+        int len, err;
+
+        iobuf = compat_alloc_user_space(sizeof(*iobuf));
+        iobuf32 = compat_ptr(arg);
+
+        if (get_user(len, &iobuf32->length) ||
+            get_user(data, &iobuf32->buffer))
+                return -EFAULT;
+        datap = compat_ptr(data);
+        if (put_user(len, &iobuf->length) ||
+            put_user(datap, &iobuf->buffer))
+                return -EFAULT;
+
+        err = do_vcc_ioctl(sock, cmd, (unsigned long) iobuf, 0);
+
+        if (!err) {
+                if (copy_in_user(&iobuf32->length, &iobuf->length,
+                                 sizeof(int)))
+                        err = -EFAULT;
+        }
+
+        return err;
+}
+
+static int do_atmif_sioc(struct socket *sock, unsigned int cmd,
+                         unsigned long arg)
+{
+        struct atmif_sioc __user *sioc;
+        struct compat_atmif_sioc __user *sioc32;
+        u32 data;
+        void __user *datap;
+        int err;
+
+        sioc = compat_alloc_user_space(sizeof(*sioc));
+        sioc32 = compat_ptr(arg);
+
+        if (copy_in_user(&sioc->number, &sioc32->number, 2 * sizeof(int)) ||
+            get_user(data, &sioc32->arg))
+                return -EFAULT;
+        datap = compat_ptr(data);
+        if (put_user(datap, &sioc->arg))
+                return -EFAULT;
+
+        err = do_vcc_ioctl(sock, cmd, (unsigned long) sioc, 0);
+
+        if (!err) {
+                if (copy_in_user(&sioc32->length, &sioc->length,
+                                 sizeof(int)))
+                        err = -EFAULT;
+        }
+        return err;
+}
+
+static int do_atm_ioctl(struct socket *sock, unsigned int cmd32,
+                        unsigned long arg)
 {
-        return do_vcc_ioctl(sock, cmd, arg, 1);
+        int i;
+        unsigned int cmd = 0;
+
+        switch (cmd32) {
+        case SONET_GETSTAT:
+        case SONET_GETSTATZ:
+        case SONET_GETDIAG:
+        case SONET_SETDIAG:
+        case SONET_CLRDIAG:
+        case SONET_SETFRAMING:
+        case SONET_GETFRAMING:
+        case SONET_GETFRSENSE:
+                return do_atmif_sioc(sock, cmd32, arg);
+        }
+
+        for (i = 0; i < NR_ATM_IOCTL; i++) {
+                if (cmd32 == atm_ioctl_map[i].cmd32) {
+                        cmd = atm_ioctl_map[i].cmd;
+                        break;
+                }
+        }
+        if (i == NR_ATM_IOCTL)
+                return -EINVAL;
+
+        switch (cmd) {
+        case ATM_GETNAMES:
+                return do_atm_iobuf(sock, cmd, arg);
+
+        case ATM_GETLINKRATE:
+        case ATM_GETTYPE:
+        case ATM_GETESI:
+        case ATM_GETADDR:
+        case ATM_RSTADDR:
+        case ATM_ADDADDR:
+        case ATM_DELADDR:
+        case ATM_GETCIRANGE:
+        case ATM_SETCIRANGE:
+        case ATM_SETESI:
+        case ATM_SETESIF:
+        case ATM_GETSTAT:
+        case ATM_GETSTATZ:
+        case ATM_GETLOOP:
+        case ATM_SETLOOP:
+        case ATM_QUERYLOOP:
+                return do_atmif_sioc(sock, cmd, arg);
+        }
+
+        return -EINVAL;
+}
+
+int vcc_compat_ioctl(struct socket *sock, unsigned int cmd,
+                     unsigned long arg)
+{
+        int ret;
+
+        ret = do_vcc_ioctl(sock, cmd, arg, 1);
+        if (ret != -ENOIOCTLCMD)
+                return ret;
+
+        return do_atm_ioctl(sock, cmd, arg);
 }
 #endif
diff --git a/net/atm/lec.c b/net/atm/lec.c
index b2d644560323..feeaf5718472 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -4,6 +4,9 @@
  * Marko Kiiskila <mkiiskila@yahoo.com>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/bitops.h>
 #include <linux/capability.h>
@@ -16,7 +19,7 @@
 #include <linux/skbuff.h>
 #include <linux/ip.h>
 #include <asm/byteorder.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <net/arp.h>
 #include <net/dst.h>
 #include <linux/proc_fs.h>
@@ -62,7 +65,6 @@ static int lec_open(struct net_device *dev);
 static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
                                   struct net_device *dev);
 static int lec_close(struct net_device *dev);
-static void lec_init(struct net_device *dev);
 static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
                                           const unsigned char *mac_addr);
 static int lec_arp_remove(struct lec_priv *priv,
@@ -86,17 +88,19 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                                        int is_rdesc,
                                        struct lec_arp_table **ret_entry);
 static void lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
-                           const unsigned char *atm_addr, unsigned long remoteflag,
+                           const unsigned char *atm_addr,
+                           unsigned long remoteflag,
                            unsigned int targetless_le_arp);
 static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id);
 static int lec_mcast_make(struct lec_priv *priv, struct atm_vcc *vcc);
 static void lec_set_flush_tran_id(struct lec_priv *priv,
                                   const unsigned char *atm_addr,
                                   unsigned long tran_id);
-static void lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
+static void lec_vcc_added(struct lec_priv *priv,
+                          const struct atmlec_ioc *ioc_data,
                           struct atm_vcc *vcc,
-                          void (*old_push) (struct atm_vcc *vcc,
-                                            struct sk_buff *skb));
+                          void (*old_push)(struct atm_vcc *vcc,
+                                           struct sk_buff *skb));
 static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc);
 
 /* must be done under lec_arp_lock */
@@ -111,7 +115,6 @@ static inline void lec_arp_put(struct lec_arp_table *entry)
                 kfree(entry);
 }
 
-
 static struct lane2_ops lane2_ops = {
         lane2_resolve,          /* resolve,             spec 3.1.3 */
         lane2_associate_req,    /* associate_req,       spec 3.1.4 */
@@ -149,7 +152,8 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
                 mesg = (struct atmlec_msg *)skb2->data;
                 mesg->type = l_topology_change;
                 buff += 4;
-                mesg->content.normal.flag = *buff & 0x01;       /* 0x01 is topology change */
+                mesg->content.normal.flag = *buff & 0x01;
+                                        /* 0x01 is topology change */
 
                 priv = netdev_priv(dev);
                 atm_force_charge(priv->lecd, skb2->truesize);
@@ -243,7 +247,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
 
 static void lec_tx_timeout(struct net_device *dev)
 {
-        printk(KERN_INFO "%s: tx timeout\n", dev->name);
+        pr_info("%s\n", dev->name);
         dev->trans_start = jiffies;
         netif_wake_queue(dev);
 }
@@ -262,14 +266,10 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         unsigned char rdesc[ETH_ALEN];  /* Token Ring route descriptor */
 #endif
         int is_rdesc;
-#if DUMP_PACKETS > 0
-        char buf[300];
-        int i = 0;
-#endif /* DUMP_PACKETS >0 */
 
-        pr_debug("lec_start_xmit called\n");
+        pr_debug("called\n");
         if (!priv->lecd) {
-                printk("%s:No lecd attached\n", dev->name);
+                pr_info("%s:No lecd attached\n", dev->name);
                 dev->stats.tx_errors++;
                 netif_stop_queue(dev);
                 kfree_skb(skb);
@@ -277,8 +277,8 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         }
 
         pr_debug("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
-                (long)skb->head, (long)skb->data, (long)skb_tail_pointer(skb),
-                (long)skb_end_pointer(skb));
+                 (long)skb->head, (long)skb->data, (long)skb_tail_pointer(skb),
+                 (long)skb_end_pointer(skb));
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
         if (memcmp(skb->data, bridge_ula_lec, sizeof(bridge_ula_lec)) == 0)
                 lec_handle_bridge(skb, dev);
@@ -286,8 +286,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
 
         /* Make sure we have room for lec_id */
         if (skb_headroom(skb) < 2) {
-
-                pr_debug("lec_start_xmit: reallocating skb\n");
+                pr_debug("reallocating skb\n");
                 skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
                 kfree_skb(skb);
                 if (skb2 == NULL)
@@ -314,23 +313,17 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         }
 #endif
 
-#if DUMP_PACKETS > 0
-        printk("%s: send datalen:%ld lecid:%4.4x\n", dev->name,
-               skb->len, priv->lecid);
 #if DUMP_PACKETS >= 2
-        for (i = 0; i < skb->len && i < 99; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
+#define MAX_DUMP_SKB 99
 #elif DUMP_PACKETS >= 1
-        for (i = 0; i < skb->len && i < 30; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
+#define MAX_DUMP_SKB 30
+#endif
+#if DUMP_PACKETS >= 1
+        printk(KERN_DEBUG "%s: send datalen:%ld lecid:%4.4x\n",
+               dev->name, skb->len, priv->lecid);
+        print_hex_dump(KERN_DEBUG, "", DUMP_OFFSET, 16, 1,
+                       skb->data, min(skb->len, MAX_DUMP_SKB), true);
 #endif /* DUMP_PACKETS >= 1 */
-        if (i == skb->len)
-                printk("%s\n", buf);
-        else
-                printk("%s...\n", buf);
-#endif /* DUMP_PACKETS > 0 */
 
         /* Minimum ethernet-frame size */
 #ifdef CONFIG_TR
@@ -368,31 +361,28 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
 #endif
         entry = NULL;
         vcc = lec_arp_resolve(priv, dst, is_rdesc, &entry);
-        pr_debug("%s:vcc:%p vcc_flags:%lx, entry:%p\n", dev->name,
-                vcc, vcc ? vcc->flags : 0, entry);
+        pr_debug("%s:vcc:%p vcc_flags:%lx, entry:%p\n",
+                 dev->name, vcc, vcc ? vcc->flags : 0, entry);
         if (!vcc || !test_bit(ATM_VF_READY, &vcc->flags)) {
                 if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
-                        pr_debug("%s:lec_start_xmit: queuing packet, ",
-                                dev->name);
-                        pr_debug("MAC address %pM\n", lec_h->h_dest);
+                        pr_debug("%s:queuing packet, MAC address %pM\n",
+                                 dev->name, lec_h->h_dest);
                         skb_queue_tail(&entry->tx_wait, skb);
                 } else {
-                        pr_debug
-                            ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
-                             dev->name);
-                        pr_debug("MAC address %pM\n", lec_h->h_dest);
+                        pr_debug("%s:tx queue full or no arp entry, dropping, MAC address: %pM\n",
+                                 dev->name, lec_h->h_dest);
                         dev->stats.tx_dropped++;
                         dev_kfree_skb(skb);
                 }
                 goto out;
         }
 #if DUMP_PACKETS > 0
-        printk("%s:sending to vpi:%d vci:%d\n", dev->name, vcc->vpi, vcc->vci);
+        printk(KERN_DEBUG "%s:sending to vpi:%d vci:%d\n",
+               dev->name, vcc->vpi, vcc->vci);
 #endif /* DUMP_PACKETS > 0 */
 
         while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
-                pr_debug("lec.c: emptying tx queue, ");
-                pr_debug("MAC address %pM\n", lec_h->h_dest);
+                pr_debug("emptying tx queue, MAC address %pM\n", lec_h->h_dest);
                 lec_send(vcc, skb2);
         }
 
@@ -445,14 +435,12 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
         pr_debug("%s: msg from zeppelin:%d\n", dev->name, mesg->type);
         switch (mesg->type) {
         case l_set_mac_addr:
-                for (i = 0; i < 6; i++) {
+                for (i = 0; i < 6; i++)
                         dev->dev_addr[i] = mesg->content.normal.mac_addr[i];
-                }
                 break;
         case l_del_mac_addr:
-                for (i = 0; i < 6; i++) {
+                for (i = 0; i < 6; i++)
                         dev->dev_addr[i] = 0;
-                }
                 break;
         case l_addr_delete:
                 lec_addr_delete(priv, mesg->content.normal.atm_addr,
@@ -478,10 +466,10 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                                mesg->content.normal.atm_addr,
                                mesg->content.normal.flag,
                                mesg->content.normal.targetless_le_arp);
-                pr_debug("lec: in l_arp_update\n");
+                pr_debug("in l_arp_update\n");
                 if (mesg->sizeoftlvs != 0) {    /* LANE2 3.1.5 */
-                        pr_debug("lec: LANE2 3.1.5, got tlvs, size %d\n",
-                                mesg->sizeoftlvs);
+                        pr_debug("LANE2 3.1.5, got tlvs, size %d\n",
+                                 mesg->sizeoftlvs);
                         lane2_associate_ind(dev, mesg->content.normal.mac_addr,
                                             tmp, mesg->sizeoftlvs);
                 }
@@ -500,13 +488,14 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                 priv->flush_timeout = (mesg->content.config.flush_timeout * HZ);
                 priv->path_switching_delay =
                     (mesg->content.config.path_switching_delay * HZ);
-                priv->lane_version = mesg->content.config.lane_version; /* LANE2 */
+                priv->lane_version = mesg->content.config.lane_version;
+                                        /* LANE2 */
                 priv->lane2_ops = NULL;
                 if (priv->lane_version > 1)
                         priv->lane2_ops = &lane2_ops;
                 if (dev_set_mtu(dev, mesg->content.config.mtu))
-                        printk("%s: change_mtu to %d failed\n", dev->name,
-                               mesg->content.config.mtu);
+                        pr_info("%s: change_mtu to %d failed\n",
+                                dev->name, mesg->content.config.mtu);
                 priv->is_proxy = mesg->content.config.is_proxy;
                 break;
         case l_flush_tran_id:
@@ -519,40 +508,35 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                 break;
         case l_should_bridge:
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
-                {
-                        pr_debug("%s: bridge zeppelin asks about %pM\n",
-                                 dev->name, mesg->content.proxy.mac_addr);
+        {
+                pr_debug("%s: bridge zeppelin asks about %pM\n",
+                         dev->name, mesg->content.proxy.mac_addr);
 
-                        if (br_fdb_test_addr_hook == NULL)
-                                break;
+                if (br_fdb_test_addr_hook == NULL)
+                        break;
 
-                        if (br_fdb_test_addr_hook(dev,
-                                        mesg->content.proxy.mac_addr)) {
-                                /* hit from bridge table, send LE_ARP_RESPONSE */
-                                struct sk_buff *skb2;
-                                struct sock *sk;
-
-                                pr_debug
-                                    ("%s: entry found, responding to zeppelin\n",
-                                     dev->name);
-                                skb2 =
-                                    alloc_skb(sizeof(struct atmlec_msg),
-                                              GFP_ATOMIC);
-                                if (skb2 == NULL)
-                                        break;
-                                skb2->len = sizeof(struct atmlec_msg);
-                                skb_copy_to_linear_data(skb2, mesg,
-                                                        sizeof(*mesg));
-                                atm_force_charge(priv->lecd, skb2->truesize);
-                                sk = sk_atm(priv->lecd);
-                                skb_queue_tail(&sk->sk_receive_queue, skb2);
-                                sk->sk_data_ready(sk, skb2->len);
-                        }
+                if (br_fdb_test_addr_hook(dev, mesg->content.proxy.mac_addr)) {
+                        /* hit from bridge table, send LE_ARP_RESPONSE */
+                        struct sk_buff *skb2;
+                        struct sock *sk;
+
+                        pr_debug("%s: entry found, responding to zeppelin\n",
+                                 dev->name);
+                        skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
+                        if (skb2 == NULL)
+                                break;
+                        skb2->len = sizeof(struct atmlec_msg);
+                        skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
+                        atm_force_charge(priv->lecd, skb2->truesize);
+                        sk = sk_atm(priv->lecd);
+                        skb_queue_tail(&sk->sk_receive_queue, skb2);
+                        sk->sk_data_ready(sk, skb2->len);
                 }
+        }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
                 break;
         default:
-                printk("%s: Unknown message type %d\n", dev->name, mesg->type);
+                pr_info("%s: Unknown message type %d\n", dev->name, mesg->type);
                 dev_kfree_skb(skb);
                 return -EINVAL;
         }
@@ -573,14 +557,13 @@ static void lec_atm_close(struct atm_vcc *vcc)
         lec_arp_destroy(priv);
 
         if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
-                printk("%s lec_atm_close: closing with messages pending\n",
-                       dev->name);
-        while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue)) != NULL) {
+                pr_info("%s closing with messages pending\n", dev->name);
+        while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) {
                 atm_return(vcc, skb->truesize);
                 dev_kfree_skb(skb);
         }
 
-        printk("%s: Shut down!\n", dev->name);
+        pr_info("%s: Shut down!\n", dev->name);
         module_put(THIS_MODULE);
 }
 
@@ -609,9 +592,8 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
         struct sk_buff *skb;
         struct atmlec_msg *mesg;
 
-        if (!priv || !priv->lecd) {
+        if (!priv || !priv->lecd)
                 return -1;
-        }
         skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
         if (!skb)
                 return -1;
@@ -634,7 +616,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
         sk->sk_data_ready(sk, skb->len);
 
         if (data != NULL) {
-                pr_debug("lec: about to send %d bytes of data\n", data->len);
+                pr_debug("about to send %d bytes of data\n", data->len);
                 atm_force_charge(priv->lecd, data->truesize);
                 skb_queue_tail(&sk->sk_receive_queue, data);
                 sk->sk_data_ready(sk, skb->len);
@@ -670,13 +652,6 @@ static const struct net_device_ops lec_netdev_ops = {
         .ndo_set_multicast_list = lec_set_multicast_list,
 };
 
-
-static void lec_init(struct net_device *dev)
-{
-        dev->netdev_ops = &lec_netdev_ops;
-        printk("%s: Initialized!\n", dev->name);
-}
-
 static const unsigned char lec_ctrl_magic[] = {
         0xff,
         0x00,
@@ -699,36 +674,28 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
         struct net_device *dev = (struct net_device *)vcc->proto_data;
         struct lec_priv *priv = netdev_priv(dev);
 
-#if DUMP_PACKETS >0
-        int i = 0;
-        char buf[300];
-
-        printk("%s: lec_push vcc vpi:%d vci:%d\n", dev->name,
-               vcc->vpi, vcc->vci);
+#if DUMP_PACKETS > 0
+        printk(KERN_DEBUG "%s: vcc vpi:%d vci:%d\n",
+               dev->name, vcc->vpi, vcc->vci);
 #endif
         if (!skb) {
                 pr_debug("%s: null skb\n", dev->name);
                 lec_vcc_close(priv, vcc);
                 return;
         }
-#if DUMP_PACKETS > 0
-        printk("%s: rcv datalen:%ld lecid:%4.4x\n", dev->name,
-               skb->len, priv->lecid);
 #if DUMP_PACKETS >= 2
-        for (i = 0; i < skb->len && i < 99; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
+#define MAX_SKB_DUMP 99
 #elif DUMP_PACKETS >= 1
-        for (i = 0; i < skb->len && i < 30; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
-#endif /* DUMP_PACKETS >= 1 */
-        if (i == skb->len)
-                printk("%s\n", buf);
-        else
-                printk("%s...\n", buf);
+#define MAX_SKB_DUMP 30
+#endif
+#if DUMP_PACKETS > 0
+        printk(KERN_DEBUG "%s: rcv datalen:%ld lecid:%4.4x\n",
+               dev->name, skb->len, priv->lecid);
+        print_hex_dump(KERN_DEBUG, "", DUMP_OFFSET, 16, 1,
+                       skb->data, min(MAX_SKB_DUMP, skb->len), true);
 #endif /* DUMP_PACKETS > 0 */
-        if (memcmp(skb->data, lec_ctrl_magic, 4) == 0) {        /* Control frame, to daemon */
+        if (memcmp(skb->data, lec_ctrl_magic, 4) == 0) {
+                                /* Control frame, to daemon */
                 struct sock *sk = sk_atm(vcc);
 
                 pr_debug("%s: To daemon\n", dev->name);
@@ -786,9 +753,8 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                         dev_kfree_skb(skb);
                         return;
                 }
-                if (!hlist_empty(&priv->lec_arp_empty_ones)) {
+                if (!hlist_empty(&priv->lec_arp_empty_ones))
                         lec_arp_check_empties(priv, vcc, skb);
-                }
                 skb_pull(skb, 2);       /* skip lec_id */
 #ifdef CONFIG_TR
                 if (priv->is_trdev)
@@ -809,7 +775,7 @@ static void lec_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         struct net_device *dev = skb->dev;
 
         if (vpriv == NULL) {
-                printk("lec_pop(): vpriv = NULL!?!?!?\n");
+                pr_info("vpriv = NULL!?!?!?\n");
                 return;
         }
 
@@ -830,15 +796,13 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
         /* Lecd must be up in this case */
         bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc));
-        if (bytes_left != 0) {
-                printk
-                    ("lec: lec_vcc_attach, copy from user failed for %d bytes\n",
-                     bytes_left);
-        }
+        if (bytes_left != 0)
+                pr_info("copy from user failed for %d bytes\n", bytes_left);
         if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF ||
             !dev_lec[ioc_data.dev_num])
                 return -EINVAL;
-        if (!(vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL)))
+        vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL);
+        if (!vpriv)
                 return -ENOMEM;
         vpriv->xoff = 0;
         vpriv->old_pop = vcc->pop;
@@ -893,6 +857,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                         dev_lec[i] = alloc_etherdev(size);
                 if (!dev_lec[i])
                         return -ENOMEM;
+                dev_lec[i]->netdev_ops = &lec_netdev_ops;
                 snprintf(dev_lec[i]->name, IFNAMSIZ, "lec%d", i);
                 if (register_netdev(dev_lec[i])) {
                         free_netdev(dev_lec[i]);
@@ -901,7 +866,6 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
 
                 priv = netdev_priv(dev_lec[i]);
                 priv->is_trdev = is_trdev;
-                lec_init(dev_lec[i]);
         } else {
                 priv = netdev_priv(dev_lec[i]);
                 if (priv->lecd)
@@ -929,9 +893,8 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
         priv->flush_timeout = (4 * HZ);
         priv->path_switching_delay = (6 * HZ);
 
-        if (dev_lec[i]->flags & IFF_UP) {
+        if (dev_lec[i]->flags & IFF_UP)
                 netif_start_queue(dev_lec[i]);
-        }
         __module_get(THIS_MODULE);
         return i;
 }
@@ -1133,7 +1096,9 @@ static int lec_seq_show(struct seq_file *seq, void *v)
         else {
                 struct lec_state *state = seq->private;
                 struct net_device *dev = state->dev;
-                struct lec_arp_table *entry = hlist_entry(state->node, struct lec_arp_table, next);
+                struct lec_arp_table *entry = hlist_entry(state->node,
+                                                          struct lec_arp_table,
+                                                          next);
 
                 seq_printf(seq, "%s ", dev->name);
                 lec_info(seq, entry);
@@ -1207,13 +1172,13 @@ static int __init lane_module_init(void)
 
         p = proc_create("lec", S_IRUGO, atm_proc_root, &lec_seq_fops);
         if (!p) {
-                printk(KERN_ERR "Unable to initialize /proc/net/atm/lec\n");
+                pr_err("Unable to initialize /proc/net/atm/lec\n");
                 return -ENOMEM;
         }
 #endif
 
         register_atm_ioctl(&lane_ioctl_ops);
-        printk("lec.c: " __DATE__ " " __TIME__ " initialized\n");
+        pr_info("lec.c: " __DATE__ " " __TIME__ " initialized\n");
         return 0;
 }
 
@@ -1302,13 +1267,13 @@ static int lane2_associate_req(struct net_device *dev, const u8 *lan_dst,
         struct lec_priv *priv = netdev_priv(dev);
 
         if (compare_ether_addr(lan_dst, dev->dev_addr))
-                return (0);     /* not our mac address */
+                return 0;       /* not our mac address */
 
         kfree(priv->tlvs);      /* NULL if there was no previous association */
 
         priv->tlvs = kmemdup(tlvs, sizeoftlvs, GFP_KERNEL);
         if (priv->tlvs == NULL)
-                return (0);
+                return 0;
         priv->sizeoftlvs = sizeoftlvs;
 
         skb = alloc_skb(sizeoftlvs, GFP_ATOMIC);
@@ -1318,12 +1283,12 @@ static int lane2_associate_req(struct net_device *dev, const u8 *lan_dst,
         skb_copy_to_linear_data(skb, tlvs, sizeoftlvs);
         retval = send_to_lecd(priv, l_associate_req, NULL, NULL, skb);
         if (retval != 0)
-                printk("lec.c: lane2_associate_req() failed\n");
+                pr_info("lec.c: lane2_associate_req() failed\n");
         /*
          * If the previous association has changed we must
          * somehow notify other LANE entities about the change
          */
-        return (1);
+        return 1;
 }
 
 /*
@@ -1356,12 +1321,12 @@ static void lane2_associate_ind(struct net_device *dev, const u8 *mac_addr,
         entry->sizeoftlvs = sizeoftlvs;
 #endif
 #if 0
-        printk("lec.c: lane2_associate_ind()\n");
-        printk("dump of tlvs, sizeoftlvs=%d\n", sizeoftlvs);
+        pr_info("\n");
+        pr_info("dump of tlvs, sizeoftlvs=%d\n", sizeoftlvs);
         while (i < sizeoftlvs)
-                printk("%02x ", tlvs[i++]);
+                pr_cont("%02x ", tlvs[i++]);
 
-        printk("\n");
+        pr_cont("\n");
 #endif
 
         /* tell MPOA about the TLVs we saw */
@@ -1381,15 +1346,15 @@ static void lane2_associate_ind(struct net_device *dev, const u8 *mac_addr,
 
 #include <linux/types.h>
 #include <linux/timer.h>
-#include <asm/param.h>
+#include <linux/param.h>
 #include <asm/atomic.h>
 #include <linux/inetdevice.h>
 #include <net/route.h>
 
 #if 0
-#define pr_debug(format,args...)
+#define pr_debug(format, args...)
 /*
-#define pr_debug printk
+  #define pr_debug printk
 */
 #endif
 #define DEBUG_ARP_TABLE 0
@@ -1403,7 +1368,7 @@ static void lec_arp_expire_arp(unsigned long data);
  * Arp table funcs
  */
 
-#define HASH(ch) (ch & (LEC_ARP_TABLE_SIZE -1))
+#define HASH(ch) (ch & (LEC_ARP_TABLE_SIZE - 1))
 
 /*
  * Initialization of arp-cache
@@ -1412,9 +1377,8 @@ static void lec_arp_init(struct lec_priv *priv)
 {
         unsigned short i;
 
-        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
                 INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
-        }
         INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
         INIT_HLIST_HEAD(&priv->lec_no_forward);
         INIT_HLIST_HEAD(&priv->mcast_fwds);
@@ -1458,10 +1422,7 @@ lec_arp_add(struct lec_priv *priv, struct lec_arp_table *entry)
         tmp = &priv->lec_arp_tables[HASH(entry->mac_addr[ETH_ALEN - 1])];
         hlist_add_head(&entry->next, tmp);
 
-        pr_debug("LEC_ARP: Added entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                0xff & entry->mac_addr[0], 0xff & entry->mac_addr[1],
-                0xff & entry->mac_addr[2], 0xff & entry->mac_addr[3],
-                0xff & entry->mac_addr[4], 0xff & entry->mac_addr[5]);
+        pr_debug("Added entry:%pM\n", entry->mac_addr);
 }
 
 /*
@@ -1474,20 +1435,23 @@ lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
         struct lec_arp_table *entry;
         int i, remove_vcc = 1;
 
-        if (!to_remove) {
+        if (!to_remove)
                 return -1;
-        }
 
         hlist_del(&to_remove->next);
         del_timer(&to_remove->timer);
 
-        /* If this is the only MAC connected to this VCC, also tear down the VCC */
+        /*
+         * If this is the only MAC connected to this VCC,
+         * also tear down the VCC
+         */
         if (to_remove->status >= ESI_FLUSH_PENDING) {
                 /*
                  * ESI_FLUSH_PENDING, ESI_FORWARD_DIRECT
                  */
                 for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                        hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                        hlist_for_each_entry(entry, node,
+                                             &priv->lec_arp_tables[i], next) {
                                 if (memcmp(to_remove->atm_addr,
                                            entry->atm_addr, ATM_ESA_LEN) == 0) {
                                         remove_vcc = 0;
@@ -1500,10 +1464,7 @@ lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
         }
         skb_queue_purge(&to_remove->tx_wait);   /* FIXME: good place for this? */
 
-        pr_debug("LEC_ARP: Removed entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                0xff & to_remove->mac_addr[0], 0xff & to_remove->mac_addr[1],
-                0xff & to_remove->mac_addr[2], 0xff & to_remove->mac_addr[3],
-                0xff & to_remove->mac_addr[4], 0xff & to_remove->mac_addr[5]);
+        pr_debug("Removed entry:%pM\n", to_remove->mac_addr);
         return 0;
 }
 
@@ -1521,9 +1482,8 @@ static const char *get_status_string(unsigned char st)
                 return "ESI_FLUSH_PENDING";
         case ESI_FORWARD_DIRECT:
                 return "ESI_FORWARD_DIRECT";
-        default:
-                return "<UNKNOWN>";
         }
+        return "<UNKNOWN>";
 }
 
 static void dump_arp_table(struct lec_priv *priv)
@@ -1533,18 +1493,15 @@ static void dump_arp_table(struct lec_priv *priv)
         char buf[256];
         int i, j, offset;
 
-        printk("Dump %p:\n", priv);
+        pr_info("Dump %p:\n", priv);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(rulla, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(rulla, node,
+                                     &priv->lec_arp_tables[i], next) {
                         offset = 0;
                         offset += sprintf(buf, "%d: %p\n", i, rulla);
-                        offset += sprintf(buf + offset, "Mac:");
-                        for (j = 0; j < ETH_ALEN; j++) {
-                                offset += sprintf(buf + offset,
-                                                  "%2.2x ",
-                                                  rulla->mac_addr[j] & 0xff);
-                        }
-                        offset += sprintf(buf + offset, "Atm:");
+                        offset += sprintf(buf + offset, "Mac: %pM",
+                                          rulla->mac_addr);
+                        offset += sprintf(buf + offset, " Atm:");
                         for (j = 0; j < ATM_ESA_LEN; j++) {
                                 offset += sprintf(buf + offset,
                                                   "%2.2x ",
@@ -1564,20 +1521,16 @@ static void dump_arp_table(struct lec_priv *priv)
                                     "Flags:%x, Packets_flooded:%x, Status: %s ",
                                     rulla->flags, rulla->packets_flooded,
                                     get_status_string(rulla->status));
-                        printk("%s\n", buf);
+                        pr_info("%s\n", buf);
                 }
         }
 
         if (!hlist_empty(&priv->lec_no_forward))
-                printk("No forward\n");
+                pr_info("No forward\n");
         hlist_for_each_entry(rulla, node, &priv->lec_no_forward, next) {
                 offset = 0;
-                offset += sprintf(buf + offset, "Mac:");
-                for (j = 0; j < ETH_ALEN; j++) {
-                        offset += sprintf(buf + offset, "%2.2x ",
-                                          rulla->mac_addr[j] & 0xff);
-                }
-                offset += sprintf(buf + offset, "Atm:");
+                offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
+                offset += sprintf(buf + offset, " Atm:");
                 for (j = 0; j < ATM_ESA_LEN; j++) {
                         offset += sprintf(buf + offset, "%2.2x ",
                                           rulla->atm_addr[j] & 0xff);
@@ -1594,19 +1547,15 @@ static void dump_arp_table(struct lec_priv *priv)
                                   "Flags:%x, Packets_flooded:%x, Status: %s ",
                                   rulla->flags, rulla->packets_flooded,
                                   get_status_string(rulla->status));
-                printk("%s\n", buf);
+                pr_info("%s\n", buf);
         }
 
         if (!hlist_empty(&priv->lec_arp_empty_ones))
-                printk("Empty ones\n");
+                pr_info("Empty ones\n");
         hlist_for_each_entry(rulla, node, &priv->lec_arp_empty_ones, next) {
                 offset = 0;
-                offset += sprintf(buf + offset, "Mac:");
-                for (j = 0; j < ETH_ALEN; j++) {
-                        offset += sprintf(buf + offset, "%2.2x ",
-                                          rulla->mac_addr[j] & 0xff);
-                }
-                offset += sprintf(buf + offset, "Atm:");
+                offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
+                offset += sprintf(buf + offset, " Atm:");
                 for (j = 0; j < ATM_ESA_LEN; j++) {
                         offset += sprintf(buf + offset, "%2.2x ",
                                           rulla->atm_addr[j] & 0xff);
@@ -1623,19 +1572,15 @@ static void dump_arp_table(struct lec_priv *priv)
                                   "Flags:%x, Packets_flooded:%x, Status: %s ",
                                   rulla->flags, rulla->packets_flooded,
                                   get_status_string(rulla->status));
-                printk("%s", buf);
+                pr_info("%s", buf);
         }
 
         if (!hlist_empty(&priv->mcast_fwds))
-                printk("Multicast Forward VCCs\n");
+                pr_info("Multicast Forward VCCs\n");
         hlist_for_each_entry(rulla, node, &priv->mcast_fwds, next) {
                 offset = 0;
-                offset += sprintf(buf + offset, "Mac:");
-                for (j = 0; j < ETH_ALEN; j++) {
-                        offset += sprintf(buf + offset, "%2.2x ",
-                                          rulla->mac_addr[j] & 0xff);
-                }
-                offset += sprintf(buf + offset, "Atm:");
+                offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
+                offset += sprintf(buf + offset, " Atm:");
                 for (j = 0; j < ATM_ESA_LEN; j++) {
                         offset += sprintf(buf + offset, "%2.2x ",
                                           rulla->atm_addr[j] & 0xff);
@@ -1652,7 +1597,7 @@ static void dump_arp_table(struct lec_priv *priv)
                                   "Flags:%x, Packets_flooded:%x, Status: %s ",
                                   rulla->flags, rulla->packets_flooded,
                                   get_status_string(rulla->status));
-                printk("%s\n", buf);
+                pr_info("%s\n", buf);
         }
 
 }
@@ -1678,14 +1623,16 @@ static void lec_arp_destroy(struct lec_priv *priv)
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
                         lec_arp_remove(priv, entry);
                         lec_arp_put(entry);
                 }
                 INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_arp_empty_ones, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
                 hlist_del(&entry->next);
@@ -1693,7 +1640,8 @@ static void lec_arp_destroy(struct lec_priv *priv)
         }
         INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_no_forward, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_no_forward, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
                 hlist_del(&entry->next);
@@ -1722,15 +1670,12 @@ static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
         struct hlist_head *head;
         struct lec_arp_table *entry;
 
-        pr_debug("LEC_ARP: lec_arp_find :%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                mac_addr[0] & 0xff, mac_addr[1] & 0xff, mac_addr[2] & 0xff,
-                mac_addr[3] & 0xff, mac_addr[4] & 0xff, mac_addr[5] & 0xff);
+        pr_debug("%pM\n", mac_addr);
 
         head = &priv->lec_arp_tables[HASH(mac_addr[ETH_ALEN - 1])];
         hlist_for_each_entry(entry, node, head, next) {
-                if (!compare_ether_addr(mac_addr, entry->mac_addr)) {
+                if (!compare_ether_addr(mac_addr, entry->mac_addr))
                         return entry;
-                }
         }
         return NULL;
 }
@@ -1742,7 +1687,7 @@ static struct lec_arp_table *make_entry(struct lec_priv *priv,
 
         to_return = kzalloc(sizeof(struct lec_arp_table), GFP_ATOMIC);
         if (!to_return) {
-                printk("LEC: Arp entry kmalloc failed\n");
+                pr_info("LEC: Arp entry kmalloc failed\n");
                 return NULL;
         }
         memcpy(to_return->mac_addr, mac_addr, ETH_ALEN);
@@ -1763,7 +1708,7 @@ static void lec_arp_expire_arp(unsigned long data)
 
         entry = (struct lec_arp_table *)data;
 
-        pr_debug("lec_arp_expire_arp\n");
+        pr_debug("\n");
         if (entry->status == ESI_ARP_PENDING) {
                 if (entry->no_tries <= entry->priv->max_retry_count) {
                         if (entry->is_rdesc)
@@ -1787,10 +1732,10 @@ static void lec_arp_expire_vcc(unsigned long data)
 
         del_timer(&to_remove->timer);
 
-        pr_debug("LEC_ARP %p %p: lec_arp_expire_vcc vpi:%d vci:%d\n",
-                to_remove, priv,
-                to_remove->vcc ? to_remove->recv_vcc->vpi : 0,
-                to_remove->vcc ? to_remove->recv_vcc->vci : 0);
+        pr_debug("%p %p: vpi:%d vci:%d\n",
+                 to_remove, priv,
+                 to_remove->vcc ? to_remove->recv_vcc->vpi : 0,
+                 to_remove->vcc ? to_remove->recv_vcc->vci : 0);
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         hlist_del(&to_remove->next);
@@ -1800,6 +1745,50 @@ static void lec_arp_expire_vcc(unsigned long data)
         lec_arp_put(to_remove);
 }
 
+static bool __lec_arp_check_expire(struct lec_arp_table *entry,
+                                   unsigned long now,
+                                   struct lec_priv *priv)
+{
+        unsigned long time_to_check;
+
+        if ((entry->flags) & LEC_REMOTE_FLAG && priv->topology_change)
+                time_to_check = priv->forward_delay_time;
+        else
+                time_to_check = priv->aging_time;
+
+        pr_debug("About to expire: %lx - %lx > %lx\n",
+                 now, entry->last_used, time_to_check);
+        if (time_after(now, entry->last_used + time_to_check) &&
+            !(entry->flags & LEC_PERMANENT_FLAG) &&
+            !(entry->mac_addr[0] & 0x01)) {     /* LANE2: 7.1.20 */
+                /* Remove entry */
+                pr_debug("Entry timed out\n");
+                lec_arp_remove(priv, entry);
+                lec_arp_put(entry);
+        } else {
+                /* Something else */
+                if ((entry->status == ESI_VC_PENDING ||
+                     entry->status == ESI_ARP_PENDING) &&
+                    time_after_eq(now, entry->timestamp +
+                                       priv->max_unknown_frame_time)) {
+                        entry->timestamp = jiffies;
+                        entry->packets_flooded = 0;
+                        if (entry->status == ESI_VC_PENDING)
+                                send_to_lecd(priv, l_svc_setup,
+                                             entry->mac_addr,
+                                             entry->atm_addr,
+                                             NULL);
+                }
+                if (entry->status == ESI_FLUSH_PENDING &&
+                    time_after_eq(now, entry->timestamp +
+                                       priv->path_switching_delay)) {
+                        lec_arp_hold(entry);
+                        return true;
+                }
+        }
+
+        return false;
+}
 /*
  * Expire entries.
  * 1. Re-set timer
@@ -1824,62 +1813,28 @@ static void lec_arp_check_expire(struct work_struct *work)
         struct hlist_node *node, *next;
         struct lec_arp_table *entry;
         unsigned long now;
-        unsigned long time_to_check;
         int i;
 
-        pr_debug("lec_arp_check_expire %p\n", priv);
+        pr_debug("%p\n", priv);
         now = jiffies;
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
-                        if ((entry->flags) & LEC_REMOTE_FLAG &&
-                            priv->topology_change)
-                                time_to_check = priv->forward_delay_time;
-                        else
-                                time_to_check = priv->aging_time;
-
-                        pr_debug("About to expire: %lx - %lx > %lx\n",
-                                now, entry->last_used, time_to_check);
-                        if (time_after(now, entry->last_used + time_to_check)
-                            && !(entry->flags & LEC_PERMANENT_FLAG)
-                            && !(entry->mac_addr[0] & 0x01)) {  /* LANE2: 7.1.20 */
-                                /* Remove entry */
-                                pr_debug("LEC:Entry timed out\n");
-                                lec_arp_remove(priv, entry);
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
+                        if (__lec_arp_check_expire(entry, now, priv)) {
+                                struct sk_buff *skb;
+                                struct atm_vcc *vcc = entry->vcc;
+
+                                spin_unlock_irqrestore(&priv->lec_arp_lock,
+                                                       flags);
+                                while ((skb = skb_dequeue(&entry->tx_wait)))
+                                        lec_send(vcc, skb);
+                                entry->last_used = jiffies;
+                                entry->status = ESI_FORWARD_DIRECT;
                                 lec_arp_put(entry);
-                        } else {
-                                /* Something else */
-                                if ((entry->status == ESI_VC_PENDING ||
-                                     entry->status == ESI_ARP_PENDING)
-                                    && time_after_eq(now,
-                                                     entry->timestamp +
-                                                     priv->
-                                                     max_unknown_frame_time)) {
-                                        entry->timestamp = jiffies;
-                                        entry->packets_flooded = 0;
-                                        if (entry->status == ESI_VC_PENDING)
-                                                send_to_lecd(priv, l_svc_setup,
-                                                             entry->mac_addr,
-                                                             entry->atm_addr,
-                                                             NULL);
-                                }
-                                if (entry->status == ESI_FLUSH_PENDING
-                                    &&
-                                    time_after_eq(now, entry->timestamp +
-                                                  priv->path_switching_delay)) {
-                                        struct sk_buff *skb;
-                                        struct atm_vcc *vcc = entry->vcc;
-
-                                        lec_arp_hold(entry);
-                                        spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-                                        while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
-                                                lec_send(vcc, skb);
-                                        entry->last_used = jiffies;
-                                        entry->status = ESI_FORWARD_DIRECT;
-                                        lec_arp_put(entry);
-                                        goto restart;
-                                }
+
+                                goto restart;
                         }
                 }
         }
@@ -1893,7 +1848,8 @@ restart:
  *
  */
 static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
-                                       const unsigned char *mac_to_find, int is_rdesc,
+                                       const unsigned char *mac_to_find,
+                                       int is_rdesc,
                                        struct lec_arp_table **ret_entry)
 {
         unsigned long flags;
@@ -1929,9 +1885,8 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                  * If the LE_ARP cache entry is still pending, reset count to 0
                  * so another LE_ARP request can be made for this frame.
                  */
-                if (entry->status == ESI_ARP_PENDING) {
+                if (entry->status == ESI_ARP_PENDING)
                         entry->no_tries = 0;
-                }
                 /*
                  * Data direct VC not yet set up, check to see if the unknown
                  * frame count is greater than the limit. If the limit has
@@ -1942,7 +1897,7 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                     entry->packets_flooded <
                     priv->maximum_unknown_frame_count) {
                         entry->packets_flooded++;
-                        pr_debug("LEC_ARP: Flooding..\n");
+                        pr_debug("Flooding..\n");
                         found = priv->mcast_vcc;
                         goto out;
                 }
@@ -1953,13 +1908,13 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                  */
                 lec_arp_hold(entry);
                 *ret_entry = entry;
-                pr_debug("lec: entry->status %d entry->vcc %p\n", entry->status,
-                        entry->vcc);
+                pr_debug("entry->status %d entry->vcc %p\n", entry->status,
+                         entry->vcc);
                 found = NULL;
         } else {
                 /* No matching entry was found */
                 entry = make_entry(priv, mac_to_find);
-                pr_debug("LEC_ARP: Making entry\n");
+                pr_debug("Making entry\n");
                 if (!entry) {
                         found = priv->mcast_vcc;
                         goto out;
@@ -1996,13 +1951,14 @@ lec_addr_delete(struct lec_priv *priv, const unsigned char *atm_addr,
         struct lec_arp_table *entry;
         int i;
 
-        pr_debug("lec_addr_delete\n");
+        pr_debug("\n");
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
-                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)
-                            && (permanent ||
-                                !(entry->flags & LEC_PERMANENT_FLAG))) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
+                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN) &&
+                            (permanent ||
+                             !(entry->flags & LEC_PERMANENT_FLAG))) {
                                 lec_arp_remove(priv, entry);
                                 lec_arp_put(entry);
                         }
@@ -2027,10 +1983,8 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
         struct lec_arp_table *entry, *tmp;
         int i;
 
-        pr_debug("lec:%s", (targetless_le_arp) ? "targetless " : " ");
-        pr_debug("lec_arp_update mac:%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-                mac_addr[0], mac_addr[1], mac_addr[2], mac_addr[3],
-                mac_addr[4], mac_addr[5]);
+        pr_debug("%smac:%pM\n",
+                 (targetless_le_arp) ? "targetless " : "", mac_addr);
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         entry = lec_arp_find(priv, mac_addr);
@@ -2040,7 +1994,8 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
                                  * we have no entry in the cache. 7.1.30
                                  */
         if (!hlist_empty(&priv->lec_arp_empty_ones)) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_empty_ones, next) {
                         if (memcmp(entry->atm_addr, atm_addr, ATM_ESA_LEN) == 0) {
                                 hlist_del(&entry->next);
                                 del_timer(&entry->timer);
@@ -2084,7 +2039,8 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
         memcpy(entry->atm_addr, atm_addr, ATM_ESA_LEN);
         del_timer(&entry->timer);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(tmp, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(tmp, node,
+                                     &priv->lec_arp_tables[i], next) {
                         if (entry != tmp &&
                             !memcmp(tmp->atm_addr, atm_addr, ATM_ESA_LEN)) {
                                 /* Vcc to this host exists */
@@ -2129,14 +2085,13 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
         int i, found_entry = 0;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
+        /* Vcc for Multicast Forward. No timer, LANEv2 7.1.20 and 2.3.5.3 */
         if (ioc_data->receive == 2) {
-                /* Vcc for Multicast Forward. No timer, LANEv2 7.1.20 and 2.3.5.3 */
-
                 pr_debug("LEC_ARP: Attaching mcast forward\n");
 #if 0
                 entry = lec_arp_find(priv, bus_mac);
                 if (!entry) {
-                        printk("LEC_ARP: Multicast entry not found!\n");
+                        pr_info("LEC_ARP: Multicast entry not found!\n");
                         goto out;
                 }
                 memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
@@ -2157,19 +2112,17 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
                  * Vcc which we don't want to make default vcc,
                  * attach it anyway.
                  */
-                pr_debug
-                    ("LEC_ARP:Attaching data direct, not default: "
-                     "%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-                     ioc_data->atm_addr[0], ioc_data->atm_addr[1],
-                     ioc_data->atm_addr[2], ioc_data->atm_addr[3],
-                     ioc_data->atm_addr[4], ioc_data->atm_addr[5],
-                     ioc_data->atm_addr[6], ioc_data->atm_addr[7],
-                     ioc_data->atm_addr[8], ioc_data->atm_addr[9],
-                     ioc_data->atm_addr[10], ioc_data->atm_addr[11],
-                     ioc_data->atm_addr[12], ioc_data->atm_addr[13],
-                     ioc_data->atm_addr[14], ioc_data->atm_addr[15],
-                     ioc_data->atm_addr[16], ioc_data->atm_addr[17],
-                     ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
+                pr_debug("LEC_ARP:Attaching data direct, not default: %2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+                         ioc_data->atm_addr[0], ioc_data->atm_addr[1],
+                         ioc_data->atm_addr[2], ioc_data->atm_addr[3],
+                         ioc_data->atm_addr[4], ioc_data->atm_addr[5],
+                         ioc_data->atm_addr[6], ioc_data->atm_addr[7],
+                         ioc_data->atm_addr[8], ioc_data->atm_addr[9],
+                         ioc_data->atm_addr[10], ioc_data->atm_addr[11],
+                         ioc_data->atm_addr[12], ioc_data->atm_addr[13],
+                         ioc_data->atm_addr[14], ioc_data->atm_addr[15],
+                         ioc_data->atm_addr[16], ioc_data->atm_addr[17],
+                         ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
                 entry = make_entry(priv, bus_mac);
                 if (entry == NULL)
                         goto out;
@@ -2185,29 +2138,28 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
                 dump_arp_table(priv);
                 goto out;
         }
-        pr_debug
-            ("LEC_ARP:Attaching data direct, default: "
-             "%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-             ioc_data->atm_addr[0], ioc_data->atm_addr[1],
-             ioc_data->atm_addr[2], ioc_data->atm_addr[3],
-             ioc_data->atm_addr[4], ioc_data->atm_addr[5],
-             ioc_data->atm_addr[6], ioc_data->atm_addr[7],
-             ioc_data->atm_addr[8], ioc_data->atm_addr[9],
-             ioc_data->atm_addr[10], ioc_data->atm_addr[11],
-             ioc_data->atm_addr[12], ioc_data->atm_addr[13],
-             ioc_data->atm_addr[14], ioc_data->atm_addr[15],
-             ioc_data->atm_addr[16], ioc_data->atm_addr[17],
-             ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
+        pr_debug("LEC_ARP:Attaching data direct, default: %2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+                 ioc_data->atm_addr[0], ioc_data->atm_addr[1],
+                 ioc_data->atm_addr[2], ioc_data->atm_addr[3],
+                 ioc_data->atm_addr[4], ioc_data->atm_addr[5],
+                 ioc_data->atm_addr[6], ioc_data->atm_addr[7],
+                 ioc_data->atm_addr[8], ioc_data->atm_addr[9],
+                 ioc_data->atm_addr[10], ioc_data->atm_addr[11],
+                 ioc_data->atm_addr[12], ioc_data->atm_addr[13],
+                 ioc_data->atm_addr[14], ioc_data->atm_addr[15],
+                 ioc_data->atm_addr[16], ioc_data->atm_addr[17],
+                 ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(entry, node,
+                                     &priv->lec_arp_tables[i], next) {
                         if (memcmp
                             (ioc_data->atm_addr, entry->atm_addr,
                              ATM_ESA_LEN) == 0) {
                                 pr_debug("LEC_ARP: Attaching data direct\n");
                                 pr_debug("Currently -> Vcc: %d, Rvcc:%d\n",
-                                        entry->vcc ? entry->vcc->vci : 0,
-                                        entry->recv_vcc ? entry->recv_vcc->
-                                        vci : 0);
+                                         entry->vcc ? entry->vcc->vci : 0,
+                                         entry->recv_vcc ? entry->recv_vcc->
+                                         vci : 0);
                                 found_entry = 1;
                                 del_timer(&entry->timer);
                                 entry->vcc = vcc;
@@ -2279,19 +2231,21 @@ static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
         struct lec_arp_table *entry;
         int i;
 
-        pr_debug("LEC:lec_flush_complete %lx\n", tran_id);
+        pr_debug("%lx\n", tran_id);
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
-                        if (entry->flush_tran_id == tran_id
-                            && entry->status == ESI_FLUSH_PENDING) {
+                hlist_for_each_entry(entry, node,
+                                     &priv->lec_arp_tables[i], next) {
+                        if (entry->flush_tran_id == tran_id &&
+                            entry->status == ESI_FLUSH_PENDING) {
                                 struct sk_buff *skb;
                                 struct atm_vcc *vcc = entry->vcc;
 
                                 lec_arp_hold(entry);
-                                spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-                                while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
+                                spin_unlock_irqrestore(&priv->lec_arp_lock,
+                                                       flags);
+                                while ((skb = skb_dequeue(&entry->tx_wait)))
                                         lec_send(vcc, skb);
                                 entry->last_used = jiffies;
                                 entry->status = ESI_FORWARD_DIRECT;
@@ -2316,11 +2270,12 @@ lec_set_flush_tran_id(struct lec_priv *priv,
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
-                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(entry, node,
+                                     &priv->lec_arp_tables[i], next) {
                         if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)) {
                                 entry->flush_tran_id = tran_id;
                                 pr_debug("Set flush transaction id to %lx for %p\n",
-                                        tran_id, entry);
+                                         tran_id, entry);
                         }
                 }
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
@@ -2336,7 +2291,8 @@ static int lec_mcast_make(struct lec_priv *priv, struct atm_vcc *vcc)
         struct lec_vcc_priv *vpriv;
         int err = 0;
 
-        if (!(vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL)))
+        vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL);
+        if (!vpriv)
                 return -ENOMEM;
         vpriv->xoff = 0;
         vpriv->old_pop = vcc->pop;
@@ -2376,18 +2332,19 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
 
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
                         if (vcc == entry->vcc) {
                                 lec_arp_remove(priv, entry);
                                 lec_arp_put(entry);
-                                if (priv->mcast_vcc == vcc) {
+                                if (priv->mcast_vcc == vcc)
                                         priv->mcast_vcc = NULL;
-                                }
                         }
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_arp_empty_ones, next) {
                 if (entry->vcc == vcc) {
                         lec_arp_clear_vccs(entry);
                         del_timer(&entry->timer);
@@ -2396,7 +2353,8 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_no_forward, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_no_forward, next) {
                 if (entry->recv_vcc == vcc) {
                         lec_arp_clear_vccs(entry);
                         del_timer(&entry->timer);
@@ -2437,14 +2395,16 @@ lec_arp_check_empties(struct lec_priv *priv,
                 src = hdr->h_source;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_arp_empty_ones, next) {
                 if (vcc == entry->vcc) {
                         del_timer(&entry->timer);
                         memcpy(entry->mac_addr, src, ETH_ALEN);
                         entry->status = ESI_FORWARD_DIRECT;
                         entry->last_used = jiffies;
                         /* We might have got an entry */
-                        if ((tmp = lec_arp_find(priv, src))) {
+                        tmp = lec_arp_find(priv, src);
+                        if (tmp) {
                                 lec_arp_remove(priv, tmp);
                                 lec_arp_put(tmp);
                         }
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 38a6cb0863f0..436f2e177657 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -1,5 +1,8 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/kernel.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/timer.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
@@ -13,8 +16,8 @@
 #include <net/sock.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
+#include <linux/uaccess.h>
 #include <asm/byteorder.h>
-#include <asm/uaccess.h>
 #include <net/checksum.h>   /* for ip_fast_csum() */
 #include <net/arp.h>
 #include <net/dst.h>
@@ -36,31 +39,47 @@
  */
 
 #if 0
-#define dprintk printk   /* debug */
+#define dprintk(format, args...) \
+        printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args)
+#define dprintk_cont(format, args...) printk(KERN_CONT format, ##args)
 #else
-#define dprintk(format,args...)
+#define dprintk(format, args...)                                        \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args);\
+        } while (0)
+#define dprintk_cont(format, args...)                   \
+        do { if (0) printk(KERN_CONT format, ##args); } while (0)
 #endif
 
 #if 0
-#define ddprintk printk  /* more debug */
+#define ddprintk(format, args...) \
+        printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args)
+#define ddprintk_cont(format, args...) printk(KERN_CONT format, ##args)
 #else
-#define ddprintk(format,args...)
+#define ddprintk(format, args...)                                       \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args);\
+        } while (0)
+#define ddprintk_cont(format, args...)                  \
+        do { if (0) printk(KERN_CONT format, ##args); } while (0)
 #endif
 
-
-
 #define MPOA_TAG_LEN 4
 
 /* mpc_daemon -> kernel */
-static void MPOA_trigger_rcvd (struct k_message *msg, struct mpoa_client *mpc);
+static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void ingress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void egress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void mps_death(struct k_message *msg, struct mpoa_client *mpc);
-static void clean_up(struct k_message *msg, struct mpoa_client *mpc, int action);
-static void MPOA_cache_impos_rcvd(struct k_message *msg, struct mpoa_client *mpc);
-static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
-static void set_mps_mac_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
+static void clean_up(struct k_message *msg, struct mpoa_client *mpc,
+                     int action);
+static void MPOA_cache_impos_rcvd(struct k_message *msg,
+                                  struct mpoa_client *mpc);
+static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg,
+                                   struct mpoa_client *mpc);
+static void set_mps_mac_addr_rcvd(struct k_message *mesg,
+                                  struct mpoa_client *mpc);
 
 static const uint8_t *copy_macs(struct mpoa_client *mpc,
                                 const uint8_t *router_mac,
@@ -74,10 +93,11 @@ static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb);
 
 static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb);
 static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
-                                         struct net_device *dev);
-static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned long event, void *dev);
+                                   struct net_device *dev);
+static int mpoa_event_listener(struct notifier_block *mpoa_notifier,
+                               unsigned long event, void *dev);
 static void mpc_timer_refresh(void);
-static void mpc_cache_check( unsigned long checking_time  );
+static void mpc_cache_check(unsigned long checking_time);
 
 static struct llc_snap_hdr llc_snap_mpoa_ctrl = {
         0xaa, 0xaa, 0x03,
@@ -167,7 +187,7 @@ struct atm_mpoa_qos *atm_mpoa_add_qos(__be32 dst_ip, struct atm_qos *qos)
 
         entry = kmalloc(sizeof(struct atm_mpoa_qos), GFP_KERNEL);
         if (entry == NULL) {
-                printk("mpoa: atm_mpoa_add_qos: out of memory\n");
+                pr_info("mpoa: out of memory\n");
                 return entry;
         }
 
@@ -185,10 +205,9 @@ struct atm_mpoa_qos *atm_mpoa_search_qos(__be32 dst_ip)
         struct atm_mpoa_qos *qos;
 
         qos = qos_head;
-        while( qos != NULL ){
-                if(qos->ipaddr == dst_ip) {
+        while (qos) {
+                if (qos->ipaddr == dst_ip)
                         break;
-                }
                 qos = qos->next;
         }
 
@@ -200,10 +219,10 @@ struct atm_mpoa_qos *atm_mpoa_search_qos(__be32 dst_ip)
  */
 int atm_mpoa_delete_qos(struct atm_mpoa_qos *entry)
 {
-
         struct atm_mpoa_qos *curr;
 
-        if (entry == NULL) return 0;
+        if (entry == NULL)
+                return 0;
         if (entry == qos_head) {
                 qos_head = qos_head->next;
                 kfree(entry);
@@ -234,9 +253,17 @@ void atm_mpoa_disp_qos(struct seq_file *m)
 
         while (qos != NULL) {
                 seq_printf(m, "%pI4\n     %-7d %-7d %-7d %-7d %-7d\n     %-7d %-7d %-7d %-7d %-7d\n",
-                                &qos->ipaddr,
-                                qos->qos.txtp.max_pcr, qos->qos.txtp.pcr, qos->qos.txtp.min_pcr, qos->qos.txtp.max_cdv, qos->qos.txtp.max_sdu,
-                                qos->qos.rxtp.max_pcr, qos->qos.rxtp.pcr, qos->qos.rxtp.min_pcr, qos->qos.rxtp.max_cdv, qos->qos.rxtp.max_sdu);
+                           &qos->ipaddr,
+                           qos->qos.txtp.max_pcr,
+                           qos->qos.txtp.pcr,
+                           qos->qos.txtp.min_pcr,
+                           qos->qos.txtp.max_cdv,
+                           qos->qos.txtp.max_sdu,
+                           qos->qos.rxtp.max_pcr,
+                           qos->qos.rxtp.pcr,
+                           qos->qos.rxtp.min_pcr,
+                           qos->qos.rxtp.max_cdv,
+                           qos->qos.rxtp.max_sdu);
                 qos = qos->next;
         }
 }
@@ -256,7 +283,7 @@ static struct mpoa_client *alloc_mpc(void)
 {
         struct mpoa_client *mpc;
 
-        mpc = kzalloc(sizeof (struct mpoa_client), GFP_KERNEL);
+        mpc = kzalloc(sizeof(struct mpoa_client), GFP_KERNEL);
         if (mpc == NULL)
                 return NULL;
         rwlock_init(&mpc->ingress_lock);
@@ -266,7 +293,7 @@ static struct mpoa_client *alloc_mpc(void)
 
         mpc->parameters.mpc_p1 = MPC_P1;
         mpc->parameters.mpc_p2 = MPC_P2;
-        memset(mpc->parameters.mpc_p3,0,sizeof(mpc->parameters.mpc_p3));
+        memset(mpc->parameters.mpc_p3, 0, sizeof(mpc->parameters.mpc_p3));
         mpc->parameters.mpc_p4 = MPC_P4;
         mpc->parameters.mpc_p5 = MPC_P5;
         mpc->parameters.mpc_p6 = MPC_P6;
@@ -286,9 +313,9 @@ static struct mpoa_client *alloc_mpc(void)
 static void start_mpc(struct mpoa_client *mpc, struct net_device *dev)
 {
 
-        dprintk("mpoa: (%s) start_mpc:\n", mpc->dev->name);
+        dprintk("(%s)\n", mpc->dev->name);
         if (!dev->netdev_ops)
-                printk("mpoa: (%s) start_mpc  not starting\n", dev->name);
+                pr_info("(%s) not starting\n", dev->name);
         else {
                 mpc->old_ops = dev->netdev_ops;
                 mpc->new_ops = *mpc->old_ops;
@@ -300,14 +327,14 @@ static void start_mpc(struct mpoa_client *mpc, struct net_device *dev)
 static void stop_mpc(struct mpoa_client *mpc)
 {
         struct net_device *dev = mpc->dev;
-        dprintk("mpoa: (%s) stop_mpc:", mpc->dev->name);
+        dprintk("(%s)", mpc->dev->name);
 
         /* Lets not nullify lec device's dev->hard_start_xmit */
         if (dev->netdev_ops != &mpc->new_ops) {
-                dprintk(" mpc already stopped, not fatal\n");
+                dprintk_cont(" mpc already stopped, not fatal\n");
                 return;
         }
-        dprintk("\n");
+        dprintk_cont("\n");
 
         dev->netdev_ops = mpc->old_ops;
         mpc->old_ops = NULL;
@@ -319,25 +346,18 @@ static const char *mpoa_device_type_string(char type) __attribute__ ((unused));
 
 static const char *mpoa_device_type_string(char type)
 {
-        switch(type) {
+        switch (type) {
         case NON_MPOA:
                 return "non-MPOA device";
-                break;
         case MPS:
                 return "MPS";
-                break;
         case MPC:
                 return "MPC";
-                break;
         case MPS_AND_MPC:
                 return "both MPS and MPC";
-                break;
-        default:
-                return "unspecified (non-MPOA) device";
-                break;
         }
 
-        return ""; /* not reached */
+        return "unspecified (non-MPOA) device";
 }
 
 /*
@@ -362,26 +382,28 @@ static void lane2_assoc_ind(struct net_device *dev, const u8 *mac_addr,
         struct mpoa_client *mpc;
 
         mpoa_device_type = number_of_mps_macs = 0; /* silence gcc */
-        dprintk("mpoa: (%s) lane2_assoc_ind: received TLV(s), ", dev->name);
+        dprintk("(%s) received TLV(s), ", dev->name);
         dprintk("total length of all TLVs %d\n", sizeoftlvs);
         mpc = find_mpc_by_lec(dev); /* Sampo-Fix: moved here from below */
         if (mpc == NULL) {
-                printk("mpoa: (%s) lane2_assoc_ind: no mpc\n", dev->name);
+                pr_info("(%s) no mpc\n", dev->name);
                 return;
         }
         end_of_tlvs = tlvs + sizeoftlvs;
         while (end_of_tlvs - tlvs >= 5) {
-                type = (tlvs[0] << 24) | (tlvs[1] << 16) | (tlvs[2] << 8) | tlvs[3];
+                type = ((tlvs[0] << 24) | (tlvs[1] << 16) |
+                        (tlvs[2] << 8) | tlvs[3]);
                 length = tlvs[4];
                 tlvs += 5;
                 dprintk("    type 0x%x length %02x\n", type, length);
                 if (tlvs + length > end_of_tlvs) {
-                        printk("TLV value extends past its buffer, aborting parse\n");
+                        pr_info("TLV value extends past its buffer, aborting parse\n");
                         return;
                 }
 
                 if (type == 0) {
-                        printk("mpoa: (%s) lane2_assoc_ind: TLV type was 0, returning\n", dev->name);
+                        pr_info("mpoa: (%s) TLV type was 0, returning\n",
+                                dev->name);
                         return;
                 }
 
@@ -391,39 +413,48 @@ static void lane2_assoc_ind(struct net_device *dev, const u8 *mac_addr,
                 }
                 mpoa_device_type = *tlvs++;
                 number_of_mps_macs = *tlvs++;
-                dprintk("mpoa: (%s) MPOA device type '%s', ", dev->name, mpoa_device_type_string(mpoa_device_type));
+                dprintk("(%s) MPOA device type '%s', ",
+                        dev->name, mpoa_device_type_string(mpoa_device_type));
                 if (mpoa_device_type == MPS_AND_MPC &&
                     length < (42 + number_of_mps_macs*ETH_ALEN)) { /* :) */
-                        printk("\nmpoa: (%s) lane2_assoc_ind: short MPOA Device Type TLV\n",
-                               dev->name);
+                        pr_info("(%s) short MPOA Device Type TLV\n",
+                                dev->name);
                         continue;
                 }
-                if ((mpoa_device_type == MPS || mpoa_device_type == MPC)
-                    && length < 22 + number_of_mps_macs*ETH_ALEN) {
-                        printk("\nmpoa: (%s) lane2_assoc_ind: short MPOA Device Type TLV\n",
-                                dev->name);
+                if ((mpoa_device_type == MPS || mpoa_device_type == MPC) &&
+                    length < 22 + number_of_mps_macs*ETH_ALEN) {
+                        pr_info("(%s) short MPOA Device Type TLV\n", dev->name);
                         continue;
                 }
-                if (mpoa_device_type != MPS && mpoa_device_type != MPS_AND_MPC) {
-                        dprintk("ignoring non-MPS device\n");
-                        if (mpoa_device_type == MPC) tlvs += 20;
+                if (mpoa_device_type != MPS &&
+                    mpoa_device_type != MPS_AND_MPC) {
+                        dprintk("ignoring non-MPS device ");
+                        if (mpoa_device_type == MPC)
+                                tlvs += 20;
                         continue;  /* we are only interested in MPSs */
                 }
-                if (number_of_mps_macs == 0 && mpoa_device_type == MPS_AND_MPC) {
-                        printk("\nmpoa: (%s) lane2_assoc_ind: MPS_AND_MPC has zero MACs\n", dev->name);
+                if (number_of_mps_macs == 0 &&
+                    mpoa_device_type == MPS_AND_MPC) {
+                        pr_info("(%s) MPS_AND_MPC has zero MACs\n", dev->name);
                         continue;  /* someone should read the spec */
                 }
-                dprintk("this MPS has %d MAC addresses\n", number_of_mps_macs);
+                dprintk_cont("this MPS has %d MAC addresses\n",
+                             number_of_mps_macs);
 
-                /* ok, now we can go and tell our daemon the control address of MPS */
+                /*
+                 * ok, now we can go and tell our daemon
+                 * the control address of MPS
+                 */
                 send_set_mps_ctrl_addr(tlvs, mpc);
 
-                tlvs = copy_macs(mpc, mac_addr, tlvs, number_of_mps_macs, mpoa_device_type);
-                if (tlvs == NULL) return;
+                tlvs = copy_macs(mpc, mac_addr, tlvs,
+                                 number_of_mps_macs, mpoa_device_type);
+                if (tlvs == NULL)
+                        return;
         }
         if (end_of_tlvs - tlvs != 0)
-                printk("mpoa: (%s) lane2_assoc_ind: ignoring %Zd bytes of trailing TLV carbage\n",
-                       dev->name, end_of_tlvs - tlvs);
+                pr_info("(%s) ignoring %Zd bytes of trailing TLV garbage\n",
+                        dev->name, end_of_tlvs - tlvs);
         return;
 }
 
@@ -441,11 +472,12 @@ static const uint8_t *copy_macs(struct mpoa_client *mpc,
         num_macs = (mps_macs > 1) ? mps_macs : 1;
 
         if (mpc->number_of_mps_macs != num_macs) { /* need to reallocate? */
-                if (mpc->number_of_mps_macs != 0) kfree(mpc->mps_macs);
+                if (mpc->number_of_mps_macs != 0)
+                        kfree(mpc->mps_macs);
                 mpc->number_of_mps_macs = 0;
-                mpc->mps_macs = kmalloc(num_macs*ETH_ALEN, GFP_KERNEL);
+                mpc->mps_macs = kmalloc(num_macs * ETH_ALEN, GFP_KERNEL);
                 if (mpc->mps_macs == NULL) {
-                        printk("mpoa: (%s) copy_macs: out of mem\n", mpc->dev->name);
+                        pr_info("(%s) out of mem\n", mpc->dev->name);
                         return NULL;
                 }
         }
@@ -478,24 +510,30 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
         iph = (struct iphdr *)buff;
         ipaddr = iph->daddr;
 
-        ddprintk("mpoa: (%s) send_via_shortcut: ipaddr 0x%x\n", mpc->dev->name, ipaddr);
+        ddprintk("(%s) ipaddr 0x%x\n",
+                 mpc->dev->name, ipaddr);
 
         entry = mpc->in_ops->get(ipaddr, mpc);
         if (entry == NULL) {
                 entry = mpc->in_ops->add_entry(ipaddr, mpc);
-                if (entry != NULL) mpc->in_ops->put(entry);
+                if (entry != NULL)
+                        mpc->in_ops->put(entry);
                 return 1;
         }
-        if (mpc->in_ops->cache_hit(entry, mpc) != OPEN){   /* threshold not exceeded or VCC not ready */
-                ddprintk("mpoa: (%s) send_via_shortcut: cache_hit: returns != OPEN\n", mpc->dev->name);
+        /* threshold not exceeded or VCC not ready */
+        if (mpc->in_ops->cache_hit(entry, mpc) != OPEN) {
+                ddprintk("(%s) cache_hit: returns != OPEN\n",
+                         mpc->dev->name);
                 mpc->in_ops->put(entry);
                 return 1;
         }
 
-        ddprintk("mpoa: (%s) send_via_shortcut: using shortcut\n", mpc->dev->name);
+        ddprintk("(%s) using shortcut\n",
+                 mpc->dev->name);
         /* MPOA spec A.1.4, MPOA client must decrement IP ttl at least by one */
         if (iph->ttl <= 1) {
-                ddprintk("mpoa: (%s) send_via_shortcut: IP ttl = %u, using LANE\n", mpc->dev->name, iph->ttl);
+                ddprintk("(%s) IP ttl = %u, using LANE\n",
+                         mpc->dev->name, iph->ttl);
                 mpc->in_ops->put(entry);
                 return 1;
         }
@@ -504,15 +542,18 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
         iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
 
         if (entry->ctrl_info.tag != 0) {
-                ddprintk("mpoa: (%s) send_via_shortcut: adding tag 0x%x\n", mpc->dev->name, entry->ctrl_info.tag);
+                ddprintk("(%s) adding tag 0x%x\n",
+                         mpc->dev->name, entry->ctrl_info.tag);
                 tagged_llc_snap_hdr.tag = entry->ctrl_info.tag;
-                skb_pull(skb, ETH_HLEN);                       /* get rid of Eth header */
-                skb_push(skb, sizeof(tagged_llc_snap_hdr));    /* add LLC/SNAP header   */
+                skb_pull(skb, ETH_HLEN);        /* get rid of Eth header */
+                skb_push(skb, sizeof(tagged_llc_snap_hdr));
+                                                /* add LLC/SNAP header   */
                 skb_copy_to_linear_data(skb, &tagged_llc_snap_hdr,
                                         sizeof(tagged_llc_snap_hdr));
         } else {
-                skb_pull(skb, ETH_HLEN);                        /* get rid of Eth header */
-                skb_push(skb, sizeof(struct llc_snap_hdr));     /* add LLC/SNAP header + tag  */
+                skb_pull(skb, ETH_HLEN);        /* get rid of Eth header */
+                skb_push(skb, sizeof(struct llc_snap_hdr));
+                                                /* add LLC/SNAP header + tag  */
                 skb_copy_to_linear_data(skb, &llc_snap_mpoa_data,
                                         sizeof(struct llc_snap_hdr));
         }
@@ -537,8 +578,8 @@ static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
         int i = 0;
 
         mpc = find_mpc_by_lec(dev); /* this should NEVER fail */
-        if(mpc == NULL) {
-                printk("mpoa: (%s) mpc_send_packet: no MPC found\n", dev->name);
+        if (mpc == NULL) {
+                pr_info("(%s) no MPC found\n", dev->name);
                 goto non_ip;
         }
 
@@ -554,14 +595,15 @@ static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
                 goto non_ip;
 
         while (i < mpc->number_of_mps_macs) {
-                if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN)))
-                        if ( send_via_shortcut(skb, mpc) == 0 )           /* try shortcut */
-                                return NETDEV_TX_OK;                      /* success!     */
+                if (!compare_ether_addr(eth->h_dest,
+                                        (mpc->mps_macs + i*ETH_ALEN)))
+                        if (send_via_shortcut(skb, mpc) == 0) /* try shortcut */
+                                return NETDEV_TX_OK;
                 i++;
         }
 
- non_ip:
-        return mpc->old_ops->ndo_start_xmit(skb,dev);
+non_ip:
+        return mpc->old_ops->ndo_start_xmit(skb, dev);
 }
 
 static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
@@ -574,7 +616,8 @@ static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
         bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmmpc_ioc));
         if (bytes_left != 0) {
-                printk("mpoa: mpc_vcc_attach: Short read (missed %d bytes) from userland\n", bytes_left);
+                pr_info("mpoa:Short read (missed %d bytes) from userland\n",
+                        bytes_left);
                 return -EFAULT;
         }
         ipaddr = ioc_data.ipaddr;
@@ -587,18 +630,20 @@ static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
         if (ioc_data.type == MPC_SOCKET_INGRESS) {
                 in_entry = mpc->in_ops->get(ipaddr, mpc);
-                if (in_entry == NULL || in_entry->entry_state < INGRESS_RESOLVED) {
-                        printk("mpoa: (%s) mpc_vcc_attach: did not find RESOLVED entry from ingress cache\n",
+                if (in_entry == NULL ||
+                    in_entry->entry_state < INGRESS_RESOLVED) {
+                        pr_info("(%s) did not find RESOLVED entry from ingress cache\n",
                                 mpc->dev->name);
-                        if (in_entry != NULL) mpc->in_ops->put(in_entry);
+                        if (in_entry != NULL)
+                                mpc->in_ops->put(in_entry);
                         return -EINVAL;
                 }
-                printk("mpoa: (%s) mpc_vcc_attach: attaching ingress SVC, entry = %pI4\n",
-                       mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
+                pr_info("(%s) attaching ingress SVC, entry = %pI4\n",
+                        mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
                 in_entry->shortcut = vcc;
                 mpc->in_ops->put(in_entry);
         } else {
-                printk("mpoa: (%s) mpc_vcc_attach: attaching egress SVC\n", mpc->dev->name);
+                pr_info("(%s) attaching egress SVC\n", mpc->dev->name);
         }
 
         vcc->proto_data = mpc->dev;
@@ -618,27 +663,27 @@ static void mpc_vcc_close(struct atm_vcc *vcc, struct net_device *dev)
 
         mpc = find_mpc_by_lec(dev);
         if (mpc == NULL) {
-                printk("mpoa: (%s) mpc_vcc_close: close for unknown MPC\n", dev->name);
+                pr_info("(%s) close for unknown MPC\n", dev->name);
                 return;
         }
 
-        dprintk("mpoa: (%s) mpc_vcc_close:\n", dev->name);
+        dprintk("(%s)\n", dev->name);
         in_entry = mpc->in_ops->get_by_vcc(vcc, mpc);
         if (in_entry) {
-                dprintk("mpoa: (%s) mpc_vcc_close: ingress SVC closed ip = %pI4\n",
-                       mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
+                dprintk("(%s) ingress SVC closed ip = %pI4\n",
+                        mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
                 in_entry->shortcut = NULL;
                 mpc->in_ops->put(in_entry);
         }
         eg_entry = mpc->eg_ops->get_by_vcc(vcc, mpc);
         if (eg_entry) {
-                dprintk("mpoa: (%s) mpc_vcc_close: egress SVC closed\n", mpc->dev->name);
+                dprintk("(%s) egress SVC closed\n", mpc->dev->name);
                 eg_entry->shortcut = NULL;
                 mpc->eg_ops->put(eg_entry);
         }
 
         if (in_entry == NULL && eg_entry == NULL)
-                dprintk("mpoa: (%s) mpc_vcc_close:  unused vcc closed\n", dev->name);
+                dprintk("(%s) unused vcc closed\n", dev->name);
 
         return;
 }
@@ -652,18 +697,19 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
         __be32 tag;
         char *tmp;
 
-        ddprintk("mpoa: (%s) mpc_push:\n", dev->name);
+        ddprintk("(%s)\n", dev->name);
         if (skb == NULL) {
-                dprintk("mpoa: (%s) mpc_push: null skb, closing VCC\n", dev->name);
+                dprintk("(%s) null skb, closing VCC\n", dev->name);
                 mpc_vcc_close(vcc, dev);
                 return;
         }
 
         skb->dev = dev;
-        if (memcmp(skb->data, &llc_snap_mpoa_ctrl, sizeof(struct llc_snap_hdr)) == 0) {
+        if (memcmp(skb->data, &llc_snap_mpoa_ctrl,
+                   sizeof(struct llc_snap_hdr)) == 0) {
                 struct sock *sk = sk_atm(vcc);
 
-                dprintk("mpoa: (%s) mpc_push: control packet arrived\n", dev->name);
+                dprintk("(%s) control packet arrived\n", dev->name);
                 /* Pass control packets to daemon */
                 skb_queue_tail(&sk->sk_receive_queue, skb);
                 sk->sk_data_ready(sk, skb->len);
@@ -675,20 +721,22 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
 
         mpc = find_mpc_by_lec(dev);
         if (mpc == NULL) {
-                printk("mpoa: (%s) mpc_push: unknown MPC\n", dev->name);
+                pr_info("(%s) unknown MPC\n", dev->name);
                 return;
         }
 
-        if (memcmp(skb->data, &llc_snap_mpoa_data_tagged, sizeof(struct llc_snap_hdr)) == 0) { /* MPOA tagged data */
-                ddprintk("mpoa: (%s) mpc_push: tagged data packet arrived\n", dev->name);
+        if (memcmp(skb->data, &llc_snap_mpoa_data_tagged,
+                   sizeof(struct llc_snap_hdr)) == 0) { /* MPOA tagged data */
+                ddprintk("(%s) tagged data packet arrived\n", dev->name);
 
-        } else if (memcmp(skb->data, &llc_snap_mpoa_data, sizeof(struct llc_snap_hdr)) == 0) { /* MPOA data */
-                printk("mpoa: (%s) mpc_push: non-tagged data packet arrived\n", dev->name);
-                printk("           mpc_push: non-tagged data unsupported, purging\n");
+        } else if (memcmp(skb->data, &llc_snap_mpoa_data,
+                          sizeof(struct llc_snap_hdr)) == 0) { /* MPOA data */
+                pr_info("(%s) Unsupported non-tagged data packet arrived.  Purging\n",
+                        dev->name);
                 dev_kfree_skb_any(skb);
                 return;
         } else {
-                printk("mpoa: (%s) mpc_push: garbage arrived, purging\n", dev->name);
+                pr_info("(%s) garbage arrived, purging\n", dev->name);
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -698,8 +746,8 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
 
         eg = mpc->eg_ops->get_by_tag(tag, mpc);
         if (eg == NULL) {
-                printk("mpoa: (%s) mpc_push: Didn't find egress cache entry, tag = %u\n",
-                       dev->name,tag);
+                pr_info("mpoa: (%s) Didn't find egress cache entry, tag = %u\n",
+                        dev->name, tag);
                 purge_egress_shortcut(vcc, NULL);
                 dev_kfree_skb_any(skb);
                 return;
@@ -711,13 +759,15 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
          */
         if (eg->shortcut == NULL) {
                 eg->shortcut = vcc;
-                printk("mpoa: (%s) mpc_push: egress SVC in use\n", dev->name);
+                pr_info("(%s) egress SVC in use\n", dev->name);
         }
 
-        skb_pull(skb, sizeof(struct llc_snap_hdr) + sizeof(tag)); /* get rid of LLC/SNAP header */
-        new_skb = skb_realloc_headroom(skb, eg->ctrl_info.DH_length); /* LLC/SNAP is shorter than MAC header :( */
+        skb_pull(skb, sizeof(struct llc_snap_hdr) + sizeof(tag));
+                                        /* get rid of LLC/SNAP header */
+        new_skb = skb_realloc_headroom(skb, eg->ctrl_info.DH_length);
+                                        /* LLC/SNAP is shorter than MAC header :( */
         dev_kfree_skb_any(skb);
-        if (new_skb == NULL){
+        if (new_skb == NULL) {
                 mpc->eg_ops->put(eg);
                 return;
         }
@@ -750,7 +800,7 @@ static struct atm_dev mpc_dev = {
         /* members not explicitly initialised will be 0 */
 };
 
-static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
+static int atm_mpoa_mpoad_attach(struct atm_vcc *vcc, int arg)
 {
         struct mpoa_client *mpc;
         struct lec_priv *priv;
@@ -770,15 +820,16 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
 
         mpc = find_mpc_by_itfnum(arg);
         if (mpc == NULL) {
-                dprintk("mpoa: mpoad_attach: allocating new mpc for itf %d\n", arg);
+                dprintk("allocating new mpc for itf %d\n", arg);
                 mpc = alloc_mpc();
                 if (mpc == NULL)
                         return -ENOMEM;
                 mpc->dev_num = arg;
-                mpc->dev = find_lec_by_itfnum(arg); /* NULL if there was no lec */
+                mpc->dev = find_lec_by_itfnum(arg);
+                                        /* NULL if there was no lec */
         }
         if (mpc->mpoad_vcc) {
-                printk("mpoa: mpoad_attach: mpoad is already present for itf %d\n", arg);
+                pr_info("mpoad is already present for itf %d\n", arg);
                 return -EADDRINUSE;
         }
 
@@ -794,8 +845,8 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
         mpc->mpoad_vcc = vcc;
         vcc->dev = &mpc_dev;
         vcc_insert_socket(sk_atm(vcc));
-        set_bit(ATM_VF_META,&vcc->flags);
-        set_bit(ATM_VF_READY,&vcc->flags);
+        set_bit(ATM_VF_META, &vcc->flags);
+        set_bit(ATM_VF_READY, &vcc->flags);
 
         if (mpc->dev) {
                 char empty[ATM_ESA_LEN];
@@ -805,7 +856,7 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
                 /* set address if mpcd e.g. gets killed and restarted.
                  * If we do not do it now we have to wait for the next LE_ARP
                  */
-                if ( memcmp(mpc->mps_ctrl_addr, empty, ATM_ESA_LEN) != 0 )
+                if (memcmp(mpc->mps_ctrl_addr, empty, ATM_ESA_LEN) != 0)
                         send_set_mps_ctrl_addr(mpc->mps_ctrl_addr, mpc);
         }
 
@@ -817,7 +868,7 @@ static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc)
 {
         struct k_message mesg;
 
-        memcpy (mpc->mps_ctrl_addr, addr, ATM_ESA_LEN);
+        memcpy(mpc->mps_ctrl_addr, addr, ATM_ESA_LEN);
 
         mesg.type = SET_MPS_CTRL_ADDR;
         memcpy(mesg.MPS_ctrl, addr, ATM_ESA_LEN);
@@ -833,11 +884,11 @@ static void mpoad_close(struct atm_vcc *vcc)
 
         mpc = find_mpc_by_vcc(vcc);
         if (mpc == NULL) {
-                printk("mpoa: mpoad_close: did not find MPC\n");
+                pr_info("did not find MPC\n");
                 return;
         }
         if (!mpc->mpoad_vcc) {
-                printk("mpoa: mpoad_close: close for non-present mpoad\n");
+                pr_info("close for non-present mpoad\n");
                 return;
         }
 
@@ -857,7 +908,7 @@ static void mpoad_close(struct atm_vcc *vcc)
                 kfree_skb(skb);
         }
 
-        printk("mpoa: (%s) going down\n",
+        pr_info("(%s) going down\n",
                 (mpc->dev) ? mpc->dev->name : "<unknown>");
         module_put(THIS_MODULE);
 
@@ -871,61 +922,61 @@ static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb)
 {
 
         struct mpoa_client *mpc = find_mpc_by_vcc(vcc);
-        struct k_message *mesg = (struct k_message*)skb->data;
+        struct k_message *mesg = (struct k_message *)skb->data;
         atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
 
         if (mpc == NULL) {
-                printk("mpoa: msg_from_mpoad: no mpc found\n");
+                pr_info("no mpc found\n");
                 return 0;
         }
-        dprintk("mpoa: (%s) msg_from_mpoad:", (mpc->dev) ? mpc->dev->name : "<unknown>");
-        switch(mesg->type) {
+        dprintk("(%s)", mpc->dev ? mpc->dev->name : "<unknown>");
+        switch (mesg->type) {
         case MPOA_RES_REPLY_RCVD:
-                dprintk(" mpoa_res_reply_rcvd\n");
+                dprintk_cont("mpoa_res_reply_rcvd\n");
                 MPOA_res_reply_rcvd(mesg, mpc);
                 break;
         case MPOA_TRIGGER_RCVD:
-                dprintk(" mpoa_trigger_rcvd\n");
+                dprintk_cont("mpoa_trigger_rcvd\n");
                 MPOA_trigger_rcvd(mesg, mpc);
                 break;
         case INGRESS_PURGE_RCVD:
-                dprintk(" nhrp_purge_rcvd\n");
+                dprintk_cont("nhrp_purge_rcvd\n");
                 ingress_purge_rcvd(mesg, mpc);
                 break;
         case EGRESS_PURGE_RCVD:
-                dprintk(" egress_purge_reply_rcvd\n");
+                dprintk_cont("egress_purge_reply_rcvd\n");
                 egress_purge_rcvd(mesg, mpc);
                 break;
         case MPS_DEATH:
-                dprintk(" mps_death\n");
+                dprintk_cont("mps_death\n");
                 mps_death(mesg, mpc);
                 break;
         case CACHE_IMPOS_RCVD:
-                dprintk(" cache_impos_rcvd\n");
+                dprintk_cont("cache_impos_rcvd\n");
                 MPOA_cache_impos_rcvd(mesg, mpc);
                 break;
         case SET_MPC_CTRL_ADDR:
-                dprintk(" set_mpc_ctrl_addr\n");
+                dprintk_cont("set_mpc_ctrl_addr\n");
                 set_mpc_ctrl_addr_rcvd(mesg, mpc);
                 break;
         case SET_MPS_MAC_ADDR:
-                dprintk(" set_mps_mac_addr\n");
+                dprintk_cont("set_mps_mac_addr\n");
                 set_mps_mac_addr_rcvd(mesg, mpc);
                 break;
         case CLEAN_UP_AND_EXIT:
-                dprintk(" clean_up_and_exit\n");
+                dprintk_cont("clean_up_and_exit\n");
                 clean_up(mesg, mpc, DIE);
                 break;
         case RELOAD:
-                dprintk(" reload\n");
+                dprintk_cont("reload\n");
                 clean_up(mesg, mpc, RELOAD);
                 break;
         case SET_MPC_PARAMS:
-                dprintk(" set_mpc_params\n");
+                dprintk_cont("set_mpc_params\n");
                 mpc->parameters = mesg->content.params;
                 break;
         default:
-                dprintk(" unknown message %d\n", mesg->type);
+                dprintk_cont("unknown message %d\n", mesg->type);
                 break;
         }
         kfree_skb(skb);
@@ -940,7 +991,7 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
         struct sock *sk;
 
         if (mpc == NULL || !mpc->mpoad_vcc) {
-                printk("mpoa: msg_to_mpoad: mesg %d to a non-existent mpoad\n", mesg->type);
+                pr_info("mesg %d to a non-existent mpoad\n", mesg->type);
                 return -ENXIO;
         }
 
@@ -958,7 +1009,8 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
         return 0;
 }
 
-static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned long event, void *dev_ptr)
+static int mpoa_event_listener(struct notifier_block *mpoa_notifier,
+                               unsigned long event, void *dev_ptr)
 {
         struct net_device *dev;
         struct mpoa_client *mpc;
@@ -980,25 +1032,24 @@ static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned lo
                 priv->lane2_ops->associate_indicator = lane2_assoc_ind;
                 mpc = find_mpc_by_itfnum(priv->itfnum);
                 if (mpc == NULL) {
-                        dprintk("mpoa: mpoa_event_listener: allocating new mpc for %s\n",
-                               dev->name);
+                        dprintk("allocating new mpc for %s\n", dev->name);
                         mpc = alloc_mpc();
                         if (mpc == NULL) {
-                                printk("mpoa: mpoa_event_listener: no new mpc");
+                                pr_info("no new mpc");
                                 break;
                         }
                 }
                 mpc->dev_num = priv->itfnum;
                 mpc->dev = dev;
                 dev_hold(dev);
-                dprintk("mpoa: (%s) was initialized\n", dev->name);
+                dprintk("(%s) was initialized\n", dev->name);
                 break;
         case NETDEV_UNREGISTER:
                 /* the lec device was deallocated */
                 mpc = find_mpc_by_lec(dev);
                 if (mpc == NULL)
                         break;
-                dprintk("mpoa: device (%s) was deallocated\n", dev->name);
+                dprintk("device (%s) was deallocated\n", dev->name);
                 stop_mpc(mpc);
                 dev_put(mpc->dev);
                 mpc->dev = NULL;
@@ -1008,9 +1059,8 @@ static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned lo
                 mpc = find_mpc_by_lec(dev);
                 if (mpc == NULL)
                         break;
-                if (mpc->mpoad_vcc != NULL) {
+                if (mpc->mpoad_vcc != NULL)
                         start_mpc(mpc, dev);
-                }
                 break;
         case NETDEV_DOWN:
                 /* the dev was ifconfig'ed down */
@@ -1020,9 +1070,8 @@ static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned lo
                 mpc = find_mpc_by_lec(dev);
                 if (mpc == NULL)
                         break;
-                if (mpc->mpoad_vcc != NULL) {
+                if (mpc->mpoad_vcc != NULL)
                         stop_mpc(mpc);
-                }
                 break;
         case NETDEV_REBOOT:
         case NETDEV_CHANGE:
@@ -1049,7 +1098,7 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         in_cache_entry *entry;
 
         entry = mpc->in_ops->get(dst_ip, mpc);
-        if(entry == NULL){
+        if (entry == NULL) {
                 entry = mpc->in_ops->add_entry(dst_ip, mpc);
                 entry->entry_state = INGRESS_RESOLVING;
                 msg->type = SND_MPOA_RES_RQST;
@@ -1060,7 +1109,7 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
                 return;
         }
 
-        if(entry->entry_state == INGRESS_INVALID){
+        if (entry->entry_state == INGRESS_INVALID) {
                 entry->entry_state = INGRESS_RESOLVING;
                 msg->type = SND_MPOA_RES_RQST;
                 msg->content.in_info = entry->ctrl_info;
@@ -1070,7 +1119,7 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
                 return;
         }
 
-        printk("mpoa: (%s) MPOA_trigger_rcvd: entry already in resolving state\n",
+        pr_info("(%s) entry already in resolving state\n",
                 (mpc->dev) ? mpc->dev->name : "<unknown>");
         mpc->in_ops->put(entry);
         return;
@@ -1080,23 +1129,25 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
  * Things get complicated because we have to check if there's an egress
  * shortcut with suitable traffic parameters we could use.
  */
-static void check_qos_and_open_shortcut(struct k_message *msg, struct mpoa_client *client, in_cache_entry *entry)
+static void check_qos_and_open_shortcut(struct k_message *msg,
+                                        struct mpoa_client *client,
+                                        in_cache_entry *entry)
 {
         __be32 dst_ip = msg->content.in_info.in_dst_ip;
         struct atm_mpoa_qos *qos = atm_mpoa_search_qos(dst_ip);
         eg_cache_entry *eg_entry = client->eg_ops->get_by_src_ip(dst_ip, client);
 
-        if(eg_entry && eg_entry->shortcut){
-                if(eg_entry->shortcut->qos.txtp.traffic_class &
-                   msg->qos.txtp.traffic_class &
-                   (qos ? qos->qos.txtp.traffic_class : ATM_UBR | ATM_CBR)){
-                            if(eg_entry->shortcut->qos.txtp.traffic_class == ATM_UBR)
-                                    entry->shortcut = eg_entry->shortcut;
-                            else if(eg_entry->shortcut->qos.txtp.max_pcr > 0)
-                                    entry->shortcut = eg_entry->shortcut;
+        if (eg_entry && eg_entry->shortcut) {
+                if (eg_entry->shortcut->qos.txtp.traffic_class &
+                    msg->qos.txtp.traffic_class &
+                    (qos ? qos->qos.txtp.traffic_class : ATM_UBR | ATM_CBR)) {
+                        if (eg_entry->shortcut->qos.txtp.traffic_class == ATM_UBR)
+                                entry->shortcut = eg_entry->shortcut;
+                        else if (eg_entry->shortcut->qos.txtp.max_pcr > 0)
+                                entry->shortcut = eg_entry->shortcut;
                 }
-                if(entry->shortcut){
-                        dprintk("mpoa: (%s) using egress SVC to reach %pI4\n",
+                if (entry->shortcut) {
+                        dprintk("(%s) using egress SVC to reach %pI4\n",
                                 client->dev->name, &dst_ip);
                         client->eg_ops->put(eg_entry);
                         return;
@@ -1107,12 +1158,13 @@ static void check_qos_and_open_shortcut(struct k_message *msg, struct mpoa_clien
 
         /* No luck in the egress cache we must open an ingress SVC */
         msg->type = OPEN_INGRESS_SVC;
-        if (qos && (qos->qos.txtp.traffic_class == msg->qos.txtp.traffic_class))
-        {
+        if (qos &&
+            (qos->qos.txtp.traffic_class == msg->qos.txtp.traffic_class)) {
                 msg->qos = qos->qos;
-                printk("mpoa: (%s) trying to get a CBR shortcut\n",client->dev->name);
-        }
-        else memset(&msg->qos,0,sizeof(struct atm_qos));
+                pr_info("(%s) trying to get a CBR shortcut\n",
+                        client->dev->name);
+        } else
+                memset(&msg->qos, 0, sizeof(struct atm_qos));
         msg_to_mpoad(msg, client);
         return;
 }
@@ -1122,17 +1174,19 @@ static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         __be32 dst_ip = msg->content.in_info.in_dst_ip;
         in_cache_entry *entry = mpc->in_ops->get(dst_ip, mpc);
 
-        dprintk("mpoa: (%s) MPOA_res_reply_rcvd: ip %pI4\n",
+        dprintk("(%s) ip %pI4\n",
                 mpc->dev->name, &dst_ip);
-        ddprintk("mpoa: (%s) MPOA_res_reply_rcvd() entry = %p", mpc->dev->name, entry);
-        if(entry == NULL){
-                printk("\nmpoa: (%s) ARGH, received res. reply for an entry that doesn't exist.\n", mpc->dev->name);
+        ddprintk("(%s) entry = %p",
+                 mpc->dev->name, entry);
+        if (entry == NULL) {
+                pr_info("(%s) ARGH, received res. reply for an entry that doesn't exist.\n",
+                        mpc->dev->name);
                 return;
         }
-        ddprintk(" entry_state = %d ", entry->entry_state);
+        ddprintk_cont(" entry_state = %d ", entry->entry_state);
 
         if (entry->entry_state == INGRESS_RESOLVED) {
-                printk("\nmpoa: (%s) MPOA_res_reply_rcvd for RESOLVED entry!\n", mpc->dev->name);
+                pr_info("(%s) RESOLVED entry!\n", mpc->dev->name);
                 mpc->in_ops->put(entry);
                 return;
         }
@@ -1141,17 +1195,18 @@ static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         do_gettimeofday(&(entry->tv));
         do_gettimeofday(&(entry->reply_wait)); /* Used in refreshing func from now on */
         entry->refresh_time = 0;
-        ddprintk("entry->shortcut = %p\n", entry->shortcut);
+        ddprintk_cont("entry->shortcut = %p\n", entry->shortcut);
 
-        if(entry->entry_state == INGRESS_RESOLVING && entry->shortcut != NULL){
+        if (entry->entry_state == INGRESS_RESOLVING &&
+            entry->shortcut != NULL) {
                 entry->entry_state = INGRESS_RESOLVED;
                 mpc->in_ops->put(entry);
                 return; /* Shortcut already open... */
         }
 
         if (entry->shortcut != NULL) {
-                printk("mpoa: (%s) MPOA_res_reply_rcvd: entry->shortcut != NULL, impossible!\n",
-                       mpc->dev->name);
+                pr_info("(%s) entry->shortcut != NULL, impossible!\n",
+                        mpc->dev->name);
                 mpc->in_ops->put(entry);
                 return;
         }
@@ -1170,14 +1225,14 @@ static void ingress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         __be32 mask = msg->ip_mask;
         in_cache_entry *entry = mpc->in_ops->get_with_mask(dst_ip, mpc, mask);
 
-        if(entry == NULL){
-                printk("mpoa: (%s) ingress_purge_rcvd: purge for a non-existing entry, ip = %pI4\n",
-                       mpc->dev->name, &dst_ip);
+        if (entry == NULL) {
+                pr_info("(%s) purge for a non-existing entry, ip = %pI4\n",
+                        mpc->dev->name, &dst_ip);
                 return;
         }
 
         do {
-                dprintk("mpoa: (%s) ingress_purge_rcvd: removing an ingress entry, ip = %pI4\n",
+                dprintk("(%s) removing an ingress entry, ip = %pI4\n",
                         mpc->dev->name, &dst_ip);
                 write_lock_bh(&mpc->ingress_lock);
                 mpc->in_ops->remove_entry(entry, mpc);
@@ -1195,7 +1250,8 @@ static void egress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         eg_cache_entry *entry = mpc->eg_ops->get_by_cache_id(cache_id, mpc);
 
         if (entry == NULL) {
-                dprintk("mpoa: (%s) egress_purge_rcvd: purge for a non-existing entry\n", mpc->dev->name);
+                dprintk("(%s) purge for a non-existing entry\n",
+                        mpc->dev->name);
                 return;
         }
 
@@ -1214,15 +1270,15 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
         struct k_message *purge_msg;
         struct sk_buff *skb;
 
-        dprintk("mpoa: purge_egress_shortcut: entering\n");
+        dprintk("entering\n");
         if (vcc == NULL) {
-                printk("mpoa: purge_egress_shortcut: vcc == NULL\n");
+                pr_info("vcc == NULL\n");
                 return;
         }
 
         skb = alloc_skb(sizeof(struct k_message), GFP_ATOMIC);
         if (skb == NULL) {
-                 printk("mpoa: purge_egress_shortcut: out of memory\n");
+                pr_info("out of memory\n");
                 return;
         }
 
@@ -1238,7 +1294,7 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
         sk = sk_atm(vcc);
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, skb->len);
-        dprintk("mpoa: purge_egress_shortcut: exiting:\n");
+        dprintk("exiting\n");
 
         return;
 }
@@ -1247,14 +1303,14 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
  * Our MPS died. Tell our daemon to send NHRP data plane purge to each
  * of the egress shortcuts we have.
  */
-static void mps_death( struct k_message * msg, struct mpoa_client * mpc )
+static void mps_death(struct k_message *msg, struct mpoa_client *mpc)
 {
         eg_cache_entry *entry;
 
-        dprintk("mpoa: (%s) mps_death:\n", mpc->dev->name);
+        dprintk("(%s)\n", mpc->dev->name);
 
-        if(memcmp(msg->MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN)){
-                printk("mpoa: (%s) mps_death: wrong MPS\n", mpc->dev->name);
+        if (memcmp(msg->MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN)) {
+                pr_info("(%s) wrong MPS\n", mpc->dev->name);
                 return;
         }
 
@@ -1273,20 +1329,21 @@ static void mps_death( struct k_message * msg, struct mpoa_client * mpc )
         return;
 }
 
-static void MPOA_cache_impos_rcvd( struct k_message * msg, struct mpoa_client * mpc)
+static void MPOA_cache_impos_rcvd(struct k_message *msg,
+                                  struct mpoa_client *mpc)
 {
         uint16_t holding_time;
         eg_cache_entry *entry = mpc->eg_ops->get_by_cache_id(msg->content.eg_info.cache_id, mpc);
 
         holding_time = msg->content.eg_info.holding_time;
-        dprintk("mpoa: (%s) MPOA_cache_impos_rcvd: entry = %p, holding_time = %u\n",
-               mpc->dev->name, entry, holding_time);
-        if(entry == NULL && holding_time) {
+        dprintk("(%s) entry = %p, holding_time = %u\n",
+                mpc->dev->name, entry, holding_time);
+        if (entry == NULL && holding_time) {
                 entry = mpc->eg_ops->add_entry(msg, mpc);
                 mpc->eg_ops->put(entry);
                 return;
         }
-        if(holding_time){
+        if (holding_time) {
                 mpc->eg_ops->update(entry, holding_time);
                 return;
         }
@@ -1300,7 +1357,8 @@ static void MPOA_cache_impos_rcvd( struct k_message * msg, struct mpoa_client *
         return;
 }
 
-static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc)
+static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg,
+                                   struct mpoa_client *mpc)
 {
         struct lec_priv *priv;
         int i, retval ;
@@ -1315,34 +1373,39 @@ static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *m
         memcpy(&tlv[7], mesg->MPS_ctrl, ATM_ESA_LEN); /* MPC ctrl ATM addr */
         memcpy(mpc->our_ctrl_addr, mesg->MPS_ctrl, ATM_ESA_LEN);
 
-        dprintk("mpoa: (%s) setting MPC ctrl ATM address to ",
-               (mpc->dev) ? mpc->dev->name : "<unknown>");
+        dprintk("(%s) setting MPC ctrl ATM address to",
+                mpc->dev ? mpc->dev->name : "<unknown>");
         for (i = 7; i < sizeof(tlv); i++)
-                dprintk("%02x ", tlv[i]);
-        dprintk("\n");
+                dprintk_cont(" %02x", tlv[i]);
+        dprintk_cont("\n");
 
         if (mpc->dev) {
                 priv = netdev_priv(mpc->dev);
-                retval = priv->lane2_ops->associate_req(mpc->dev, mpc->dev->dev_addr, tlv, sizeof(tlv));
+                retval = priv->lane2_ops->associate_req(mpc->dev,
+                                                        mpc->dev->dev_addr,
+                                                        tlv, sizeof(tlv));
                 if (retval == 0)
-                        printk("mpoa: (%s) MPOA device type TLV association failed\n", mpc->dev->name);
+                        pr_info("(%s) MPOA device type TLV association failed\n",
+                                mpc->dev->name);
                 retval = priv->lane2_ops->resolve(mpc->dev, NULL, 1, NULL, NULL);
                 if (retval < 0)
-                        printk("mpoa: (%s) targetless LE_ARP request failed\n", mpc->dev->name);
+                        pr_info("(%s) targetless LE_ARP request failed\n",
+                                mpc->dev->name);
         }
 
         return;
 }
 
-static void set_mps_mac_addr_rcvd(struct k_message *msg, struct mpoa_client *client)
+static void set_mps_mac_addr_rcvd(struct k_message *msg,
+                                  struct mpoa_client *client)
 {
 
-        if(client->number_of_mps_macs)
+        if (client->number_of_mps_macs)
                 kfree(client->mps_macs);
         client->number_of_mps_macs = 0;
         client->mps_macs = kmemdup(msg->MPS_ctrl, ETH_ALEN, GFP_KERNEL);
         if (client->mps_macs == NULL) {
-                printk("mpoa: set_mps_mac_addr_rcvd: out of memory\n");
+                pr_info("out of memory\n");
                 return;
         }
         client->number_of_mps_macs = 1;
@@ -1363,11 +1426,11 @@ static void clean_up(struct k_message *msg, struct mpoa_client *mpc, int action)
         /* FIXME: This knows too much of the cache structure */
         read_lock_irq(&mpc->egress_lock);
         entry = mpc->eg_cache;
-        while (entry != NULL){
-                    msg->content.eg_info = entry->ctrl_info;
-                    dprintk("mpoa: cache_id %u\n", entry->ctrl_info.cache_id);
-                    msg_to_mpoad(msg, mpc);
-                    entry = entry->next;
+        while (entry != NULL) {
+                msg->content.eg_info = entry->ctrl_info;
+                dprintk("cache_id %u\n", entry->ctrl_info.cache_id);
+                msg_to_mpoad(msg, mpc);
+                entry = entry->next;
         }
         read_unlock_irq(&mpc->egress_lock);
 
@@ -1386,20 +1449,22 @@ static void mpc_timer_refresh(void)
         return;
 }
 
-static void mpc_cache_check( unsigned long checking_time  )
+static void mpc_cache_check(unsigned long checking_time)
 {
         struct mpoa_client *mpc = mpcs;
         static unsigned long previous_resolving_check_time;
         static unsigned long previous_refresh_time;
 
-        while( mpc != NULL ){
+        while (mpc != NULL) {
                 mpc->in_ops->clear_count(mpc);
                 mpc->eg_ops->clear_expired(mpc);
-                if(checking_time - previous_resolving_check_time > mpc->parameters.mpc_p4 * HZ ){
+                if (checking_time - previous_resolving_check_time >
+                    mpc->parameters.mpc_p4 * HZ) {
                         mpc->in_ops->check_resolving(mpc);
                         previous_resolving_check_time = checking_time;
                 }
-                if(checking_time - previous_refresh_time > mpc->parameters.mpc_p5 * HZ ){
+                if (checking_time - previous_refresh_time >
+                    mpc->parameters.mpc_p5 * HZ) {
                         mpc->in_ops->refresh(mpc);
                         previous_refresh_time = checking_time;
                 }
@@ -1410,7 +1475,8 @@ static void mpc_cache_check( unsigned long checking_time  )
         return;
 }
 
-static int atm_mpoa_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+static int atm_mpoa_ioctl(struct socket *sock, unsigned int cmd,
+                          unsigned long arg)
 {
         int err = 0;
         struct atm_vcc *vcc = ATM_SD(sock);
@@ -1422,21 +1488,20 @@ static int atm_mpoa_ioctl(struct socket *sock, unsigned int cmd, unsigned long a
                 return -EPERM;
 
         switch (cmd) {
-                case ATMMPC_CTRL:
-                        err = atm_mpoa_mpoad_attach(vcc, (int)arg);
-                        if (err >= 0)
-                                sock->state = SS_CONNECTED;
-                        break;
-                case ATMMPC_DATA:
-                        err = atm_mpoa_vcc_attach(vcc, (void __user *)arg);
-                        break;
-                default:
-                        break;
+        case ATMMPC_CTRL:
+                err = atm_mpoa_mpoad_attach(vcc, (int)arg);
+                if (err >= 0)
+                        sock->state = SS_CONNECTED;
+                break;
+        case ATMMPC_DATA:
+                err = atm_mpoa_vcc_attach(vcc, (void __user *)arg);
+                break;
+        default:
+                break;
         }
         return err;
 }
 
-
 static struct atm_ioctl atm_ioctl_ops = {
         .owner  = THIS_MODULE,
         .ioctl  = atm_mpoa_ioctl,
@@ -1447,9 +1512,9 @@ static __init int atm_mpoa_init(void)
         register_atm_ioctl(&atm_ioctl_ops);
 
         if (mpc_proc_init() != 0)
-                printk(KERN_INFO "mpoa: failed to initialize /proc/mpoa\n");
+                pr_info("failed to initialize /proc/mpoa\n");
 
-        printk("mpc.c: " __DATE__ " " __TIME__ " initialized\n");
+        pr_info("mpc.c: " __DATE__ " " __TIME__ " initialized\n");
 
         return 0;
 }
@@ -1476,15 +1541,15 @@ static void __exit atm_mpoa_cleanup(void)
                         if (priv->lane2_ops != NULL)
                                 priv->lane2_ops->associate_indicator = NULL;
                 }
-                ddprintk("mpoa: cleanup_module: about to clear caches\n");
+                ddprintk("about to clear caches\n");
                 mpc->in_ops->destroy_cache(mpc);
                 mpc->eg_ops->destroy_cache(mpc);
-                ddprintk("mpoa: cleanup_module: caches cleared\n");
+                ddprintk("caches cleared\n");
                 kfree(mpc->mps_macs);
                 memset(mpc, 0, sizeof(struct mpoa_client));
-                ddprintk("mpoa: cleanup_module: about to kfree %p\n", mpc);
+                ddprintk("about to kfree %p\n", mpc);
                 kfree(mpc);
-                ddprintk("mpoa: cleanup_module: next mpc is at %p\n", tmp);
+                ddprintk("next mpc is at %p\n", tmp);
                 mpc = tmp;
         }
 
@@ -1492,7 +1557,7 @@ static void __exit atm_mpoa_cleanup(void)
         qos_head = NULL;
         while (qos != NULL) {
                 nextqos = qos->next;
-                dprintk("mpoa: cleanup_module: freeing qos entry %p\n", qos);
+                dprintk("freeing qos entry %p\n", qos);
                 kfree(qos);
                 qos = nextqos;
         }
diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
index 4504a4b339bb..e773d8336918 100644
--- a/net/atm/mpoa_caches.c
+++ b/net/atm/mpoa_caches.c
@@ -1,5 +1,6 @@
 #include <linux/types.h>
 #include <linux/atmmpc.h>
+#include <linux/slab.h>
 #include <linux/time.h>
 
 #include "mpoa_caches.h"
@@ -11,15 +12,23 @@
  */
 
 #if 0
-#define dprintk printk    /* debug */
+#define dprintk(format, args...)                                        \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
 #else
-#define dprintk(format,args...)
+#define dprintk(format, args...)                                        \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
 #endif
 
 #if 0
-#define ddprintk printk  /* more debug */
+#define ddprintk(format, args...)                                       \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
 #else
-#define ddprintk(format,args...)
+#define ddprintk(format, args...)                                       \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
 #endif
 
 static in_cache_entry *in_cache_get(__be32 dst_ip,
@@ -29,8 +38,8 @@ static in_cache_entry *in_cache_get(__be32 dst_ip,
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                if( entry->ctrl_info.in_dst_ip == dst_ip ){
+        while (entry != NULL) {
+                if (entry->ctrl_info.in_dst_ip == dst_ip) {
                         atomic_inc(&entry->use);
                         read_unlock_bh(&client->ingress_lock);
                         return entry;
@@ -50,8 +59,8 @@ static in_cache_entry *in_cache_get_with_mask(__be32 dst_ip,
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                if((entry->ctrl_info.in_dst_ip & mask)  == (dst_ip & mask )){
+        while (entry != NULL) {
+                if ((entry->ctrl_info.in_dst_ip & mask) == (dst_ip & mask)) {
                         atomic_inc(&entry->use);
                         read_unlock_bh(&client->ingress_lock);
                         return entry;
@@ -65,14 +74,14 @@ static in_cache_entry *in_cache_get_with_mask(__be32 dst_ip,
 }
 
 static in_cache_entry *in_cache_get_by_vcc(struct atm_vcc *vcc,
-                                           struct mpoa_client *client )
+                                           struct mpoa_client *client)
 {
         in_cache_entry *entry;
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                if(entry->shortcut == vcc) {
+        while (entry != NULL) {
+                if (entry->shortcut == vcc) {
                         atomic_inc(&entry->use);
                         read_unlock_bh(&client->ingress_lock);
                         return entry;
@@ -90,14 +99,14 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip,
         in_cache_entry *entry = kzalloc(sizeof(in_cache_entry), GFP_KERNEL);
 
         if (entry == NULL) {
-                printk("mpoa: mpoa_caches.c: new_in_cache_entry: out of memory\n");
+                pr_info("mpoa: mpoa_caches.c: new_in_cache_entry: out of memory\n");
                 return NULL;
         }
 
-        dprintk("mpoa: mpoa_caches.c: adding an ingress entry, ip = %pI4\n", &dst_ip);
+        dprintk("adding an ingress entry, ip = %pI4\n", &dst_ip);
 
         atomic_set(&entry->use, 1);
-        dprintk("mpoa: mpoa_caches.c: new_in_cache_entry: about to lock\n");
+        dprintk("new_in_cache_entry: about to lock\n");
         write_lock_bh(&client->ingress_lock);
         entry->next = client->in_cache;
         entry->prev = NULL;
@@ -115,7 +124,7 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip,
         atomic_inc(&entry->use);
 
         write_unlock_bh(&client->ingress_lock);
-        dprintk("mpoa: mpoa_caches.c: new_in_cache_entry: unlocked\n");
+        dprintk("new_in_cache_entry: unlocked\n");
 
         return entry;
 }
@@ -126,39 +135,41 @@ static int cache_hit(in_cache_entry *entry, struct mpoa_client *mpc)
         struct k_message msg;
 
         entry->count++;
-        if(entry->entry_state == INGRESS_RESOLVED && entry->shortcut != NULL)
+        if (entry->entry_state == INGRESS_RESOLVED && entry->shortcut != NULL)
                 return OPEN;
 
-        if(entry->entry_state == INGRESS_REFRESHING){
-                if(entry->count > mpc->parameters.mpc_p1){
+        if (entry->entry_state == INGRESS_REFRESHING) {
+                if (entry->count > mpc->parameters.mpc_p1) {
                         msg.type = SND_MPOA_RES_RQST;
                         msg.content.in_info = entry->ctrl_info;
                         memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN);
                         qos = atm_mpoa_search_qos(entry->ctrl_info.in_dst_ip);
-                        if (qos != NULL) msg.qos = qos->qos;
+                        if (qos != NULL)
+                                msg.qos = qos->qos;
                         msg_to_mpoad(&msg, mpc);
                         do_gettimeofday(&(entry->reply_wait));
                         entry->entry_state = INGRESS_RESOLVING;
                 }
-                if(entry->shortcut != NULL)
+                if (entry->shortcut != NULL)
                         return OPEN;
                 return CLOSED;
         }
 
-        if(entry->entry_state == INGRESS_RESOLVING && entry->shortcut != NULL)
+        if (entry->entry_state == INGRESS_RESOLVING && entry->shortcut != NULL)
                 return OPEN;
 
-        if( entry->count > mpc->parameters.mpc_p1 &&
-            entry->entry_state == INGRESS_INVALID){
-                dprintk("mpoa: (%s) mpoa_caches.c: threshold exceeded for ip %pI4, sending MPOA res req\n",
+        if (entry->count > mpc->parameters.mpc_p1 &&
+            entry->entry_state == INGRESS_INVALID) {
+                dprintk("(%s) threshold exceeded for ip %pI4, sending MPOA res req\n",
                         mpc->dev->name, &entry->ctrl_info.in_dst_ip);
                 entry->entry_state = INGRESS_RESOLVING;
-                msg.type =  SND_MPOA_RES_RQST;
-                memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN );
+                msg.type = SND_MPOA_RES_RQST;
+                memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN);
                 msg.content.in_info = entry->ctrl_info;
                 qos = atm_mpoa_search_qos(entry->ctrl_info.in_dst_ip);
-                if (qos != NULL) msg.qos = qos->qos;
-                msg_to_mpoad( &msg, mpc);
+                if (qos != NULL)
+                        msg.qos = qos->qos;
+                msg_to_mpoad(&msg, mpc);
                 do_gettimeofday(&(entry->reply_wait));
         }
 
@@ -185,7 +196,7 @@ static void in_cache_remove_entry(in_cache_entry *entry,
         struct k_message msg;
 
         vcc = entry->shortcut;
-        dprintk("mpoa: mpoa_caches.c: removing an ingress entry, ip = %pI4\n",
+        dprintk("removing an ingress entry, ip = %pI4\n",
                 &entry->ctrl_info.in_dst_ip);
 
         if (entry->prev != NULL)
@@ -195,14 +206,15 @@ static void in_cache_remove_entry(in_cache_entry *entry,
         if (entry->next != NULL)
                 entry->next->prev = entry->prev;
         client->in_ops->put(entry);
-        if(client->in_cache == NULL && client->eg_cache == NULL){
+        if (client->in_cache == NULL && client->eg_cache == NULL) {
                 msg.type = STOP_KEEP_ALIVE_SM;
-                msg_to_mpoad(&msg,client);
+                msg_to_mpoad(&msg, client);
         }
 
         /* Check if the egress side still uses this VCC */
         if (vcc != NULL) {
-                eg_cache_entry *eg_entry = client->eg_ops->get_by_vcc(vcc, client);
+                eg_cache_entry *eg_entry = client->eg_ops->get_by_vcc(vcc,
+                                                                      client);
                 if (eg_entry != NULL) {
                         client->eg_ops->put(eg_entry);
                         return;
@@ -213,7 +225,6 @@ static void in_cache_remove_entry(in_cache_entry *entry,
         return;
 }
 
-
 /* Call this every MPC-p2 seconds... Not exactly correct solution,
    but an easy one... */
 static void clear_count_and_expired(struct mpoa_client *client)
@@ -225,12 +236,12 @@ static void clear_count_and_expired(struct mpoa_client *client)
 
         write_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                entry->count=0;
+        while (entry != NULL) {
+                entry->count = 0;
                 next_entry = entry->next;
-                if((now.tv_sec - entry->tv.tv_sec)
-                   > entry->ctrl_info.holding_time){
-                        dprintk("mpoa: mpoa_caches.c: holding time expired, ip = %pI4\n",
+                if ((now.tv_sec - entry->tv.tv_sec)
+                   > entry->ctrl_info.holding_time) {
+                        dprintk("holding time expired, ip = %pI4\n",
                                 &entry->ctrl_info.in_dst_ip);
                         client->in_ops->remove_entry(entry, client);
                 }
@@ -250,33 +261,38 @@ static void check_resolving_entries(struct mpoa_client *client)
         struct timeval now;
         struct k_message msg;
 
-        do_gettimeofday( &now );
+        do_gettimeofday(&now);
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while( entry != NULL ){
-                if(entry->entry_state == INGRESS_RESOLVING){
-                        if(now.tv_sec - entry->hold_down.tv_sec < client->parameters.mpc_p6){
-                                entry = entry->next;                      /* Entry in hold down */
+        while (entry != NULL) {
+                if (entry->entry_state == INGRESS_RESOLVING) {
+                        if ((now.tv_sec - entry->hold_down.tv_sec) <
+                            client->parameters.mpc_p6) {
+                                entry = entry->next;    /* Entry in hold down */
                                 continue;
                         }
-                        if( (now.tv_sec - entry->reply_wait.tv_sec) >
-                            entry->retry_time ){
-                                entry->retry_time = MPC_C1*( entry->retry_time );
-                                if(entry->retry_time > client->parameters.mpc_p5){
-                                        /* Retry time maximum exceeded, put entry in hold down. */
+                        if ((now.tv_sec - entry->reply_wait.tv_sec) >
+                            entry->retry_time) {
+                                entry->retry_time = MPC_C1 * (entry->retry_time);
+                                /*
+                                 * Retry time maximum exceeded,
+                                 * put entry in hold down.
+                                 */
+                                if (entry->retry_time > client->parameters.mpc_p5) {
                                         do_gettimeofday(&(entry->hold_down));
                                         entry->retry_time = client->parameters.mpc_p4;
                                         entry = entry->next;
                                         continue;
                                 }
                                 /* Ask daemon to send a resolution request. */
-                                memset(&(entry->hold_down),0,sizeof(struct timeval));
+                                memset(&(entry->hold_down), 0, sizeof(struct timeval));
                                 msg.type = SND_MPOA_RES_RTRY;
                                 memcpy(msg.MPS_ctrl, client->mps_ctrl_addr, ATM_ESA_LEN);
                                 msg.content.in_info = entry->ctrl_info;
                                 qos = atm_mpoa_search_qos(entry->ctrl_info.in_dst_ip);
-                                if (qos != NULL) msg.qos = qos->qos;
+                                if (qos != NULL)
+                                        msg.qos = qos->qos;
                                 msg_to_mpoad(&msg, client);
                                 do_gettimeofday(&(entry->reply_wait));
                         }
@@ -292,16 +308,17 @@ static void refresh_entries(struct mpoa_client *client)
         struct timeval now;
         struct in_cache_entry *entry = client->in_cache;
 
-        ddprintk("mpoa: mpoa_caches.c: refresh_entries\n");
+        ddprintk("refresh_entries\n");
         do_gettimeofday(&now);
 
         read_lock_bh(&client->ingress_lock);
-        while( entry != NULL ){
-                if( entry->entry_state == INGRESS_RESOLVED ){
-                        if(!(entry->refresh_time))
-                                entry->refresh_time = (2*(entry->ctrl_info.holding_time))/3;
-                        if( (now.tv_sec - entry->reply_wait.tv_sec) > entry->refresh_time ){
-                                dprintk("mpoa: mpoa_caches.c: refreshing an entry.\n");
+        while (entry != NULL) {
+                if (entry->entry_state == INGRESS_RESOLVED) {
+                        if (!(entry->refresh_time))
+                                entry->refresh_time = (2 * (entry->ctrl_info.holding_time))/3;
+                        if ((now.tv_sec - entry->reply_wait.tv_sec) >
+                            entry->refresh_time) {
+                                dprintk("refreshing an entry.\n");
                                 entry->entry_state = INGRESS_REFRESHING;
 
                         }
@@ -314,21 +331,22 @@ static void refresh_entries(struct mpoa_client *client)
 static void in_destroy_cache(struct mpoa_client *mpc)
 {
         write_lock_irq(&mpc->ingress_lock);
-        while(mpc->in_cache != NULL)
+        while (mpc->in_cache != NULL)
                 mpc->in_ops->remove_entry(mpc->in_cache, mpc);
         write_unlock_irq(&mpc->ingress_lock);
 
         return;
 }
 
-static eg_cache_entry *eg_cache_get_by_cache_id(__be32 cache_id, struct mpoa_client *mpc)
+static eg_cache_entry *eg_cache_get_by_cache_id(__be32 cache_id,
+                                                struct mpoa_client *mpc)
 {
         eg_cache_entry *entry;
 
         read_lock_irq(&mpc->egress_lock);
         entry = mpc->eg_cache;
-        while(entry != NULL){
-                if(entry->ctrl_info.cache_id == cache_id){
+        while (entry != NULL) {
+                if (entry->ctrl_info.cache_id == cache_id) {
                         atomic_inc(&entry->use);
                         read_unlock_irq(&mpc->egress_lock);
                         return entry;
@@ -348,7 +366,7 @@ static eg_cache_entry *eg_cache_get_by_tag(__be32 tag, struct mpoa_client *mpc)
 
         read_lock_irqsave(&mpc->egress_lock, flags);
         entry = mpc->eg_cache;
-        while (entry != NULL){
+        while (entry != NULL) {
                 if (entry->ctrl_info.tag == tag) {
                         atomic_inc(&entry->use);
                         read_unlock_irqrestore(&mpc->egress_lock, flags);
@@ -362,14 +380,15 @@ static eg_cache_entry *eg_cache_get_by_tag(__be32 tag, struct mpoa_client *mpc)
 }
 
 /* This can be called from any context since it saves CPU flags */
-static eg_cache_entry *eg_cache_get_by_vcc(struct atm_vcc *vcc, struct mpoa_client *mpc)
+static eg_cache_entry *eg_cache_get_by_vcc(struct atm_vcc *vcc,
+                                           struct mpoa_client *mpc)
 {
         unsigned long flags;
         eg_cache_entry *entry;
 
         read_lock_irqsave(&mpc->egress_lock, flags);
         entry = mpc->eg_cache;
-        while (entry != NULL){
+        while (entry != NULL) {
                 if (entry->shortcut == vcc) {
                         atomic_inc(&entry->use);
                         read_unlock_irqrestore(&mpc->egress_lock, flags);
@@ -382,14 +401,15 @@ static eg_cache_entry *eg_cache_get_by_vcc(struct atm_vcc *vcc, struct mpoa_clie
         return NULL;
 }
 
-static eg_cache_entry *eg_cache_get_by_src_ip(__be32 ipaddr, struct mpoa_client *mpc)
+static eg_cache_entry *eg_cache_get_by_src_ip(__be32 ipaddr,
+                                              struct mpoa_client *mpc)
 {
         eg_cache_entry *entry;
 
         read_lock_irq(&mpc->egress_lock);
         entry = mpc->eg_cache;
-        while(entry != NULL){
-                if(entry->latest_ip_addr == ipaddr) {
+        while (entry != NULL) {
+                if (entry->latest_ip_addr == ipaddr) {
                         atomic_inc(&entry->use);
                         read_unlock_irq(&mpc->egress_lock);
                         return entry;
@@ -421,7 +441,7 @@ static void eg_cache_remove_entry(eg_cache_entry *entry,
         struct k_message msg;
 
         vcc = entry->shortcut;
-        dprintk("mpoa: mpoa_caches.c: removing an egress entry.\n");
+        dprintk("removing an egress entry.\n");
         if (entry->prev != NULL)
                 entry->prev->next = entry->next;
         else
@@ -429,9 +449,9 @@ static void eg_cache_remove_entry(eg_cache_entry *entry,
         if (entry->next != NULL)
                 entry->next->prev = entry->prev;
         client->eg_ops->put(entry);
-        if(client->in_cache == NULL && client->eg_cache == NULL){
+        if (client->in_cache == NULL && client->eg_cache == NULL) {
                 msg.type = STOP_KEEP_ALIVE_SM;
-                msg_to_mpoad(&msg,client);
+                msg_to_mpoad(&msg, client);
         }
 
         /* Check if the ingress side still uses this VCC */
@@ -447,20 +467,21 @@ static void eg_cache_remove_entry(eg_cache_entry *entry,
         return;
 }
 
-static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_client *client)
+static eg_cache_entry *eg_cache_add_entry(struct k_message *msg,
+                                          struct mpoa_client *client)
 {
         eg_cache_entry *entry = kzalloc(sizeof(eg_cache_entry), GFP_KERNEL);
 
         if (entry == NULL) {
-                printk("mpoa: mpoa_caches.c: new_eg_cache_entry: out of memory\n");
+                pr_info("out of memory\n");
                 return NULL;
         }
 
-        dprintk("mpoa: mpoa_caches.c: adding an egress entry, ip = %pI4, this should be our IP\n",
+        dprintk("adding an egress entry, ip = %pI4, this should be our IP\n",
                 &msg->content.eg_info.eg_dst_ip);
 
         atomic_set(&entry->use, 1);
-        dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry: about to lock\n");
+        dprintk("new_eg_cache_entry: about to lock\n");
         write_lock_irq(&client->egress_lock);
         entry->next = client->eg_cache;
         entry->prev = NULL;
@@ -472,18 +493,18 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_cli
         entry->ctrl_info = msg->content.eg_info;
         do_gettimeofday(&(entry->tv));
         entry->entry_state = EGRESS_RESOLVED;
-        dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry cache_id %lu\n", ntohl(entry->ctrl_info.cache_id));
-        dprintk("mpoa: mpoa_caches.c: mps_ip = %pI4\n",
-                &entry->ctrl_info.mps_ip);
+        dprintk("new_eg_cache_entry cache_id %u\n",
+                ntohl(entry->ctrl_info.cache_id));
+        dprintk("mps_ip = %pI4\n", &entry->ctrl_info.mps_ip);
         atomic_inc(&entry->use);
 
         write_unlock_irq(&client->egress_lock);
-        dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry: unlocked\n");
+        dprintk("new_eg_cache_entry: unlocked\n");
 
         return entry;
 }
 
-static void update_eg_cache_entry(eg_cache_entry * entry, uint16_t holding_time)
+static void update_eg_cache_entry(eg_cache_entry *entry, uint16_t holding_time)
 {
         do_gettimeofday(&(entry->tv));
         entry->entry_state = EGRESS_RESOLVED;
@@ -502,13 +523,14 @@ static void clear_expired(struct mpoa_client *client)
 
         write_lock_irq(&client->egress_lock);
         entry = client->eg_cache;
-        while(entry != NULL){
+        while (entry != NULL) {
                 next_entry = entry->next;
-                if((now.tv_sec - entry->tv.tv_sec)
-                   > entry->ctrl_info.holding_time){
+                if ((now.tv_sec - entry->tv.tv_sec)
+                   > entry->ctrl_info.holding_time) {
                         msg.type = SND_EGRESS_PURGE;
                         msg.content.eg_info = entry->ctrl_info;
-                        dprintk("mpoa: mpoa_caches.c: egress_cache: holding time expired, cache_id = %lu.\n",ntohl(entry->ctrl_info.cache_id));
+                        dprintk("egress_cache: holding time expired, cache_id = %u.\n",
+                                ntohl(entry->ctrl_info.cache_id));
                         msg_to_mpoad(&msg, client);
                         client->eg_ops->remove_entry(entry, client);
                 }
@@ -522,7 +544,7 @@ static void clear_expired(struct mpoa_client *client)
 static void eg_destroy_cache(struct mpoa_client *mpc)
 {
         write_lock_irq(&mpc->egress_lock);
-        while(mpc->eg_cache != NULL)
+        while (mpc->eg_cache != NULL)
                 mpc->eg_ops->remove_entry(mpc->eg_cache, mpc);
         write_unlock_irq(&mpc->egress_lock);
 
@@ -530,7 +552,6 @@ static void eg_destroy_cache(struct mpoa_client *mpc)
 }
 
 
-
 static struct in_cache_ops ingress_ops = {
         in_cache_add_entry,               /* add_entry       */
         in_cache_get,                     /* get             */
diff --git a/net/atm/mpoa_proc.c b/net/atm/mpoa_proc.c
index 1a0f5ccea9c4..53e500292271 100644
--- a/net/atm/mpoa_proc.c
+++ b/net/atm/mpoa_proc.c
@@ -1,3 +1,4 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #ifdef CONFIG_PROC_FS
 #include <linux/errno.h>
@@ -8,9 +9,10 @@
 #include <linux/proc_fs.h>
 #include <linux/time.h>
 #include <linux/seq_file.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <linux/atmmpc.h>
 #include <linux/atm.h>
+#include <linux/gfp.h>
 #include "mpc.h"
 #include "mpoa_caches.h"
 
@@ -20,9 +22,23 @@
  */
 
 #if 1
-#define dprintk printk   /* debug */
+#define dprintk(format, args...)                                        \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
 #else
-#define dprintk(format,args...)
+#define dprintk(format, args...)                                        \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
+#endif
+
+#if 0
+#define ddprintk(format, args...)                                       \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
+#else
+#define ddprintk(format, args...)                                       \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
 #endif
 
 #define STAT_FILE_NAME "mpc"     /* Our statistic file's name */
@@ -51,42 +67,37 @@ static const struct file_operations mpc_file_operations = {
 /*
  * Returns the state of an ingress cache entry as a string
  */
-static const char *ingress_state_string(int state){
-        switch(state) {
+static const char *ingress_state_string(int state)
+{
+        switch (state) {
         case INGRESS_RESOLVING:
                 return "resolving  ";
-                break;
         case INGRESS_RESOLVED:
                 return "resolved   ";
-                break;
         case INGRESS_INVALID:
                 return "invalid    ";
-                break;
         case INGRESS_REFRESHING:
                 return "refreshing ";
-                break;
-        default:
-               return "";
         }
+
+        return "";
 }
 
 /*
  * Returns the state of an egress cache entry as a string
  */
-static const char *egress_state_string(int state){
-        switch(state) {
+static const char *egress_state_string(int state)
+{
+        switch (state) {
         case EGRESS_RESOLVED:
                 return "resolved   ";
-                break;
         case EGRESS_PURGE:
                 return "purge      ";
-                break;
         case EGRESS_INVALID:
                 return "invalid    ";
-                break;
-        default:
-               return "";
         }
+
+        return "";
 }
 
 /*
@@ -123,7 +134,6 @@ static void mpc_stop(struct seq_file *m, void *v)
 static int mpc_show(struct seq_file *m, void *v)
 {
         struct mpoa_client *mpc = v;
-        unsigned char *temp;
         int i;
         in_cache_entry *in_entry;
         eg_cache_entry *eg_entry;
@@ -140,15 +150,17 @@ static int mpc_show(struct seq_file *m, void *v)
         do_gettimeofday(&now);
 
         for (in_entry = mpc->in_cache; in_entry; in_entry = in_entry->next) {
-                temp = (unsigned char *)&in_entry->ctrl_info.in_dst_ip;
-                sprintf(ip_string,"%d.%d.%d.%d", temp[0], temp[1], temp[2], temp[3]);
+                sprintf(ip_string, "%pI4", &in_entry->ctrl_info.in_dst_ip);
                 seq_printf(m, "%-16s%s%-14lu%-12u",
-                              ip_string,
-                              ingress_state_string(in_entry->entry_state),
-                              in_entry->ctrl_info.holding_time-(now.tv_sec-in_entry->tv.tv_sec),
-                              in_entry->packets_fwded);
+                           ip_string,
+                           ingress_state_string(in_entry->entry_state),
+                           in_entry->ctrl_info.holding_time -
+                           (now.tv_sec-in_entry->tv.tv_sec),
+                           in_entry->packets_fwded);
                 if (in_entry->shortcut)
-                        seq_printf(m, "   %-3d  %-3d",in_entry->shortcut->vpi,in_entry->shortcut->vci);
+                        seq_printf(m, "   %-3d  %-3d",
+                                   in_entry->shortcut->vpi,
+                                   in_entry->shortcut->vci);
                 seq_printf(m, "\n");
         }
 
@@ -156,21 +168,23 @@ static int mpc_show(struct seq_file *m, void *v)
         seq_printf(m, "Egress Entries:\nIngress MPC ATM addr\nCache-id        State      Holding time  Packets recvd  Latest IP addr   VPI VCI\n");
         for (eg_entry = mpc->eg_cache; eg_entry; eg_entry = eg_entry->next) {
                 unsigned char *p = eg_entry->ctrl_info.in_MPC_data_ATM_addr;
-                for(i = 0; i < ATM_ESA_LEN; i++)
+                for (i = 0; i < ATM_ESA_LEN; i++)
                         seq_printf(m, "%02x", p[i]);
                 seq_printf(m, "\n%-16lu%s%-14lu%-15u",
                            (unsigned long)ntohl(eg_entry->ctrl_info.cache_id),
                            egress_state_string(eg_entry->entry_state),
-                           (eg_entry->ctrl_info.holding_time-(now.tv_sec-eg_entry->tv.tv_sec)),
+                           (eg_entry->ctrl_info.holding_time -
+                            (now.tv_sec-eg_entry->tv.tv_sec)),
                            eg_entry->packets_rcvd);
 
                 /* latest IP address */
-                temp = (unsigned char *)&eg_entry->latest_ip_addr;
-                sprintf(ip_string, "%d.%d.%d.%d", temp[0], temp[1], temp[2], temp[3]);
+                sprintf(ip_string, "%pI4", &eg_entry->latest_ip_addr);
                 seq_printf(m, "%-16s", ip_string);
 
                 if (eg_entry->shortcut)
-                        seq_printf(m, " %-3d %-3d",eg_entry->shortcut->vpi,eg_entry->shortcut->vci);
+                        seq_printf(m, " %-3d %-3d",
+                                   eg_entry->shortcut->vpi,
+                                   eg_entry->shortcut->vci);
                 seq_printf(m, "\n");
         }
         seq_printf(m, "\n");
@@ -258,12 +272,9 @@ static int parse_qos(const char *buff)
         qos.rxtp.max_pcr = rx_pcr;
         qos.rxtp.max_sdu = rx_sdu;
         qos.aal = ATM_AAL5;
-        dprintk("mpoa: mpoa_proc.c: parse_qos(): setting qos paramameters to tx=%d,%d rx=%d,%d\n",
-                qos.txtp.max_pcr,
-                qos.txtp.max_sdu,
-                qos.rxtp.max_pcr,
-                qos.rxtp.max_sdu
-                );
+        dprintk("parse_qos(): setting qos paramameters to tx=%d,%d rx=%d,%d\n",
+                qos.txtp.max_pcr, qos.txtp.max_sdu,
+                qos.rxtp.max_pcr, qos.rxtp.max_sdu);
 
         atm_mpoa_add_qos(ipaddr, &qos);
         return 1;
@@ -278,7 +289,7 @@ int mpc_proc_init(void)
 
         p = proc_create(STAT_FILE_NAME, 0, atm_proc_root, &mpc_file_operations);
         if (!p) {
-                printk(KERN_ERR "Unable to initialize /proc/atm/%s\n", STAT_FILE_NAME);
+                pr_err("Unable to initialize /proc/atm/%s\n", STAT_FILE_NAME);
                 return -ENOMEM;
         }
         return 0;
@@ -289,10 +300,9 @@ int mpc_proc_init(void)
  */
 void mpc_proc_clean(void)
 {
-        remove_proc_entry(STAT_FILE_NAME,atm_proc_root);
+        remove_proc_entry(STAT_FILE_NAME, atm_proc_root);
 }
 
-
 #endif /* CONFIG_PROC_FS */
 
 
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 0af84cd4f65b..e49bb6d948a1 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -33,9 +33,12 @@
  * These hooks are not yet available in ppp_generic
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/atm.h>
 #include <linux/atmdev.h>
 #include <linux/capability.h>
@@ -132,7 +135,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc *atmvcc)
 static void pppoatm_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
 {
         struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
-        pr_debug("pppoatm push\n");
+        pr_debug("\n");
         if (skb == NULL) {                      /* VCC was closed */
                 pr_debug("removing ATMPPP VCC %p\n", pvcc);
                 pppoatm_unassign_vcc(atmvcc);
@@ -165,17 +168,17 @@ static void pppoatm_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         pvcc->chan.mtu += LLC_LEN;
                         break;
                 }
-                pr_debug("Couldn't autodetect yet "
-                    "(skb: %02X %02X %02X %02X %02X %02X)\n",
-                    skb->data[0], skb->data[1], skb->data[2],
-                    skb->data[3], skb->data[4], skb->data[5]);
+                pr_debug("Couldn't autodetect yet (skb: %02X %02X %02X %02X %02X %02X)\n",
+                         skb->data[0], skb->data[1], skb->data[2],
+                         skb->data[3], skb->data[4], skb->data[5]);
                 goto error;
         case e_vc:
                 break;
         }
         ppp_input(&pvcc->chan, skb);
         return;
-    error:
+
+error:
         kfree_skb(skb);
         ppp_input_error(&pvcc->chan, 0);
 }
@@ -194,7 +197,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
 {
         struct pppoatm_vcc *pvcc = chan_to_pvcc(chan);
         ATM_SKB(skb)->vcc = pvcc->atmvcc;
-        pr_debug("pppoatm_send (skb=0x%p, vcc=0x%p)\n", skb, pvcc->atmvcc);
+        pr_debug("(skb=0x%p, vcc=0x%p)\n", skb, pvcc->atmvcc);
         if (skb->data[0] == '\0' && (pvcc->flags & SC_COMP_PROT))
                 (void) skb_pull(skb, 1);
         switch (pvcc->encaps) {         /* LLC encapsulation needed */
@@ -208,7 +211,8 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
                                 goto nospace;
                         }
                         kfree_skb(skb);
-                        if ((skb = n) == NULL)
+                        skb = n;
+                        if (skb == NULL)
                                 return DROP_PACKET;
                 } else if (!atm_may_send(pvcc->atmvcc, skb->truesize))
                         goto nospace;
@@ -226,11 +230,11 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
 
         atomic_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
         ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
-        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, ATM_SKB(skb)->vcc,
-            ATM_SKB(skb)->vcc->dev);
+        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
+                 skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
         return ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
             ? DROP_PACKET : 1;
-    nospace:
+nospace:
         /*
          * We don't have space to send this SKB now, but we might have
          * already applied SC_COMP_PROT compression, so may need to undo
@@ -289,7 +293,8 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
             (be.encaps == e_vc ? 0 : LLC_LEN);
         pvcc->wakeup_tasklet = tasklet_proto;
         pvcc->wakeup_tasklet.data = (unsigned long) &pvcc->chan;
-        if ((err = ppp_register_channel(&pvcc->chan)) != 0) {
+        err = ppp_register_channel(&pvcc->chan);
+        if (err != 0) {
                 kfree(pvcc);
                 return err;
         }
diff --git a/net/atm/proc.c b/net/atm/proc.c
index ab8419a324b6..696e218436e5 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -22,17 +22,18 @@
 #include <linux/netdevice.h>
 #include <linux/atmclip.h>
 #include <linux/init.h> /* for __init */
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/atmclip.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
+#include <linux/param.h> /* for HZ */
 #include <asm/atomic.h>
-#include <asm/param.h> /* for HZ */
 #include "resources.h"
 #include "common.h" /* atm_proc_init prototype */
 #include "signaling.h" /* to get sigd - ugly too */
 
-static ssize_t proc_dev_atm_read(struct file *file,char __user *buf,size_t count,
-    loff_t *pos);
+static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
+                                 size_t count, loff_t *pos);
 
 static const struct file_operations proc_atm_dev_ops = {
         .owner =        THIS_MODULE,
@@ -43,9 +44,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
   const struct k_atm_aal_stats *stats)
 {
         seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
-            atomic_read(&stats->tx),atomic_read(&stats->tx_err),
-            atomic_read(&stats->rx),atomic_read(&stats->rx_err),
-            atomic_read(&stats->rx_drop));
+                   atomic_read(&stats->tx), atomic_read(&stats->tx_err),
+                   atomic_read(&stats->rx), atomic_read(&stats->rx_err),
+                   atomic_read(&stats->rx_drop));
 }
 
 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
@@ -151,8 +152,8 @@ static void *vcc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
 static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
 {
-        static const char *const class_name[] =
-                {"off","UBR","CBR","VBR","ABR"};
+        static const char *const class_name[] = {
+                "off", "UBR", "CBR", "VBR", "ABR"};
         static const char *const aal_name[] = {
                 "---",  "1",    "2",    "3/4",  /*  0- 3 */
                 "???",  "5",    "???",  "???",  /*  4- 7 */
@@ -160,11 +161,12 @@ static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
                 "???",  "0",    "???",  "???"}; /* 12-15 */
 
         seq_printf(seq, "%3d %3d %5d %-3s %7d %-5s %7d %-6s",
-            vcc->dev->number,vcc->vpi,vcc->vci,
-            vcc->qos.aal >= ARRAY_SIZE(aal_name) ? "err" :
-            aal_name[vcc->qos.aal],vcc->qos.rxtp.min_pcr,
-            class_name[vcc->qos.rxtp.traffic_class],vcc->qos.txtp.min_pcr,
-            class_name[vcc->qos.txtp.traffic_class]);
+                   vcc->dev->number, vcc->vpi, vcc->vci,
+                   vcc->qos.aal >= ARRAY_SIZE(aal_name) ? "err" :
+                   aal_name[vcc->qos.aal], vcc->qos.rxtp.min_pcr,
+                   class_name[vcc->qos.rxtp.traffic_class],
+                   vcc->qos.txtp.min_pcr,
+                   class_name[vcc->qos.txtp.traffic_class]);
         if (test_bit(ATM_VF_IS_CLIP, &vcc->flags)) {
                 struct clip_vcc *clip_vcc = CLIP_VCC(vcc);
                 struct net_device *dev;
@@ -195,19 +197,20 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
                 seq_printf(seq, "%3d %3d %5d ", vcc->dev->number, vcc->vpi,
                         vcc->vci);
         switch (sk->sk_family) {
-                case AF_ATMPVC:
-                        seq_printf(seq, "PVC");
-                        break;
-                case AF_ATMSVC:
-                        seq_printf(seq, "SVC");
-                        break;
-                default:
-                        seq_printf(seq, "%3d", sk->sk_family);
+        case AF_ATMPVC:
+                seq_printf(seq, "PVC");
+                break;
+        case AF_ATMSVC:
+                seq_printf(seq, "SVC");
+                break;
+        default:
+                seq_printf(seq, "%3d", sk->sk_family);
         }
-        seq_printf(seq, " %04lx  %5d %7d/%7d %7d/%7d [%d]\n", vcc->flags, sk->sk_err,
-                  sk_wmem_alloc_get(sk), sk->sk_sndbuf,
-                  sk_rmem_alloc_get(sk), sk->sk_rcvbuf,
-                  atomic_read(&sk->sk_refcnt));
+        seq_printf(seq, " %04lx  %5d %7d/%7d %7d/%7d [%d]\n",
+                   vcc->flags, sk->sk_err,
+                   sk_wmem_alloc_get(sk), sk->sk_sndbuf,
+                   sk_rmem_alloc_get(sk), sk->sk_rcvbuf,
+                   atomic_read(&sk->sk_refcnt));
 }
 
 static void svc_info(struct seq_file *seq, struct atm_vcc *vcc)
@@ -236,7 +239,7 @@ static int atm_dev_seq_show(struct seq_file *seq, void *v)
                 "Itf Type    ESI/\"MAC\"addr "
                 "AAL(TX,err,RX,err,drop) ...               [refcnt]\n";
 
-        if (v == SEQ_START_TOKEN)
+        if (v == &atm_devs)
                 seq_puts(seq, atm_dev_banner);
         else {
                 struct atm_dev *dev = list_entry(v, struct atm_dev, dev_list);
@@ -376,32 +379,35 @@ static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
         unsigned long page;
         int length;
 
-        if (count == 0) return 0;
+        if (count == 0)
+                return 0;
         page = get_zeroed_page(GFP_KERNEL);
-        if (!page) return -ENOMEM;
+        if (!page)
+                return -ENOMEM;
         dev = PDE(file->f_path.dentry->d_inode)->data;
         if (!dev->ops->proc_read)
                 length = -EINVAL;
         else {
-                length = dev->ops->proc_read(dev,pos,(char *) page);
-                if (length > count) length = -EINVAL;
+                length = dev->ops->proc_read(dev, pos, (char *)page);
+                if (length > count)
+                        length = -EINVAL;
         }
         if (length >= 0) {
-                if (copy_to_user(buf,(char *) page,length)) length = -EFAULT;
+                if (copy_to_user(buf, (char *)page, length))
+                        length = -EFAULT;
                 (*pos)++;
         }
         free_page(page);
         return length;
 }
 
-
 struct proc_dir_entry *atm_proc_root;
 EXPORT_SYMBOL(atm_proc_root);
 
 
 int atm_proc_dev_register(struct atm_dev *dev)
 {
-        int digits,num;
+        int digits, num;
         int error;
 
         /* No proc info */
@@ -410,26 +416,28 @@ int atm_proc_dev_register(struct atm_dev *dev)
 
         error = -ENOMEM;
         digits = 0;
-        for (num = dev->number; num; num /= 10) digits++;
-        if (!digits) digits++;
+        for (num = dev->number; num; num /= 10)
+                digits++;
+        if (!digits)
+                digits++;
 
         dev->proc_name = kmalloc(strlen(dev->type) + digits + 2, GFP_KERNEL);
         if (!dev->proc_name)
                 goto err_out;
-        sprintf(dev->proc_name,"%s:%d",dev->type, dev->number);
+        sprintf(dev->proc_name, "%s:%d", dev->type, dev->number);
 
         dev->proc_entry = proc_create_data(dev->proc_name, 0, atm_proc_root,
                                            &proc_atm_dev_ops, dev);
         if (!dev->proc_entry)
                 goto err_free_name;
         return 0;
+
 err_free_name:
         kfree(dev->proc_name);
 err_out:
         return error;
 }
 
-
 void atm_proc_dev_deregister(struct atm_dev *dev)
 {
         if (!dev->ops->proc_read)
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index d4c024504f99..437ee70c5e62 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -17,32 +17,35 @@
 #include "common.h"             /* common for PVCs and SVCs */
 
 
-static int pvc_shutdown(struct socket *sock,int how)
+static int pvc_shutdown(struct socket *sock, int how)
 {
         return 0;
 }
 
-
-static int pvc_bind(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len)
+static int pvc_bind(struct socket *sock, struct sockaddr *sockaddr,
+                    int sockaddr_len)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_atmpvc *addr;
         struct atm_vcc *vcc;
         int error;
 
-        if (sockaddr_len != sizeof(struct sockaddr_atmpvc)) return -EINVAL;
-        addr = (struct sockaddr_atmpvc *) sockaddr;
-        if (addr->sap_family != AF_ATMPVC) return -EAFNOSUPPORT;
+        if (sockaddr_len != sizeof(struct sockaddr_atmpvc))
+                return -EINVAL;
+        addr = (struct sockaddr_atmpvc *)sockaddr;
+        if (addr->sap_family != AF_ATMPVC)
+                return -EAFNOSUPPORT;
         lock_sock(sk);
         vcc = ATM_SD(sock);
         if (!test_bit(ATM_VF_HASQOS, &vcc->flags)) {
                 error = -EBADFD;
                 goto out;
         }
-        if (test_bit(ATM_VF_PARTIAL,&vcc->flags)) {
-                if (vcc->vpi != ATM_VPI_UNSPEC) addr->sap_addr.vpi = vcc->vpi;
-                if (vcc->vci != ATM_VCI_UNSPEC) addr->sap_addr.vci = vcc->vci;
+        if (test_bit(ATM_VF_PARTIAL, &vcc->flags)) {
+                if (vcc->vpi != ATM_VPI_UNSPEC)
+                        addr->sap_addr.vpi = vcc->vpi;
+                if (vcc->vci != ATM_VCI_UNSPEC)
+                        addr->sap_addr.vci = vcc->vci;
         }
         error = vcc_connect(sock, addr->sap_addr.itf, addr->sap_addr.vpi,
                             addr->sap_addr.vci);
@@ -51,11 +54,10 @@ out:
         return error;
 }
 
-
-static int pvc_connect(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len,int flags)
+static int pvc_connect(struct socket *sock, struct sockaddr *sockaddr,
+                       int sockaddr_len, int flags)
 {
-        return pvc_bind(sock,sockaddr,sockaddr_len);
+        return pvc_bind(sock, sockaddr, sockaddr_len);
 }
 
 static int pvc_setsockopt(struct socket *sock, int level, int optname,
@@ -70,7 +72,6 @@ static int pvc_setsockopt(struct socket *sock, int level, int optname,
         return error;
 }
 
-
 static int pvc_getsockopt(struct socket *sock, int level, int optname,
                           char __user *optval, int __user *optlen)
 {
@@ -83,16 +84,16 @@ static int pvc_getsockopt(struct socket *sock, int level, int optname,
         return error;
 }
 
-
-static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
-    int *sockaddr_len,int peer)
+static int pvc_getname(struct socket *sock, struct sockaddr *sockaddr,
+                       int *sockaddr_len, int peer)
 {
         struct sockaddr_atmpvc *addr;
         struct atm_vcc *vcc = ATM_SD(sock);
 
-        if (!vcc->dev || !test_bit(ATM_VF_ADDR,&vcc->flags)) return -ENOTCONN;
+        if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
+                return -ENOTCONN;
         *sockaddr_len = sizeof(struct sockaddr_atmpvc);
-        addr = (struct sockaddr_atmpvc *) sockaddr;
+        addr = (struct sockaddr_atmpvc *)sockaddr;
         addr->sap_family = AF_ATMPVC;
         addr->sap_addr.itf = vcc->dev->number;
         addr->sap_addr.vpi = vcc->vpi;
@@ -100,7 +101,6 @@ static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
         return 0;
 }
 
-
 static const struct proto_ops pvc_proto_ops = {
         .family =       PF_ATMPVC,
         .owner =        THIS_MODULE,
@@ -127,7 +127,8 @@ static const struct proto_ops pvc_proto_ops = {
 };
 
 
-static int pvc_create(struct net *net, struct socket *sock,int protocol)
+static int pvc_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
         if (net != &init_net)
                 return -EAFNOSUPPORT;
@@ -136,8 +137,7 @@ static int pvc_create(struct net *net, struct socket *sock,int protocol)
         return vcc_create(net, sock, protocol, PF_ATMPVC);
 }
 
-
-static struct net_proto_family pvc_family_ops = {
+static const struct net_proto_family pvc_family_ops = {
         .family = PF_ATMPVC,
         .create = pvc_create,
         .owner = THIS_MODULE,
diff --git a/net/atm/raw.c b/net/atm/raw.c
index cbfcc71a17b1..b4f7b9ff3c74 100644
--- a/net/atm/raw.c
+++ b/net/atm/raw.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/module.h>
 #include <linux/atmdev.h>
@@ -9,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 
 #include "common.h"
 #include "protocols.h"
@@ -17,7 +19,7 @@
  * SKB == NULL indicates that the link is being closed
  */
 
-static void atm_push_raw(struct atm_vcc *vcc,struct sk_buff *skb)
+static void atm_push_raw(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         if (skb) {
                 struct sock *sk = sk_atm(vcc);
@@ -27,36 +29,33 @@ static void atm_push_raw(struct atm_vcc *vcc,struct sk_buff *skb)
         }
 }
 
-
-static void atm_pop_raw(struct atm_vcc *vcc,struct sk_buff *skb)
+static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         struct sock *sk = sk_atm(vcc);
 
-        pr_debug("APopR (%d) %d -= %d\n", vcc->vci,
-                sk_wmem_alloc_get(sk), skb->truesize);
+        pr_debug("(%d) %d -= %d\n",
+                 vcc->vci, sk_wmem_alloc_get(sk), skb->truesize);
         atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
         dev_kfree_skb_any(skb);
         sk->sk_write_space(sk);
 }
 
-
-static int atm_send_aal0(struct atm_vcc *vcc,struct sk_buff *skb)
+static int atm_send_aal0(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         /*
          * Note that if vpi/vci are _ANY or _UNSPEC the below will
          * still work
          */
         if (!capable(CAP_NET_ADMIN) &&
-            (((u32 *) skb->data)[0] & (ATM_HDR_VPI_MASK | ATM_HDR_VCI_MASK)) !=
-            ((vcc->vpi << ATM_HDR_VPI_SHIFT) | (vcc->vci << ATM_HDR_VCI_SHIFT)))
-            {
+            (((u32 *)skb->data)[0] & (ATM_HDR_VPI_MASK | ATM_HDR_VCI_MASK)) !=
+            ((vcc->vpi << ATM_HDR_VPI_SHIFT) |
+             (vcc->vci << ATM_HDR_VCI_SHIFT))) {
                 kfree_skb(skb);
                 return -EADDRNOTAVAIL;
         }
-        return vcc->dev->ops->send(vcc,skb);
+        return vcc->dev->ops->send(vcc, skb);
 }
 
-
 int atm_init_aal0(struct atm_vcc *vcc)
 {
         vcc->push = atm_push_raw;
@@ -66,7 +65,6 @@ int atm_init_aal0(struct atm_vcc *vcc)
         return 0;
 }
 
-
 int atm_init_aal34(struct atm_vcc *vcc)
 {
         vcc->push = atm_push_raw;
@@ -76,7 +74,6 @@ int atm_init_aal34(struct atm_vcc *vcc)
         return 0;
 }
 
-
 int atm_init_aal5(struct atm_vcc *vcc)
 {
         vcc->push = atm_push_raw;
@@ -85,6 +82,4 @@ int atm_init_aal5(struct atm_vcc *vcc)
         vcc->send = vcc->dev->ops->send;
         return 0;
 }
-
-
 EXPORT_SYMBOL(atm_init_aal5);
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 56b7322ff461..d29e58261511 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -7,6 +7,7 @@
  * 2002/01 - don't free the whole struct sock on sk->destruct time,
  *           use the default destruct function initialized by sock_init_data */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/ctype.h>
 #include <linux/string.h>
@@ -18,6 +19,7 @@
 #include <linux/capability.h>
 #include <linux/delay.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 
 #include <net/sock.h>    /* for struct sock */
 
@@ -70,7 +72,7 @@ struct atm_dev *atm_dev_lookup(int number)
         mutex_unlock(&atm_dev_mutex);
         return dev;
 }
-
+EXPORT_SYMBOL(atm_dev_lookup);
 
 struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
                                  int number, unsigned long *flags)
@@ -79,13 +81,13 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
 
         dev = __alloc_atm_dev(type);
         if (!dev) {
-                printk(KERN_ERR "atm_dev_register: no space for dev %s\n",
-                    type);
+                pr_err("no space for dev %s\n", type);
                 return NULL;
         }
         mutex_lock(&atm_dev_mutex);
         if (number != -1) {
-                if ((inuse = __atm_dev_lookup(number))) {
+                inuse = __atm_dev_lookup(number);
+                if (inuse) {
                         atm_dev_put(inuse);
                         mutex_unlock(&atm_dev_mutex);
                         kfree(dev);
@@ -109,16 +111,12 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
         atomic_set(&dev->refcnt, 1);
 
         if (atm_proc_dev_register(dev) < 0) {
-                printk(KERN_ERR "atm_dev_register: "
-                       "atm_proc_dev_register failed for dev %s\n",
-                       type);
+                pr_err("atm_proc_dev_register failed for dev %s\n", type);
                 goto out_fail;
         }
 
         if (atm_register_sysfs(dev) < 0) {
-                printk(KERN_ERR "atm_dev_register: "
-                       "atm_register_sysfs failed for dev %s\n",
-                       type);
+                pr_err("atm_register_sysfs failed for dev %s\n", type);
                 atm_proc_dev_deregister(dev);
                 goto out_fail;
         }
@@ -134,7 +132,7 @@ out_fail:
         dev = NULL;
         goto out;
 }
-
+EXPORT_SYMBOL(atm_dev_register);
 
 void atm_dev_deregister(struct atm_dev *dev)
 {
@@ -156,7 +154,7 @@ void atm_dev_deregister(struct atm_dev *dev)
 
         atm_dev_put(dev);
 }
-
+EXPORT_SYMBOL(atm_dev_deregister);
 
 static void copy_aal_stats(struct k_atm_aal_stats *from,
     struct atm_aal_stats *to)
@@ -166,7 +164,6 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
 #undef __HANDLE_ITEM
 }
 
-
 static void subtract_aal_stats(struct k_atm_aal_stats *from,
     struct atm_aal_stats *to)
 {
@@ -175,8 +172,8 @@ static void subtract_aal_stats(struct k_atm_aal_stats *from,
 #undef __HANDLE_ITEM
 }
 
-
-static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, int zero)
+static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg,
+                       int zero)
 {
         struct atm_dev_stats tmp;
         int error = 0;
@@ -194,7 +191,6 @@ static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, in
         return error ? -EFAULT : 0;
 }
 
-
 int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
 {
         void __user *buf;
@@ -210,50 +206,49 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
 #endif
 
         switch (cmd) {
-                case ATM_GETNAMES:
-
-                        if (compat) {
+        case ATM_GETNAMES:
+                if (compat) {
 #ifdef CONFIG_COMPAT
-                                struct compat_atm_iobuf __user *ciobuf = arg;
-                                compat_uptr_t cbuf;
-                                iobuf_len = &ciobuf->length;
-                                if (get_user(cbuf, &ciobuf->buffer))
-                                        return -EFAULT;
-                                buf = compat_ptr(cbuf);
+                        struct compat_atm_iobuf __user *ciobuf = arg;
+                        compat_uptr_t cbuf;
+                        iobuf_len = &ciobuf->length;
+                        if (get_user(cbuf, &ciobuf->buffer))
+                                return -EFAULT;
+                        buf = compat_ptr(cbuf);
 #endif
-                        } else {
-                                struct atm_iobuf __user *iobuf = arg;
-                                iobuf_len = &iobuf->length;
-                                if (get_user(buf, &iobuf->buffer))
-                                        return -EFAULT;
-                        }
-                        if (get_user(len, iobuf_len))
+                } else {
+                        struct atm_iobuf __user *iobuf = arg;
+                        iobuf_len = &iobuf->length;
+                        if (get_user(buf, &iobuf->buffer))
                                 return -EFAULT;
-                        mutex_lock(&atm_dev_mutex);
-                        list_for_each(p, &atm_devs)
-                                size += sizeof(int);
-                        if (size > len) {
-                                mutex_unlock(&atm_dev_mutex);
-                                return -E2BIG;
-                        }
-                        tmp_buf = kmalloc(size, GFP_ATOMIC);
-                        if (!tmp_buf) {
-                                mutex_unlock(&atm_dev_mutex);
-                                return -ENOMEM;
-                        }
-                        tmp_p = tmp_buf;
-                        list_for_each(p, &atm_devs) {
-                                dev = list_entry(p, struct atm_dev, dev_list);
-                                *tmp_p++ = dev->number;
-                        }
+                }
+                if (get_user(len, iobuf_len))
+                        return -EFAULT;
+                mutex_lock(&atm_dev_mutex);
+                list_for_each(p, &atm_devs)
+                        size += sizeof(int);
+                if (size > len) {
+                        mutex_unlock(&atm_dev_mutex);
+                        return -E2BIG;
+                }
+                tmp_buf = kmalloc(size, GFP_ATOMIC);
+                if (!tmp_buf) {
                         mutex_unlock(&atm_dev_mutex);
-                        error = ((copy_to_user(buf, tmp_buf, size)) ||
-                                        put_user(size, iobuf_len))
-                                                ? -EFAULT : 0;
-                        kfree(tmp_buf);
-                        return error;
-                default:
-                        break;
+                        return -ENOMEM;
+                }
+                tmp_p = tmp_buf;
+                list_for_each(p, &atm_devs) {
+                        dev = list_entry(p, struct atm_dev, dev_list);
+                        *tmp_p++ = dev->number;
+                }
+                mutex_unlock(&atm_dev_mutex);
+                error = ((copy_to_user(buf, tmp_buf, size)) ||
+                         put_user(size, iobuf_len))
+                        ? -EFAULT : 0;
+                kfree(tmp_buf);
+                return error;
+        default:
+                break;
         }
 
         if (compat) {
@@ -282,166 +277,167 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
                 if (get_user(number, &sioc->number))
                         return -EFAULT;
         }
-        if (!(dev = try_then_request_module(atm_dev_lookup(number),
-                                            "atm-device-%d", number)))
+
+        dev = try_then_request_module(atm_dev_lookup(number), "atm-device-%d",
+                                      number);
+        if (!dev)
                 return -ENODEV;
 
         switch (cmd) {
-                case ATM_GETTYPE:
-                        size = strlen(dev->type) + 1;
-                        if (copy_to_user(buf, dev->type, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_GETESI:
-                        size = ESI_LEN;
-                        if (copy_to_user(buf, dev->esi, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_SETESI:
-                        {
-                                int i;
-
-                                for (i = 0; i < ESI_LEN; i++)
-                                        if (dev->esi[i]) {
-                                                error = -EEXIST;
-                                                goto done;
-                                        }
-                        }
-                        /* fall through */
-                case ATM_SETESIF:
-                        {
-                                unsigned char esi[ESI_LEN];
-
-                                if (!capable(CAP_NET_ADMIN)) {
-                                        error = -EPERM;
-                                        goto done;
-                                }
-                                if (copy_from_user(esi, buf, ESI_LEN)) {
-                                        error = -EFAULT;
-                                        goto done;
-                                }
-                                memcpy(dev->esi, esi, ESI_LEN);
-                                error =  ESI_LEN;
-                                goto done;
-                        }
-                case ATM_GETSTATZ:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        /* fall through */
-                case ATM_GETSTAT:
-                        size = sizeof(struct atm_dev_stats);
-                        error = fetch_stats(dev, buf, cmd == ATM_GETSTATZ);
-                        if (error)
-                                goto done;
-                        break;
-                case ATM_GETCIRANGE:
-                        size = sizeof(struct atm_cirange);
-                        if (copy_to_user(buf, &dev->ci_range, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_GETLINKRATE:
-                        size = sizeof(int);
-                        if (copy_to_user(buf, &dev->link_rate, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_RSTADDR:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        atm_reset_addr(dev, ATM_ADDR_LOCAL);
-                        break;
-                case ATM_ADDADDR:
-                case ATM_DELADDR:
-                case ATM_ADDLECSADDR:
-                case ATM_DELLECSADDR:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        {
-                                struct sockaddr_atmsvc addr;
-
-                                if (copy_from_user(&addr, buf, sizeof(addr))) {
-                                        error = -EFAULT;
-                                        goto done;
-                                }
-                                if (cmd == ATM_ADDADDR || cmd == ATM_ADDLECSADDR)
-                                        error = atm_add_addr(dev, &addr,
-                                                             (cmd == ATM_ADDADDR ?
-                                                              ATM_ADDR_LOCAL : ATM_ADDR_LECS));
-                                else
-                                        error = atm_del_addr(dev, &addr,
-                                                             (cmd == ATM_DELADDR ?
-                                                              ATM_ADDR_LOCAL : ATM_ADDR_LECS));
+        case ATM_GETTYPE:
+                size = strlen(dev->type) + 1;
+                if (copy_to_user(buf, dev->type, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_GETESI:
+                size = ESI_LEN;
+                if (copy_to_user(buf, dev->esi, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_SETESI:
+        {
+                int i;
+
+                for (i = 0; i < ESI_LEN; i++)
+                        if (dev->esi[i]) {
+                                error = -EEXIST;
                                 goto done;
                         }
-                case ATM_GETADDR:
-                case ATM_GETLECSADDR:
-                        error = atm_get_addr(dev, buf, len,
-                                             (cmd == ATM_GETADDR ?
+        }
+        /* fall through */
+        case ATM_SETESIF:
+        {
+                unsigned char esi[ESI_LEN];
+
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+                if (copy_from_user(esi, buf, ESI_LEN)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                memcpy(dev->esi, esi, ESI_LEN);
+                error =  ESI_LEN;
+                goto done;
+        }
+        case ATM_GETSTATZ:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+                /* fall through */
+        case ATM_GETSTAT:
+                size = sizeof(struct atm_dev_stats);
+                error = fetch_stats(dev, buf, cmd == ATM_GETSTATZ);
+                if (error)
+                        goto done;
+                break;
+        case ATM_GETCIRANGE:
+                size = sizeof(struct atm_cirange);
+                if (copy_to_user(buf, &dev->ci_range, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_GETLINKRATE:
+                size = sizeof(int);
+                if (copy_to_user(buf, &dev->link_rate, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_RSTADDR:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+                atm_reset_addr(dev, ATM_ADDR_LOCAL);
+                break;
+        case ATM_ADDADDR:
+        case ATM_DELADDR:
+        case ATM_ADDLECSADDR:
+        case ATM_DELLECSADDR:
+        {
+                struct sockaddr_atmsvc addr;
+
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+
+                if (copy_from_user(&addr, buf, sizeof(addr))) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                if (cmd == ATM_ADDADDR || cmd == ATM_ADDLECSADDR)
+                        error = atm_add_addr(dev, &addr,
+                                             (cmd == ATM_ADDADDR ?
                                               ATM_ADDR_LOCAL : ATM_ADDR_LECS));
-                        if (error < 0)
-                                goto done;
-                        size = error;
-                        /* may return 0, but later on size == 0 means "don't
-                           write the length" */
-                        error = put_user(size, sioc_len)
-                                ? -EFAULT : 0;
+                else
+                        error = atm_del_addr(dev, &addr,
+                                             (cmd == ATM_DELADDR ?
+                                              ATM_ADDR_LOCAL : ATM_ADDR_LECS));
+                goto done;
+        }
+        case ATM_GETADDR:
+        case ATM_GETLECSADDR:
+                error = atm_get_addr(dev, buf, len,
+                                     (cmd == ATM_GETADDR ?
+                                      ATM_ADDR_LOCAL : ATM_ADDR_LECS));
+                if (error < 0)
+                        goto done;
+                size = error;
+                /* may return 0, but later on size == 0 means "don't
+                   write the length" */
+                error = put_user(size, sioc_len) ? -EFAULT : 0;
+                goto done;
+        case ATM_SETLOOP:
+                if (__ATM_LM_XTRMT((int) (unsigned long) buf) &&
+                    __ATM_LM_XTLOC((int) (unsigned long) buf) >
+                    __ATM_LM_XTRMT((int) (unsigned long) buf)) {
+                        error = -EINVAL;
+                        goto done;
+                }
+                /* fall through */
+        case ATM_SETCIRANGE:
+        case SONET_GETSTATZ:
+        case SONET_SETDIAG:
+        case SONET_CLRDIAG:
+        case SONET_SETFRAMING:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
                         goto done;
-                case ATM_SETLOOP:
-                        if (__ATM_LM_XTRMT((int) (unsigned long) buf) &&
-                            __ATM_LM_XTLOC((int) (unsigned long) buf) >
-                            __ATM_LM_XTRMT((int) (unsigned long) buf)) {
+                }
+                /* fall through */
+        default:
+                if (compat) {
+#ifdef CONFIG_COMPAT
+                        if (!dev->ops->compat_ioctl) {
                                 error = -EINVAL;
                                 goto done;
                         }
-                        /* fall through */
-                case ATM_SETCIRANGE:
-                case SONET_GETSTATZ:
-                case SONET_SETDIAG:
-                case SONET_CLRDIAG:
-                case SONET_SETFRAMING:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        /* fall through */
-                default:
-                        if (compat) {
-#ifdef CONFIG_COMPAT
-                                if (!dev->ops->compat_ioctl) {
-                                        error = -EINVAL;
-                                        goto done;
-                                }
-                                size = dev->ops->compat_ioctl(dev, cmd, buf);
+                        size = dev->ops->compat_ioctl(dev, cmd, buf);
 #endif
-                        } else {
-                                if (!dev->ops->ioctl) {
-                                        error = -EINVAL;
-                                        goto done;
-                                }
-                                size = dev->ops->ioctl(dev, cmd, buf);
-                        }
-                        if (size < 0) {
-                                error = (size == -ENOIOCTLCMD ? -EINVAL : size);
+                } else {
+                        if (!dev->ops->ioctl) {
+                                error = -EINVAL;
                                 goto done;
                         }
+                        size = dev->ops->ioctl(dev, cmd, buf);
+                }
+                if (size < 0) {
+                        error = (size == -ENOIOCTLCMD ? -EINVAL : size);
+                        goto done;
+                }
         }
 
         if (size)
-                error = put_user(size, sioc_len)
-                        ? -EFAULT : 0;
+                error = put_user(size, sioc_len) ? -EFAULT : 0;
         else
                 error = 0;
 done:
@@ -449,21 +445,10 @@ done:
         return error;
 }
 
-static __inline__ void *dev_get_idx(loff_t left)
-{
-        struct list_head *p;
-
-        list_for_each(p, &atm_devs) {
-                if (!--left)
-                        break;
-        }
-        return (p != &atm_devs) ? p : NULL;
-}
-
 void *atm_dev_seq_start(struct seq_file *seq, loff_t *pos)
 {
         mutex_lock(&atm_dev_mutex);
-        return *pos ? dev_get_idx(*pos) : SEQ_START_TOKEN;
+        return seq_list_start_head(&atm_devs, *pos);
 }
 
 void atm_dev_seq_stop(struct seq_file *seq, void *v)
@@ -473,13 +458,5 @@ void atm_dev_seq_stop(struct seq_file *seq, void *v)
 
 void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
-        v = (v == SEQ_START_TOKEN)
-                ? atm_devs.next : ((struct list_head *)v)->next;
-        return (v == &atm_devs) ? NULL : v;
+        return seq_list_next(v, &atm_devs, pos);
 }
-
-
-EXPORT_SYMBOL(atm_dev_register);
-EXPORT_SYMBOL(atm_dev_deregister);
-EXPORT_SYMBOL(atm_dev_lookup);
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 229921400522..6ba6e466ee54 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/errno.h>        /* error codes */
 #include <linux/kernel.h>       /* printk */
@@ -13,11 +14,11 @@
 #include <linux/atmsvc.h>
 #include <linux/atmdev.h>
 #include <linux/bitops.h>
+#include <linux/slab.h>
 
 #include "resources.h"
 #include "signaling.h"
 
-
 #undef WAIT_FOR_DEMON           /* #define this if system calls on SVC sockets
                                    should block until the demon runs.
                                    Danger: may cause nasty hangs if the demon
@@ -28,60 +29,59 @@ struct atm_vcc *sigd = NULL;
 static DECLARE_WAIT_QUEUE_HEAD(sigd_sleep);
 #endif
 
-
 static void sigd_put_skb(struct sk_buff *skb)
 {
 #ifdef WAIT_FOR_DEMON
-        DECLARE_WAITQUEUE(wait,current);
+        DECLARE_WAITQUEUE(wait, current);
 
-        add_wait_queue(&sigd_sleep,&wait);
+        add_wait_queue(&sigd_sleep, &wait);
         while (!sigd) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
-                pr_debug("atmsvc: waiting for signaling demon...\n");
+                pr_debug("atmsvc: waiting for signaling daemon...\n");
                 schedule();
         }
         current->state = TASK_RUNNING;
-        remove_wait_queue(&sigd_sleep,&wait);
+        remove_wait_queue(&sigd_sleep, &wait);
 #else
         if (!sigd) {
-                pr_debug("atmsvc: no signaling demon\n");
+                pr_debug("atmsvc: no signaling daemon\n");
                 kfree_skb(skb);
                 return;
         }
 #endif
-        atm_force_charge(sigd,skb->truesize);
-        skb_queue_tail(&sk_atm(sigd)->sk_receive_queue,skb);
+        atm_force_charge(sigd, skb->truesize);
+        skb_queue_tail(&sk_atm(sigd)->sk_receive_queue, skb);
         sk_atm(sigd)->sk_data_ready(sk_atm(sigd), skb->len);
 }
 
-
-static void modify_qos(struct atm_vcc *vcc,struct atmsvc_msg *msg)
+static void modify_qos(struct atm_vcc *vcc, struct atmsvc_msg *msg)
 {
         struct sk_buff *skb;
 
-        if (test_bit(ATM_VF_RELEASED,&vcc->flags) ||
-            !test_bit(ATM_VF_READY,&vcc->flags))
+        if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
+            !test_bit(ATM_VF_READY, &vcc->flags))
                 return;
         msg->type = as_error;
-        if (!vcc->dev->ops->change_qos) msg->reply = -EOPNOTSUPP;
+        if (!vcc->dev->ops->change_qos)
+                msg->reply = -EOPNOTSUPP;
         else {
                 /* should lock VCC */
-                msg->reply = vcc->dev->ops->change_qos(vcc,&msg->qos,
-                    msg->reply);
-                if (!msg->reply) msg->type = as_okay;
+                msg->reply = vcc->dev->ops->change_qos(vcc, &msg->qos,
+                                                       msg->reply);
+                if (!msg->reply)
+                        msg->type = as_okay;
         }
         /*
          * Should probably just turn around the old skb. But the, the buffer
          * space accounting needs to follow the change too. Maybe later.
          */
-        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg),GFP_KERNEL)))
+        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg), GFP_KERNEL)))
                 schedule();
-        *(struct atmsvc_msg *) skb_put(skb,sizeof(struct atmsvc_msg)) = *msg;
+        *(struct atmsvc_msg *)skb_put(skb, sizeof(struct atmsvc_msg)) = *msg;
         sigd_put_skb(skb);
 }
 
-
-static int sigd_send(struct atm_vcc *vcc,struct sk_buff *skb)
+static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         struct atmsvc_msg *msg;
         struct atm_vcc *session_vcc;
@@ -90,69 +90,68 @@ static int sigd_send(struct atm_vcc *vcc,struct sk_buff *skb)
         msg = (struct atmsvc_msg *) skb->data;
         atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
         vcc = *(struct atm_vcc **) &msg->vcc;
-        pr_debug("sigd_send %d (0x%lx)\n",(int) msg->type,
-          (unsigned long) vcc);
+        pr_debug("%d (0x%lx)\n", (int)msg->type, (unsigned long)vcc);
         sk = sk_atm(vcc);
 
         switch (msg->type) {
-                case as_okay:
-                        sk->sk_err = -msg->reply;
-                        clear_bit(ATM_VF_WAITING, &vcc->flags);
-                        if (!*vcc->local.sas_addr.prv &&
-                            !*vcc->local.sas_addr.pub) {
-                                vcc->local.sas_family = AF_ATMSVC;
-                                memcpy(vcc->local.sas_addr.prv,
-                                    msg->local.sas_addr.prv,ATM_ESA_LEN);
-                                memcpy(vcc->local.sas_addr.pub,
-                                    msg->local.sas_addr.pub,ATM_E164_LEN+1);
-                        }
-                        session_vcc = vcc->session ? vcc->session : vcc;
-                        if (session_vcc->vpi || session_vcc->vci) break;
-                        session_vcc->itf = msg->pvc.sap_addr.itf;
-                        session_vcc->vpi = msg->pvc.sap_addr.vpi;
-                        session_vcc->vci = msg->pvc.sap_addr.vci;
-                        if (session_vcc->vpi || session_vcc->vci)
-                                session_vcc->qos = msg->qos;
-                        break;
-                case as_error:
-                        clear_bit(ATM_VF_REGIS,&vcc->flags);
-                        clear_bit(ATM_VF_READY,&vcc->flags);
-                        sk->sk_err = -msg->reply;
-                        clear_bit(ATM_VF_WAITING, &vcc->flags);
+        case as_okay:
+                sk->sk_err = -msg->reply;
+                clear_bit(ATM_VF_WAITING, &vcc->flags);
+                if (!*vcc->local.sas_addr.prv && !*vcc->local.sas_addr.pub) {
+                        vcc->local.sas_family = AF_ATMSVC;
+                        memcpy(vcc->local.sas_addr.prv,
+                               msg->local.sas_addr.prv, ATM_ESA_LEN);
+                        memcpy(vcc->local.sas_addr.pub,
+                               msg->local.sas_addr.pub, ATM_E164_LEN + 1);
+                }
+                session_vcc = vcc->session ? vcc->session : vcc;
+                if (session_vcc->vpi || session_vcc->vci)
                         break;
-                case as_indicate:
-                        vcc = *(struct atm_vcc **) &msg->listen_vcc;
-                        sk = sk_atm(vcc);
-                        pr_debug("as_indicate!!!\n");
-                        lock_sock(sk);
-                        if (sk_acceptq_is_full(sk)) {
-                                sigd_enq(NULL,as_reject,vcc,NULL,NULL);
-                                dev_kfree_skb(skb);
-                                goto as_indicate_complete;
-                        }
-                        sk->sk_ack_backlog++;
-                        skb_queue_tail(&sk->sk_receive_queue, skb);
-                        pr_debug("waking sk->sk_sleep 0x%p\n", sk->sk_sleep);
-                        sk->sk_state_change(sk);
+                session_vcc->itf = msg->pvc.sap_addr.itf;
+                session_vcc->vpi = msg->pvc.sap_addr.vpi;
+                session_vcc->vci = msg->pvc.sap_addr.vci;
+                if (session_vcc->vpi || session_vcc->vci)
+                        session_vcc->qos = msg->qos;
+                break;
+        case as_error:
+                clear_bit(ATM_VF_REGIS, &vcc->flags);
+                clear_bit(ATM_VF_READY, &vcc->flags);
+                sk->sk_err = -msg->reply;
+                clear_bit(ATM_VF_WAITING, &vcc->flags);
+                break;
+        case as_indicate:
+                vcc = *(struct atm_vcc **)&msg->listen_vcc;
+                sk = sk_atm(vcc);
+                pr_debug("as_indicate!!!\n");
+                lock_sock(sk);
+                if (sk_acceptq_is_full(sk)) {
+                        sigd_enq(NULL, as_reject, vcc, NULL, NULL);
+                        dev_kfree_skb(skb);
+                        goto as_indicate_complete;
+                }
+                sk->sk_ack_backlog++;
+                skb_queue_tail(&sk->sk_receive_queue, skb);
+                pr_debug("waking sk->sk_sleep 0x%p\n", sk->sk_sleep);
+                sk->sk_state_change(sk);
 as_indicate_complete:
-                        release_sock(sk);
-                        return 0;
-                case as_close:
-                        set_bit(ATM_VF_RELEASED,&vcc->flags);
-                        vcc_release_async(vcc, msg->reply);
-                        goto out;
-                case as_modify:
-                        modify_qos(vcc,msg);
-                        break;
-                case as_addparty:
-                case as_dropparty:
-                        sk->sk_err_soft = msg->reply;   /* < 0 failure, otherwise ep_ref */
-                        clear_bit(ATM_VF_WAITING, &vcc->flags);
-                        break;
-                default:
-                        printk(KERN_ALERT "sigd_send: bad message type %d\n",
-                            (int) msg->type);
-                        return -EINVAL;
+                release_sock(sk);
+                return 0;
+        case as_close:
+                set_bit(ATM_VF_RELEASED, &vcc->flags);
+                vcc_release_async(vcc, msg->reply);
+                goto out;
+        case as_modify:
+                modify_qos(vcc, msg);
+                break;
+        case as_addparty:
+        case as_dropparty:
+                sk->sk_err_soft = msg->reply;
+                                        /* < 0 failure, otherwise ep_ref */
+                clear_bit(ATM_VF_WAITING, &vcc->flags);
+                break;
+        default:
+                pr_alert("bad message type %d\n", (int)msg->type);
+                return -EINVAL;
         }
         sk->sk_state_change(sk);
 out:
@@ -160,48 +159,52 @@ out:
         return 0;
 }
 
-
-void sigd_enq2(struct atm_vcc *vcc,enum atmsvc_msg_type type,
-    struct atm_vcc *listen_vcc,const struct sockaddr_atmpvc *pvc,
-    const struct sockaddr_atmsvc *svc,const struct atm_qos *qos,int reply)
+void sigd_enq2(struct atm_vcc *vcc, enum atmsvc_msg_type type,
+               struct atm_vcc *listen_vcc, const struct sockaddr_atmpvc *pvc,
+               const struct sockaddr_atmsvc *svc, const struct atm_qos *qos,
+               int reply)
 {
         struct sk_buff *skb;
         struct atmsvc_msg *msg;
         static unsigned session = 0;
 
-        pr_debug("sigd_enq %d (0x%p)\n",(int) type,vcc);
-        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg),GFP_KERNEL)))
+        pr_debug("%d (0x%p)\n", (int)type, vcc);
+        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg), GFP_KERNEL)))
                 schedule();
-        msg = (struct atmsvc_msg *) skb_put(skb,sizeof(struct atmsvc_msg));
-        memset(msg,0,sizeof(*msg));
+        msg = (struct atmsvc_msg *)skb_put(skb, sizeof(struct atmsvc_msg));
+        memset(msg, 0, sizeof(*msg));
         msg->type = type;
         *(struct atm_vcc **) &msg->vcc = vcc;
         *(struct atm_vcc **) &msg->listen_vcc = listen_vcc;
         msg->reply = reply;
-        if (qos) msg->qos = *qos;
-        if (vcc) msg->sap = vcc->sap;
-        if (svc) msg->svc = *svc;
-        if (vcc) msg->local = vcc->local;
-        if (pvc) msg->pvc = *pvc;
+        if (qos)
+                msg->qos = *qos;
+        if (vcc)
+                msg->sap = vcc->sap;
+        if (svc)
+                msg->svc = *svc;
+        if (vcc)
+                msg->local = vcc->local;
+        if (pvc)
+                msg->pvc = *pvc;
         if (vcc) {
                 if (type == as_connect && test_bit(ATM_VF_SESSION, &vcc->flags))
                         msg->session = ++session;
                         /* every new pmp connect gets the next session number */
         }
         sigd_put_skb(skb);
-        if (vcc) set_bit(ATM_VF_REGIS,&vcc->flags);
+        if (vcc)
+                set_bit(ATM_VF_REGIS, &vcc->flags);
 }
 
-
-void sigd_enq(struct atm_vcc *vcc,enum atmsvc_msg_type type,
-    struct atm_vcc *listen_vcc,const struct sockaddr_atmpvc *pvc,
-    const struct sockaddr_atmsvc *svc)
+void sigd_enq(struct atm_vcc *vcc, enum atmsvc_msg_type type,
+              struct atm_vcc *listen_vcc, const struct sockaddr_atmpvc *pvc,
+              const struct sockaddr_atmsvc *svc)
 {
-        sigd_enq2(vcc,type,listen_vcc,pvc,svc,vcc ? &vcc->qos : NULL,0);
+        sigd_enq2(vcc, type, listen_vcc, pvc, svc, vcc ? &vcc->qos : NULL, 0);
         /* other ISP applications may use "reply" */
 }
 
-
 static void purge_vcc(struct atm_vcc *vcc)
 {
         if (sk_atm(vcc)->sk_family == PF_ATMSVC &&
@@ -212,21 +215,20 @@ static void purge_vcc(struct atm_vcc *vcc)
         }
 }
 
-
 static void sigd_close(struct atm_vcc *vcc)
 {
         struct hlist_node *node;
         struct sock *s;
         int i;
 
-        pr_debug("sigd_close\n");
+        pr_debug("\n");
         sigd = NULL;
         if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
-                printk(KERN_ERR "sigd_close: closing with requests pending\n");
+                pr_err("closing with requests pending\n");
         skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
 
         read_lock(&vcc_sklist_lock);
-        for(i = 0; i < VCC_HTABLE_SIZE; ++i) {
+        for (i = 0; i < VCC_HTABLE_SIZE; ++i) {
                 struct hlist_head *head = &vcc_hash[i];
 
                 sk_for_each(s, node, head) {
@@ -238,13 +240,11 @@ static void sigd_close(struct atm_vcc *vcc)
         read_unlock(&vcc_sklist_lock);
 }
 
-
 static struct atmdev_ops sigd_dev_ops = {
         .close = sigd_close,
         .send = sigd_send
 };
 
-
 static struct atm_dev sigd_dev = {
         .ops =          &sigd_dev_ops,
         .type =         "sig",
@@ -252,16 +252,16 @@ static struct atm_dev sigd_dev = {
         .lock =         __SPIN_LOCK_UNLOCKED(sigd_dev.lock)
 };
 
-
 int sigd_attach(struct atm_vcc *vcc)
 {
-        if (sigd) return -EADDRINUSE;
-        pr_debug("sigd_attach\n");
+        if (sigd)
+                return -EADDRINUSE;
+        pr_debug("\n");
         sigd = vcc;
         vcc->dev = &sigd_dev;
         vcc_insert_socket(sk_atm(vcc));
-        set_bit(ATM_VF_META,&vcc->flags);
-        set_bit(ATM_VF_READY,&vcc->flags);
+        set_bit(ATM_VF_META, &vcc->flags);
+        set_bit(ATM_VF_READY, &vcc->flags);
 #ifdef WAIT_FOR_DEMON
         wake_up(&sigd_sleep);
 #endif
diff --git a/net/atm/svc.c b/net/atm/svc.c
index f90d143c4b25..3ba9a45a51ac 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/string.h>
 #include <linux/net.h>          /* struct socket, struct proto_ops */
@@ -18,14 +19,15 @@
 #include <linux/atmdev.h>
 #include <linux/bitops.h>
 #include <net/sock.h>           /* for sock_no_* */
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include "resources.h"
 #include "common.h"             /* common for PVCs and SVCs */
 #include "signaling.h"
 #include "addr.h"
 
-static int svc_create(struct net *net, struct socket *sock,int protocol);
+static int svc_create(struct net *net, struct socket *sock, int protocol,
+                      int kern);
 
 /*
  * Note: since all this is still nicely synchronized with the signaling demon,
@@ -34,25 +36,25 @@ static int svc_create(struct net *net, struct socket *sock,int protocol);
  */
 
 
-static int svc_shutdown(struct socket *sock,int how)
+static int svc_shutdown(struct socket *sock, int how)
 {
         return 0;
 }
 
-
 static void svc_disconnect(struct atm_vcc *vcc)
 {
         DEFINE_WAIT(wait);
         struct sk_buff *skb;
         struct sock *sk = sk_atm(vcc);
 
-        pr_debug("svc_disconnect %p\n",vcc);
-        if (test_bit(ATM_VF_REGIS,&vcc->flags)) {
+        pr_debug("%p\n", vcc);
+        if (test_bit(ATM_VF_REGIS, &vcc->flags)) {
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-                sigd_enq(vcc,as_close,NULL,NULL,NULL);
-                while (!test_bit(ATM_VF_RELEASED,&vcc->flags) && sigd) {
+                sigd_enq(vcc, as_close, NULL, NULL, NULL);
+                while (!test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
                         schedule();
-                        prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                        prepare_to_wait(sk->sk_sleep, &wait,
+                                        TASK_UNINTERRUPTIBLE);
                 }
                 finish_wait(sk->sk_sleep, &wait);
         }
@@ -61,35 +63,35 @@ static void svc_disconnect(struct atm_vcc *vcc)
         while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
                 atm_return(vcc, skb->truesize);
                 pr_debug("LISTEN REL\n");
-                sigd_enq2(NULL,as_reject,vcc,NULL,NULL,&vcc->qos,0);
+                sigd_enq2(NULL, as_reject, vcc, NULL, NULL, &vcc->qos, 0);
                 dev_kfree_skb(skb);
         }
         clear_bit(ATM_VF_REGIS, &vcc->flags);
         /* ... may retry later */
 }
 
-
 static int svc_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct atm_vcc *vcc;
 
-        if (sk)  {
+        if (sk) {
                 vcc = ATM_SD(sock);
-                pr_debug("svc_release %p\n", vcc);
+                pr_debug("%p\n", vcc);
                 clear_bit(ATM_VF_READY, &vcc->flags);
-                /* VCC pointer is used as a reference, so we must not free it
-                   (thereby subjecting it to re-use) before all pending connections
-                   are closed */
+                /*
+                 * VCC pointer is used as a reference,
+                 * so we must not free it (thereby subjecting it to re-use)
+                 * before all pending connections are closed
+                 */
                 svc_disconnect(vcc);
                 vcc_release(sock);
         }
         return 0;
 }
 
-
-static int svc_bind(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len)
+static int svc_bind(struct socket *sock, struct sockaddr *sockaddr,
+                    int sockaddr_len)
 {
         DEFINE_WAIT(wait);
         struct sock *sk = sock->sk;
@@ -114,38 +116,37 @@ static int svc_bind(struct socket *sock,struct sockaddr *sockaddr,
                 error = -EAFNOSUPPORT;
                 goto out;
         }
-        clear_bit(ATM_VF_BOUND,&vcc->flags);
+        clear_bit(ATM_VF_BOUND, &vcc->flags);
             /* failing rebind will kill old binding */
         /* @@@ check memory (de)allocation on rebind */
-        if (!test_bit(ATM_VF_HASQOS,&vcc->flags)) {
+        if (!test_bit(ATM_VF_HASQOS, &vcc->flags)) {
                 error = -EBADFD;
                 goto out;
         }
         vcc->local = *addr;
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-        sigd_enq(vcc,as_bind,NULL,NULL,&vcc->local);
+        sigd_enq(vcc, as_bind, NULL, NULL, &vcc->local);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
         }
         finish_wait(sk->sk_sleep, &wait);
-        clear_bit(ATM_VF_REGIS,&vcc->flags); /* doesn't count */
+        clear_bit(ATM_VF_REGIS, &vcc->flags); /* doesn't count */
         if (!sigd) {
                 error = -EUNATCH;
                 goto out;
         }
         if (!sk->sk_err)
-                set_bit(ATM_VF_BOUND,&vcc->flags);
+                set_bit(ATM_VF_BOUND, &vcc->flags);
         error = -sk->sk_err;
 out:
         release_sock(sk);
         return error;
 }
 
-
-static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len,int flags)
+static int svc_connect(struct socket *sock, struct sockaddr *sockaddr,
+                       int sockaddr_len, int flags)
 {
         DEFINE_WAIT(wait);
         struct sock *sk = sock->sk;
@@ -153,7 +154,7 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
         struct atm_vcc *vcc = ATM_SD(sock);
         int error;
 
-        pr_debug("svc_connect %p\n",vcc);
+        pr_debug("%p\n", vcc);
         lock_sock(sk);
         if (sockaddr_len != sizeof(struct sockaddr_atmsvc)) {
                 error = -EINVAL;
@@ -201,7 +202,7 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
                 vcc->remote = *addr;
                 set_bit(ATM_VF_WAITING, &vcc->flags);
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
-                sigd_enq(vcc,as_connect,NULL,NULL,&vcc->remote);
+                sigd_enq(vcc, as_connect, NULL, NULL, &vcc->remote);
                 if (flags & O_NONBLOCK) {
                         finish_wait(sk->sk_sleep, &wait);
                         sock->state = SS_CONNECTING;
@@ -212,7 +213,8 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
                 while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                         schedule();
                         if (!signal_pending(current)) {
-                                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                                prepare_to_wait(sk->sk_sleep, &wait,
+                                                TASK_INTERRUPTIBLE);
                                 continue;
                         }
                         pr_debug("*ABORT*\n");
@@ -228,20 +230,22 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
                          *   Kernel <--okay---- Demon
                          *   Kernel <--close--- Demon
                          */
-                        sigd_enq(vcc,as_close,NULL,NULL,NULL);
+                        sigd_enq(vcc, as_close, NULL, NULL, NULL);
                         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-                                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                                prepare_to_wait(sk->sk_sleep, &wait,
+                                                TASK_INTERRUPTIBLE);
                                 schedule();
                         }
                         if (!sk->sk_err)
-                                while (!test_bit(ATM_VF_RELEASED,&vcc->flags)
-                                    && sigd) {
-                                        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                                while (!test_bit(ATM_VF_RELEASED, &vcc->flags) &&
+                                       sigd) {
+                                        prepare_to_wait(sk->sk_sleep, &wait,
+                                                        TASK_INTERRUPTIBLE);
                                         schedule();
                                 }
-                        clear_bit(ATM_VF_REGIS,&vcc->flags);
-                        clear_bit(ATM_VF_RELEASED,&vcc->flags);
-                        clear_bit(ATM_VF_CLOSE,&vcc->flags);
+                        clear_bit(ATM_VF_REGIS, &vcc->flags);
+                        clear_bit(ATM_VF_RELEASED, &vcc->flags);
+                        clear_bit(ATM_VF_CLOSE, &vcc->flags);
                             /* we're gone now but may connect later */
                         error = -EINTR;
                         break;
@@ -269,37 +273,37 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
 /*
  * #endif
  */
-        if (!(error = vcc_connect(sock, vcc->itf, vcc->vpi, vcc->vci)))
+        error = vcc_connect(sock, vcc->itf, vcc->vpi, vcc->vci);
+        if (!error)
                 sock->state = SS_CONNECTED;
         else
-                (void) svc_disconnect(vcc);
+                (void)svc_disconnect(vcc);
 out:
         release_sock(sk);
         return error;
 }
 
-
-static int svc_listen(struct socket *sock,int backlog)
+static int svc_listen(struct socket *sock, int backlog)
 {
         DEFINE_WAIT(wait);
         struct sock *sk = sock->sk;
         struct atm_vcc *vcc = ATM_SD(sock);
         int error;
 
-        pr_debug("svc_listen %p\n",vcc);
+        pr_debug("%p\n", vcc);
         lock_sock(sk);
         /* let server handle listen on unbound sockets */
-        if (test_bit(ATM_VF_SESSION,&vcc->flags)) {
+        if (test_bit(ATM_VF_SESSION, &vcc->flags)) {
                 error = -EINVAL;
                 goto out;
         }
         if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
                 error = -EADDRINUSE;
                 goto out;
-        }
+        }
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-        sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
+        sigd_enq(vcc, as_listen, NULL, NULL, &vcc->local);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
@@ -309,7 +313,7 @@ static int svc_listen(struct socket *sock,int backlog)
                 error = -EUNATCH;
                 goto out;
         }
-        set_bit(ATM_VF_LISTEN,&vcc->flags);
+        set_bit(ATM_VF_LISTEN, &vcc->flags);
         vcc_insert_socket(sk);
         sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
         error = -sk->sk_err;
@@ -318,8 +322,7 @@ out:
         return error;
 }
 
-
-static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
+static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
 {
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
@@ -330,21 +333,22 @@ static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
 
         lock_sock(sk);
 
-        error = svc_create(sock_net(sk), newsock,0);
+        error = svc_create(sock_net(sk), newsock, 0, 0);
         if (error)
                 goto out;
 
         new_vcc = ATM_SD(newsock);
 
-        pr_debug("svc_accept %p -> %p\n",old_vcc,new_vcc);
+        pr_debug("%p -> %p\n", old_vcc, new_vcc);
         while (1) {
                 DEFINE_WAIT(wait);
 
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
                 while (!(skb = skb_dequeue(&sk->sk_receive_queue)) &&
                        sigd) {
-                        if (test_bit(ATM_VF_RELEASED,&old_vcc->flags)) break;
-                        if (test_bit(ATM_VF_CLOSE,&old_vcc->flags)) {
+                        if (test_bit(ATM_VF_RELEASED, &old_vcc->flags))
+                                break;
+                        if (test_bit(ATM_VF_CLOSE, &old_vcc->flags)) {
                                 error = -sk->sk_err;
                                 break;
                         }
@@ -359,7 +363,8 @@ static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
                                 error = -ERESTARTSYS;
                                 break;
                         }
-                        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                        prepare_to_wait(sk->sk_sleep, &wait,
+                                        TASK_INTERRUPTIBLE);
                 }
                 finish_wait(sk->sk_sleep, &wait);
                 if (error)
@@ -368,31 +373,34 @@ static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
                         error = -EUNATCH;
                         goto out;
                 }
-                msg = (struct atmsvc_msg *) skb->data;
+                msg = (struct atmsvc_msg *)skb->data;
                 new_vcc->qos = msg->qos;
-                set_bit(ATM_VF_HASQOS,&new_vcc->flags);
+                set_bit(ATM_VF_HASQOS, &new_vcc->flags);
                 new_vcc->remote = msg->svc;
                 new_vcc->local = msg->local;
                 new_vcc->sap = msg->sap;
                 error = vcc_connect(newsock, msg->pvc.sap_addr.itf,
-                                    msg->pvc.sap_addr.vpi, msg->pvc.sap_addr.vci);
+                                    msg->pvc.sap_addr.vpi,
+                                    msg->pvc.sap_addr.vci);
                 dev_kfree_skb(skb);
                 sk->sk_ack_backlog--;
                 if (error) {
-                        sigd_enq2(NULL,as_reject,old_vcc,NULL,NULL,
-                            &old_vcc->qos,error);
+                        sigd_enq2(NULL, as_reject, old_vcc, NULL, NULL,
+                                  &old_vcc->qos, error);
                         error = error == -EAGAIN ? -EBUSY : error;
                         goto out;
                 }
                 /* wait should be short, so we ignore the non-blocking flag */
                 set_bit(ATM_VF_WAITING, &new_vcc->flags);
-                prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-                sigd_enq(new_vcc,as_accept,old_vcc,NULL,NULL);
+                prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                sigd_enq(new_vcc, as_accept, old_vcc, NULL, NULL);
                 while (test_bit(ATM_VF_WAITING, &new_vcc->flags) && sigd) {
                         release_sock(sk);
                         schedule();
                         lock_sock(sk);
-                        prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                        prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait,
+                                        TASK_UNINTERRUPTIBLE);
                 }
                 finish_wait(sk_atm(new_vcc)->sk_sleep, &wait);
                 if (!sigd) {
@@ -412,39 +420,37 @@ out:
         return error;
 }
 
-
-static int svc_getname(struct socket *sock,struct sockaddr *sockaddr,
-    int *sockaddr_len,int peer)
+static int svc_getname(struct socket *sock, struct sockaddr *sockaddr,
+                       int *sockaddr_len, int peer)
 {
         struct sockaddr_atmsvc *addr;
 
         *sockaddr_len = sizeof(struct sockaddr_atmsvc);
         addr = (struct sockaddr_atmsvc *) sockaddr;
-        memcpy(addr,peer ? &ATM_SD(sock)->remote : &ATM_SD(sock)->local,
-            sizeof(struct sockaddr_atmsvc));
+        memcpy(addr, peer ? &ATM_SD(sock)->remote : &ATM_SD(sock)->local,
+               sizeof(struct sockaddr_atmsvc));
         return 0;
 }
 
-
-int svc_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
+int svc_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
 {
         struct sock *sk = sk_atm(vcc);
         DEFINE_WAIT(wait);
 
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-        sigd_enq2(vcc,as_modify,NULL,NULL,&vcc->local,qos,0);
+        sigd_enq2(vcc, as_modify, NULL, NULL, &vcc->local, qos, 0);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) &&
                !test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
         }
         finish_wait(sk->sk_sleep, &wait);
-        if (!sigd) return -EUNATCH;
+        if (!sigd)
+                return -EUNATCH;
         return -sk->sk_err;
 }
 
-
 static int svc_setsockopt(struct socket *sock, int level, int optname,
                           char __user *optval, unsigned int optlen)
 {
@@ -454,37 +460,35 @@ static int svc_setsockopt(struct socket *sock, int level, int optname,
 
         lock_sock(sk);
         switch (optname) {
-                case SO_ATMSAP:
-                        if (level != SOL_ATM || optlen != sizeof(struct atm_sap)) {
-                                error = -EINVAL;
-                                goto out;
-                        }
-                        if (copy_from_user(&vcc->sap, optval, optlen)) {
-                                error = -EFAULT;
-                                goto out;
-                        }
-                        set_bit(ATM_VF_HASSAP, &vcc->flags);
-                        break;
-                case SO_MULTIPOINT:
-                        if (level != SOL_ATM || optlen != sizeof(int)) {
-                                error = -EINVAL;
-                                goto out;
-                        }
-                        if (get_user(value, (int __user *) optval)) {
-                                error = -EFAULT;
-                                goto out;
-                        }
-                        if (value == 1) {
-                                set_bit(ATM_VF_SESSION, &vcc->flags);
-                        } else if (value == 0) {
-                                clear_bit(ATM_VF_SESSION, &vcc->flags);
-                        } else {
-                                error = -EINVAL;
-                        }
-                        break;
-                default:
-                        error = vcc_setsockopt(sock, level, optname,
-                                               optval, optlen);
+        case SO_ATMSAP:
+                if (level != SOL_ATM || optlen != sizeof(struct atm_sap)) {
+                        error = -EINVAL;
+                        goto out;
+                }
+                if (copy_from_user(&vcc->sap, optval, optlen)) {
+                        error = -EFAULT;
+                        goto out;
+                }
+                set_bit(ATM_VF_HASSAP, &vcc->flags);
+                break;
+        case SO_MULTIPOINT:
+                if (level != SOL_ATM || optlen != sizeof(int)) {
+                        error = -EINVAL;
+                        goto out;
+                }
+                if (get_user(value, (int __user *)optval)) {
+                        error = -EFAULT;
+                        goto out;
+                }
+                if (value == 1)
+                        set_bit(ATM_VF_SESSION, &vcc->flags);
+                else if (value == 0)
+                        clear_bit(ATM_VF_SESSION, &vcc->flags);
+                else
+                        error = -EINVAL;
+                break;
+        default:
+                error = vcc_setsockopt(sock, level, optname, optval, optlen);
         }
 
 out:
@@ -492,9 +496,8 @@ out:
         return error;
 }
 
-
-static int svc_getsockopt(struct socket *sock,int level,int optname,
-    char __user *optval,int __user *optlen)
+static int svc_getsockopt(struct socket *sock, int level, int optname,
+                          char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
         int error = 0, len;
@@ -521,7 +524,6 @@ out:
         return error;
 }
 
-
 static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
                         int sockaddr_len, int flags)
 {
@@ -540,7 +542,7 @@ static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
                 error = -EINPROGRESS;
                 goto out;
         }
-        pr_debug("svc_addparty added wait queue\n");
+        pr_debug("added wait queue\n");
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
@@ -552,7 +554,6 @@ out:
         return error;
 }
 
-
 static int svc_dropparty(struct socket *sock, int ep_ref)
 {
         DEFINE_WAIT(wait);
@@ -579,7 +580,6 @@ out:
         return error;
 }
 
-
 static int svc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         int error, ep_ref;
@@ -587,29 +587,31 @@ static int svc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         struct atm_vcc *vcc = ATM_SD(sock);
 
         switch (cmd) {
-                case ATM_ADDPARTY:
-                        if (!test_bit(ATM_VF_SESSION, &vcc->flags))
-                                return -EINVAL;
-                        if (copy_from_user(&sa, (void __user *) arg, sizeof(sa)))
-                                return -EFAULT;
-                        error = svc_addparty(sock, (struct sockaddr *) &sa, sizeof(sa), 0);
-                        break;
-                case ATM_DROPPARTY:
-                        if (!test_bit(ATM_VF_SESSION, &vcc->flags))
-                                return -EINVAL;
-                        if (copy_from_user(&ep_ref, (void __user *) arg, sizeof(int)))
-                                return -EFAULT;
-                        error = svc_dropparty(sock, ep_ref);
-                        break;
-                default:
-                        error = vcc_ioctl(sock, cmd, arg);
+        case ATM_ADDPARTY:
+                if (!test_bit(ATM_VF_SESSION, &vcc->flags))
+                        return -EINVAL;
+                if (copy_from_user(&sa, (void __user *) arg, sizeof(sa)))
+                        return -EFAULT;
+                error = svc_addparty(sock, (struct sockaddr *)&sa, sizeof(sa),
+                                     0);
+                break;
+        case ATM_DROPPARTY:
+                if (!test_bit(ATM_VF_SESSION, &vcc->flags))
+                        return -EINVAL;
+                if (copy_from_user(&ep_ref, (void __user *) arg, sizeof(int)))
+                        return -EFAULT;
+                error = svc_dropparty(sock, ep_ref);
+                break;
+        default:
+                error = vcc_ioctl(sock, cmd, arg);
         }
 
         return error;
 }
 
 #ifdef CONFIG_COMPAT
-static int svc_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+static int svc_compat_ioctl(struct socket *sock, unsigned int cmd,
+                            unsigned long arg)
 {
         /* The definition of ATM_ADDPARTY uses the size of struct atm_iobuf.
            But actually it takes a struct sockaddr_atmsvc, which doesn't need
@@ -650,23 +652,24 @@ static const struct proto_ops svc_proto_ops = {
 };
 
 
-static int svc_create(struct net *net, struct socket *sock,int protocol)
+static int svc_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
         int error;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         sock->ops = &svc_proto_ops;
         error = vcc_create(net, sock, protocol, AF_ATMSVC);
-        if (error) return error;
+        if (error)
+                return error;
         ATM_SD(sock)->local.sas_family = AF_ATMSVC;
         ATM_SD(sock)->remote.sas_family = AF_ATMSVC;
         return 0;
 }
 
-
-static struct net_proto_family svc_family_ops = {
+static const struct net_proto_family svc_family_ops = {
         .family = PF_ATMSVC,
         .create = svc_create,
         .owner = THIS_MODULE,
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index f45460730371..65c5801261f9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -25,6 +25,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -369,6 +370,9 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
         if (ax25_ctl.digi_count > AX25_MAX_DIGIS)
                 return -EINVAL;
 
+        if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL)
+                return -EINVAL;
+
         digi.ndigi = ax25_ctl.digi_count;
         for (k = 0; k < digi.ndigi; k++)
                 digi.calls[k] = ax25_ctl.digi_addr[k];
@@ -418,14 +422,10 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
                 break;
 
         case AX25_T3:
-                if (ax25_ctl.arg < 0)
-                        goto einval_put;
                 ax25->t3 = ax25_ctl.arg * HZ;
                 break;
 
         case AX25_IDLE:
-                if (ax25_ctl.arg < 0)
-                        goto einval_put;
                 ax25->idle = ax25_ctl.arg * 60 * HZ;
                 break;
 
@@ -800,12 +800,13 @@ static struct proto ax25_proto = {
         .obj_size = sizeof(struct sock),
 };
 
-static int ax25_create(struct net *net, struct socket *sock, int protocol)
+static int ax25_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         ax25_cb *ax25;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         switch (sock->type) {
@@ -1863,25 +1864,13 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static void *ax25_info_start(struct seq_file *seq, loff_t *pos)
         __acquires(ax25_list_lock)
 {
-        struct ax25_cb *ax25;
-        struct hlist_node *node;
-        int i = 0;
-
         spin_lock_bh(&ax25_list_lock);
-        ax25_for_each(ax25, node, &ax25_list) {
-                if (i == *pos)
-                        return ax25;
-                ++i;
-        }
-        return NULL;
+        return seq_hlist_start(&ax25_list, *pos);
 }
 
 static void *ax25_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
-
-        return hlist_entry( ((struct ax25_cb *)v)->ax25_node.next,
-                            struct ax25_cb, ax25_node);
+        return seq_hlist_next(v, &ax25_list, pos);
 }
 
 static void ax25_info_stop(struct seq_file *seq, void *v)
@@ -1892,7 +1881,7 @@ static void ax25_info_stop(struct seq_file *seq, void *v)
 
 static int ax25_info_show(struct seq_file *seq, void *v)
 {
-        ax25_cb *ax25 = v;
+        ax25_cb *ax25 = hlist_entry(v, struct ax25_cb, ax25_node);
         char buf[11];
         int k;
 
@@ -1961,7 +1950,7 @@ static const struct file_operations ax25_info_fops = {
 
 #endif
 
-static struct net_proto_family ax25_family_ops = {
+static const struct net_proto_family ax25_family_ops = {
         .family =       PF_AX25,
         .create =       ax25_create,
         .owner  =       THIS_MODULE,
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
index a7a0e0c9698b..c1cb982f6e86 100644
--- a/net/ax25/ax25_dev.c
+++ b/net/ax25/ax25_dev.c
@@ -9,6 +9,7 @@
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
 #include <linux/timer.h>
diff --git a/net/ax25/ax25_ds_subr.c b/net/ax25/ax25_ds_subr.c
index b5e59787be2f..85816e612dc0 100644
--- a/net/ax25/ax25_ds_subr.c
+++ b/net/ax25/ax25_ds_subr.c
@@ -17,6 +17,7 @@
 #include <linux/sockios.h>
 #include <linux/spinlock.h>
 #include <linux/net.h>
+#include <linux/gfp.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 71338f112108..5a0dda8df492 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -17,6 +17,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index de56d3983de0..9bb776541203 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -18,6 +18,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index f047a57aa95c..cf0c47a26530 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index bf706f83a5c9..37507d806f65 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -19,6 +19,7 @@
 #include <linux/sockios.h>
 #include <linux/spinlock.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -92,6 +93,12 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, ax25_address *src, ax2
 #endif
         }
 
+        /*
+         * There is one ref for the state machine; a caller needs
+         * one more to put it back, just like with the existing one.
+         */
+        ax25_cb_hold(ax25);
+
         ax25_cb_add(ax25);
 
         ax25->state = AX25_STATE_1;
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index c833ba4c45a5..7805945a5fd6 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -23,6 +23,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 034aa10a5198..c6715ee4ab8f 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -18,6 +18,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 832bcf092a01..d349be9578f5 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -18,6 +18,7 @@
 #include <linux/sockios.h>
 #include <linux/net.h>
 #include <linux/spinlock.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -146,31 +147,13 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(ax25_uid_lock)
 {
-        struct ax25_uid_assoc *pt;
-        struct hlist_node *node;
-        int i = 1;
-
         read_lock(&ax25_uid_lock);
-
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        ax25_uid_for_each(pt, node, &ax25_uid_list) {
-                if (i == *pos)
-                        return pt;
-                ++i;
-        }
-        return NULL;
+        return seq_hlist_start_head(&ax25_uid_list, *pos);
 }
 
 static void *ax25_uid_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                return ax25_uid_list.first;
-        else
-                return hlist_entry(((ax25_uid_assoc *)v)->uid_node.next,
-                           ax25_uid_assoc, uid_node);
+        return seq_hlist_next(v, &ax25_uid_list, pos);
 }
 
 static void ax25_uid_seq_stop(struct seq_file *seq, void *v)
@@ -186,8 +169,9 @@ static int ax25_uid_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq, "Policy: %d\n", ax25_uid_policy);
         else {
-                struct ax25_uid_assoc *pt = v;
+                struct ax25_uid_assoc *pt;
 
+                pt = hlist_entry(v, struct ax25_uid_assoc, uid_node);
                 seq_printf(seq, "%6d %s\n", pt->uid, ax2asc(buf, &pt->call));
         }
         return 0;
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index 62ee3fb34732..ebe0ef3f1d83 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -7,6 +7,7 @@
  * Copyright (C) 1996 Mike Shaver (shaver@zeroknowledge.com)
  */
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/spinlock.h>
 #include <net/ax25.h>
@@ -34,156 +35,128 @@ static ctl_table *ax25_table;
 static int ax25_table_size;
 
 static struct ctl_path ax25_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ax25", .ctl_name = NET_AX25, },
+        { .procname = "net", },
+        { .procname = "ax25", },
         { }
 };
 
 static const ctl_table ax25_param_table[] = {
         {
-                .ctl_name       = NET_AX25_IP_DEFAULT_MODE,
                 .procname       = "ip_default_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ipdefmode,
                 .extra2         = &max_ipdefmode
         },
         {
-                .ctl_name       = NET_AX25_DEFAULT_MODE,
                 .procname       = "ax25_default_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_axdefmode,
                 .extra2         = &max_axdefmode
         },
         {
-                .ctl_name       = NET_AX25_BACKOFF_TYPE,
                 .procname       = "backoff_type",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_backoff,
                 .extra2         = &max_backoff
         },
         {
-                .ctl_name       = NET_AX25_CONNECT_MODE,
                 .procname       = "connect_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_conmode,
                 .extra2         = &max_conmode
         },
         {
-                .ctl_name       = NET_AX25_STANDARD_WINDOW,
                 .procname       = "standard_window_size",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_window,
                 .extra2         = &max_window
         },
         {
-                .ctl_name       = NET_AX25_EXTENDED_WINDOW,
                 .procname       = "extended_window_size",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ewindow,
                 .extra2         = &max_ewindow
         },
         {
-                .ctl_name       = NET_AX25_T1_TIMEOUT,
                 .procname       = "t1_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t1,
                 .extra2         = &max_t1
         },
         {
-                .ctl_name       = NET_AX25_T2_TIMEOUT,
                 .procname       = "t2_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t2,
                 .extra2         = &max_t2
         },
         {
-                .ctl_name       = NET_AX25_T3_TIMEOUT,
                 .procname       = "t3_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t3,
                 .extra2         = &max_t3
         },
         {
-                .ctl_name       = NET_AX25_IDLE_TIMEOUT,
                 .procname       = "idle_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_idle,
                 .extra2         = &max_idle
         },
         {
-                .ctl_name       = NET_AX25_N2,
                 .procname       = "maximum_retry_count",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_n2,
                 .extra2         = &max_n2
         },
         {
-                .ctl_name       = NET_AX25_PACLEN,
                 .procname       = "maximum_packet_length",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_paclen,
                 .extra2         = &max_paclen
         },
         {
-                .ctl_name       = NET_AX25_PROTOCOL,
                 .procname       = "protocol",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_proto,
                 .extra2         = &max_proto
         },
 #ifdef CONFIG_AX25_DAMA_SLAVE
         {
-                .ctl_name       = NET_AX25_DAMA_SLAVE_TIMEOUT,
                 .procname       = "dama_slave_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ds_timeout,
                 .extra2         = &max_ds_timeout
         },
 #endif
 
-        { .ctl_name = 0 }       /* that's all, folks! */
+        { }     /* that's all, folks! */
 };
 
 void ax25_register_sysctl(void)
@@ -212,11 +185,9 @@ void ax25_register_sysctl(void)
                         return;
                 }
                 ax25_table[n].child = ax25_dev->systable = child;
-                ax25_table[n].ctl_name     = n + 1;
                 ax25_table[n].procname     = ax25_dev->dev->name;
                 ax25_table[n].mode         = 0555;
 
-                child[AX25_MAX_VALUES].ctl_name = 0;    /* just in case... */
 
                 for (k = 0; k < AX25_MAX_VALUES; k++)
                         child[k].data = &ax25_dev->values[k];
@@ -233,7 +204,7 @@ void ax25_unregister_sysctl(void)
         ctl_table *p;
         unregister_sysctl_table(ax25_table_header);
 
-        for (p = ax25_table; p->ctl_name; p++)
+        for (p = ax25_table; p->procname; p++)
                 kfree(p->child);
         kfree(ax25_table);
 }
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 8cfb5a849841..404a8500fd03 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -31,7 +31,6 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
-#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/poll.h>
@@ -45,7 +44,7 @@
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
-static struct net_proto_family *bt_proto[BT_MAX_PROTO];
+static const struct net_proto_family *bt_proto[BT_MAX_PROTO];
 static DEFINE_RWLOCK(bt_proto_lock);
 
 static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
@@ -86,7 +85,7 @@ static inline void bt_sock_reclassify_lock(struct socket *sock, int proto)
                                 bt_key_strings[proto], &bt_lock_key[proto]);
 }
 
-int bt_sock_register(int proto, struct net_proto_family *ops)
+int bt_sock_register(int proto, const struct net_proto_family *ops)
 {
         int err = 0;
 
@@ -126,7 +125,8 @@ int bt_sock_unregister(int proto)
 }
 EXPORT_SYMBOL(bt_sock_unregister);
 
-static int bt_sock_create(struct net *net, struct socket *sock, int proto)
+static int bt_sock_create(struct net *net, struct socket *sock, int proto,
+                          int kern)
 {
         int err;
 
@@ -144,7 +144,7 @@ static int bt_sock_create(struct net *net, struct socket *sock, int proto)
         read_lock(&bt_proto_lock);
 
         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
-                err = bt_proto[proto]->create(net, sock, proto);
+                err = bt_proto[proto]->create(net, sock, proto, kern);
                 bt_sock_reclassify_lock(sock, proto);
                 module_put(bt_proto[proto]->owner);
         }
@@ -257,7 +257,7 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_reset_transport_header(skb);
         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
         if (err == 0)
-                sock_recv_timestamp(msg, sk, skb);
+                sock_recv_ts_and_drops(msg, sk, skb);
 
         skb_free_datagram(sk, skb);
 
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index cafe9f54d841..8062dad6d10d 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -35,6 +35,7 @@
 #include <linux/freezer.h>
 #include <linux/errno.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 
 #include <linux/socket.h>
@@ -78,7 +79,7 @@ static struct bnep_session *__bnep_get_session(u8 *dst)
 static void __bnep_link_session(struct bnep_session *s)
 {
         /* It's safe to call __module_get() here because sessions are added
-           by the socket layer which has to hold the refference to this module.
+           by the socket layer which has to hold the reference to this module.
          */
         __module_get(THIS_MODULE);
         list_add(&s->list, &bnep_session_list);
@@ -230,7 +231,6 @@ static int bnep_rx_control(struct bnep_session *s, void *data, int len)
 
         switch (cmd) {
         case BNEP_CMD_NOT_UNDERSTOOD:
-        case BNEP_SETUP_CONN_REQ:
         case BNEP_SETUP_CONN_RSP:
         case BNEP_FILTER_NET_TYPE_RSP:
         case BNEP_FILTER_MULTI_ADDR_RSP:
@@ -245,6 +245,10 @@ static int bnep_rx_control(struct bnep_session *s, void *data, int len)
                 err = bnep_ctrl_set_mcfilter(s, data, len);
                 break;
 
+        case BNEP_SETUP_CONN_REQ:
+                err = bnep_send_rsp(s, BNEP_SETUP_CONN_RSP, BNEP_CONN_NOT_ALLOWED);
+                break;
+
         default: {
                         u8 pkt[3];
                         pkt[0] = BNEP_CONTROL;
@@ -629,7 +633,7 @@ int bnep_del_connection(struct bnep_conndel_req *req)
         s = __bnep_get_session(req->dst);
         if (s) {
                 /* Wakeup user-space which is polling for socket errors.
-                 * This is temporary hack untill we have shutdown in L2CAP */
+                 * This is temporary hack until we have shutdown in L2CAP */
                 s->sock->sk->sk_err = EUNATCH;
 
                 /* Kill session thread */
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index 26fb831ef7e0..5643a2391e76 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -26,6 +26,7 @@
 */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include <linux/socket.h>
 #include <linux/netdevice.h>
@@ -64,7 +65,7 @@ static void bnep_net_set_mc_list(struct net_device *dev)
         struct sk_buff *skb;
         int size;
 
-        BT_DBG("%s mc_count %d", dev->name, dev->mc_count);
+        BT_DBG("%s mc_count %d", dev->name, netdev_mc_count(dev));
 
         size = sizeof(*r) + (BNEP_MAX_MULTICAST_FILTERS + 1) * ETH_ALEN * 2;
         skb  = alloc_skb(size, GFP_ATOMIC);
@@ -97,7 +98,9 @@ static void bnep_net_set_mc_list(struct net_device *dev)
 
                 /* FIXME: We should group addresses here. */
 
-                for (i = 0; i < dev->mc_count && i < BNEP_MAX_MULTICAST_FILTERS; i++) {
+                for (i = 0;
+                     i < netdev_mc_count(dev) && i < BNEP_MAX_MULTICAST_FILTERS;
+                     i++) {
                         memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
                         memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
                         dmi = dmi->next;
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index e857628b0b27..2862f53b66b1 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -30,7 +30,6 @@
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/poll.h>
 #include <linux/fcntl.h>
 #include <linux/skbuff.h>
@@ -39,6 +38,7 @@
 #include <linux/file.h>
 #include <linux/init.h>
 #include <linux/compat.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -195,7 +195,8 @@ static struct proto bnep_proto = {
         .obj_size       = sizeof(struct bt_sock)
 };
 
-static int bnep_sock_create(struct net *net, struct socket *sock, int protocol)
+static int bnep_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -222,7 +223,7 @@ static int bnep_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family bnep_sock_family_ops = {
+static const struct net_proto_family bnep_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = bnep_sock_create
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 97f8d68d574d..3487cfe74aec 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -21,7 +21,8 @@
 */
 
 #include <linux/module.h>
-
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
@@ -516,33 +517,37 @@ static char *cmtp_procinfo(struct capi_ctr *ctrl)
         return "CAPI Message Transport Protocol";
 }
 
-static int cmtp_ctr_read_proc(char *page, char **start, off_t off, int count, int *eof, struct capi_ctr *ctrl)
+static int cmtp_proc_show(struct seq_file *m, void *v)
 {
+        struct capi_ctr *ctrl = m->private;
         struct cmtp_session *session = ctrl->driverdata;
         struct cmtp_application *app;
         struct list_head *p, *n;
-        int len = 0;
 
-        len += sprintf(page + len, "%s\n\n", cmtp_procinfo(ctrl));
-        len += sprintf(page + len, "addr %s\n", session->name);
-        len += sprintf(page + len, "ctrl %d\n", session->num);
+        seq_printf(m, "%s\n\n", cmtp_procinfo(ctrl));
+        seq_printf(m, "addr %s\n", session->name);
+        seq_printf(m, "ctrl %d\n", session->num);
 
         list_for_each_safe(p, n, &session->applications) {
                 app = list_entry(p, struct cmtp_application, list);
-                len += sprintf(page + len, "appl %d -> %d\n", app->appl, app->mapping);
+                seq_printf(m, "appl %d -> %d\n", app->appl, app->mapping);
         }
 
-        if (off + count >= len)
-                *eof = 1;
-
-        if (len < off)
-                return 0;
-
-        *start = page + off;
+        return 0;
+}
 
-        return ((count < len - off) ? count : len - off);
+static int cmtp_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, cmtp_proc_show, PDE(inode)->data);
 }
 
+static const struct file_operations cmtp_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = cmtp_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 
 int cmtp_attach_device(struct cmtp_session *session)
 {
@@ -582,7 +587,7 @@ int cmtp_attach_device(struct cmtp_session *session)
         session->ctrl.send_message  = cmtp_send_message;
 
         session->ctrl.procinfo      = cmtp_procinfo;
-        session->ctrl.ctr_read_proc = cmtp_ctr_read_proc;
+        session->ctrl.proc_fops = &cmtp_proc_fops;
 
         if (attach_capi_ctr(&session->ctrl) < 0) {
                 BT_ERR("Can't attach new controller");
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 16b0fad74f6e..7ea1979a8e4f 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -26,7 +26,6 @@
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/poll.h>
 #include <linux/fcntl.h>
 #include <linux/skbuff.h>
@@ -34,6 +33,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/compat.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
@@ -190,7 +190,8 @@ static struct proto cmtp_proto = {
         .obj_size       = sizeof(struct bt_sock)
 };
 
-static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol)
+static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -217,7 +218,7 @@ static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family cmtp_sock_family_ops = {
+static const struct net_proto_family cmtp_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = cmtp_sock_create
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b7c4224f4e7d..b10e3cdb08f8 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -377,6 +377,9 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 
         if (acl->state == BT_CONNECTED &&
                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
+                acl->power_save = 1;
+                hci_conn_enter_active_mode(acl);
+
                 if (lmp_esco_capable(hdev))
                         hci_setup_sync(sco, acl->handle);
                 else
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e1da8f68759c..4ad23192c7a5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -193,8 +193,9 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         while ((skb = skb_dequeue(&hdev->driver_init))) {
                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
                 skb->dev = (void *) hdev;
+
                 skb_queue_tail(&hdev->cmd_q, skb);
-                hci_sched_cmd(hdev);
+                tasklet_schedule(&hdev->cmd_task);
         }
         skb_queue_purge(&hdev->driver_init);
 
@@ -490,6 +491,10 @@ int hci_dev_open(__u16 dev)
         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
                 set_bit(HCI_RAW, &hdev->flags);
 
+        /* Treat all non BR/EDR controllers as raw devices for now */
+        if (hdev->dev_type != HCI_BREDR)
+                set_bit(HCI_RAW, &hdev->flags);
+
         if (hdev->open(hdev)) {
                 ret = -EIO;
                 goto done;
@@ -796,7 +801,7 @@ int hci_get_dev_info(void __user *arg)
 
         strcpy(di.name, hdev->name);
         di.bdaddr   = hdev->bdaddr;
-        di.type     = hdev->type;
+        di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
         di.flags    = hdev->flags;
         di.pkt_type = hdev->pkt_type;
         di.acl_mtu  = hdev->acl_mtu;
@@ -868,8 +873,8 @@ int hci_register_dev(struct hci_dev *hdev)
         struct list_head *head = &hci_dev_list, *p;
         int i, id = 0;
 
-        BT_DBG("%p name %s type %d owner %p", hdev, hdev->name,
-                                                hdev->type, hdev->owner);
+        BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
+                                                hdev->bus, hdev->owner);
 
         if (!hdev->open || !hdev->close || !hdev->destruct)
                 return -EINVAL;
@@ -945,7 +950,7 @@ int hci_unregister_dev(struct hci_dev *hdev)
 {
         int i;
 
-        BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
         write_lock_bh(&hci_dev_list_lock);
         list_del(&hdev->list);
@@ -987,6 +992,30 @@ int hci_resume_dev(struct hci_dev *hdev)
 }
 EXPORT_SYMBOL(hci_resume_dev);
 
+/* Receive frame from HCI drivers */
+int hci_recv_frame(struct sk_buff *skb)
+{
+        struct hci_dev *hdev = (struct hci_dev *) skb->dev;
+        if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
+                                && !test_bit(HCI_INIT, &hdev->flags))) {
+                kfree_skb(skb);
+                return -ENXIO;
+        }
+
+        /* Incomming skb */
+        bt_cb(skb)->incoming = 1;
+
+        /* Time stamp */
+        __net_timestamp(skb);
+
+        /* Queue frame for rx task */
+        skb_queue_tail(&hdev->rx_q, skb);
+        tasklet_schedule(&hdev->rx_task);
+
+        return 0;
+}
+EXPORT_SYMBOL(hci_recv_frame);
+
 /* Receive packet type fragment */
 #define __reassembly(hdev, type)  ((hdev)->reassembly[(type) - 2])
 
@@ -1193,8 +1222,9 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
 
         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
         skb->dev = (void *) hdev;
+
         skb_queue_tail(&hdev->cmd_q, skb);
-        hci_sched_cmd(hdev);
+        tasklet_schedule(&hdev->cmd_task);
 
         return 0;
 }
@@ -1271,7 +1301,8 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
                 spin_unlock_bh(&conn->data_q.lock);
         }
 
-        hci_sched_tx(hdev);
+        tasklet_schedule(&hdev->tx_task);
+
         return 0;
 }
 EXPORT_SYMBOL(hci_send_acl);
@@ -1298,8 +1329,10 @@ int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
 
         skb->dev = (void *) hdev;
         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
+
         skb_queue_tail(&conn->data_q, skb);
-        hci_sched_tx(hdev);
+        tasklet_schedule(&hdev->tx_task);
+
         return 0;
 }
 EXPORT_SYMBOL(hci_send_sco);
@@ -1612,7 +1645,7 @@ static void hci_cmd_task(unsigned long arg)
                         hdev->cmd_last_tx = jiffies;
                 } else {
                         skb_queue_head(&hdev->cmd_q, skb);
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
                 }
         }
 }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e99fe385fba2..6c57fc71c7e2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1320,7 +1320,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
         if (ev->ncmd) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
         }
 }
 
@@ -1386,7 +1386,7 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (ev->ncmd) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
         }
 }
 
@@ -1454,7 +1454,7 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
                 }
         }
 
-        hci_sched_tx(hdev);
+        tasklet_schedule(&hdev->tx_task);
 
         tasklet_enable(&hdev->tx_task);
 }
@@ -1698,7 +1698,9 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                 hci_conn_add_sysfs(conn);
                 break;
 
+        case 0x11:      /* Unsupported Feature or Parameter Value */
         case 0x1c:      /* SCO interval rejected */
+        case 0x1a:      /* Unsupported Remote Feature */
         case 0x1f:      /* Unspecified error */
                 if (conn->out && conn->attempt < 2) {
                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 75302a986067..38f08f6b86f6 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -329,6 +329,9 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
         }
 
         if (mask & HCI_CMSG_TSTAMP) {
+#ifdef CONFIG_COMPAT
+                struct compat_timeval ctv;
+#endif
                 struct timeval tv;
                 void *data;
                 int len;
@@ -339,7 +342,6 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
                 len = sizeof(tv);
 #ifdef CONFIG_COMPAT
                 if (msg->msg_flags & MSG_CMSG_COMPAT) {
-                        struct compat_timeval ctv;
                         ctv.tv_sec = tv.tv_sec;
                         ctv.tv_usec = tv.tv_usec;
                         data = &ctv;
@@ -414,6 +416,11 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto done;
         }
 
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = -ENETDOWN;
+                goto done;
+        }
+
         if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
                 goto done;
 
@@ -440,10 +447,10 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
                 if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) {
                         skb_queue_tail(&hdev->raw_q, skb);
-                        hci_sched_tx(hdev);
+                        tasklet_schedule(&hdev->tx_task);
                 } else {
                         skb_queue_tail(&hdev->cmd_q, skb);
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
                 }
         } else {
                 if (!capable(CAP_NET_RAW)) {
@@ -452,7 +459,7 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 }
 
                 skb_queue_tail(&hdev->raw_q, skb);
-                hci_sched_tx(hdev);
+                tasklet_schedule(&hdev->tx_task);
         }
 
         err = len;
@@ -621,7 +628,8 @@ static struct proto hci_sk_proto = {
         .obj_size       = sizeof(struct hci_pinfo)
 };
 
-static int hci_sock_create(struct net *net, struct socket *sock, int protocol)
+static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
+                           int kern)
 {
         struct sock *sk;
 
@@ -687,7 +695,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
         return NOTIFY_DONE;
 }
 
-static struct net_proto_family hci_sock_family_ops = {
+static const struct net_proto_family hci_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hci_sock_create,
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 2bc6f6a8de68..0e8e1a59856c 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -1,13 +1,18 @@
 /* Bluetooth HCI driver model support. */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/init.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
-struct class *bt_class = NULL;
-EXPORT_SYMBOL_GPL(bt_class);
+static struct class *bt_class;
+
+struct dentry *bt_debugfs = NULL;
+EXPORT_SYMBOL_GPL(bt_debugfs);
 
 static struct workqueue_struct *bt_workq;
 
@@ -166,9 +171,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
         queue_work(bt_workq, &conn->work_del);
 }
 
-static inline char *host_typetostr(int type)
+static inline char *host_bustostr(int bus)
 {
-        switch (type) {
+        switch (bus) {
         case HCI_VIRTUAL:
                 return "VIRTUAL";
         case HCI_USB:
@@ -188,10 +193,28 @@ static inline char *host_typetostr(int type)
         }
 }
 
+static inline char *host_typetostr(int type)
+{
+        switch (type) {
+        case HCI_BREDR:
+                return "BR/EDR";
+        case HCI_80211:
+                return "802.11";
+        default:
+                return "UNKNOWN";
+        }
+}
+
+static ssize_t show_bus(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_dev *hdev = dev_get_drvdata(dev);
+        return sprintf(buf, "%s\n", host_bustostr(hdev->bus));
+}
+
 static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        return sprintf(buf, "%s\n", host_typetostr(hdev->type));
+        return sprintf(buf, "%s\n", host_typetostr(hdev->dev_type));
 }
 
 static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
@@ -251,32 +274,6 @@ static ssize_t show_hci_revision(struct device *dev, struct device_attribute *at
         return sprintf(buf, "%d\n", hdev->hci_rev);
 }
 
-static ssize_t show_inquiry_cache(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct hci_dev *hdev = dev_get_drvdata(dev);
-        struct inquiry_cache *cache = &hdev->inq_cache;
-        struct inquiry_entry *e;
-        int n = 0;
-
-        hci_dev_lock_bh(hdev);
-
-        for (e = cache->list; e; e = e->next) {
-                struct inquiry_data *data = &e->data;
-                bdaddr_t bdaddr;
-                baswap(&bdaddr, &data->bdaddr);
-                n += sprintf(buf + n, "%s %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
-                                batostr(&bdaddr),
-                                data->pscan_rep_mode, data->pscan_period_mode,
-                                data->pscan_mode, data->dev_class[2],
-                                data->dev_class[1], data->dev_class[0],
-                                __le16_to_cpu(data->clock_offset),
-                                data->rssi, data->ssp_mode, e->timestamp);
-        }
-
-        hci_dev_unlock_bh(hdev);
-        return n;
-}
-
 static ssize_t show_idle_timeout(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
@@ -355,6 +352,7 @@ static ssize_t store_sniff_min_interval(struct device *dev, struct device_attrib
         return count;
 }
 
+static DEVICE_ATTR(bus, S_IRUGO, show_bus, NULL);
 static DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
 static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
 static DEVICE_ATTR(class, S_IRUGO, show_class, NULL);
@@ -363,7 +361,6 @@ static DEVICE_ATTR(features, S_IRUGO, show_features, NULL);
 static DEVICE_ATTR(manufacturer, S_IRUGO, show_manufacturer, NULL);
 static DEVICE_ATTR(hci_version, S_IRUGO, show_hci_version, NULL);
 static DEVICE_ATTR(hci_revision, S_IRUGO, show_hci_revision, NULL);
-static DEVICE_ATTR(inquiry_cache, S_IRUGO, show_inquiry_cache, NULL);
 
 static DEVICE_ATTR(idle_timeout, S_IRUGO | S_IWUSR,
                                 show_idle_timeout, store_idle_timeout);
@@ -373,6 +370,7 @@ static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR,
                                 show_sniff_min_interval, store_sniff_min_interval);
 
 static struct attribute *bt_host_attrs[] = {
+        &dev_attr_bus.attr,
         &dev_attr_type.attr,
         &dev_attr_name.attr,
         &dev_attr_class.attr,
@@ -381,7 +379,6 @@ static struct attribute *bt_host_attrs[] = {
         &dev_attr_manufacturer.attr,
         &dev_attr_hci_version.attr,
         &dev_attr_hci_revision.attr,
-        &dev_attr_inquiry_cache.attr,
         &dev_attr_idle_timeout.attr,
         &dev_attr_sniff_max_interval.attr,
         &dev_attr_sniff_min_interval.attr,
@@ -409,12 +406,50 @@ static struct device_type bt_host = {
         .release = bt_host_release,
 };
 
+static int inquiry_cache_show(struct seq_file *f, void *p)
+{
+        struct hci_dev *hdev = f->private;
+        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct inquiry_entry *e;
+
+        hci_dev_lock_bh(hdev);
+
+        for (e = cache->list; e; e = e->next) {
+                struct inquiry_data *data = &e->data;
+                bdaddr_t bdaddr;
+                baswap(&bdaddr, &data->bdaddr);
+                seq_printf(f, "%s %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
+                           batostr(&bdaddr),
+                           data->pscan_rep_mode, data->pscan_period_mode,
+                           data->pscan_mode, data->dev_class[2],
+                           data->dev_class[1], data->dev_class[0],
+                           __le16_to_cpu(data->clock_offset),
+                           data->rssi, data->ssp_mode, e->timestamp);
+        }
+
+        hci_dev_unlock_bh(hdev);
+
+        return 0;
+}
+
+static int inquiry_cache_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, inquiry_cache_show, inode->i_private);
+}
+
+static const struct file_operations inquiry_cache_fops = {
+        .open           = inquiry_cache_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
 int hci_register_sysfs(struct hci_dev *hdev)
 {
         struct device *dev = &hdev->dev;
         int err;
 
-        BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
         dev->type = &bt_host;
         dev->class = bt_class;
@@ -428,12 +463,24 @@ int hci_register_sysfs(struct hci_dev *hdev)
         if (err < 0)
                 return err;
 
+        if (!bt_debugfs)
+                return 0;
+
+        hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
+        if (!hdev->debugfs)
+                return 0;
+
+        debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
+                                                hdev, &inquiry_cache_fops);
+
         return 0;
 }
 
 void hci_unregister_sysfs(struct hci_dev *hdev)
 {
-        BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+
+        debugfs_remove_recursive(hdev->debugfs);
 
         device_del(&hdev->dev);
 }
@@ -444,6 +491,8 @@ int __init bt_sysfs_init(void)
         if (!bt_workq)
                 return -ENOMEM;
 
+        bt_debugfs = debugfs_create_dir("bluetooth", NULL);
+
         bt_class = class_create(THIS_MODULE, "bluetooth");
         if (IS_ERR(bt_class)) {
                 destroy_workqueue(bt_workq);
@@ -455,7 +504,9 @@ int __init bt_sysfs_init(void)
 
 void bt_sysfs_cleanup(void)
 {
-        destroy_workqueue(bt_workq);
-
         class_destroy(bt_class);
+
+        debugfs_remove_recursive(bt_debugfs);
+
+        destroy_workqueue(bt_workq);
 }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 49d8495d69be..280529ad9274 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -243,6 +243,39 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
         input_sync(dev);
 }
 
+static int __hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        struct sk_buff *skb;
+
+        BT_DBG("session %p data %p size %d", session, data, size);
+
+        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+
+        *skb_put(skb, 1) = hdr;
+        if (data && size > 0)
+                memcpy(skb_put(skb, size), data, size);
+
+        skb_queue_tail(&session->ctrl_transmit, skb);
+
+        return 0;
+}
+
+static inline int hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        int err;
+
+        err = __hidp_send_ctrl_message(session, hdr, data, size);
+
+        hidp_schedule(session);
+
+        return err;
+}
+
 static int hidp_queue_report(struct hidp_session *session,
                                 unsigned char *data, int size)
 {
@@ -280,6 +313,26 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
         return hidp_queue_report(session, buf, rsize);
 }
 
+static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
+                unsigned char report_type)
+{
+        switch (report_type) {
+        case HID_FEATURE_REPORT:
+                report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
+                break;
+        case HID_OUTPUT_REPORT:
+                report_type = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (hidp_send_ctrl_message(hid->driver_data, report_type,
+                        data, count))
+                return -ENOMEM;
+        return count;
+}
+
 static void hidp_idle_timeout(unsigned long arg)
 {
         struct hidp_session *session = (struct hidp_session *) arg;
@@ -300,39 +353,6 @@ static inline void hidp_del_timer(struct hidp_session *session)
                 del_timer(&session->timer);
 }
 
-static int __hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        struct sk_buff *skb;
-
-        BT_DBG("session %p data %p size %d", session, data, size);
-
-        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
-                BT_ERR("Can't allocate memory for new frame");
-                return -ENOMEM;
-        }
-
-        *skb_put(skb, 1) = hdr;
-        if (data && size > 0)
-                memcpy(skb_put(skb, size), data, size);
-
-        skb_queue_tail(&session->ctrl_transmit, skb);
-
-        return 0;
-}
-
-static inline int hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        int err;
-
-        err = __hidp_send_ctrl_message(session, hdr, data, size);
-
-        hidp_schedule(session);
-
-        return err;
-}
-
 static void hidp_process_handshake(struct hidp_session *session,
                                         unsigned char param)
 {
@@ -694,29 +714,9 @@ static void hidp_close(struct hid_device *hid)
 static int hidp_parse(struct hid_device *hid)
 {
         struct hidp_session *session = hid->driver_data;
-        struct hidp_connadd_req *req = session->req;
-        unsigned char *buf;
-        int ret;
-
-        buf = kmalloc(req->rd_size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        if (copy_from_user(buf, req->rd_data, req->rd_size)) {
-                kfree(buf);
-                return -EFAULT;
-        }
-
-        ret = hid_parse_report(session->hid, buf, req->rd_size);
-
-        kfree(buf);
-
-        if (ret)
-                return ret;
 
-        session->req = NULL;
-
-        return 0;
+        return hid_parse_report(session->hid, session->rd_data,
+                        session->rd_size);
 }
 
 static int hidp_start(struct hid_device *hid)
@@ -761,12 +761,24 @@ static int hidp_setup_hid(struct hidp_session *session,
         bdaddr_t src, dst;
         int err;
 
+        session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
+        if (!session->rd_data)
+                return -ENOMEM;
+
+        if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
+                err = -EFAULT;
+                goto fault;
+        }
+        session->rd_size = req->rd_size;
+
         hid = hid_allocate_device();
-        if (IS_ERR(hid))
-                return PTR_ERR(session->hid);
+        if (IS_ERR(hid)) {
+                err = PTR_ERR(hid);
+                goto fault;
+        }
 
         session->hid = hid;
-        session->req = req;
+
         hid->driver_data = session;
 
         baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
@@ -785,6 +797,8 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->dev.parent = hidp_get_device(session);
         hid->ll_driver = &hidp_hid_driver;
 
+        hid->hid_output_raw_report = hidp_output_raw_report;
+
         err = hid_add_device(hid);
         if (err < 0)
                 goto failed;
@@ -795,6 +809,10 @@ failed:
         hid_destroy_device(hid);
         session->hid = NULL;
 
+fault:
+        kfree(session->rd_data);
+        session->rd_data = NULL;
+
         return err;
 }
 
@@ -889,6 +907,9 @@ unlink:
                 session->hid = NULL;
         }
 
+        kfree(session->rd_data);
+        session->rd_data = NULL;
+
 purge:
         skb_queue_purge(&session->ctrl_transmit);
         skb_queue_purge(&session->intr_transmit);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index faf3d74c3586..a4e215d50c10 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -154,7 +154,9 @@ struct hidp_session {
         struct sk_buff_head ctrl_transmit;
         struct sk_buff_head intr_transmit;
 
-        struct hidp_connadd_req *req;
+        /* Report descriptor */
+        __u8 *rd_data;
+        uint rd_size;
 };
 
 static inline void hidp_schedule(struct hidp_session *session)
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 37c9d7d2e688..250dfd46237d 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -26,7 +26,6 @@
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/poll.h>
 #include <linux/fcntl.h>
 #include <linux/skbuff.h>
@@ -35,6 +34,7 @@
 #include <linux/file.h>
 #include <linux/init.h>
 #include <linux/compat.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 
 #include "hidp.h"
@@ -241,7 +241,8 @@ static struct proto hidp_proto = {
         .obj_size       = sizeof(struct bt_sock)
 };
 
-static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
+static int hidp_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -268,7 +269,7 @@ static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family hidp_sock_family_ops = {
+static const struct net_proto_family hidp_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hidp_sock_create
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 947f8bbb4bb3..9753b690a8b3 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -40,6 +40,8 @@
 #include <linux/skbuff.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/crc16.h>
 #include <net/sock.h>
@@ -54,6 +56,7 @@
 #define VERSION "2.14"
 
 static int enable_ertm = 0;
+static int max_transmit = L2CAP_DEFAULT_MAX_TX;
 
 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
 static u8 l2cap_fixed_chan[8] = { 0x02, };
@@ -373,6 +376,8 @@ static inline int l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
         else
                 control |= L2CAP_SUPER_RCV_READY;
 
+        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
         return l2cap_send_sframe(pi, control);
 }
 
@@ -819,7 +824,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
         return sk;
 }
 
-static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
+static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
+                             int kern)
 {
         struct sock *sk;
 
@@ -831,7 +837,7 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 return -EPERM;
 
         sock->ops = &l2cap_sock_ops;
@@ -996,7 +1002,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
 
         BT_DBG("sk %p", sk);
 
-        if (!addr || addr->sa_family != AF_BLUETOOTH)
+        if (!addr || alen < sizeof(addr->sa_family) ||
+            addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
         memset(&la, 0, sizeof(la));
@@ -1208,6 +1215,7 @@ static void l2cap_monitor_timeout(unsigned long arg)
         bh_lock_sock(sk);
         if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
                 l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk);
+                bh_unlock_sock(sk);
                 return;
         }
 
@@ -1332,7 +1340,7 @@ static int l2cap_retransmit_frame(struct sock *sk, u8 tx_seq)
                 tx_skb = skb_clone(skb, GFP_ATOMIC);
                 bt_cb(skb)->retries++;
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-                control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                                 | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
@@ -1361,9 +1369,8 @@ static int l2cap_ertm_send(struct sock *sk)
         if (pi->conn_state & L2CAP_CONN_WAIT_F)
                 return 0;
 
-        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))
-                        && !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
+        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
+               !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
 
                 if (pi->remote_max_tx &&
                                 bt_cb(skb)->retries == pi->remote_max_tx) {
@@ -1371,10 +1378,12 @@ static int l2cap_ertm_send(struct sock *sk)
                         break;
                 }
 
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
+
                 bt_cb(skb)->retries++;
 
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-                control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                                 | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
@@ -1603,8 +1612,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                 return -EOPNOTSUPP;
 
         /* Check outgoing MTU */
-        if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC
-                        && len > pi->omtu)
+        if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC &&
+            len > pi->omtu)
                 return -EINVAL;
 
         lock_sock(sk);
@@ -1617,7 +1626,10 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
         /* Connectionless channel */
         if (sk->sk_type == SOCK_DGRAM) {
                 skb = l2cap_create_connless_pdu(sk, msg, len);
-                err = l2cap_do_send(sk, skb);
+                if (IS_ERR(skb))
+                        err = PTR_ERR(skb);
+                else
+                        err = l2cap_do_send(sk, skb);
                 goto done;
         }
 
@@ -2172,6 +2184,21 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
         *ptr += L2CAP_CONF_OPT_SIZE + len;
 }
 
+static inline void l2cap_ertm_init(struct sock *sk)
+{
+        l2cap_pi(sk)->expected_ack_seq = 0;
+        l2cap_pi(sk)->unacked_frames = 0;
+        l2cap_pi(sk)->buffer_seq = 0;
+        l2cap_pi(sk)->num_to_ack = 0;
+
+        setup_timer(&l2cap_pi(sk)->retrans_timer,
+                        l2cap_retrans_timeout, (unsigned long) sk);
+        setup_timer(&l2cap_pi(sk)->monitor_timer,
+                        l2cap_monitor_timeout, (unsigned long) sk);
+
+        __skb_queue_head_init(SREJ_QUEUE(sk));
+}
+
 static int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
 {
         u32 local_feat_mask = l2cap_feat_mask;
@@ -2235,7 +2262,7 @@ done:
         case L2CAP_MODE_ERTM:
                 rfc.mode            = L2CAP_MODE_ERTM;
                 rfc.txwin_size      = L2CAP_DEFAULT_TX_WINDOW;
-                rfc.max_transmit    = L2CAP_DEFAULT_MAX_TX;
+                rfc.max_transmit    = max_transmit;
                 rfc.retrans_timeout = 0;
                 rfc.monitor_timeout = 0;
                 rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
@@ -2755,22 +2782,18 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto unlock;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
-                                || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
                         l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
 
                 sk->sk_state = BT_CONNECTED;
-                l2cap_pi(sk)->next_tx_seq = 0;
-                l2cap_pi(sk)->expected_ack_seq = 0;
-                l2cap_pi(sk)->unacked_frames = 0;
-
-                setup_timer(&l2cap_pi(sk)->retrans_timer,
-                                l2cap_retrans_timeout, (unsigned long) sk);
-                setup_timer(&l2cap_pi(sk)->monitor_timer,
-                                l2cap_monitor_timeout, (unsigned long) sk);
 
+                l2cap_pi(sk)->next_tx_seq = 0;
+                l2cap_pi(sk)->expected_tx_seq = 0;
                 __skb_queue_head_init(TX_QUEUE(sk));
-                __skb_queue_head_init(SREJ_QUEUE(sk));
+                if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(sk);
+
                 l2cap_chan_ready(sk);
                 goto unlock;
         }
@@ -2813,6 +2836,11 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                         int len = cmd->len - sizeof(*rsp);
                         char req[64];
 
+                        if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
+                                l2cap_send_disconn_req(conn, sk);
+                                goto done;
+                        }
+
                         /* throw out any old stored conf requests */
                         result = L2CAP_CONF_SUCCESS;
                         len = l2cap_parse_conf_rsp(sk, rsp->data,
@@ -2844,16 +2872,17 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
-                                || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
                         l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
 
                 sk->sk_state = BT_CONNECTED;
+                l2cap_pi(sk)->next_tx_seq = 0;
                 l2cap_pi(sk)->expected_tx_seq = 0;
-                l2cap_pi(sk)->buffer_seq = 0;
-                l2cap_pi(sk)->num_to_ack = 0;
                 __skb_queue_head_init(TX_QUEUE(sk));
-                __skb_queue_head_init(SREJ_QUEUE(sk));
+                if (l2cap_pi(sk)->mode ==  L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(sk);
+
                 l2cap_chan_ready(sk);
         }
 
@@ -2885,9 +2914,12 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
         sk->sk_shutdown = SHUTDOWN_MASK;
 
         skb_queue_purge(TX_QUEUE(sk));
-        skb_queue_purge(SREJ_QUEUE(sk));
-        del_timer(&l2cap_pi(sk)->retrans_timer);
-        del_timer(&l2cap_pi(sk)->monitor_timer);
+
+        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
+                skb_queue_purge(SREJ_QUEUE(sk));
+                del_timer(&l2cap_pi(sk)->retrans_timer);
+                del_timer(&l2cap_pi(sk)->monitor_timer);
+        }
 
         l2cap_chan_del(sk, ECONNRESET);
         bh_unlock_sock(sk);
@@ -2912,9 +2944,12 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
                 return 0;
 
         skb_queue_purge(TX_QUEUE(sk));
-        skb_queue_purge(SREJ_QUEUE(sk));
-        del_timer(&l2cap_pi(sk)->retrans_timer);
-        del_timer(&l2cap_pi(sk)->monitor_timer);
+
+        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
+                skb_queue_purge(SREJ_QUEUE(sk));
+                del_timer(&l2cap_pi(sk)->retrans_timer);
+                del_timer(&l2cap_pi(sk)->monitor_timer);
+        }
 
         l2cap_chan_del(sk, 0);
         bh_unlock_sock(sk);
@@ -3279,12 +3314,16 @@ static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, str
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         u8 tx_seq = __get_txseq(rx_control);
+        u8 req_seq = __get_reqseq(rx_control);
         u16 tx_control = 0;
         u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
         int err = 0;
 
         BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
 
+        pi->expected_ack_seq = req_seq;
+        l2cap_drop_acked_frames(sk);
+
         if (tx_seq == pi->expected_tx_seq)
                 goto expected;
 
@@ -3339,6 +3378,16 @@ expected:
                 return 0;
         }
 
+        if (rx_control & L2CAP_CTRL_FINAL) {
+                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                else {
+                        sk->sk_send_head = TX_QUEUE(sk)->next;
+                        pi->next_tx_seq = pi->expected_ack_seq;
+                        l2cap_ertm_send(sk);
+                }
+        }
+
         pi->buffer_seq = (pi->buffer_seq + 1) % 64;
 
         err = l2cap_sar_reassembly_sdu(sk, skb, rx_control);
@@ -3375,6 +3424,14 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                         pi->expected_ack_seq = tx_seq;
                         l2cap_drop_acked_frames(sk);
 
+                        if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                                pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                        else {
+                                sk->sk_send_head = TX_QUEUE(sk)->next;
+                                pi->next_tx_seq = pi->expected_ack_seq;
+                                l2cap_ertm_send(sk);
+                        }
+
                         if (!(pi->conn_state & L2CAP_CONN_WAIT_F))
                                 break;
 
@@ -3387,12 +3444,12 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                         pi->expected_ack_seq = tx_seq;
                         l2cap_drop_acked_frames(sk);
 
-                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
-                                        && (pi->unacked_frames > 0))
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                            (pi->unacked_frames > 0))
                                 __mod_retrans_timer();
 
-                        l2cap_ertm_send(sk);
                         pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                        l2cap_ertm_send(sk);
                 }
                 break;
 
@@ -3402,10 +3459,24 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                 pi->expected_ack_seq = __get_reqseq(rx_control);
                 l2cap_drop_acked_frames(sk);
 
-                sk->sk_send_head = TX_QUEUE(sk)->next;
-                pi->next_tx_seq = pi->expected_ack_seq;
+                if (rx_control & L2CAP_CTRL_FINAL) {
+                        if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                                pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                        else {
+                                sk->sk_send_head = TX_QUEUE(sk)->next;
+                                pi->next_tx_seq = pi->expected_ack_seq;
+                                l2cap_ertm_send(sk);
+                        }
+                } else {
+                        sk->sk_send_head = TX_QUEUE(sk)->next;
+                        pi->next_tx_seq = pi->expected_ack_seq;
+                        l2cap_ertm_send(sk);
 
-                l2cap_ertm_send(sk);
+                        if (pi->conn_state & L2CAP_CONN_WAIT_F) {
+                                pi->srej_save_reqseq = tx_seq;
+                                pi->conn_state |= L2CAP_CONN_REJ_ACT;
+                        }
+                }
 
                 break;
 
@@ -3413,9 +3484,9 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
                 if (rx_control & L2CAP_CTRL_POLL) {
-                        l2cap_retransmit_frame(sk, tx_seq);
                         pi->expected_ack_seq = tx_seq;
                         l2cap_drop_acked_frames(sk);
+                        l2cap_retransmit_frame(sk, tx_seq);
                         l2cap_ertm_send(sk);
                         if (pi->conn_state & L2CAP_CONN_WAIT_F) {
                                 pi->srej_save_reqseq = tx_seq;
@@ -3424,7 +3495,7 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                 } else if (rx_control & L2CAP_CTRL_FINAL) {
                         if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
                                         pi->srej_save_reqseq == tx_seq)
-                                pi->srej_save_reqseq &= ~L2CAP_CONN_SREJ_ACT;
+                                pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
                         else
                                 l2cap_retransmit_frame(sk, tx_seq);
                 }
@@ -3459,7 +3530,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
         struct l2cap_pinfo *pi;
         u16 control, len;
         u8 tx_seq;
-        int err;
 
         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
         if (!sk) {
@@ -3511,13 +3581,11 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                         goto drop;
 
                 if (__is_iframe(control))
-                        err = l2cap_data_channel_iframe(sk, control, skb);
+                        l2cap_data_channel_iframe(sk, control, skb);
                 else
-                        err = l2cap_data_channel_sframe(sk, control, skb);
+                        l2cap_data_channel_sframe(sk, control, skb);
 
-                if (!err)
-                        goto done;
-                break;
+                goto done;
 
         case L2CAP_MODE_STREAMING:
                 control = get_unaligned_le16(skb->data);
@@ -3543,7 +3611,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 else
                         pi->expected_tx_seq = tx_seq + 1;
 
-                err = l2cap_sar_reassembly_sdu(sk, skb, control);
+                l2cap_sar_reassembly_sdu(sk, skb, control);
 
                 goto done;
 
@@ -3880,29 +3948,42 @@ drop:
         return 0;
 }
 
-static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
+static int l2cap_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&l2cap_sk_list.lock);
 
         sk_for_each(sk, node, &l2cap_sk_list.head) {
                 struct l2cap_pinfo *pi = l2cap_pi(sk);
 
-                str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
-                                pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
+                seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
+                                        batostr(&bt_sk(sk)->src),
+                                        batostr(&bt_sk(sk)->dst),
+                                        sk->sk_state, __le16_to_cpu(pi->psm),
+                                        pi->scid, pi->dcid,
+                                        pi->imtu, pi->omtu, pi->sec_level);
         }
 
         read_unlock_bh(&l2cap_sk_list.lock);
 
-        return str - buf;
+        return 0;
+}
+
+static int l2cap_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, l2cap_debugfs_show, inode->i_private);
 }
 
-static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
+static const struct file_operations l2cap_debugfs_fops = {
+        .open           = l2cap_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *l2cap_debugfs;
 
 static const struct proto_ops l2cap_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -3924,7 +4005,7 @@ static const struct proto_ops l2cap_sock_ops = {
         .getsockopt     = l2cap_sock_getsockopt
 };
 
-static struct net_proto_family l2cap_sock_family_ops = {
+static const struct net_proto_family l2cap_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = l2cap_sock_create,
@@ -3962,8 +4043,12 @@ static int __init l2cap_init(void)
                 goto error;
         }
 
-        if (class_create_file(bt_class, &class_attr_l2cap) < 0)
-                BT_ERR("Failed to create L2CAP info file");
+        if (bt_debugfs) {
+                l2cap_debugfs = debugfs_create_file("l2cap", 0444,
+                                        bt_debugfs, NULL, &l2cap_debugfs_fops);
+                if (!l2cap_debugfs)
+                        BT_ERR("Failed to create L2CAP debug file");
+        }
 
         BT_INFO("L2CAP ver %s", VERSION);
         BT_INFO("L2CAP socket layer initialized");
@@ -3977,7 +4062,7 @@ error:
 
 static void __exit l2cap_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_l2cap);
+        debugfs_remove(l2cap_debugfs);
 
         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
                 BT_ERR("L2CAP socket unregistration failed");
@@ -4003,6 +4088,9 @@ module_exit(l2cap_exit);
 module_param(enable_ertm, bool, 0644);
 MODULE_PARM_DESC(enable_ertm, "Enable enhanced retransmission mode");
 
+module_param(max_transmit, uint, 0644);
+MODULE_PARM_DESC(max_transmit, "Max transmit value (default = 3)");
+
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 25692bc0a342..7dca91bb8c57 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -33,9 +33,12 @@
 #include <linux/init.h>
 #include <linux/wait.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/net.h>
 #include <linux/mutex.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 
 #include <net/sock.h>
 #include <asm/uaccess.h>
@@ -51,6 +54,7 @@
 static int disable_cfc = 0;
 static int channel_mtu = -1;
 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
+static int l2cap_ertm = 0;
 
 static struct task_struct *rfcomm_thread;
 
@@ -251,7 +255,6 @@ static void rfcomm_session_timeout(unsigned long arg)
         BT_DBG("session %p state %ld", s, s->state);
 
         set_bit(RFCOMM_TIMED_OUT, &s->flags);
-        rfcomm_session_put(s);
         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 }
 
@@ -702,6 +705,8 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         sk = sock->sk;
         lock_sock(sk);
         l2cap_pi(sk)->imtu = l2cap_mtu;
+        if (l2cap_ertm)
+                l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
         release_sock(sk);
 
         s = rfcomm_session_add(sock, BT_BOUND);
@@ -1148,7 +1153,11 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         break;
 
                 case BT_DISCONN:
-                        rfcomm_session_put(s);
+                        /* When socket is closed and we are not RFCOMM
+                         * initiator rfcomm_process_rx already calls
+                         * rfcomm_session_put() */
+                        if (s->sock->sk->sk_state != BT_CLOSED)
+                                rfcomm_session_put(s);
                         break;
                 }
         }
@@ -1917,6 +1926,7 @@ static inline void rfcomm_process_sessions(void)
                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
                         s->state = BT_DISCONN;
                         rfcomm_send_disc(s, 0);
+                        rfcomm_session_put(s);
                         continue;
                 }
 
@@ -2091,11 +2101,10 @@ static struct hci_cb rfcomm_cb = {
         .security_cfm   = rfcomm_security_cfm
 };
 
-static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
+static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
 {
         struct rfcomm_session *s;
         struct list_head *pp, *p;
-        char *str = buf;
 
         rfcomm_lock();
 
@@ -2105,18 +2114,32 @@ static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
                         struct sock *sk = s->sock->sk;
                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
 
-                        str += sprintf(str, "%s %s %ld %d %d %d %d\n",
-                                        batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                        d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
+                        seq_printf(f, "%s %s %ld %d %d %d %d\n",
+                                                batostr(&bt_sk(sk)->src),
+                                                batostr(&bt_sk(sk)->dst),
+                                                d->state, d->dlci, d->mtu,
+                                                d->rx_credits, d->tx_credits);
                 }
         }
 
         rfcomm_unlock();
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
+static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations rfcomm_dlc_debugfs_fops = {
+        .open           = rfcomm_dlc_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *rfcomm_dlc_debugfs;
 
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
@@ -2133,8 +2156,12 @@ static int __init rfcomm_init(void)
                 goto unregister;
         }
 
-        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
-                BT_ERR("Failed to create RFCOMM info file");
+        if (bt_debugfs) {
+                rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
+                                bt_debugfs, NULL, &rfcomm_dlc_debugfs_fops);
+                if (!rfcomm_dlc_debugfs)
+                        BT_ERR("Failed to create RFCOMM debug file");
+        }
 
         err = rfcomm_init_ttys();
         if (err < 0)
@@ -2162,7 +2189,7 @@ unregister:
 
 static void __exit rfcomm_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_rfcomm_dlc);
+        debugfs_remove(rfcomm_dlc_debugfs);
 
         hci_unregister_cb(&rfcomm_cb);
 
@@ -2185,6 +2212,9 @@ MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
 module_param(l2cap_mtu, uint, 0644);
 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
 
+module_param(l2cap_ertm, bool, 0644);
+MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
+
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 8a20aaf1f231..8ed3c37684fa 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -40,6 +40,8 @@
 #include <linux/skbuff.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -323,7 +325,8 @@ static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int
         return sk;
 }
 
-static int rfcomm_sock_create(struct net *net, struct socket *sock, int protocol)
+static int rfcomm_sock_create(struct net *net, struct socket *sock,
+                              int protocol, int kern)
 {
         struct sock *sk;
 
@@ -394,7 +397,8 @@ static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int a
 
         BT_DBG("sk %p", sk);
 
-        if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
+        if (alen < sizeof(struct sockaddr_rc) ||
+            addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
         lock_sock(sk);
@@ -703,7 +707,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 copied += chunk;
                 size   -= chunk;
 
-                sock_recv_timestamp(msg, sk, skb);
+                sock_recv_ts_and_drops(msg, sk, skb);
 
                 if (!(flags & MSG_PEEK)) {
                         atomic_sub(chunk, &sk->sk_rmem_alloc);
@@ -1060,26 +1064,38 @@ done:
         return result;
 }
 
-static ssize_t rfcomm_sock_sysfs_show(struct class *dev, char *buf)
+static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&rfcomm_sk_list.lock);
 
         sk_for_each(sk, node, &rfcomm_sk_list.head) {
-                str += sprintf(str, "%s %s %d %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+                seq_printf(f, "%s %s %d %d\n",
+                                batostr(&bt_sk(sk)->src),
+                                batostr(&bt_sk(sk)->dst),
                                 sk->sk_state, rfcomm_pi(sk)->channel);
         }
 
         read_unlock_bh(&rfcomm_sk_list.lock);
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
+static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations rfcomm_sock_debugfs_fops = {
+        .open           = rfcomm_sock_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *rfcomm_sock_debugfs;
 
 static const struct proto_ops rfcomm_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -1101,7 +1117,7 @@ static const struct proto_ops rfcomm_sock_ops = {
         .mmap           = sock_no_mmap
 };
 
-static struct net_proto_family rfcomm_sock_family_ops = {
+static const struct net_proto_family rfcomm_sock_family_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .create         = rfcomm_sock_create
@@ -1119,8 +1135,12 @@ int __init rfcomm_init_sockets(void)
         if (err < 0)
                 goto error;
 
-        if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
-                BT_ERR("Failed to create RFCOMM info file");
+        if (bt_debugfs) {
+                rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
+                                bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
+                if (!rfcomm_sock_debugfs)
+                        BT_ERR("Failed to create RFCOMM debug file");
+        }
 
         BT_INFO("RFCOMM socket layer initialized");
 
@@ -1134,7 +1154,7 @@ error:
 
 void rfcomm_cleanup_sockets(void)
 {
-        class_remove_file(bt_class, &class_attr_rfcomm);
+        debugfs_remove(rfcomm_sock_debugfs);
 
         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
                 BT_ERR("RFCOMM socket layer unregistration failed");
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 77f4153bdb5e..ca6b2ad1c3fc 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -38,6 +38,8 @@
 #include <linux/socket.h>
 #include <linux/skbuff.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/list.h>
 #include <net/sock.h>
 
@@ -430,7 +432,8 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int pro
         return sk;
 }
 
-static int sco_sock_create(struct net *net, struct socket *sock, int protocol)
+static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
+                           int kern)
 {
         struct sock *sk;
 
@@ -496,7 +499,8 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
 
         BT_DBG("sk %p", sk);
 
-        if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_sco))
+        if (alen < sizeof(struct sockaddr_sco) ||
+            addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
@@ -952,26 +956,36 @@ drop:
         return 0;
 }
 
-static ssize_t sco_sysfs_show(struct class *dev, char *buf)
+static int sco_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&sco_sk_list.lock);
 
         sk_for_each(sk, node, &sco_sk_list.head) {
-                str += sprintf(str, "%s %s %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state);
+                seq_printf(f, "%s %s %d\n", batostr(&bt_sk(sk)->src),
+                                batostr(&bt_sk(sk)->dst), sk->sk_state);
         }
 
         read_unlock_bh(&sco_sk_list.lock);
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(sco, S_IRUGO, sco_sysfs_show, NULL);
+static int sco_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, sco_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations sco_debugfs_fops = {
+        .open           = sco_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *sco_debugfs;
 
 static const struct proto_ops sco_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -993,7 +1007,7 @@ static const struct proto_ops sco_sock_ops = {
         .getsockopt     = sco_sock_getsockopt
 };
 
-static struct net_proto_family sco_sock_family_ops = {
+static const struct net_proto_family sco_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = sco_sock_create,
@@ -1029,8 +1043,12 @@ static int __init sco_init(void)
                 goto error;
         }
 
-        if (class_create_file(bt_class, &class_attr_sco) < 0)
-                BT_ERR("Failed to create SCO info file");
+        if (bt_debugfs) {
+                sco_debugfs = debugfs_create_file("sco", 0444,
+                                        bt_debugfs, NULL, &sco_debugfs_fops);
+                if (!sco_debugfs)
+                        BT_ERR("Failed to create SCO debug file");
+        }
 
         BT_INFO("SCO (Voice Link) ver %s", VERSION);
         BT_INFO("SCO socket layer initialized");
@@ -1044,7 +1062,7 @@ error:
 
 static void __exit sco_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_sco);
+        debugfs_remove(sco_debugfs);
 
         if (bt_sock_unregister(BTPROTO_SCO) < 0)
                 BT_ERR("SCO socket unregistration failed");
diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
index e143ca678881..d115d5cea5b6 100644
--- a/net/bridge/Kconfig
+++ b/net/bridge/Kconfig
@@ -31,3 +31,17 @@ config BRIDGE
           will be called bridge.
 
           If unsure, say N.
+
+config BRIDGE_IGMP_SNOOPING
+        bool "IGMP snooping"
+        depends on BRIDGE
+        depends on INET
+        default y
+        ---help---
+          If you say Y here, then the Ethernet bridge will be able selectively
+          forward multicast traffic based on IGMP traffic received from each
+          port.
+
+          Say N to exclude this support and reduce the binary size.
+
+          If unsure, say Y.
diff --git a/net/bridge/Makefile b/net/bridge/Makefile
index f444c12cde5a..d0359ea8ee79 100644
--- a/net/bridge/Makefile
+++ b/net/bridge/Makefile
@@ -12,4 +12,6 @@ bridge-$(CONFIG_SYSFS) += br_sysfs_if.o br_sysfs_br.o
 
 bridge-$(CONFIG_BRIDGE_NETFILTER) += br_netfilter.o
 
+bridge-$(CONFIG_BRIDGE_IGMP_SNOOPING) += br_multicast.o
+
 obj-$(CONFIG_BRIDGE_NF_EBTABLES) += netfilter/
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 07a07770c8b6..90a9024e5c1e 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -25,6 +25,9 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         struct net_bridge *br = netdev_priv(dev);
         const unsigned char *dest = skb->data;
         struct net_bridge_fdb_entry *dst;
+        struct net_bridge_mdb_entry *mdst;
+
+        BR_INPUT_SKB_CB(skb)->brdev = dev;
 
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
@@ -32,13 +35,21 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_reset_mac_header(skb);
         skb_pull(skb, ETH_HLEN);
 
-        if (dest[0] & 1)
-                br_flood_deliver(br, skb);
-        else if ((dst = __br_fdb_get(br, dest)) != NULL)
+        if (dest[0] & 1) {
+                if (br_multicast_rcv(br, NULL, skb))
+                        goto out;
+
+                mdst = br_mdb_get(br, skb);
+                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
+                        br_multicast_deliver(mdst, skb);
+                else
+                        br_flood_deliver(br, skb);
+        } else if ((dst = __br_fdb_get(br, dest)) != NULL)
                 br_deliver(dst->dst, skb);
         else
                 br_flood_deliver(br, skb);
 
+out:
         return NETDEV_TX_OK;
 }
 
@@ -49,6 +60,7 @@ static int br_dev_open(struct net_device *dev)
         br_features_recompute(br);
         netif_start_queue(dev);
         br_stp_enable_bridge(br);
+        br_multicast_open(br);
 
         return 0;
 }
@@ -59,7 +71,10 @@ static void br_dev_set_multicast_list(struct net_device *dev)
 
 static int br_dev_stop(struct net_device *dev)
 {
-        br_stp_disable_bridge(netdev_priv(dev));
+        struct net_bridge *br = netdev_priv(dev);
+
+        br_stp_disable_bridge(br);
+        br_multicast_stop(br);
 
         netif_stop_queue(dev);
 
@@ -157,6 +172,7 @@ static const struct ethtool_ops br_ethtool_ops = {
         .get_tso        = ethtool_op_get_tso,
         .set_tso        = br_set_tso,
         .get_ufo        = ethtool_op_get_ufo,
+        .set_ufo        = ethtool_op_set_ufo,
         .get_flags      = ethtool_op_get_flags,
 };
 
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 57bf05c353bc..9101a4e56201 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -20,6 +20,7 @@
 #include <linux/etherdevice.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <asm/atomic.h>
 #include <asm/unaligned.h>
 #include "br_private.h"
@@ -60,8 +61,8 @@ static inline unsigned long hold_time(const struct net_bridge *br)
 static inline int has_expired(const struct net_bridge *br,
                                   const struct net_bridge_fdb_entry *fdb)
 {
-        return !fdb->is_static
-                && time_before_eq(fdb->ageing_timer + hold_time(br), jiffies);
+        return !fdb->is_static &&
+                time_before_eq(fdb->ageing_timer + hold_time(br), jiffies);
 }
 
 static inline int br_mac_hash(const unsigned char *mac)
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index bc1704ac6cd9..7a241c396981 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -11,6 +11,8 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
@@ -18,6 +20,11 @@
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
 
+static int deliver_clone(const struct net_bridge_port *prev,
+                         struct sk_buff *skb,
+                         void (*__packet_hook)(const struct net_bridge_port *p,
+                                               struct sk_buff *skb));
+
 /* Don't forward packets to originating port or forwarding diasabled */
 static inline int should_deliver(const struct net_bridge_port *p,
                                  const struct sk_buff *skb)
@@ -93,61 +100,167 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 }
 
 /* called with rcu_read_lock */
-void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
+void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
 {
         if (should_deliver(to, skb)) {
-                __br_forward(to, skb);
+                if (skb0)
+                        deliver_clone(to, skb, __br_forward);
+                else
+                        __br_forward(to, skb);
                 return;
         }
 
-        kfree_skb(skb);
+        if (!skb0)
+                kfree_skb(skb);
 }
 
-/* called under bridge lock */
-static void br_flood(struct net_bridge *br, struct sk_buff *skb,
+static int deliver_clone(const struct net_bridge_port *prev,
+                         struct sk_buff *skb,
+                         void (*__packet_hook)(const struct net_bridge_port *p,
+                                               struct sk_buff *skb))
+{
+        skb = skb_clone(skb, GFP_ATOMIC);
+        if (!skb) {
+                struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+
+                dev->stats.tx_dropped++;
+                return -ENOMEM;
+        }
+
+        __packet_hook(prev, skb);
+        return 0;
+}
+
+static struct net_bridge_port *maybe_deliver(
+        struct net_bridge_port *prev, struct net_bridge_port *p,
+        struct sk_buff *skb,
         void (*__packet_hook)(const struct net_bridge_port *p,
                               struct sk_buff *skb))
 {
+        int err;
+
+        if (!should_deliver(p, skb))
+                return prev;
+
+        if (!prev)
+                goto out;
+
+        err = deliver_clone(prev, skb, __packet_hook);
+        if (err)
+                return ERR_PTR(err);
+
+out:
+        return p;
+}
+
+/* called under bridge lock */
+static void br_flood(struct net_bridge *br, struct sk_buff *skb,
+                     struct sk_buff *skb0,
+                     void (*__packet_hook)(const struct net_bridge_port *p,
+                                           struct sk_buff *skb))
+{
         struct net_bridge_port *p;
         struct net_bridge_port *prev;
 
         prev = NULL;
 
         list_for_each_entry_rcu(p, &br->port_list, list) {
-                if (should_deliver(p, skb)) {
-                        if (prev != NULL) {
-                                struct sk_buff *skb2;
-
-                                if ((skb2 = skb_clone(skb, GFP_ATOMIC)) == NULL) {
-                                        br->dev->stats.tx_dropped++;
-                                        kfree_skb(skb);
-                                        return;
-                                }
-
-                                __packet_hook(prev, skb2);
-                        }
-
-                        prev = p;
-                }
+                prev = maybe_deliver(prev, p, skb, __packet_hook);
+                if (IS_ERR(prev))
+                        goto out;
         }
 
-        if (prev != NULL) {
+        if (!prev)
+                goto out;
+
+        if (skb0)
+                deliver_clone(prev, skb, __packet_hook);
+        else
                 __packet_hook(prev, skb);
-                return;
-        }
+        return;
 
-        kfree_skb(skb);
+out:
+        if (!skb0)
+                kfree_skb(skb);
 }
 
 
 /* called with rcu_read_lock */
 void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb)
 {
-        br_flood(br, skb, __br_deliver);
+        br_flood(br, skb, NULL, __br_deliver);
 }
 
 /* called under bridge lock */
-void br_flood_forward(struct net_bridge *br, struct sk_buff *skb)
+void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
+                      struct sk_buff *skb2)
+{
+        br_flood(br, skb, skb2, __br_forward);
+}
+
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+/* called with rcu_read_lock */
+static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+                               struct sk_buff *skb, struct sk_buff *skb0,
+                               void (*__packet_hook)(
+                                        const struct net_bridge_port *p,
+                                        struct sk_buff *skb))
+{
+        struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+        struct net_bridge *br = netdev_priv(dev);
+        struct net_bridge_port *port;
+        struct net_bridge_port *lport, *rport;
+        struct net_bridge_port *prev;
+        struct net_bridge_port_group *p;
+        struct hlist_node *rp;
+
+        prev = NULL;
+
+        rp = br->router_list.first;
+        p = mdst ? mdst->ports : NULL;
+        while (p || rp) {
+                lport = p ? p->port : NULL;
+                rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
+                             NULL;
+
+                port = (unsigned long)lport > (unsigned long)rport ?
+                       lport : rport;
+
+                prev = maybe_deliver(prev, port, skb, __packet_hook);
+                if (IS_ERR(prev))
+                        goto out;
+
+                if ((unsigned long)lport >= (unsigned long)port)
+                        p = p->next;
+                if ((unsigned long)rport >= (unsigned long)port)
+                        rp = rp->next;
+        }
+
+        if (!prev)
+                goto out;
+
+        if (skb0)
+                deliver_clone(prev, skb, __packet_hook);
+        else
+                __packet_hook(prev, skb);
+        return;
+
+out:
+        if (!skb0)
+                kfree_skb(skb);
+}
+
+/* called with rcu_read_lock */
+void br_multicast_deliver(struct net_bridge_mdb_entry *mdst,
+                          struct sk_buff *skb)
+{
+        br_multicast_flood(mdst, skb, NULL, __br_deliver);
+}
+
+/* called with rcu_read_lock */
+void br_multicast_forward(struct net_bridge_mdb_entry *mdst,
+                          struct sk_buff *skb, struct sk_buff *skb2)
 {
-        br_flood(br, skb, __br_forward);
+        br_multicast_flood(mdst, skb, skb2, __br_forward);
 }
+#endif
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 4a9f52732655..0b6b1f2ff7ac 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -19,6 +19,7 @@
 #include <linux/init.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_ether.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 
 #include "br_private.h"
@@ -147,6 +148,8 @@ static void del_nbp(struct net_bridge_port *p)
 
         rcu_assign_pointer(dev->br_port, NULL);
 
+        br_multicast_del_port(p);
+
         kobject_uevent(&p->kobj, KOBJ_REMOVE);
         kobject_del(&p->kobj);
 
@@ -154,7 +157,7 @@ static void del_nbp(struct net_bridge_port *p)
 }
 
 /* called with RTNL */
-static void del_br(struct net_bridge *br)
+static void del_br(struct net_bridge *br, struct list_head *head)
 {
         struct net_bridge_port *p, *n;
 
@@ -165,7 +168,7 @@ static void del_br(struct net_bridge *br)
         del_timer_sync(&br->gc_timer);
 
         br_sysfs_delbr(br->dev);
-        unregister_netdevice(br->dev);
+        unregister_netdevice_queue(br->dev, head);
 }
 
 static struct net_device *new_bridge_dev(struct net *net, const char *name)
@@ -206,9 +209,8 @@ static struct net_device *new_bridge_dev(struct net *net, const char *name)
 
         br_netfilter_rtable_init(br);
 
-        INIT_LIST_HEAD(&br->age_list);
-
         br_stp_timer_init(br);
+        br_multicast_init(br);
 
         return dev;
 }
@@ -260,6 +262,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         br_init_port(p);
         p->state = BR_STATE_DISABLED;
         br_stp_port_timer_init(p);
+        br_multicast_add_port(p);
 
         return p;
 }
@@ -323,7 +326,7 @@ int br_del_bridge(struct net *net, const char *name)
         }
 
         else
-                del_br(netdev_priv(dev));
+                del_br(netdev_priv(dev), NULL);
 
         rtnl_unlock();
         return ret;
@@ -390,6 +393,10 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (dev->br_port != NULL)
                 return -EBUSY;
 
+        /* No bridging devices that dislike that (e.g. wireless) */
+        if (dev->priv_flags & IFF_DONT_BRIDGE)
+                return -EOPNOTSUPP;
+
         p = new_nbp(br, dev);
         if (IS_ERR(p))
                 return PTR_ERR(p);
@@ -463,18 +470,17 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         return 0;
 }
 
-void br_net_exit(struct net *net)
+void __net_exit br_net_exit(struct net *net)
 {
         struct net_device *dev;
+        LIST_HEAD(list);
 
         rtnl_lock();
-restart:
-        for_each_netdev(net, dev) {
-                if (dev->priv_flags & IFF_EBRIDGE) {
-                        del_br(netdev_priv(dev));
-                        goto restart;
-                }
-        }
+        for_each_netdev(net, dev)
+                if (dev->priv_flags & IFF_EBRIDGE)
+                        del_br(netdev_priv(dev), &list);
+
+        unregister_netdevice_many(&list);
         rtnl_unlock();
 
 }
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 5ee1a3682bf2..a82dde2d2ead 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -11,6 +11,7 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -20,9 +21,9 @@
 /* Bridge group multicast address 802.1d (pg 51). */
 const u8 br_group_address[ETH_ALEN] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
 
-static void br_pass_frame_up(struct net_bridge *br, struct sk_buff *skb)
+static int br_pass_frame_up(struct sk_buff *skb)
 {
-        struct net_device *indev, *brdev = br->dev;
+        struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
 
         brdev->stats.rx_packets++;
         brdev->stats.rx_bytes += skb->len;
@@ -30,8 +31,8 @@ static void br_pass_frame_up(struct net_bridge *br, struct sk_buff *skb)
         indev = skb->dev;
         skb->dev = brdev;
 
-        NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
-                netif_receive_skb);
+        return NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
+                       netif_receive_skb);
 }
 
 /* note: already called with rcu_read_lock (preempt_disabled) */
@@ -41,6 +42,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
         struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
         struct net_bridge *br;
         struct net_bridge_fdb_entry *dst;
+        struct net_bridge_mdb_entry *mdst;
         struct sk_buff *skb2;
 
         if (!p || p->state == BR_STATE_DISABLED)
@@ -50,9 +52,15 @@ int br_handle_frame_finish(struct sk_buff *skb)
         br = p->br;
         br_fdb_update(br, p, eth_hdr(skb)->h_source);
 
+        if (is_multicast_ether_addr(dest) &&
+            br_multicast_rcv(br, p, skb))
+                goto drop;
+
         if (p->state == BR_STATE_LEARNING)
                 goto drop;
 
+        BR_INPUT_SKB_CB(skb)->brdev = br->dev;
+
         /* The packet skb2 goes to the local host (NULL to skip). */
         skb2 = NULL;
 
@@ -62,27 +70,35 @@ int br_handle_frame_finish(struct sk_buff *skb)
         dst = NULL;
 
         if (is_multicast_ether_addr(dest)) {
+                mdst = br_mdb_get(br, skb);
+                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
+                        if ((mdst && !hlist_unhashed(&mdst->mglist)) ||
+                            br_multicast_is_router(br))
+                                skb2 = skb;
+                        br_multicast_forward(mdst, skb, skb2);
+                        skb = NULL;
+                        if (!skb2)
+                                goto out;
+                } else
+                        skb2 = skb;
+
                 br->dev->stats.multicast++;
-                skb2 = skb;
         } else if ((dst = __br_fdb_get(br, dest)) && dst->is_local) {
                 skb2 = skb;
                 /* Do not forward the packet since it's local. */
                 skb = NULL;
         }
 
-        if (skb2 == skb)
-                skb2 = skb_clone(skb, GFP_ATOMIC);
-
-        if (skb2)
-                br_pass_frame_up(br, skb2);
-
         if (skb) {
                 if (dst)
-                        br_forward(dst->dst, skb);
+                        br_forward(dst->dst, skb, skb2);
                 else
-                        br_flood_forward(br, skb);
+                        br_flood_forward(br, skb, skb2);
         }
 
+        if (skb2)
+                return br_pass_frame_up(skb2);
+
 out:
         return 0;
 drop:
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 6a6433daaf27..995afc4b04dc 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/if_bridge.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <linux/times.h>
 #include <net/net_namespace.h>
 #include <asm/uaccess.h>
@@ -81,6 +82,7 @@ static int get_fdb_entries(struct net_bridge *br, void __user *userbuf,
         return num;
 }
 
+/* called with RTNL */
 static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
 {
         struct net_device *dev;
@@ -89,7 +91,7 @@ static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        dev = dev_get_by_index(dev_net(br->dev), ifindex);
+        dev = __dev_get_by_index(dev_net(br->dev), ifindex);
         if (dev == NULL)
                 return -EINVAL;
 
@@ -98,7 +100,6 @@ static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
         else
                 ret = br_del_if(br, dev);
 
-        dev_put(dev);
         return ret;
 }
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
new file mode 100644
index 000000000000..eaa0e1bae49b
--- /dev/null
+++ b/net/bridge/br_multicast.c
@@ -0,0 +1,1309 @@
+/*
+ * Bridge multicast support.
+ *
+ * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#include <linux/err.h>
+#include <linux/if_ether.h>
+#include <linux/igmp.h>
+#include <linux/jhash.h>
+#include <linux/kernel.h>
+#include <linux/log2.h>
+#include <linux/netdevice.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/random.h>
+#include <linux/rculist.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/timer.h>
+#include <net/ip.h>
+
+#include "br_private.h"
+
+static inline int br_ip_hash(struct net_bridge_mdb_htable *mdb, __be32 ip)
+{
+        return jhash_1word(mdb->secret, (u32)ip) & (mdb->max - 1);
+}
+
+static struct net_bridge_mdb_entry *__br_mdb_ip_get(
+        struct net_bridge_mdb_htable *mdb, __be32 dst, int hash)
+{
+        struct net_bridge_mdb_entry *mp;
+        struct hlist_node *p;
+
+        hlist_for_each_entry_rcu(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+                if (dst == mp->addr)
+                        return mp;
+        }
+
+        return NULL;
+}
+
+static struct net_bridge_mdb_entry *br_mdb_ip_get(
+        struct net_bridge_mdb_htable *mdb, __be32 dst)
+{
+        if (!mdb)
+                return NULL;
+
+        return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
+}
+
+struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
+                                        struct sk_buff *skb)
+{
+        if (br->multicast_disabled)
+                return NULL;
+
+        switch (skb->protocol) {
+        case htons(ETH_P_IP):
+                if (BR_INPUT_SKB_CB(skb)->igmp)
+                        break;
+                return br_mdb_ip_get(br->mdb, ip_hdr(skb)->daddr);
+        }
+
+        return NULL;
+}
+
+static void br_mdb_free(struct rcu_head *head)
+{
+        struct net_bridge_mdb_htable *mdb =
+                container_of(head, struct net_bridge_mdb_htable, rcu);
+        struct net_bridge_mdb_htable *old = mdb->old;
+
+        mdb->old = NULL;
+        kfree(old->mhash);
+        kfree(old);
+}
+
+static int br_mdb_copy(struct net_bridge_mdb_htable *new,
+                       struct net_bridge_mdb_htable *old,
+                       int elasticity)
+{
+        struct net_bridge_mdb_entry *mp;
+        struct hlist_node *p;
+        int maxlen;
+        int len;
+        int i;
+
+        for (i = 0; i < old->max; i++)
+                hlist_for_each_entry(mp, p, &old->mhash[i], hlist[old->ver])
+                        hlist_add_head(&mp->hlist[new->ver],
+                                       &new->mhash[br_ip_hash(new, mp->addr)]);
+
+        if (!elasticity)
+                return 0;
+
+        maxlen = 0;
+        for (i = 0; i < new->max; i++) {
+                len = 0;
+                hlist_for_each_entry(mp, p, &new->mhash[i], hlist[new->ver])
+                        len++;
+                if (len > maxlen)
+                        maxlen = len;
+        }
+
+        return maxlen > elasticity ? -EINVAL : 0;
+}
+
+static void br_multicast_free_pg(struct rcu_head *head)
+{
+        struct net_bridge_port_group *p =
+                container_of(head, struct net_bridge_port_group, rcu);
+
+        kfree(p);
+}
+
+static void br_multicast_free_group(struct rcu_head *head)
+{
+        struct net_bridge_mdb_entry *mp =
+                container_of(head, struct net_bridge_mdb_entry, rcu);
+
+        kfree(mp);
+}
+
+static void br_multicast_group_expired(unsigned long data)
+{
+        struct net_bridge_mdb_entry *mp = (void *)data;
+        struct net_bridge *br = mp->br;
+        struct net_bridge_mdb_htable *mdb;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) || timer_pending(&mp->timer))
+                goto out;
+
+        if (!hlist_unhashed(&mp->mglist))
+                hlist_del_init(&mp->mglist);
+
+        if (mp->ports)
+                goto out;
+
+        mdb = br->mdb;
+        hlist_del_rcu(&mp->hlist[mdb->ver]);
+        mdb->size--;
+
+        del_timer(&mp->query_timer);
+        call_rcu_bh(&mp->rcu, br_multicast_free_group);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+static void br_multicast_del_pg(struct net_bridge *br,
+                                struct net_bridge_port_group *pg)
+{
+        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct net_bridge_mdb_entry *mp;
+        struct net_bridge_port_group *p;
+        struct net_bridge_port_group **pp;
+
+        mp = br_mdb_ip_get(mdb, pg->addr);
+        if (WARN_ON(!mp))
+                return;
+
+        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+                if (p != pg)
+                        continue;
+
+                *pp = p->next;
+                hlist_del_init(&p->mglist);
+                del_timer(&p->timer);
+                del_timer(&p->query_timer);
+                call_rcu_bh(&p->rcu, br_multicast_free_pg);
+
+                if (!mp->ports && hlist_unhashed(&mp->mglist) &&
+                    netif_running(br->dev))
+                        mod_timer(&mp->timer, jiffies);
+
+                return;
+        }
+
+        WARN_ON(1);
+}
+
+static void br_multicast_port_group_expired(unsigned long data)
+{
+        struct net_bridge_port_group *pg = (void *)data;
+        struct net_bridge *br = pg->port->br;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) || timer_pending(&pg->timer) ||
+            hlist_unhashed(&pg->mglist))
+                goto out;
+
+        br_multicast_del_pg(br, pg);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+static int br_mdb_rehash(struct net_bridge_mdb_htable **mdbp, int max,
+                         int elasticity)
+{
+        struct net_bridge_mdb_htable *old = *mdbp;
+        struct net_bridge_mdb_htable *mdb;
+        int err;
+
+        mdb = kmalloc(sizeof(*mdb), GFP_ATOMIC);
+        if (!mdb)
+                return -ENOMEM;
+
+        mdb->max = max;
+        mdb->old = old;
+
+        mdb->mhash = kzalloc(max * sizeof(*mdb->mhash), GFP_ATOMIC);
+        if (!mdb->mhash) {
+                kfree(mdb);
+                return -ENOMEM;
+        }
+
+        mdb->size = old ? old->size : 0;
+        mdb->ver = old ? old->ver ^ 1 : 0;
+
+        if (!old || elasticity)
+                get_random_bytes(&mdb->secret, sizeof(mdb->secret));
+        else
+                mdb->secret = old->secret;
+
+        if (!old)
+                goto out;
+
+        err = br_mdb_copy(mdb, old, elasticity);
+        if (err) {
+                kfree(mdb->mhash);
+                kfree(mdb);
+                return err;
+        }
+
+        call_rcu_bh(&mdb->rcu, br_mdb_free);
+
+out:
+        rcu_assign_pointer(*mdbp, mdb);
+
+        return 0;
+}
+
+static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
+                                                __be32 group)
+{
+        struct sk_buff *skb;
+        struct igmphdr *ih;
+        struct ethhdr *eth;
+        struct iphdr *iph;
+
+        skb = netdev_alloc_skb_ip_align(br->dev, sizeof(*eth) + sizeof(*iph) +
+                                                 sizeof(*ih) + 4);
+        if (!skb)
+                goto out;
+
+        skb->protocol = htons(ETH_P_IP);
+
+        skb_reset_mac_header(skb);
+        eth = eth_hdr(skb);
+
+        memcpy(eth->h_source, br->dev->dev_addr, 6);
+        eth->h_dest[0] = 1;
+        eth->h_dest[1] = 0;
+        eth->h_dest[2] = 0x5e;
+        eth->h_dest[3] = 0;
+        eth->h_dest[4] = 0;
+        eth->h_dest[5] = 1;
+        eth->h_proto = htons(ETH_P_IP);
+        skb_put(skb, sizeof(*eth));
+
+        skb_set_network_header(skb, skb->len);
+        iph = ip_hdr(skb);
+
+        iph->version = 4;
+        iph->ihl = 6;
+        iph->tos = 0xc0;
+        iph->tot_len = htons(sizeof(*iph) + sizeof(*ih) + 4);
+        iph->id = 0;
+        iph->frag_off = htons(IP_DF);
+        iph->ttl = 1;
+        iph->protocol = IPPROTO_IGMP;
+        iph->saddr = 0;
+        iph->daddr = htonl(INADDR_ALLHOSTS_GROUP);
+        ((u8 *)&iph[1])[0] = IPOPT_RA;
+        ((u8 *)&iph[1])[1] = 4;
+        ((u8 *)&iph[1])[2] = 0;
+        ((u8 *)&iph[1])[3] = 0;
+        ip_send_check(iph);
+        skb_put(skb, 24);
+
+        skb_set_transport_header(skb, skb->len);
+        ih = igmp_hdr(skb);
+        ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
+        ih->code = (group ? br->multicast_last_member_interval :
+                            br->multicast_query_response_interval) /
+                   (HZ / IGMP_TIMER_SCALE);
+        ih->group = group;
+        ih->csum = 0;
+        ih->csum = ip_compute_csum((void *)ih, sizeof(struct igmphdr));
+        skb_put(skb, sizeof(*ih));
+
+        __skb_pull(skb, sizeof(*eth));
+
+out:
+        return skb;
+}
+
+static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
+{
+        struct net_bridge *br = mp->br;
+        struct sk_buff *skb;
+
+        skb = br_multicast_alloc_query(br, mp->addr);
+        if (!skb)
+                goto timer;
+
+        netif_rx(skb);
+
+timer:
+        if (++mp->queries_sent < br->multicast_last_member_count)
+                mod_timer(&mp->query_timer,
+                          jiffies + br->multicast_last_member_interval);
+}
+
+static void br_multicast_group_query_expired(unsigned long data)
+{
+        struct net_bridge_mdb_entry *mp = (void *)data;
+        struct net_bridge *br = mp->br;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) || hlist_unhashed(&mp->mglist) ||
+            mp->queries_sent >= br->multicast_last_member_count)
+                goto out;
+
+        br_multicast_send_group_query(mp);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
+{
+        struct net_bridge_port *port = pg->port;
+        struct net_bridge *br = port->br;
+        struct sk_buff *skb;
+
+        skb = br_multicast_alloc_query(br, pg->addr);
+        if (!skb)
+                goto timer;
+
+        br_deliver(port, skb);
+
+timer:
+        if (++pg->queries_sent < br->multicast_last_member_count)
+                mod_timer(&pg->query_timer,
+                          jiffies + br->multicast_last_member_interval);
+}
+
+static void br_multicast_port_group_query_expired(unsigned long data)
+{
+        struct net_bridge_port_group *pg = (void *)data;
+        struct net_bridge_port *port = pg->port;
+        struct net_bridge *br = port->br;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
+            pg->queries_sent >= br->multicast_last_member_count)
+                goto out;
+
+        br_multicast_send_port_group_query(pg);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+static struct net_bridge_mdb_entry *br_multicast_get_group(
+        struct net_bridge *br, struct net_bridge_port *port, __be32 group,
+        int hash)
+{
+        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct net_bridge_mdb_entry *mp;
+        struct hlist_node *p;
+        unsigned count = 0;
+        unsigned max;
+        int elasticity;
+        int err;
+
+        hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+                count++;
+                if (unlikely(group == mp->addr)) {
+                        return mp;
+                }
+        }
+
+        elasticity = 0;
+        max = mdb->max;
+
+        if (unlikely(count > br->hash_elasticity && count)) {
+                if (net_ratelimit())
+                        printk(KERN_INFO "%s: Multicast hash table "
+                               "chain limit reached: %s\n",
+                               br->dev->name, port ? port->dev->name :
+                                                     br->dev->name);
+
+                elasticity = br->hash_elasticity;
+        }
+
+        if (mdb->size >= max) {
+                max *= 2;
+                if (unlikely(max >= br->hash_max)) {
+                        printk(KERN_WARNING "%s: Multicast hash table maximum "
+                               "reached, disabling snooping: %s, %d\n",
+                               br->dev->name, port ? port->dev->name :
+                                                     br->dev->name,
+                               max);
+                        err = -E2BIG;
+disable:
+                        br->multicast_disabled = 1;
+                        goto err;
+                }
+        }
+
+        if (max > mdb->max || elasticity) {
+                if (mdb->old) {
+                        if (net_ratelimit())
+                                printk(KERN_INFO "%s: Multicast hash table "
+                                       "on fire: %s\n",
+                                       br->dev->name, port ? port->dev->name :
+                                                             br->dev->name);
+                        err = -EEXIST;
+                        goto err;
+                }
+
+                err = br_mdb_rehash(&br->mdb, max, elasticity);
+                if (err) {
+                        printk(KERN_WARNING "%s: Cannot rehash multicast "
+                               "hash table, disabling snooping: "
+                               "%s, %d, %d\n",
+                               br->dev->name, port ? port->dev->name :
+                                                     br->dev->name,
+                               mdb->size, err);
+                        goto disable;
+                }
+
+                err = -EAGAIN;
+                goto err;
+        }
+
+        return NULL;
+
+err:
+        mp = ERR_PTR(err);
+        return mp;
+}
+
+static struct net_bridge_mdb_entry *br_multicast_new_group(
+        struct net_bridge *br, struct net_bridge_port *port, __be32 group)
+{
+        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct net_bridge_mdb_entry *mp;
+        int hash;
+
+        if (!mdb) {
+                if (br_mdb_rehash(&br->mdb, BR_HASH_SIZE, 0))
+                        return NULL;
+                goto rehash;
+        }
+
+        hash = br_ip_hash(mdb, group);
+        mp = br_multicast_get_group(br, port, group, hash);
+        switch (PTR_ERR(mp)) {
+        case 0:
+                break;
+
+        case -EAGAIN:
+rehash:
+                mdb = br->mdb;
+                hash = br_ip_hash(mdb, group);
+                break;
+
+        default:
+                goto out;
+        }
+
+        mp = kzalloc(sizeof(*mp), GFP_ATOMIC);
+        if (unlikely(!mp))
+                goto out;
+
+        mp->br = br;
+        mp->addr = group;
+        setup_timer(&mp->timer, br_multicast_group_expired,
+                    (unsigned long)mp);
+        setup_timer(&mp->query_timer, br_multicast_group_query_expired,
+                    (unsigned long)mp);
+
+        hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
+        mdb->size++;
+
+out:
+        return mp;
+}
+
+static int br_multicast_add_group(struct net_bridge *br,
+                                  struct net_bridge_port *port, __be32 group)
+{
+        struct net_bridge_mdb_entry *mp;
+        struct net_bridge_port_group *p;
+        struct net_bridge_port_group **pp;
+        unsigned long now = jiffies;
+        int err;
+
+        if (ipv4_is_local_multicast(group))
+                return 0;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) ||
+            (port && port->state == BR_STATE_DISABLED))
+                goto out;
+
+        mp = br_multicast_new_group(br, port, group);
+        err = PTR_ERR(mp);
+        if (unlikely(IS_ERR(mp) || !mp))
+                goto err;
+
+        if (!port) {
+                hlist_add_head(&mp->mglist, &br->mglist);
+                mod_timer(&mp->timer, now + br->multicast_membership_interval);
+                goto out;
+        }
+
+        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+                if (p->port == port)
+                        goto found;
+                if ((unsigned long)p->port < (unsigned long)port)
+                        break;
+        }
+
+        p = kzalloc(sizeof(*p), GFP_ATOMIC);
+        err = -ENOMEM;
+        if (unlikely(!p))
+                goto err;
+
+        p->addr = group;
+        p->port = port;
+        p->next = *pp;
+        hlist_add_head(&p->mglist, &port->mglist);
+        setup_timer(&p->timer, br_multicast_port_group_expired,
+                    (unsigned long)p);
+        setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
+                    (unsigned long)p);
+
+        rcu_assign_pointer(*pp, p);
+
+found:
+        mod_timer(&p->timer, now + br->multicast_membership_interval);
+out:
+        err = 0;
+
+err:
+        spin_unlock(&br->multicast_lock);
+        return err;
+}
+
+static void br_multicast_router_expired(unsigned long data)
+{
+        struct net_bridge_port *port = (void *)data;
+        struct net_bridge *br = port->br;
+
+        spin_lock(&br->multicast_lock);
+        if (port->multicast_router != 1 ||
+            timer_pending(&port->multicast_router_timer) ||
+            hlist_unhashed(&port->rlist))
+                goto out;
+
+        hlist_del_init_rcu(&port->rlist);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+static void br_multicast_local_router_expired(unsigned long data)
+{
+}
+
+static void br_multicast_send_query(struct net_bridge *br,
+                                    struct net_bridge_port *port, u32 sent)
+{
+        unsigned long time;
+        struct sk_buff *skb;
+
+        if (!netif_running(br->dev) || br->multicast_disabled ||
+            timer_pending(&br->multicast_querier_timer))
+                return;
+
+        skb = br_multicast_alloc_query(br, 0);
+        if (!skb)
+                goto timer;
+
+        if (port) {
+                __skb_push(skb, sizeof(struct ethhdr));
+                skb->dev = port->dev;
+                NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+                        dev_queue_xmit);
+        } else
+                netif_rx(skb);
+
+timer:
+        time = jiffies;
+        time += sent < br->multicast_startup_query_count ?
+                br->multicast_startup_query_interval :
+                br->multicast_query_interval;
+        mod_timer(port ? &port->multicast_query_timer :
+                         &br->multicast_query_timer, time);
+}
+
+static void br_multicast_port_query_expired(unsigned long data)
+{
+        struct net_bridge_port *port = (void *)data;
+        struct net_bridge *br = port->br;
+
+        spin_lock(&br->multicast_lock);
+        if (port->state == BR_STATE_DISABLED ||
+            port->state == BR_STATE_BLOCKING)
+                goto out;
+
+        if (port->multicast_startup_queries_sent <
+            br->multicast_startup_query_count)
+                port->multicast_startup_queries_sent++;
+
+        br_multicast_send_query(port->br, port,
+                                port->multicast_startup_queries_sent);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+void br_multicast_add_port(struct net_bridge_port *port)
+{
+        port->multicast_router = 1;
+
+        setup_timer(&port->multicast_router_timer, br_multicast_router_expired,
+                    (unsigned long)port);
+        setup_timer(&port->multicast_query_timer,
+                    br_multicast_port_query_expired, (unsigned long)port);
+}
+
+void br_multicast_del_port(struct net_bridge_port *port)
+{
+        del_timer_sync(&port->multicast_router_timer);
+}
+
+static void __br_multicast_enable_port(struct net_bridge_port *port)
+{
+        port->multicast_startup_queries_sent = 0;
+
+        if (try_to_del_timer_sync(&port->multicast_query_timer) >= 0 ||
+            del_timer(&port->multicast_query_timer))
+                mod_timer(&port->multicast_query_timer, jiffies);
+}
+
+void br_multicast_enable_port(struct net_bridge_port *port)
+{
+        struct net_bridge *br = port->br;
+
+        spin_lock(&br->multicast_lock);
+        if (br->multicast_disabled || !netif_running(br->dev))
+                goto out;
+
+        __br_multicast_enable_port(port);
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+void br_multicast_disable_port(struct net_bridge_port *port)
+{
+        struct net_bridge *br = port->br;
+        struct net_bridge_port_group *pg;
+        struct hlist_node *p, *n;
+
+        spin_lock(&br->multicast_lock);
+        hlist_for_each_entry_safe(pg, p, n, &port->mglist, mglist)
+                br_multicast_del_pg(br, pg);
+
+        if (!hlist_unhashed(&port->rlist))
+                hlist_del_init_rcu(&port->rlist);
+        del_timer(&port->multicast_router_timer);
+        del_timer(&port->multicast_query_timer);
+        spin_unlock(&br->multicast_lock);
+}
+
+static int br_multicast_igmp3_report(struct net_bridge *br,
+                                     struct net_bridge_port *port,
+                                     struct sk_buff *skb)
+{
+        struct igmpv3_report *ih;
+        struct igmpv3_grec *grec;
+        int i;
+        int len;
+        int num;
+        int type;
+        int err = 0;
+        __be32 group;
+
+        if (!pskb_may_pull(skb, sizeof(*ih)))
+                return -EINVAL;
+
+        ih = igmpv3_report_hdr(skb);
+        num = ntohs(ih->ngrec);
+        len = sizeof(*ih);
+
+        for (i = 0; i < num; i++) {
+                len += sizeof(*grec);
+                if (!pskb_may_pull(skb, len))
+                        return -EINVAL;
+
+                grec = (void *)(skb->data + len - sizeof(*grec));
+                group = grec->grec_mca;
+                type = grec->grec_type;
+
+                len += ntohs(grec->grec_nsrcs) * 4;
+                if (!pskb_may_pull(skb, len))
+                        return -EINVAL;
+
+                /* We treat this as an IGMPv2 report for now. */
+                switch (type) {
+                case IGMPV3_MODE_IS_INCLUDE:
+                case IGMPV3_MODE_IS_EXCLUDE:
+                case IGMPV3_CHANGE_TO_INCLUDE:
+                case IGMPV3_CHANGE_TO_EXCLUDE:
+                case IGMPV3_ALLOW_NEW_SOURCES:
+                case IGMPV3_BLOCK_OLD_SOURCES:
+                        break;
+
+                default:
+                        continue;
+                }
+
+                err = br_multicast_add_group(br, port, group);
+                if (err)
+                        break;
+        }
+
+        return err;
+}
+
+static void br_multicast_add_router(struct net_bridge *br,
+                                    struct net_bridge_port *port)
+{
+        struct hlist_node *p;
+        struct hlist_node **h;
+
+        for (h = &br->router_list.first;
+             (p = *h) &&
+             (unsigned long)container_of(p, struct net_bridge_port, rlist) >
+             (unsigned long)port;
+             h = &p->next)
+                ;
+
+        port->rlist.pprev = h;
+        port->rlist.next = p;
+        rcu_assign_pointer(*h, &port->rlist);
+        if (p)
+                p->pprev = &port->rlist.next;
+}
+
+static void br_multicast_mark_router(struct net_bridge *br,
+                                     struct net_bridge_port *port)
+{
+        unsigned long now = jiffies;
+
+        if (!port) {
+                if (br->multicast_router == 1)
+                        mod_timer(&br->multicast_router_timer,
+                                  now + br->multicast_querier_interval);
+                return;
+        }
+
+        if (port->multicast_router != 1)
+                return;
+
+        if (!hlist_unhashed(&port->rlist))
+                goto timer;
+
+        br_multicast_add_router(br, port);
+
+timer:
+        mod_timer(&port->multicast_router_timer,
+                  now + br->multicast_querier_interval);
+}
+
+static void br_multicast_query_received(struct net_bridge *br,
+                                        struct net_bridge_port *port,
+                                        __be32 saddr)
+{
+        if (saddr)
+                mod_timer(&br->multicast_querier_timer,
+                          jiffies + br->multicast_querier_interval);
+        else if (timer_pending(&br->multicast_querier_timer))
+                return;
+
+        br_multicast_mark_router(br, port);
+}
+
+static int br_multicast_query(struct net_bridge *br,
+                              struct net_bridge_port *port,
+                              struct sk_buff *skb)
+{
+        struct iphdr *iph = ip_hdr(skb);
+        struct igmphdr *ih = igmp_hdr(skb);
+        struct net_bridge_mdb_entry *mp;
+        struct igmpv3_query *ih3;
+        struct net_bridge_port_group *p;
+        struct net_bridge_port_group **pp;
+        unsigned long max_delay;
+        unsigned long now = jiffies;
+        __be32 group;
+        int err = 0;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) ||
+            (port && port->state == BR_STATE_DISABLED))
+                goto out;
+
+        br_multicast_query_received(br, port, iph->saddr);
+
+        group = ih->group;
+
+        if (skb->len == sizeof(*ih)) {
+                max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
+
+                if (!max_delay) {
+                        max_delay = 10 * HZ;
+                        group = 0;
+                }
+        } else {
+                if (!pskb_may_pull(skb, sizeof(struct igmpv3_query))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+
+                ih3 = igmpv3_query_hdr(skb);
+                if (ih3->nsrcs)
+                        goto out;
+
+                max_delay = ih3->code ?
+                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
+        }
+
+        if (!group)
+                goto out;
+
+        mp = br_mdb_ip_get(br->mdb, group);
+        if (!mp)
+                goto out;
+
+        max_delay *= br->multicast_last_member_count;
+
+        if (!hlist_unhashed(&mp->mglist) &&
+            (timer_pending(&mp->timer) ?
+             time_after(mp->timer.expires, now + max_delay) :
+             try_to_del_timer_sync(&mp->timer) >= 0))
+                mod_timer(&mp->timer, now + max_delay);
+
+        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+                if (timer_pending(&p->timer) ?
+                    time_after(p->timer.expires, now + max_delay) :
+                    try_to_del_timer_sync(&p->timer) >= 0)
+                        mod_timer(&mp->timer, now + max_delay);
+        }
+
+out:
+        spin_unlock(&br->multicast_lock);
+        return err;
+}
+
+static void br_multicast_leave_group(struct net_bridge *br,
+                                     struct net_bridge_port *port,
+                                     __be32 group)
+{
+        struct net_bridge_mdb_htable *mdb;
+        struct net_bridge_mdb_entry *mp;
+        struct net_bridge_port_group *p;
+        unsigned long now;
+        unsigned long time;
+
+        if (ipv4_is_local_multicast(group))
+                return;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) ||
+            (port && port->state == BR_STATE_DISABLED) ||
+            timer_pending(&br->multicast_querier_timer))
+                goto out;
+
+        mdb = br->mdb;
+        mp = br_mdb_ip_get(mdb, group);
+        if (!mp)
+                goto out;
+
+        now = jiffies;
+        time = now + br->multicast_last_member_count *
+                     br->multicast_last_member_interval;
+
+        if (!port) {
+                if (!hlist_unhashed(&mp->mglist) &&
+                    (timer_pending(&mp->timer) ?
+                     time_after(mp->timer.expires, time) :
+                     try_to_del_timer_sync(&mp->timer) >= 0)) {
+                        mod_timer(&mp->timer, time);
+
+                        mp->queries_sent = 0;
+                        mod_timer(&mp->query_timer, now);
+                }
+
+                goto out;
+        }
+
+        for (p = mp->ports; p; p = p->next) {
+                if (p->port != port)
+                        continue;
+
+                if (!hlist_unhashed(&p->mglist) &&
+                    (timer_pending(&p->timer) ?
+                     time_after(p->timer.expires, time) :
+                     try_to_del_timer_sync(&p->timer) >= 0)) {
+                        mod_timer(&p->timer, time);
+
+                        p->queries_sent = 0;
+                        mod_timer(&p->query_timer, now);
+                }
+
+                break;
+        }
+
+out:
+        spin_unlock(&br->multicast_lock);
+}
+
+static int br_multicast_ipv4_rcv(struct net_bridge *br,
+                                 struct net_bridge_port *port,
+                                 struct sk_buff *skb)
+{
+        struct sk_buff *skb2 = skb;
+        struct iphdr *iph;
+        struct igmphdr *ih;
+        unsigned len;
+        unsigned offset;
+        int err;
+
+        /* We treat OOM as packet loss for now. */
+        if (!pskb_may_pull(skb, sizeof(*iph)))
+                return -EINVAL;
+
+        iph = ip_hdr(skb);
+
+        if (iph->ihl < 5 || iph->version != 4)
+                return -EINVAL;
+
+        if (!pskb_may_pull(skb, ip_hdrlen(skb)))
+                return -EINVAL;
+
+        iph = ip_hdr(skb);
+
+        if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
+                return -EINVAL;
+
+        if (iph->protocol != IPPROTO_IGMP)
+                return 0;
+
+        len = ntohs(iph->tot_len);
+        if (skb->len < len || len < ip_hdrlen(skb))
+                return -EINVAL;
+
+        if (skb->len > len) {
+                skb2 = skb_clone(skb, GFP_ATOMIC);
+                if (!skb2)
+                        return -ENOMEM;
+
+                err = pskb_trim_rcsum(skb2, len);
+                if (err)
+                        goto err_out;
+        }
+
+        len -= ip_hdrlen(skb2);
+        offset = skb_network_offset(skb2) + ip_hdrlen(skb2);
+        __skb_pull(skb2, offset);
+        skb_reset_transport_header(skb2);
+
+        err = -EINVAL;
+        if (!pskb_may_pull(skb2, sizeof(*ih)))
+                goto out;
+
+        iph = ip_hdr(skb2);
+
+        switch (skb2->ip_summed) {
+        case CHECKSUM_COMPLETE:
+                if (!csum_fold(skb2->csum))
+                        break;
+                /* fall through */
+        case CHECKSUM_NONE:
+                skb2->csum = 0;
+                if (skb_checksum_complete(skb2))
+                        goto out;
+        }
+
+        err = 0;
+
+        BR_INPUT_SKB_CB(skb)->igmp = 1;
+        ih = igmp_hdr(skb2);
+
+        switch (ih->type) {
+        case IGMP_HOST_MEMBERSHIP_REPORT:
+        case IGMPV2_HOST_MEMBERSHIP_REPORT:
+                BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+                err = br_multicast_add_group(br, port, ih->group);
+                break;
+        case IGMPV3_HOST_MEMBERSHIP_REPORT:
+                err = br_multicast_igmp3_report(br, port, skb2);
+                break;
+        case IGMP_HOST_MEMBERSHIP_QUERY:
+                err = br_multicast_query(br, port, skb2);
+                break;
+        case IGMP_HOST_LEAVE_MESSAGE:
+                br_multicast_leave_group(br, port, ih->group);
+                break;
+        }
+
+out:
+        __skb_push(skb2, offset);
+err_out:
+        if (skb2 != skb)
+                kfree_skb(skb2);
+        return err;
+}
+
+int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
+                     struct sk_buff *skb)
+{
+        BR_INPUT_SKB_CB(skb)->igmp = 0;
+        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
+
+        if (br->multicast_disabled)
+                return 0;
+
+        switch (skb->protocol) {
+        case htons(ETH_P_IP):
+                return br_multicast_ipv4_rcv(br, port, skb);
+        }
+
+        return 0;
+}
+
+static void br_multicast_query_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
+
+        spin_lock(&br->multicast_lock);
+        if (br->multicast_startup_queries_sent <
+            br->multicast_startup_query_count)
+                br->multicast_startup_queries_sent++;
+
+        br_multicast_send_query(br, NULL, br->multicast_startup_queries_sent);
+
+        spin_unlock(&br->multicast_lock);
+}
+
+void br_multicast_init(struct net_bridge *br)
+{
+        br->hash_elasticity = 4;
+        br->hash_max = 512;
+
+        br->multicast_router = 1;
+        br->multicast_last_member_count = 2;
+        br->multicast_startup_query_count = 2;
+
+        br->multicast_last_member_interval = HZ;
+        br->multicast_query_response_interval = 10 * HZ;
+        br->multicast_startup_query_interval = 125 * HZ / 4;
+        br->multicast_query_interval = 125 * HZ;
+        br->multicast_querier_interval = 255 * HZ;
+        br->multicast_membership_interval = 260 * HZ;
+
+        spin_lock_init(&br->multicast_lock);
+        setup_timer(&br->multicast_router_timer,
+                    br_multicast_local_router_expired, 0);
+        setup_timer(&br->multicast_querier_timer,
+                    br_multicast_local_router_expired, 0);
+        setup_timer(&br->multicast_query_timer, br_multicast_query_expired,
+                    (unsigned long)br);
+}
+
+void br_multicast_open(struct net_bridge *br)
+{
+        br->multicast_startup_queries_sent = 0;
+
+        if (br->multicast_disabled)
+                return;
+
+        mod_timer(&br->multicast_query_timer, jiffies);
+}
+
+void br_multicast_stop(struct net_bridge *br)
+{
+        struct net_bridge_mdb_htable *mdb;
+        struct net_bridge_mdb_entry *mp;
+        struct hlist_node *p, *n;
+        u32 ver;
+        int i;
+
+        del_timer_sync(&br->multicast_router_timer);
+        del_timer_sync(&br->multicast_querier_timer);
+        del_timer_sync(&br->multicast_query_timer);
+
+        spin_lock_bh(&br->multicast_lock);
+        mdb = br->mdb;
+        if (!mdb)
+                goto out;
+
+        br->mdb = NULL;
+
+        ver = mdb->ver;
+        for (i = 0; i < mdb->max; i++) {
+                hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
+                                          hlist[ver]) {
+                        del_timer(&mp->timer);
+                        del_timer(&mp->query_timer);
+                        call_rcu_bh(&mp->rcu, br_multicast_free_group);
+                }
+        }
+
+        if (mdb->old) {
+                spin_unlock_bh(&br->multicast_lock);
+                rcu_barrier_bh();
+                spin_lock_bh(&br->multicast_lock);
+                WARN_ON(mdb->old);
+        }
+
+        mdb->old = mdb;
+        call_rcu_bh(&mdb->rcu, br_mdb_free);
+
+out:
+        spin_unlock_bh(&br->multicast_lock);
+}
+
+int br_multicast_set_router(struct net_bridge *br, unsigned long val)
+{
+        int err = -ENOENT;
+
+        spin_lock_bh(&br->multicast_lock);
+        if (!netif_running(br->dev))
+                goto unlock;
+
+        switch (val) {
+        case 0:
+        case 2:
+                del_timer(&br->multicast_router_timer);
+                /* fall through */
+        case 1:
+                br->multicast_router = val;
+                err = 0;
+                break;
+
+        default:
+                err = -EINVAL;
+                break;
+        }
+
+unlock:
+        spin_unlock_bh(&br->multicast_lock);
+
+        return err;
+}
+
+int br_multicast_set_port_router(struct net_bridge_port *p, unsigned long val)
+{
+        struct net_bridge *br = p->br;
+        int err = -ENOENT;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) || p->state == BR_STATE_DISABLED)
+                goto unlock;
+
+        switch (val) {
+        case 0:
+        case 1:
+        case 2:
+                p->multicast_router = val;
+                err = 0;
+
+                if (val < 2 && !hlist_unhashed(&p->rlist))
+                        hlist_del_init_rcu(&p->rlist);
+
+                if (val == 1)
+                        break;
+
+                del_timer(&p->multicast_router_timer);
+
+                if (val == 0)
+                        break;
+
+                br_multicast_add_router(br, p);
+                break;
+
+        default:
+                err = -EINVAL;
+                break;
+        }
+
+unlock:
+        spin_unlock(&br->multicast_lock);
+
+        return err;
+}
+
+int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+{
+        struct net_bridge_port *port;
+        int err = -ENOENT;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev))
+                goto unlock;
+
+        err = 0;
+        if (br->multicast_disabled == !val)
+                goto unlock;
+
+        br->multicast_disabled = !val;
+        if (br->multicast_disabled)
+                goto unlock;
+
+        if (br->mdb) {
+                if (br->mdb->old) {
+                        err = -EEXIST;
+rollback:
+                        br->multicast_disabled = !!val;
+                        goto unlock;
+                }
+
+                err = br_mdb_rehash(&br->mdb, br->mdb->max,
+                                    br->hash_elasticity);
+                if (err)
+                        goto rollback;
+        }
+
+        br_multicast_open(br);
+        list_for_each_entry(port, &br->port_list, list) {
+                if (port->state == BR_STATE_DISABLED ||
+                    port->state == BR_STATE_BLOCKING)
+                        continue;
+
+                __br_multicast_enable_port(port);
+        }
+
+unlock:
+        spin_unlock(&br->multicast_lock);
+
+        return err;
+}
+
+int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
+{
+        int err = -ENOENT;
+        u32 old;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev))
+                goto unlock;
+
+        err = -EINVAL;
+        if (!is_power_of_2(val))
+                goto unlock;
+        if (br->mdb && val < br->mdb->size)
+                goto unlock;
+
+        err = 0;
+
+        old = br->hash_max;
+        br->hash_max = val;
+
+        if (br->mdb) {
+                if (br->mdb->old) {
+                        err = -EEXIST;
+rollback:
+                        br->hash_max = old;
+                        goto unlock;
+                }
+
+                err = br_mdb_rehash(&br->mdb, br->hash_max,
+                                    br->hash_elasticity);
+                if (err)
+                        goto rollback;
+        }
+
+unlock:
+        spin_unlock(&br->multicast_lock);
+
+        return err;
+}
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index a16a2342f6bf..4c4977d12fd6 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -23,6 +23,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/ip.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
@@ -1013,12 +1014,12 @@ static ctl_table brnf_table[] = {
                 .mode           = 0644,
                 .proc_handler   = brnf_sysctl_call_tables,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_path brnf_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "bridge", .ctl_name = NET_BRIDGE, },
+        { .procname = "net", },
+        { .procname = "bridge", },
         { }
 };
 #endif
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index fcffb3fb1177..aa56ac2c8829 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <net/rtnetlink.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2114e45682ea..846d7d1e2075 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -57,6 +57,41 @@ struct net_bridge_fdb_entry
         unsigned char                   is_static;
 };
 
+struct net_bridge_port_group {
+        struct net_bridge_port          *port;
+        struct net_bridge_port_group    *next;
+        struct hlist_node               mglist;
+        struct rcu_head                 rcu;
+        struct timer_list               timer;
+        struct timer_list               query_timer;
+        __be32                          addr;
+        u32                             queries_sent;
+};
+
+struct net_bridge_mdb_entry
+{
+        struct hlist_node               hlist[2];
+        struct hlist_node               mglist;
+        struct net_bridge               *br;
+        struct net_bridge_port_group    *ports;
+        struct rcu_head                 rcu;
+        struct timer_list               timer;
+        struct timer_list               query_timer;
+        __be32                          addr;
+        u32                             queries_sent;
+};
+
+struct net_bridge_mdb_htable
+{
+        struct hlist_head               *mhash;
+        struct rcu_head                 rcu;
+        struct net_bridge_mdb_htable    *old;
+        u32                             size;
+        u32                             max;
+        u32                             secret;
+        u32                             ver;
+};
+
 struct net_bridge_port
 {
         struct net_bridge               *br;
@@ -84,6 +119,15 @@ struct net_bridge_port
 
         unsigned long                   flags;
 #define BR_HAIRPIN_MODE         0x00000001
+
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+        u32                             multicast_startup_queries_sent;
+        unsigned char                   multicast_router;
+        struct timer_list               multicast_router_timer;
+        struct timer_list               multicast_query_timer;
+        struct hlist_head               mglist;
+        struct hlist_node               rlist;
+#endif
 };
 
 struct net_bridge
@@ -93,7 +137,6 @@ struct net_bridge
         struct net_device               *dev;
         spinlock_t                      hash_lock;
         struct hlist_head               hash[BR_HASH_SIZE];
-        struct list_head                age_list;
         unsigned long                   feature_mask;
 #ifdef CONFIG_BRIDGE_NETFILTER
         struct rtable                   fake_rtable;
@@ -125,6 +168,35 @@ struct net_bridge
         unsigned char                   topology_change;
         unsigned char                   topology_change_detected;
 
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+        unsigned char                   multicast_router;
+
+        u8                              multicast_disabled:1;
+
+        u32                             hash_elasticity;
+        u32                             hash_max;
+
+        u32                             multicast_last_member_count;
+        u32                             multicast_startup_queries_sent;
+        u32                             multicast_startup_query_count;
+
+        unsigned long                   multicast_last_member_interval;
+        unsigned long                   multicast_membership_interval;
+        unsigned long                   multicast_querier_interval;
+        unsigned long                   multicast_query_interval;
+        unsigned long                   multicast_query_response_interval;
+        unsigned long                   multicast_startup_query_interval;
+
+        spinlock_t                      multicast_lock;
+        struct net_bridge_mdb_htable    *mdb;
+        struct hlist_head               router_list;
+        struct hlist_head               mglist;
+
+        struct timer_list               multicast_router_timer;
+        struct timer_list               multicast_querier_timer;
+        struct timer_list               multicast_query_timer;
+#endif
+
         struct timer_list               hello_timer;
         struct timer_list               tcn_timer;
         struct timer_list               topology_change_timer;
@@ -132,6 +204,22 @@ struct net_bridge
         struct kobject                  *ifobj;
 };
 
+struct br_input_skb_cb {
+        struct net_device *brdev;
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+        int igmp;
+        int mrouters_only;
+#endif
+};
+
+#define BR_INPUT_SKB_CB(__skb)  ((struct br_input_skb_cb *)(__skb)->cb)
+
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+# define BR_INPUT_SKB_CB_MROUTERS_ONLY(__skb)   (BR_INPUT_SKB_CB(__skb)->mrouters_only)
+#else
+# define BR_INPUT_SKB_CB_MROUTERS_ONLY(__skb)   (0)
+#endif
+
 extern struct notifier_block br_device_notifier;
 extern const u8 br_group_address[ETH_ALEN];
 
@@ -172,10 +260,11 @@ extern void br_deliver(const struct net_bridge_port *to,
                 struct sk_buff *skb);
 extern int br_dev_queue_push_xmit(struct sk_buff *skb);
 extern void br_forward(const struct net_bridge_port *to,
-                struct sk_buff *skb);
+                struct sk_buff *skb, struct sk_buff *skb0);
 extern int br_forward_finish(struct sk_buff *skb);
 extern void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb);
-extern void br_flood_forward(struct net_bridge *br, struct sk_buff *skb);
+extern void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
+                             struct sk_buff *skb2);
 
 /* br_if.c */
 extern void br_port_carrier_check(struct net_bridge_port *p);
@@ -198,6 +287,94 @@ extern struct sk_buff *br_handle_frame(struct net_bridge_port *p,
 extern int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *arg);
 
+/* br_multicast.c */
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+extern int br_multicast_rcv(struct net_bridge *br,
+                            struct net_bridge_port *port,
+                            struct sk_buff *skb);
+extern struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
+                                               struct sk_buff *skb);
+extern void br_multicast_add_port(struct net_bridge_port *port);
+extern void br_multicast_del_port(struct net_bridge_port *port);
+extern void br_multicast_enable_port(struct net_bridge_port *port);
+extern void br_multicast_disable_port(struct net_bridge_port *port);
+extern void br_multicast_init(struct net_bridge *br);
+extern void br_multicast_open(struct net_bridge *br);
+extern void br_multicast_stop(struct net_bridge *br);
+extern void br_multicast_deliver(struct net_bridge_mdb_entry *mdst,
+                                 struct sk_buff *skb);
+extern void br_multicast_forward(struct net_bridge_mdb_entry *mdst,
+                                 struct sk_buff *skb, struct sk_buff *skb2);
+extern int br_multicast_set_router(struct net_bridge *br, unsigned long val);
+extern int br_multicast_set_port_router(struct net_bridge_port *p,
+                                        unsigned long val);
+extern int br_multicast_toggle(struct net_bridge *br, unsigned long val);
+extern int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val);
+
+static inline bool br_multicast_is_router(struct net_bridge *br)
+{
+        return br->multicast_router == 2 ||
+               (br->multicast_router == 1 &&
+                timer_pending(&br->multicast_router_timer));
+}
+#else
+static inline int br_multicast_rcv(struct net_bridge *br,
+                                   struct net_bridge_port *port,
+                                   struct sk_buff *skb)
+{
+        return 0;
+}
+
+static inline struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
+                                                      struct sk_buff *skb)
+{
+        return NULL;
+}
+
+static inline void br_multicast_add_port(struct net_bridge_port *port)
+{
+}
+
+static inline void br_multicast_del_port(struct net_bridge_port *port)
+{
+}
+
+static inline void br_multicast_enable_port(struct net_bridge_port *port)
+{
+}
+
+static inline void br_multicast_disable_port(struct net_bridge_port *port)
+{
+}
+
+static inline void br_multicast_init(struct net_bridge *br)
+{
+}
+
+static inline void br_multicast_open(struct net_bridge *br)
+{
+}
+
+static inline void br_multicast_stop(struct net_bridge *br)
+{
+}
+
+static inline void br_multicast_deliver(struct net_bridge_mdb_entry *mdst,
+                                        struct sk_buff *skb)
+{
+}
+
+static inline void br_multicast_forward(struct net_bridge_mdb_entry *mdst,
+                                        struct sk_buff *skb,
+                                        struct sk_buff *skb2)
+{
+}
+static inline bool br_multicast_is_router(struct net_bridge *br)
+{
+        return 0;
+}
+#endif
+
 /* br_netfilter.c */
 #ifdef CONFIG_BRIDGE_NETFILTER
 extern int br_netfilter_init(void);
@@ -254,7 +431,7 @@ extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
 
 #ifdef CONFIG_SYSFS
 /* br_sysfs_if.c */
-extern struct sysfs_ops brport_sysfs_ops;
+extern const struct sysfs_ops brport_sysfs_ops;
 extern int br_sysfs_addif(struct net_bridge_port *p);
 
 /* br_sysfs_br.c */
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index fd3f8d6c0998..edcf14b560f6 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -386,6 +386,8 @@ static void br_make_forwarding(struct net_bridge_port *p)
         else
                 p->state = BR_STATE_LEARNING;
 
+        br_multicast_enable_port(p);
+
         br_log_state(p);
 
         if (br->forward_delay != 0)
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 81ae40b3f655..d66cce11f3bf 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -15,6 +15,7 @@
 #include <linux/netfilter_bridge.h>
 #include <linux/etherdevice.h>
 #include <linux/llc.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 9a52ac5b4525..d527119e9f54 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -108,6 +108,7 @@ void br_stp_disable_port(struct net_bridge_port *p)
         del_timer(&p->hold_timer);
 
         br_fdb_delete_by_port(br, p, 0);
+        br_multicast_disable_port(p);
 
         br_configuration_update(br);
 
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index ee4820aa1843..dd321e39e621 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -316,9 +316,9 @@ static ssize_t store_group_addr(struct device *d,
         if (new_addr[5] & ~0xf)
                 return -EINVAL;
 
-        if (new_addr[5] == 1    /* 802.3x Pause address */
-            || new_addr[5] == 2 /* 802.3ad Slow protocols */
-            || new_addr[5] == 3) /* 802.1X PAE address */
+        if (new_addr[5] == 1 ||         /* 802.3x Pause address */
+            new_addr[5] == 2 ||         /* 802.3ad Slow protocols */
+            new_addr[5] == 3)           /* 802.1X PAE address */
                 return -EINVAL;
 
         spin_lock_bh(&br->lock);
@@ -345,6 +345,273 @@ static ssize_t store_flush(struct device *d,
 }
 static DEVICE_ATTR(flush, S_IWUSR, NULL, store_flush);
 
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+static ssize_t show_multicast_router(struct device *d,
+                                     struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%d\n", br->multicast_router);
+}
+
+static ssize_t store_multicast_router(struct device *d,
+                                      struct device_attribute *attr,
+                                      const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, br_multicast_set_router);
+}
+static DEVICE_ATTR(multicast_router, S_IRUGO | S_IWUSR, show_multicast_router,
+                   store_multicast_router);
+
+static ssize_t show_multicast_snooping(struct device *d,
+                                       struct device_attribute *attr,
+                                       char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%d\n", !br->multicast_disabled);
+}
+
+static ssize_t store_multicast_snooping(struct device *d,
+                                        struct device_attribute *attr,
+                                        const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, br_multicast_toggle);
+}
+static DEVICE_ATTR(multicast_snooping, S_IRUGO | S_IWUSR,
+                   show_multicast_snooping, store_multicast_snooping);
+
+static ssize_t show_hash_elasticity(struct device *d,
+                                    struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%u\n", br->hash_elasticity);
+}
+
+static int set_elasticity(struct net_bridge *br, unsigned long val)
+{
+        br->hash_elasticity = val;
+        return 0;
+}
+
+static ssize_t store_hash_elasticity(struct device *d,
+                                     struct device_attribute *attr,
+                                     const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_elasticity);
+}
+static DEVICE_ATTR(hash_elasticity, S_IRUGO | S_IWUSR, show_hash_elasticity,
+                   store_hash_elasticity);
+
+static ssize_t show_hash_max(struct device *d, struct device_attribute *attr,
+                             char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%u\n", br->hash_max);
+}
+
+static ssize_t store_hash_max(struct device *d, struct device_attribute *attr,
+                              const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, br_multicast_set_hash_max);
+}
+static DEVICE_ATTR(hash_max, S_IRUGO | S_IWUSR, show_hash_max,
+                   store_hash_max);
+
+static ssize_t show_multicast_last_member_count(struct device *d,
+                                                struct device_attribute *attr,
+                                                char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%u\n", br->multicast_last_member_count);
+}
+
+static int set_last_member_count(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_last_member_count = val;
+        return 0;
+}
+
+static ssize_t store_multicast_last_member_count(struct device *d,
+                                                 struct device_attribute *attr,
+                                                 const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_last_member_count);
+}
+static DEVICE_ATTR(multicast_last_member_count, S_IRUGO | S_IWUSR,
+                   show_multicast_last_member_count,
+                   store_multicast_last_member_count);
+
+static ssize_t show_multicast_startup_query_count(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%u\n", br->multicast_startup_query_count);
+}
+
+static int set_startup_query_count(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_startup_query_count = val;
+        return 0;
+}
+
+static ssize_t store_multicast_startup_query_count(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_startup_query_count);
+}
+static DEVICE_ATTR(multicast_startup_query_count, S_IRUGO | S_IWUSR,
+                   show_multicast_startup_query_count,
+                   store_multicast_startup_query_count);
+
+static ssize_t show_multicast_last_member_interval(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%lu\n",
+                       jiffies_to_clock_t(br->multicast_last_member_interval));
+}
+
+static int set_last_member_interval(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_last_member_interval = clock_t_to_jiffies(val);
+        return 0;
+}
+
+static ssize_t store_multicast_last_member_interval(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_last_member_interval);
+}
+static DEVICE_ATTR(multicast_last_member_interval, S_IRUGO | S_IWUSR,
+                   show_multicast_last_member_interval,
+                   store_multicast_last_member_interval);
+
+static ssize_t show_multicast_membership_interval(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%lu\n",
+                       jiffies_to_clock_t(br->multicast_membership_interval));
+}
+
+static int set_membership_interval(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_membership_interval = clock_t_to_jiffies(val);
+        return 0;
+}
+
+static ssize_t store_multicast_membership_interval(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_membership_interval);
+}
+static DEVICE_ATTR(multicast_membership_interval, S_IRUGO | S_IWUSR,
+                   show_multicast_membership_interval,
+                   store_multicast_membership_interval);
+
+static ssize_t show_multicast_querier_interval(struct device *d,
+                                               struct device_attribute *attr,
+                                               char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%lu\n",
+                       jiffies_to_clock_t(br->multicast_querier_interval));
+}
+
+static int set_querier_interval(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_querier_interval = clock_t_to_jiffies(val);
+        return 0;
+}
+
+static ssize_t store_multicast_querier_interval(struct device *d,
+                                                struct device_attribute *attr,
+                                                const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_querier_interval);
+}
+static DEVICE_ATTR(multicast_querier_interval, S_IRUGO | S_IWUSR,
+                   show_multicast_querier_interval,
+                   store_multicast_querier_interval);
+
+static ssize_t show_multicast_query_interval(struct device *d,
+                                             struct device_attribute *attr,
+                                             char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%lu\n",
+                       jiffies_to_clock_t(br->multicast_query_interval));
+}
+
+static int set_query_interval(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_query_interval = clock_t_to_jiffies(val);
+        return 0;
+}
+
+static ssize_t store_multicast_query_interval(struct device *d,
+                                              struct device_attribute *attr,
+                                              const char *buf, size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_query_interval);
+}
+static DEVICE_ATTR(multicast_query_interval, S_IRUGO | S_IWUSR,
+                   show_multicast_query_interval,
+                   store_multicast_query_interval);
+
+static ssize_t show_multicast_query_response_interval(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(
+                buf, "%lu\n",
+                jiffies_to_clock_t(br->multicast_query_response_interval));
+}
+
+static int set_query_response_interval(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_query_response_interval = clock_t_to_jiffies(val);
+        return 0;
+}
+
+static ssize_t store_multicast_query_response_interval(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_query_response_interval);
+}
+static DEVICE_ATTR(multicast_query_response_interval, S_IRUGO | S_IWUSR,
+                   show_multicast_query_response_interval,
+                   store_multicast_query_response_interval);
+
+static ssize_t show_multicast_startup_query_interval(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(
+                buf, "%lu\n",
+                jiffies_to_clock_t(br->multicast_startup_query_interval));
+}
+
+static int set_startup_query_interval(struct net_bridge *br, unsigned long val)
+{
+        br->multicast_startup_query_interval = clock_t_to_jiffies(val);
+        return 0;
+}
+
+static ssize_t store_multicast_startup_query_interval(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_startup_query_interval);
+}
+static DEVICE_ATTR(multicast_startup_query_interval, S_IRUGO | S_IWUSR,
+                   show_multicast_startup_query_interval,
+                   store_multicast_startup_query_interval);
+#endif
+
 static struct attribute *bridge_attrs[] = {
         &dev_attr_forward_delay.attr,
         &dev_attr_hello_time.attr,
@@ -364,6 +631,20 @@ static struct attribute *bridge_attrs[] = {
         &dev_attr_gc_timer.attr,
         &dev_attr_group_addr.attr,
         &dev_attr_flush.attr,
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+        &dev_attr_multicast_router.attr,
+        &dev_attr_multicast_snooping.attr,
+        &dev_attr_hash_elasticity.attr,
+        &dev_attr_hash_max.attr,
+        &dev_attr_multicast_last_member_count.attr,
+        &dev_attr_multicast_startup_query_count.attr,
+        &dev_attr_multicast_last_member_interval.attr,
+        &dev_attr_multicast_membership_interval.attr,
+        &dev_attr_multicast_querier_interval.attr,
+        &dev_attr_multicast_query_interval.attr,
+        &dev_attr_multicast_query_response_interval.attr,
+        &dev_attr_multicast_startup_query_interval.attr,
+#endif
         NULL
 };
 
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 820643a3ba9c..0b9916489d6b 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -159,6 +159,21 @@ static ssize_t store_hairpin_mode(struct net_bridge_port *p, unsigned long v)
 static BRPORT_ATTR(hairpin_mode, S_IRUGO | S_IWUSR,
                    show_hairpin_mode, store_hairpin_mode);
 
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
+{
+        return sprintf(buf, "%d\n", p->multicast_router);
+}
+
+static ssize_t store_multicast_router(struct net_bridge_port *p,
+                                      unsigned long v)
+{
+        return br_multicast_set_port_router(p, v);
+}
+static BRPORT_ATTR(multicast_router, S_IRUGO | S_IWUSR, show_multicast_router,
+                   store_multicast_router);
+#endif
+
 static struct brport_attribute *brport_attrs[] = {
         &brport_attr_path_cost,
         &brport_attr_priority,
@@ -176,6 +191,9 @@ static struct brport_attribute *brport_attrs[] = {
         &brport_attr_hold_timer,
         &brport_attr_flush,
         &brport_attr_hairpin_mode,
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+        &brport_attr_multicast_router,
+#endif
         NULL
 };
 
@@ -220,7 +238,7 @@ static ssize_t brport_store(struct kobject * kobj,
         return ret;
 }
 
-struct sysfs_ops brport_sysfs_ops = {
+const struct sysfs_ops brport_sysfs_ops = {
         .show = brport_show,
         .store = brport_store,
 };
diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index bd91dc58d49b..5d1176758ca5 100644
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -52,7 +52,7 @@ static struct xt_match ebt_802_3_mt_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_802_3_mt,
         .checkentry     = ebt_802_3_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_802_3_info)),
+        .matchsize      = sizeof(struct ebt_802_3_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index b7ad60419f9a..e727697c5847 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -120,7 +120,7 @@ static struct xt_match ebt_arp_mt_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_arp_mt,
         .checkentry     = ebt_arp_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_arp_info)),
+        .matchsize      = sizeof(struct ebt_arp_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 76584cd72e57..f392e9d93f53 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -78,7 +78,7 @@ static struct xt_target ebt_arpreply_tg_reg __read_mostly = {
         .hooks          = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING),
         .target         = ebt_arpreply_tg,
         .checkentry     = ebt_arpreply_tg_check,
-        .targetsize     = XT_ALIGN(sizeof(struct ebt_arpreply_info)),
+        .targetsize     = sizeof(struct ebt_arpreply_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index 6b49ea9e31fb..2bb40d728a35 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -54,7 +54,7 @@ static struct xt_target ebt_dnat_tg_reg __read_mostly = {
                           (1 << NF_BR_LOCAL_OUT) | (1 << NF_BR_BROUTING),
         .target         = ebt_dnat_tg,
         .checkentry     = ebt_dnat_tg_check,
-        .targetsize     = XT_ALIGN(sizeof(struct ebt_nat_info)),
+        .targetsize     = sizeof(struct ebt_nat_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index d771bbfbcbe6..5de6df6f86b8 100644
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -110,7 +110,7 @@ static struct xt_match ebt_ip_mt_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_ip_mt,
         .checkentry     = ebt_ip_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_ip_info)),
+        .matchsize      = sizeof(struct ebt_ip_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 784a6573876c..bbf2534ef026 100644
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -122,7 +122,7 @@ static struct xt_match ebt_ip6_mt_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_ip6_mt,
         .checkentry     = ebt_ip6_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_ip6_info)),
+        .matchsize      = sizeof(struct ebt_ip6_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index f7bd9192ff0c..7a8182710eb3 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -84,13 +84,29 @@ static bool ebt_limit_mt_check(const struct xt_mtchk_param *par)
         return true;
 }
 
+
+#ifdef CONFIG_COMPAT
+/*
+ * no conversion function needed --
+ * only avg/burst have meaningful values in userspace.
+ */
+struct ebt_compat_limit_info {
+        compat_uint_t avg, burst;
+        compat_ulong_t prev;
+        compat_uint_t credit, credit_cap, cost;
+};
+#endif
+
 static struct xt_match ebt_limit_mt_reg __read_mostly = {
         .name           = "limit",
         .revision       = 0,
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_limit_mt,
         .checkentry     = ebt_limit_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_limit_info)),
+        .matchsize      = sizeof(struct ebt_limit_info),
+#ifdef CONFIG_COMPAT
+        .compatsize     = sizeof(struct ebt_compat_limit_info),
+#endif
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index e4ea3fdd1d41..e873924ddb5d 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -195,7 +195,7 @@ static struct xt_target ebt_log_tg_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .target         = ebt_log_tg,
         .checkentry     = ebt_log_tg_check,
-        .targetsize     = XT_ALIGN(sizeof(struct ebt_log_info)),
+        .targetsize     = sizeof(struct ebt_log_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 2fee7e8e2e93..2b5ce533d6b9 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -52,6 +52,32 @@ static bool ebt_mark_tg_check(const struct xt_tgchk_param *par)
                 return false;
         return true;
 }
+#ifdef CONFIG_COMPAT
+struct compat_ebt_mark_t_info {
+        compat_ulong_t mark;
+        compat_uint_t target;
+};
+
+static void mark_tg_compat_from_user(void *dst, const void *src)
+{
+        const struct compat_ebt_mark_t_info *user = src;
+        struct ebt_mark_t_info *kern = dst;
+
+        kern->mark = user->mark;
+        kern->target = user->target;
+}
+
+static int mark_tg_compat_to_user(void __user *dst, const void *src)
+{
+        struct compat_ebt_mark_t_info __user *user = dst;
+        const struct ebt_mark_t_info *kern = src;
+
+        if (put_user(kern->mark, &user->mark) ||
+            put_user(kern->target, &user->target))
+                return -EFAULT;
+        return 0;
+}
+#endif
 
 static struct xt_target ebt_mark_tg_reg __read_mostly = {
         .name           = "mark",
@@ -59,7 +85,12 @@ static struct xt_target ebt_mark_tg_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .target         = ebt_mark_tg,
         .checkentry     = ebt_mark_tg_check,
-        .targetsize     = XT_ALIGN(sizeof(struct ebt_mark_t_info)),
+        .targetsize     = sizeof(struct ebt_mark_t_info),
+#ifdef CONFIG_COMPAT
+        .compatsize     = sizeof(struct compat_ebt_mark_t_info),
+        .compat_from_user = mark_tg_compat_from_user,
+        .compat_to_user = mark_tg_compat_to_user,
+#endif
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_mark_m.c b/net/bridge/netfilter/ebt_mark_m.c
index ea570f214b1d..8de8c396d913 100644
--- a/net/bridge/netfilter/ebt_mark_m.c
+++ b/net/bridge/netfilter/ebt_mark_m.c
@@ -35,13 +35,50 @@ static bool ebt_mark_mt_check(const struct xt_mtchk_param *par)
         return true;
 }
 
+
+#ifdef CONFIG_COMPAT
+struct compat_ebt_mark_m_info {
+        compat_ulong_t mark, mask;
+        uint8_t invert, bitmask;
+};
+
+static void mark_mt_compat_from_user(void *dst, const void *src)
+{
+        const struct compat_ebt_mark_m_info *user = src;
+        struct ebt_mark_m_info *kern = dst;
+
+        kern->mark = user->mark;
+        kern->mask = user->mask;
+        kern->invert = user->invert;
+        kern->bitmask = user->bitmask;
+}
+
+static int mark_mt_compat_to_user(void __user *dst, const void *src)
+{
+        struct compat_ebt_mark_m_info __user *user = dst;
+        const struct ebt_mark_m_info *kern = src;
+
+        if (put_user(kern->mark, &user->mark) ||
+            put_user(kern->mask, &user->mask) ||
+            put_user(kern->invert, &user->invert) ||
+            put_user(kern->bitmask, &user->bitmask))
+                return -EFAULT;
+        return 0;
+}
+#endif
+
 static struct xt_match ebt_mark_mt_reg __read_mostly = {
         .name           = "mark_m",
         .revision       = 0,
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_mark_mt,
         .checkentry     = ebt_mark_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_mark_m_info)),
+        .matchsize      = sizeof(struct ebt_mark_m_info),
+#ifdef CONFIG_COMPAT
+        .compatsize     = sizeof(struct compat_ebt_mark_m_info),
+        .compat_from_user = mark_mt_compat_from_user,
+        .compat_to_user = mark_mt_compat_to_user,
+#endif
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_nflog.c b/net/bridge/netfilter/ebt_nflog.c
index 2a63d996dd4e..40dbd248b9ae 100644
--- a/net/bridge/netfilter/ebt_nflog.c
+++ b/net/bridge/netfilter/ebt_nflog.c
@@ -51,7 +51,7 @@ static struct xt_target ebt_nflog_tg_reg __read_mostly = {
         .family     = NFPROTO_BRIDGE,
         .target     = ebt_nflog_tg,
         .checkentry = ebt_nflog_tg_check,
-        .targetsize = XT_ALIGN(sizeof(struct ebt_nflog_info)),
+        .targetsize = sizeof(struct ebt_nflog_info),
         .me         = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_pkttype.c b/net/bridge/netfilter/ebt_pkttype.c
index 883e96e2a542..e2a07e6cbef3 100644
--- a/net/bridge/netfilter/ebt_pkttype.c
+++ b/net/bridge/netfilter/ebt_pkttype.c
@@ -36,7 +36,7 @@ static struct xt_match ebt_pkttype_mt_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_pkttype_mt,
         .checkentry     = ebt_pkttype_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_pkttype_info)),
+        .matchsize      = sizeof(struct ebt_pkttype_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index c8a49f7a57ba..9be8fbcd370b 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -59,7 +59,7 @@ static struct xt_target ebt_redirect_tg_reg __read_mostly = {
                           (1 << NF_BR_BROUTING),
         .target         = ebt_redirect_tg,
         .checkentry     = ebt_redirect_tg_check,
-        .targetsize     = XT_ALIGN(sizeof(struct ebt_redirect_info)),
+        .targetsize     = sizeof(struct ebt_redirect_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index 8d04d4c302bd..9c7b520765a2 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -67,7 +67,7 @@ static struct xt_target ebt_snat_tg_reg __read_mostly = {
         .hooks          = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_POST_ROUTING),
         .target         = ebt_snat_tg,
         .checkentry     = ebt_snat_tg_check,
-        .targetsize     = XT_ALIGN(sizeof(struct ebt_nat_info)),
+        .targetsize     = sizeof(struct ebt_nat_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index 48527e621626..92a93d363765 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -135,8 +135,8 @@ ebt_stp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
         if (memcmp(sp, header, sizeof(header)))
                 return false;
 
-        if (info->bitmask & EBT_STP_TYPE
-            && FWINV(info->type != sp->type, EBT_STP_TYPE))
+        if (info->bitmask & EBT_STP_TYPE &&
+            FWINV(info->type != sp->type, EBT_STP_TYPE))
                 return false;
 
         if (sp->type == BPDU_TYPE_CONFIG &&
@@ -177,7 +177,7 @@ static struct xt_match ebt_stp_mt_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_stp_mt,
         .checkentry     = ebt_stp_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_stp_info)),
+        .matchsize      = sizeof(struct ebt_stp_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index ce50688a6431..f9560f3dbdc7 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -29,6 +29,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/socket.h>
 #include <linux/skbuff.h>
@@ -275,7 +276,7 @@ static struct xt_target ebt_ulog_tg_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .target         = ebt_ulog_tg,
         .checkentry     = ebt_ulog_tg_check,
-        .targetsize     = XT_ALIGN(sizeof(struct ebt_ulog_info)),
+        .targetsize     = sizeof(struct ebt_ulog_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index 3dddd489328e..be1dd2e1f615 100644
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -163,7 +163,7 @@ static struct xt_match ebt_vlan_mt_reg __read_mostly = {
         .family         = NFPROTO_BRIDGE,
         .match          = ebt_vlan_mt,
         .checkentry     = ebt_vlan_mt_check,
-        .matchsize      = XT_ALIGN(sizeof(struct ebt_vlan_info)),
+        .matchsize      = sizeof(struct ebt_vlan_info),
         .me             = THIS_MODULE,
 };
 
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index d32ab13e728c..ae3f106c3908 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -71,7 +71,7 @@ static int __net_init broute_net_init(struct net *net)
 
 static void __net_exit broute_net_exit(struct net *net)
 {
-        ebt_unregister_table(net->xt.broute_table);
+        ebt_unregister_table(net, net->xt.broute_table);
 }
 
 static struct pernet_operations broute_net_ops = {
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 60b1a6ca7185..42e6bd094574 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -107,7 +107,7 @@ static int __net_init frame_filter_net_init(struct net *net)
 
 static void __net_exit frame_filter_net_exit(struct net *net)
 {
-        ebt_unregister_table(net->xt.frame_filter);
+        ebt_unregister_table(net, net->xt.frame_filter);
 }
 
 static struct pernet_operations frame_filter_net_ops = {
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 4a98804203b0..6dc2f878ae05 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -107,7 +107,7 @@ static int __net_init frame_nat_net_init(struct net *net)
 
 static void __net_exit frame_nat_net_exit(struct net *net)
 {
-        ebt_unregister_table(net->xt.frame_nat);
+        ebt_unregister_table(net, net->xt.frame_nat);
 }
 
 static struct pernet_operations frame_nat_net_ops = {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index bd1c65425d4f..f0865fd1e3ec 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -23,6 +23,7 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/smp.h>
 #include <linux/cpumask.h>
@@ -33,11 +34,6 @@
 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
                                          "report to author: "format, ## args)
 /* #define BUGPRINT(format, args...) */
-#define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
-                                         ": out of memory: "format, ## args)
-/* #define MEMPRINT(format, args...) */
-
-
 
 /*
  * Each cpu has its own set of counters, so there is no need for write_lock in
@@ -56,11 +52,37 @@
 
 static DEFINE_MUTEX(ebt_mutex);
 
+#ifdef CONFIG_COMPAT
+static void ebt_standard_compat_from_user(void *dst, const void *src)
+{
+        int v = *(compat_int_t *)src;
+
+        if (v >= 0)
+                v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
+        memcpy(dst, &v, sizeof(v));
+}
+
+static int ebt_standard_compat_to_user(void __user *dst, const void *src)
+{
+        compat_int_t cv = *(int *)src;
+
+        if (cv >= 0)
+                cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
+        return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
+}
+#endif
+
+
 static struct xt_target ebt_standard_target = {
         .name       = "standard",
         .revision   = 0,
         .family     = NFPROTO_BRIDGE,
         .targetsize = sizeof(int),
+#ifdef CONFIG_COMPAT
+        .compatsize = sizeof(compat_int_t),
+        .compat_from_user = ebt_standard_compat_from_user,
+        .compat_to_user =  ebt_standard_compat_to_user,
+#endif
 };
 
 static inline int
@@ -82,7 +104,8 @@ static inline int ebt_do_match (struct ebt_entry_match *m,
         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 }
 
-static inline int ebt_dev_check(char *entry, const struct net_device *device)
+static inline int
+ebt_dev_check(const char *entry, const struct net_device *device)
 {
         int i = 0;
         const char *devname;
@@ -100,8 +123,9 @@ static inline int ebt_dev_check(char *entry, const struct net_device *device)
 
 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 /* process standard matches */
-static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
-   const struct net_device *in, const struct net_device *out)
+static inline int
+ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
+                const struct net_device *in, const struct net_device *out)
 {
         int verdict, i;
 
@@ -156,12 +180,12 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
         int i, nentries;
         struct ebt_entry *point;
         struct ebt_counter *counter_base, *cb_base;
-        struct ebt_entry_target *t;
+        const struct ebt_entry_target *t;
         int verdict, sp = 0;
         struct ebt_chainstack *cs;
         struct ebt_entries *chaininfo;
-        char *base;
-        struct ebt_table_info *private;
+        const char *base;
+        const struct ebt_table_info *private;
         bool hotdrop = false;
         struct xt_match_param mtpar;
         struct xt_target_param tgpar;
@@ -395,7 +419,7 @@ ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
         return 0;
 }
 
-static int ebt_verify_pointers(struct ebt_replace *repl,
+static int ebt_verify_pointers(const struct ebt_replace *repl,
                                struct ebt_table_info *newinfo)
 {
         unsigned int limit = repl->entries_size;
@@ -442,6 +466,8 @@ static int ebt_verify_pointers(struct ebt_replace *repl,
                                 break;
                         if (left < e->next_offset)
                                 break;
+                        if (e->next_offset < sizeof(struct ebt_entry))
+                                return -EINVAL;
                         offset += e->next_offset;
                 }
         }
@@ -466,8 +492,8 @@ static int ebt_verify_pointers(struct ebt_replace *repl,
  * to parse the userspace data
  */
 static inline int
-ebt_check_entry_size_and_hooks(struct ebt_entry *e,
-   struct ebt_table_info *newinfo,
+ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
+   const struct ebt_table_info *newinfo,
    unsigned int *n, unsigned int *cnt,
    unsigned int *totalcnt, unsigned int *udc_cnt)
 {
@@ -561,13 +587,14 @@ ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 }
 
 static inline int
-ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
+ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 {
         struct xt_mtdtor_param par;
 
         if (i && (*i)-- == 0)
                 return 1;
 
+        par.net       = net;
         par.match     = m->u.match;
         par.matchinfo = m->data;
         par.family    = NFPROTO_BRIDGE;
@@ -578,13 +605,14 @@ ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 }
 
 static inline int
-ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
+ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 {
         struct xt_tgdtor_param par;
 
         if (i && (*i)-- == 0)
                 return 1;
 
+        par.net      = net;
         par.target   = w->u.watcher;
         par.targinfo = w->data;
         par.family   = NFPROTO_BRIDGE;
@@ -595,7 +623,7 @@ ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 }
 
 static inline int
-ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
+ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 {
         struct xt_tgdtor_param par;
         struct ebt_entry_target *t;
@@ -605,10 +633,11 @@ ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
         /* we're done */
         if (cnt && (*cnt)-- == 0)
                 return 1;
-        EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
-        EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
+        EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
+        EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 
+        par.net      = net;
         par.target   = t->u.target;
         par.targinfo = t->data;
         par.family   = NFPROTO_BRIDGE;
@@ -619,7 +648,8 @@ ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 }
 
 static inline int
-ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
+ebt_check_entry(struct ebt_entry *e, struct net *net,
+   const struct ebt_table_info *newinfo,
    const char *name, unsigned int *cnt,
    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 {
@@ -671,6 +701,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
         }
         i = 0;
 
+        mtpar.net       = tgpar.net       = net;
         mtpar.table     = tgpar.table     = name;
         mtpar.entryinfo = tgpar.entryinfo = e;
         mtpar.hook_mask = tgpar.hook_mask = hookmask;
@@ -726,9 +757,9 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
         (*cnt)++;
         return 0;
 cleanup_watchers:
-        EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
+        EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 cleanup_matches:
-        EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
+        EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
         return ret;
 }
 
@@ -737,12 +768,12 @@ cleanup_matches:
  * the hook mask for udc tells us from which base chains the udc can be
  * accessed. This mask is a parameter to the check() functions of the extensions
  */
-static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
+static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
    unsigned int udc_cnt, unsigned int hooknr, char *base)
 {
         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
-        struct ebt_entry *e = (struct ebt_entry *)chain->data;
-        struct ebt_entry_target *t;
+        const struct ebt_entry *e = (struct ebt_entry *)chain->data;
+        const struct ebt_entry_target *t;
 
         while (pos < nentries || chain_nr != -1) {
                 /* end of udc, go back one 'recursion' step */
@@ -808,7 +839,8 @@ letscontinue:
 }
 
 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
-static int translate_table(char *name, struct ebt_table_info *newinfo)
+static int translate_table(struct net *net, const char *name,
+                           struct ebt_table_info *newinfo)
 {
         unsigned int i, j, k, udc_cnt;
         int ret;
@@ -917,17 +949,17 @@ static int translate_table(char *name, struct ebt_table_info *newinfo)
         /* used to know what we need to clean up if something goes wrong */
         i = 0;
         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
-           ebt_check_entry, newinfo, name, &i, cl_s, udc_cnt);
+           ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
         if (ret != 0) {
                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
-                   ebt_cleanup_entry, &i);
+                                  ebt_cleanup_entry, net, &i);
         }
         vfree(cl_s);
         return ret;
 }
 
 /* called under write_lock */
-static void get_counters(struct ebt_counter *oldcounters,
+static void get_counters(const struct ebt_counter *oldcounters,
    struct ebt_counter *counters, unsigned int nentries)
 {
         int i, cpu;
@@ -949,90 +981,45 @@ static void get_counters(struct ebt_counter *oldcounters,
         }
 }
 
-/* replace the table */
-static int do_replace(struct net *net, void __user *user, unsigned int len)
+static int do_replace_finish(struct net *net, struct ebt_replace *repl,
+                              struct ebt_table_info *newinfo)
 {
-        int ret, i, countersize;
-        struct ebt_table_info *newinfo;
-        struct ebt_replace tmp;
-        struct ebt_table *t;
+        int ret, i;
         struct ebt_counter *counterstmp = NULL;
         /* used to be able to unlock earlier */
         struct ebt_table_info *table;
-
-        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
-                return -EFAULT;
-
-        if (len != sizeof(tmp) + tmp.entries_size) {
-                BUGPRINT("Wrong len argument\n");
-                return -EINVAL;
-        }
-
-        if (tmp.entries_size == 0) {
-                BUGPRINT("Entries_size never zero\n");
-                return -EINVAL;
-        }
-        /* overflow check */
-        if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
-                        SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
-                return -ENOMEM;
-        if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
-                return -ENOMEM;
-
-        countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
-        newinfo = vmalloc(sizeof(*newinfo) + countersize);
-        if (!newinfo)
-                return -ENOMEM;
-
-        if (countersize)
-                memset(newinfo->counters, 0, countersize);
-
-        newinfo->entries = vmalloc(tmp.entries_size);
-        if (!newinfo->entries) {
-                ret = -ENOMEM;
-                goto free_newinfo;
-        }
-        if (copy_from_user(
-           newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
-                BUGPRINT("Couldn't copy entries from userspace\n");
-                ret = -EFAULT;
-                goto free_entries;
-        }
+        struct ebt_table *t;
 
         /* the user wants counters back
            the check on the size is done later, when we have the lock */
-        if (tmp.num_counters) {
-                counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
-                if (!counterstmp) {
-                        ret = -ENOMEM;
-                        goto free_entries;
-                }
+        if (repl->num_counters) {
+                unsigned long size = repl->num_counters * sizeof(*counterstmp);
+                counterstmp = vmalloc(size);
+                if (!counterstmp)
+                        return -ENOMEM;
         }
-        else
-                counterstmp = NULL;
 
-        /* this can get initialized by translate_table() */
         newinfo->chainstack = NULL;
-        ret = ebt_verify_pointers(&tmp, newinfo);
+        ret = ebt_verify_pointers(repl, newinfo);
         if (ret != 0)
                 goto free_counterstmp;
 
-        ret = translate_table(tmp.name, newinfo);
+        ret = translate_table(net, repl->name, newinfo);
 
         if (ret != 0)
                 goto free_counterstmp;
 
-        t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
+        t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
         if (!t) {
                 ret = -ENOENT;
                 goto free_iterate;
         }
 
         /* the table doesn't like it */
-        if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
+        if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
                 goto free_unlock;
 
-        if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
+        if (repl->num_counters && repl->num_counters != t->private->nentries) {
                 BUGPRINT("Wrong nr. of counters requested\n");
                 ret = -EINVAL;
                 goto free_unlock;
@@ -1048,7 +1035,7 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
                 module_put(t->me);
         /* we need an atomic snapshot of the counters */
         write_lock_bh(&t->lock);
-        if (tmp.num_counters)
+        if (repl->num_counters)
                 get_counters(t->private->counters, counterstmp,
                    t->private->nentries);
 
@@ -1059,10 +1046,9 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
            allocation. Only reason why this is done is because this way the lock
            is held only once, while this doesn't bring the kernel into a
            dangerous state. */
-        if (tmp.num_counters &&
-           copy_to_user(tmp.counters, counterstmp,
-           tmp.num_counters * sizeof(struct ebt_counter))) {
-                BUGPRINT("Couldn't copy counters to userspace\n");
+        if (repl->num_counters &&
+           copy_to_user(repl->counters, counterstmp,
+           repl->num_counters * sizeof(struct ebt_counter))) {
                 ret = -EFAULT;
         }
         else
@@ -1070,7 +1056,7 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
 
         /* decrease module count and free resources */
         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
-           ebt_cleanup_entry, NULL);
+                          ebt_cleanup_entry, net, NULL);
 
         vfree(table->entries);
         if (table->chainstack) {
@@ -1087,7 +1073,7 @@ free_unlock:
         mutex_unlock(&ebt_mutex);
 free_iterate:
         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
-           ebt_cleanup_entry, NULL);
+                          ebt_cleanup_entry, net, NULL);
 free_counterstmp:
         vfree(counterstmp);
         /* can be initialized in translate_table() */
@@ -1096,6 +1082,59 @@ free_counterstmp:
                         vfree(newinfo->chainstack[i]);
                 vfree(newinfo->chainstack);
         }
+        return ret;
+}
+
+/* replace the table */
+static int do_replace(struct net *net, const void __user *user,
+                      unsigned int len)
+{
+        int ret, countersize;
+        struct ebt_table_info *newinfo;
+        struct ebt_replace tmp;
+
+        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+                return -EFAULT;
+
+        if (len != sizeof(tmp) + tmp.entries_size) {
+                BUGPRINT("Wrong len argument\n");
+                return -EINVAL;
+        }
+
+        if (tmp.entries_size == 0) {
+                BUGPRINT("Entries_size never zero\n");
+                return -EINVAL;
+        }
+        /* overflow check */
+        if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
+                        NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
+                return -ENOMEM;
+
+        countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
+        if (!newinfo)
+                return -ENOMEM;
+
+        if (countersize)
+                memset(newinfo->counters, 0, countersize);
+
+        newinfo->entries = vmalloc(tmp.entries_size);
+        if (!newinfo->entries) {
+                ret = -ENOMEM;
+                goto free_newinfo;
+        }
+        if (copy_from_user(
+           newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
+                BUGPRINT("Couldn't copy entries from userspace\n");
+                ret = -EFAULT;
+                goto free_entries;
+        }
+
+        ret = do_replace_finish(net, &tmp, newinfo);
+        if (ret == 0)
+                return ret;
 free_entries:
         vfree(newinfo->entries);
 free_newinfo:
@@ -1154,7 +1193,7 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
                         newinfo->hook_entry[i] = p +
                                 ((char *)repl->hook_entry[i] - repl->entries);
         }
-        ret = translate_table(repl->name, newinfo);
+        ret = translate_table(net, repl->name, newinfo);
         if (ret != 0) {
                 BUGPRINT("Translate_table failed\n");
                 goto free_chainstack;
@@ -1204,7 +1243,7 @@ out:
         return ERR_PTR(ret);
 }
 
-void ebt_unregister_table(struct ebt_table *table)
+void ebt_unregister_table(struct net *net, struct ebt_table *table)
 {
         int i;
 
@@ -1216,7 +1255,7 @@ void ebt_unregister_table(struct ebt_table *table)
         list_del(&table->list);
         mutex_unlock(&ebt_mutex);
         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
-                          ebt_cleanup_entry, NULL);
+                          ebt_cleanup_entry, net, NULL);
         if (table->private->nentries)
                 module_put(table->me);
         vfree(table->private->entries);
@@ -1230,39 +1269,33 @@ void ebt_unregister_table(struct ebt_table *table)
 }
 
 /* userspace just supplied us with counters */
-static int update_counters(struct net *net, void __user *user, unsigned int len)
+static int do_update_counters(struct net *net, const char *name,
+                                struct ebt_counter __user *counters,
+                                unsigned int num_counters,
+                                const void __user *user, unsigned int len)
 {
         int i, ret;
         struct ebt_counter *tmp;
-        struct ebt_replace hlp;
         struct ebt_table *t;
 
-        if (copy_from_user(&hlp, user, sizeof(hlp)))
-                return -EFAULT;
-
-        if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
-                return -EINVAL;
-        if (hlp.num_counters == 0)
+        if (num_counters == 0)
                 return -EINVAL;
 
-        if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
-                MEMPRINT("Update_counters && nomemory\n");
+        tmp = vmalloc(num_counters * sizeof(*tmp));
+        if (!tmp)
                 return -ENOMEM;
-        }
 
-        t = find_table_lock(net, hlp.name, &ret, &ebt_mutex);
+        t = find_table_lock(net, name, &ret, &ebt_mutex);
         if (!t)
                 goto free_tmp;
 
-        if (hlp.num_counters != t->private->nentries) {
+        if (num_counters != t->private->nentries) {
                 BUGPRINT("Wrong nr of counters\n");
                 ret = -EINVAL;
                 goto unlock_mutex;
         }
 
-        if ( copy_from_user(tmp, hlp.counters,
-           hlp.num_counters * sizeof(struct ebt_counter)) ) {
-                BUGPRINT("Updata_counters && !cfu\n");
+        if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
                 ret = -EFAULT;
                 goto unlock_mutex;
         }
@@ -1271,7 +1304,7 @@ static int update_counters(struct net *net, void __user *user, unsigned int len)
         write_lock_bh(&t->lock);
 
         /* we add to the counters of the first cpu */
-        for (i = 0; i < hlp.num_counters; i++) {
+        for (i = 0; i < num_counters; i++) {
                 t->private->counters[i].pcnt += tmp[i].pcnt;
                 t->private->counters[i].bcnt += tmp[i].bcnt;
         }
@@ -1285,8 +1318,23 @@ free_tmp:
         return ret;
 }
 
-static inline int ebt_make_matchname(struct ebt_entry_match *m,
-   char *base, char __user *ubase)
+static int update_counters(struct net *net, const void __user *user,
+                            unsigned int len)
+{
+        struct ebt_replace hlp;
+
+        if (copy_from_user(&hlp, user, sizeof(hlp)))
+                return -EFAULT;
+
+        if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
+                return -EINVAL;
+
+        return do_update_counters(net, hlp.name, hlp.counters,
+                                hlp.num_counters, user, len);
+}
+
+static inline int ebt_make_matchname(const struct ebt_entry_match *m,
+    const char *base, char __user *ubase)
 {
         char __user *hlp = ubase + ((char *)m - base);
         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
@@ -1294,8 +1342,8 @@ static inline int ebt_make_matchname(struct ebt_entry_match *m,
         return 0;
 }
 
-static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
-   char *base, char __user *ubase)
+static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
+    const char *base, char __user *ubase)
 {
         char __user *hlp = ubase + ((char *)w - base);
         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
@@ -1303,11 +1351,12 @@ static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
         return 0;
 }
 
-static inline int ebt_make_names(struct ebt_entry *e, char *base, char __user *ubase)
+static inline int
+ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
 {
         int ret;
         char __user *hlp;
-        struct ebt_entry_target *t;
+        const struct ebt_entry_target *t;
 
         if (e->bitmask == 0)
                 return 0;
@@ -1326,13 +1375,46 @@ static inline int ebt_make_names(struct ebt_entry *e, char *base, char __user *u
         return 0;
 }
 
+static int copy_counters_to_user(struct ebt_table *t,
+                                  const struct ebt_counter *oldcounters,
+                                  void __user *user, unsigned int num_counters,
+                                  unsigned int nentries)
+{
+        struct ebt_counter *counterstmp;
+        int ret = 0;
+
+        /* userspace might not need the counters */
+        if (num_counters == 0)
+                return 0;
+
+        if (num_counters != nentries) {
+                BUGPRINT("Num_counters wrong\n");
+                return -EINVAL;
+        }
+
+        counterstmp = vmalloc(nentries * sizeof(*counterstmp));
+        if (!counterstmp)
+                return -ENOMEM;
+
+        write_lock_bh(&t->lock);
+        get_counters(oldcounters, counterstmp, nentries);
+        write_unlock_bh(&t->lock);
+
+        if (copy_to_user(user, counterstmp,
+           nentries * sizeof(struct ebt_counter)))
+                ret = -EFAULT;
+        vfree(counterstmp);
+        return ret;
+}
+
 /* called with ebt_mutex locked */
 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
-   int *len, int cmd)
+    const int *len, int cmd)
 {
         struct ebt_replace tmp;
-        struct ebt_counter *counterstmp, *oldcounters;
+        const struct ebt_counter *oldcounters;
         unsigned int entries_size, nentries;
+        int ret;
         char *entries;
 
         if (cmd == EBT_SO_GET_ENTRIES) {
@@ -1347,16 +1429,12 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                 oldcounters = t->table->counters;
         }
 
-        if (copy_from_user(&tmp, user, sizeof(tmp))) {
-                BUGPRINT("Cfu didn't work\n");
+        if (copy_from_user(&tmp, user, sizeof(tmp)))
                 return -EFAULT;
-        }
 
         if (*len != sizeof(struct ebt_replace) + entries_size +
-           (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
-                BUGPRINT("Wrong size\n");
+           (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
                 return -EINVAL;
-        }
 
         if (tmp.nentries != nentries) {
                 BUGPRINT("Nentries wrong\n");
@@ -1368,29 +1446,10 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                 return -EINVAL;
         }
 
-        /* userspace might not need the counters */
-        if (tmp.num_counters) {
-                if (tmp.num_counters != nentries) {
-                        BUGPRINT("Num_counters wrong\n");
-                        return -EINVAL;
-                }
-                counterstmp = vmalloc(nentries * sizeof(*counterstmp));
-                if (!counterstmp) {
-                        MEMPRINT("Couldn't copy counters, out of memory\n");
-                        return -ENOMEM;
-                }
-                write_lock_bh(&t->lock);
-                get_counters(oldcounters, counterstmp, nentries);
-                write_unlock_bh(&t->lock);
-
-                if (copy_to_user(tmp.counters, counterstmp,
-                   nentries * sizeof(struct ebt_counter))) {
-                        BUGPRINT("Couldn't copy counters to userspace\n");
-                        vfree(counterstmp);
-                        return -EFAULT;
-                }
-                vfree(counterstmp);
-        }
+        ret = copy_counters_to_user(t, oldcounters, tmp.counters,
+                                        tmp.num_counters, nentries);
+        if (ret)
+                return ret;
 
         if (copy_to_user(tmp.entries, entries, entries_size)) {
                 BUGPRINT("Couldn't copy entries to userspace\n");
@@ -1406,6 +1465,9 @@ static int do_ebt_set_ctl(struct sock *sk,
 {
         int ret;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         switch(cmd) {
         case EBT_SO_SET_ENTRIES:
                 ret = do_replace(sock_net(sk), user, len);
@@ -1415,7 +1477,7 @@ static int do_ebt_set_ctl(struct sock *sk,
                 break;
         default:
                 ret = -EINVAL;
-  }
+        }
         return ret;
 }
 
@@ -1425,6 +1487,9 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         struct ebt_replace tmp;
         struct ebt_table *t;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         if (copy_from_user(&tmp, user, sizeof(tmp)))
                 return -EFAULT;
 
@@ -1472,15 +1537,892 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         return ret;
 }
 
+#ifdef CONFIG_COMPAT
+/* 32 bit-userspace compatibility definitions. */
+struct compat_ebt_replace {
+        char name[EBT_TABLE_MAXNAMELEN];
+        compat_uint_t valid_hooks;
+        compat_uint_t nentries;
+        compat_uint_t entries_size;
+        /* start of the chains */
+        compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
+        /* nr of counters userspace expects back */
+        compat_uint_t num_counters;
+        /* where the kernel will put the old counters. */
+        compat_uptr_t counters;
+        compat_uptr_t entries;
+};
+
+/* struct ebt_entry_match, _target and _watcher have same layout */
+struct compat_ebt_entry_mwt {
+        union {
+                char name[EBT_FUNCTION_MAXNAMELEN];
+                compat_uptr_t ptr;
+        } u;
+        compat_uint_t match_size;
+        compat_uint_t data[0];
+};
+
+/* account for possible padding between match_size and ->data */
+static int ebt_compat_entry_padsize(void)
+{
+        BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
+                        COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
+        return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
+                        COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
+}
+
+static int ebt_compat_match_offset(const struct xt_match *match,
+                                   unsigned int userlen)
+{
+        /*
+         * ebt_among needs special handling. The kernel .matchsize is
+         * set to -1 at registration time; at runtime an EBT_ALIGN()ed
+         * value is expected.
+         * Example: userspace sends 4500, ebt_among.c wants 4504.
+         */
+        if (unlikely(match->matchsize == -1))
+                return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
+        return xt_compat_match_offset(match);
+}
+
+static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
+                                unsigned int *size)
+{
+        const struct xt_match *match = m->u.match;
+        struct compat_ebt_entry_mwt __user *cm = *dstptr;
+        int off = ebt_compat_match_offset(match, m->match_size);
+        compat_uint_t msize = m->match_size - off;
+
+        BUG_ON(off >= m->match_size);
+
+        if (copy_to_user(cm->u.name, match->name,
+            strlen(match->name) + 1) || put_user(msize, &cm->match_size))
+                return -EFAULT;
+
+        if (match->compat_to_user) {
+                if (match->compat_to_user(cm->data, m->data))
+                        return -EFAULT;
+        } else if (copy_to_user(cm->data, m->data, msize))
+                        return -EFAULT;
+
+        *size -= ebt_compat_entry_padsize() + off;
+        *dstptr = cm->data;
+        *dstptr += msize;
+        return 0;
+}
+
+static int compat_target_to_user(struct ebt_entry_target *t,
+                                 void __user **dstptr,
+                                 unsigned int *size)
+{
+        const struct xt_target *target = t->u.target;
+        struct compat_ebt_entry_mwt __user *cm = *dstptr;
+        int off = xt_compat_target_offset(target);
+        compat_uint_t tsize = t->target_size - off;
+
+        BUG_ON(off >= t->target_size);
+
+        if (copy_to_user(cm->u.name, target->name,
+            strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
+                return -EFAULT;
+
+        if (target->compat_to_user) {
+                if (target->compat_to_user(cm->data, t->data))
+                        return -EFAULT;
+        } else if (copy_to_user(cm->data, t->data, tsize))
+                return -EFAULT;
+
+        *size -= ebt_compat_entry_padsize() + off;
+        *dstptr = cm->data;
+        *dstptr += tsize;
+        return 0;
+}
+
+static int compat_watcher_to_user(struct ebt_entry_watcher *w,
+                                  void __user **dstptr,
+                                  unsigned int *size)
+{
+        return compat_target_to_user((struct ebt_entry_target *)w,
+                                                        dstptr, size);
+}
+
+static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
+                                unsigned int *size)
+{
+        struct ebt_entry_target *t;
+        struct ebt_entry __user *ce;
+        u32 watchers_offset, target_offset, next_offset;
+        compat_uint_t origsize;
+        int ret;
+
+        if (e->bitmask == 0) {
+                if (*size < sizeof(struct ebt_entries))
+                        return -EINVAL;
+                if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
+                        return -EFAULT;
+
+                *dstptr += sizeof(struct ebt_entries);
+                *size -= sizeof(struct ebt_entries);
+                return 0;
+        }
+
+        if (*size < sizeof(*ce))
+                return -EINVAL;
+
+        ce = (struct ebt_entry __user *)*dstptr;
+        if (copy_to_user(ce, e, sizeof(*ce)))
+                return -EFAULT;
+
+        origsize = *size;
+        *dstptr += sizeof(*ce);
+
+        ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
+        if (ret)
+                return ret;
+        watchers_offset = e->watchers_offset - (origsize - *size);
+
+        ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
+        if (ret)
+                return ret;
+        target_offset = e->target_offset - (origsize - *size);
+
+        t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
+
+        ret = compat_target_to_user(t, dstptr, size);
+        if (ret)
+                return ret;
+        next_offset = e->next_offset - (origsize - *size);
+
+        if (put_user(watchers_offset, &ce->watchers_offset) ||
+            put_user(target_offset, &ce->target_offset) ||
+            put_user(next_offset, &ce->next_offset))
+                return -EFAULT;
+
+        *size -= sizeof(*ce);
+        return 0;
+}
+
+static int compat_calc_match(struct ebt_entry_match *m, int *off)
+{
+        *off += ebt_compat_match_offset(m->u.match, m->match_size);
+        *off += ebt_compat_entry_padsize();
+        return 0;
+}
+
+static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
+{
+        *off += xt_compat_target_offset(w->u.watcher);
+        *off += ebt_compat_entry_padsize();
+        return 0;
+}
+
+static int compat_calc_entry(const struct ebt_entry *e,
+                             const struct ebt_table_info *info,
+                             const void *base,
+                             struct compat_ebt_replace *newinfo)
+{
+        const struct ebt_entry_target *t;
+        unsigned int entry_offset;
+        int off, ret, i;
+
+        if (e->bitmask == 0)
+                return 0;
+
+        off = 0;
+        entry_offset = (void *)e - base;
+
+        EBT_MATCH_ITERATE(e, compat_calc_match, &off);
+        EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
+
+        t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
+
+        off += xt_compat_target_offset(t->u.target);
+        off += ebt_compat_entry_padsize();
+
+        newinfo->entries_size -= off;
+
+        ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
+        if (ret)
+                return ret;
+
+        for (i = 0; i < NF_BR_NUMHOOKS; i++) {
+                const void *hookptr = info->hook_entry[i];
+                if (info->hook_entry[i] &&
+                    (e < (struct ebt_entry *)(base - hookptr))) {
+                        newinfo->hook_entry[i] -= off;
+                        pr_debug("0x%08X -> 0x%08X\n",
+                                        newinfo->hook_entry[i] + off,
+                                        newinfo->hook_entry[i]);
+                }
+        }
+
+        return 0;
+}
+
+
+static int compat_table_info(const struct ebt_table_info *info,
+                             struct compat_ebt_replace *newinfo)
+{
+        unsigned int size = info->entries_size;
+        const void *entries = info->entries;
+
+        newinfo->entries_size = size;
+
+        return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
+                                                        entries, newinfo);
+}
+
+static int compat_copy_everything_to_user(struct ebt_table *t,
+                                          void __user *user, int *len, int cmd)
+{
+        struct compat_ebt_replace repl, tmp;
+        struct ebt_counter *oldcounters;
+        struct ebt_table_info tinfo;
+        int ret;
+        void __user *pos;
+
+        memset(&tinfo, 0, sizeof(tinfo));
+
+        if (cmd == EBT_SO_GET_ENTRIES) {
+                tinfo.entries_size = t->private->entries_size;
+                tinfo.nentries = t->private->nentries;
+                tinfo.entries = t->private->entries;
+                oldcounters = t->private->counters;
+        } else {
+                tinfo.entries_size = t->table->entries_size;
+                tinfo.nentries = t->table->nentries;
+                tinfo.entries = t->table->entries;
+                oldcounters = t->table->counters;
+        }
+
+        if (copy_from_user(&tmp, user, sizeof(tmp)))
+                return -EFAULT;
+
+        if (tmp.nentries != tinfo.nentries ||
+           (tmp.num_counters && tmp.num_counters != tinfo.nentries))
+                return -EINVAL;
+
+        memcpy(&repl, &tmp, sizeof(repl));
+        if (cmd == EBT_SO_GET_ENTRIES)
+                ret = compat_table_info(t->private, &repl);
+        else
+                ret = compat_table_info(&tinfo, &repl);
+        if (ret)
+                return ret;
+
+        if (*len != sizeof(tmp) + repl.entries_size +
+           (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
+                pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
+                                *len, tinfo.entries_size, repl.entries_size);
+                return -EINVAL;
+        }
+
+        /* userspace might not need the counters */
+        ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
+                                        tmp.num_counters, tinfo.nentries);
+        if (ret)
+                return ret;
+
+        pos = compat_ptr(tmp.entries);
+        return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
+                        compat_copy_entry_to_user, &pos, &tmp.entries_size);
+}
+
+struct ebt_entries_buf_state {
+        char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
+        u32 buf_kern_len;       /* total size of kernel buffer */
+        u32 buf_kern_offset;    /* amount of data copied so far */
+        u32 buf_user_offset;    /* read position in userspace buffer */
+};
+
+static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
+{
+        state->buf_kern_offset += sz;
+        return state->buf_kern_offset >= sz ? 0 : -EINVAL;
+}
+
+static int ebt_buf_add(struct ebt_entries_buf_state *state,
+                       void *data, unsigned int sz)
+{
+        if (state->buf_kern_start == NULL)
+                goto count_only;
+
+        BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
+
+        memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
+
+ count_only:
+        state->buf_user_offset += sz;
+        return ebt_buf_count(state, sz);
+}
+
+static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
+{
+        char *b = state->buf_kern_start;
+
+        BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
+
+        if (b != NULL && sz > 0)
+                memset(b + state->buf_kern_offset, 0, sz);
+        /* do not adjust ->buf_user_offset here, we added kernel-side padding */
+        return ebt_buf_count(state, sz);
+}
+
+enum compat_mwt {
+        EBT_COMPAT_MATCH,
+        EBT_COMPAT_WATCHER,
+        EBT_COMPAT_TARGET,
+};
+
+static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
+                                enum compat_mwt compat_mwt,
+                                struct ebt_entries_buf_state *state,
+                                const unsigned char *base)
+{
+        char name[EBT_FUNCTION_MAXNAMELEN];
+        struct xt_match *match;
+        struct xt_target *wt;
+        void *dst = NULL;
+        int off, pad = 0, ret = 0;
+        unsigned int size_kern, entry_offset, match_size = mwt->match_size;
+
+        strlcpy(name, mwt->u.name, sizeof(name));
+
+        if (state->buf_kern_start)
+                dst = state->buf_kern_start + state->buf_kern_offset;
+
+        entry_offset = (unsigned char *) mwt - base;
+        switch (compat_mwt) {
+        case EBT_COMPAT_MATCH:
+                match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
+                                                name, 0), "ebt_%s", name);
+                if (match == NULL)
+                        return -ENOENT;
+                if (IS_ERR(match))
+                        return PTR_ERR(match);
+
+                off = ebt_compat_match_offset(match, match_size);
+                if (dst) {
+                        if (match->compat_from_user)
+                                match->compat_from_user(dst, mwt->data);
+                        else
+                                memcpy(dst, mwt->data, match_size);
+                }
+
+                size_kern = match->matchsize;
+                if (unlikely(size_kern == -1))
+                        size_kern = match_size;
+                module_put(match->me);
+                break;
+        case EBT_COMPAT_WATCHER: /* fallthrough */
+        case EBT_COMPAT_TARGET:
+                wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
+                                                name, 0), "ebt_%s", name);
+                if (wt == NULL)
+                        return -ENOENT;
+                if (IS_ERR(wt))
+                        return PTR_ERR(wt);
+                off = xt_compat_target_offset(wt);
+
+                if (dst) {
+                        if (wt->compat_from_user)
+                                wt->compat_from_user(dst, mwt->data);
+                        else
+                                memcpy(dst, mwt->data, match_size);
+                }
+
+                size_kern = wt->targetsize;
+                module_put(wt->me);
+                break;
+        }
+
+        if (!dst) {
+                ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
+                                        off + ebt_compat_entry_padsize());
+                if (ret < 0)
+                        return ret;
+        }
+
+        state->buf_kern_offset += match_size + off;
+        state->buf_user_offset += match_size;
+        pad = XT_ALIGN(size_kern) - size_kern;
+
+        if (pad > 0 && dst) {
+                BUG_ON(state->buf_kern_len <= pad);
+                BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
+                memset(dst + size_kern, 0, pad);
+        }
+        return off + match_size;
+}
+
+/*
+ * return size of all matches, watchers or target, including necessary
+ * alignment and padding.
+ */
+static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
+                        unsigned int size_left, enum compat_mwt type,
+                        struct ebt_entries_buf_state *state, const void *base)
+{
+        int growth = 0;
+        char *buf;
+
+        if (size_left == 0)
+                return 0;
+
+        buf = (char *) match32;
+
+        while (size_left >= sizeof(*match32)) {
+                struct ebt_entry_match *match_kern;
+                int ret;
+
+                match_kern = (struct ebt_entry_match *) state->buf_kern_start;
+                if (match_kern) {
+                        char *tmp;
+                        tmp = state->buf_kern_start + state->buf_kern_offset;
+                        match_kern = (struct ebt_entry_match *) tmp;
+                }
+                ret = ebt_buf_add(state, buf, sizeof(*match32));
+                if (ret < 0)
+                        return ret;
+                size_left -= sizeof(*match32);
+
+                /* add padding before match->data (if any) */
+                ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
+                if (ret < 0)
+                        return ret;
+
+                if (match32->match_size > size_left)
+                        return -EINVAL;
+
+                size_left -= match32->match_size;
+
+                ret = compat_mtw_from_user(match32, type, state, base);
+                if (ret < 0)
+                        return ret;
+
+                BUG_ON(ret < match32->match_size);
+                growth += ret - match32->match_size;
+                growth += ebt_compat_entry_padsize();
+
+                buf += sizeof(*match32);
+                buf += match32->match_size;
+
+                if (match_kern)
+                        match_kern->match_size = ret;
+
+                WARN_ON(type == EBT_COMPAT_TARGET && size_left);
+                match32 = (struct compat_ebt_entry_mwt *) buf;
+        }
+
+        return growth;
+}
+
+#define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...)          \
+({                                                          \
+        unsigned int __i;                                   \
+        int __ret = 0;                                      \
+        struct compat_ebt_entry_mwt *__watcher;             \
+                                                            \
+        for (__i = e->watchers_offset;                      \
+             __i < (e)->target_offset;                      \
+             __i += __watcher->watcher_size +               \
+             sizeof(struct compat_ebt_entry_mwt)) {         \
+                __watcher = (void *)(e) + __i;              \
+                __ret = fn(__watcher , ## args);            \
+                if (__ret != 0)                             \
+                        break;                              \
+        }                                                   \
+        if (__ret == 0) {                                   \
+                if (__i != (e)->target_offset)              \
+                        __ret = -EINVAL;                    \
+        }                                                   \
+        __ret;                                              \
+})
+
+#define EBT_COMPAT_MATCH_ITERATE(e, fn, args...)            \
+({                                                          \
+        unsigned int __i;                                   \
+        int __ret = 0;                                      \
+        struct compat_ebt_entry_mwt *__match;               \
+                                                            \
+        for (__i = sizeof(struct ebt_entry);                \
+             __i < (e)->watchers_offset;                    \
+             __i += __match->match_size +                   \
+             sizeof(struct compat_ebt_entry_mwt)) {         \
+                __match = (void *)(e) + __i;                \
+                __ret = fn(__match , ## args);              \
+                if (__ret != 0)                             \
+                        break;                              \
+        }                                                   \
+        if (__ret == 0) {                                   \
+                if (__i != (e)->watchers_offset)            \
+                        __ret = -EINVAL;                    \
+        }                                                   \
+        __ret;                                              \
+})
+
+/* called for all ebt_entry structures. */
+static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
+                          unsigned int *total,
+                          struct ebt_entries_buf_state *state)
+{
+        unsigned int i, j, startoff, new_offset = 0;
+        /* stores match/watchers/targets & offset of next struct ebt_entry: */
+        unsigned int offsets[4];
+        unsigned int *offsets_update = NULL;
+        int ret;
+        char *buf_start;
+
+        if (*total < sizeof(struct ebt_entries))
+                return -EINVAL;
+
+        if (!entry->bitmask) {
+                *total -= sizeof(struct ebt_entries);
+                return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
+        }
+        if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
+                return -EINVAL;
+
+        startoff = state->buf_user_offset;
+        /* pull in most part of ebt_entry, it does not need to be changed. */
+        ret = ebt_buf_add(state, entry,
+                        offsetof(struct ebt_entry, watchers_offset));
+        if (ret < 0)
+                return ret;
+
+        offsets[0] = sizeof(struct ebt_entry); /* matches come first */
+        memcpy(&offsets[1], &entry->watchers_offset,
+                        sizeof(offsets) - sizeof(offsets[0]));
+
+        if (state->buf_kern_start) {
+                buf_start = state->buf_kern_start + state->buf_kern_offset;
+                offsets_update = (unsigned int *) buf_start;
+        }
+        ret = ebt_buf_add(state, &offsets[1],
+                        sizeof(offsets) - sizeof(offsets[0]));
+        if (ret < 0)
+                return ret;
+        buf_start = (char *) entry;
+        /*
+         * 0: matches offset, always follows ebt_entry.
+         * 1: watchers offset, from ebt_entry structure
+         * 2: target offset, from ebt_entry structure
+         * 3: next ebt_entry offset, from ebt_entry structure
+         *
+         * offsets are relative to beginning of struct ebt_entry (i.e., 0).
+         */
+        for (i = 0, j = 1 ; j < 4 ; j++, i++) {
+                struct compat_ebt_entry_mwt *match32;
+                unsigned int size;
+                char *buf = buf_start;
+
+                buf = buf_start + offsets[i];
+                if (offsets[i] > offsets[j])
+                        return -EINVAL;
+
+                match32 = (struct compat_ebt_entry_mwt *) buf;
+                size = offsets[j] - offsets[i];
+                ret = ebt_size_mwt(match32, size, i, state, base);
+                if (ret < 0)
+                        return ret;
+                new_offset += ret;
+                if (offsets_update && new_offset) {
+                        pr_debug("ebtables: change offset %d to %d\n",
+                                offsets_update[i], offsets[j] + new_offset);
+                        offsets_update[i] = offsets[j] + new_offset;
+                }
+        }
+
+        startoff = state->buf_user_offset - startoff;
+
+        BUG_ON(*total < startoff);
+        *total -= startoff;
+        return 0;
+}
+
+/*
+ * repl->entries_size is the size of the ebt_entry blob in userspace.
+ * It might need more memory when copied to a 64 bit kernel in case
+ * userspace is 32-bit. So, first task: find out how much memory is needed.
+ *
+ * Called before validation is performed.
+ */
+static int compat_copy_entries(unsigned char *data, unsigned int size_user,
+                                struct ebt_entries_buf_state *state)
+{
+        unsigned int size_remaining = size_user;
+        int ret;
+
+        ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
+                                        &size_remaining, state);
+        if (ret < 0)
+                return ret;
+
+        WARN_ON(size_remaining);
+        return state->buf_kern_offset;
+}
+
+
+static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
+                                            void __user *user, unsigned int len)
+{
+        struct compat_ebt_replace tmp;
+        int i;
+
+        if (len < sizeof(tmp))
+                return -EINVAL;
+
+        if (copy_from_user(&tmp, user, sizeof(tmp)))
+                return -EFAULT;
+
+        if (len != sizeof(tmp) + tmp.entries_size)
+                return -EINVAL;
+
+        if (tmp.entries_size == 0)
+                return -EINVAL;
+
+        if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
+                        NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
+                return -ENOMEM;
+
+        memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
+
+        /* starting with hook_entry, 32 vs. 64 bit structures are different */
+        for (i = 0; i < NF_BR_NUMHOOKS; i++)
+                repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
+
+        repl->num_counters = tmp.num_counters;
+        repl->counters = compat_ptr(tmp.counters);
+        repl->entries = compat_ptr(tmp.entries);
+        return 0;
+}
+
+static int compat_do_replace(struct net *net, void __user *user,
+                             unsigned int len)
+{
+        int ret, i, countersize, size64;
+        struct ebt_table_info *newinfo;
+        struct ebt_replace tmp;
+        struct ebt_entries_buf_state state;
+        void *entries_tmp;
+
+        ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
+        if (ret) {
+                /* try real handler in case userland supplied needed padding */
+                if (ret == -EINVAL && do_replace(net, user, len) == 0)
+                        ret = 0;
+                return ret;
+        }
+
+        countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
+        if (!newinfo)
+                return -ENOMEM;
+
+        if (countersize)
+                memset(newinfo->counters, 0, countersize);
+
+        memset(&state, 0, sizeof(state));
+
+        newinfo->entries = vmalloc(tmp.entries_size);
+        if (!newinfo->entries) {
+                ret = -ENOMEM;
+                goto free_newinfo;
+        }
+        if (copy_from_user(
+           newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
+                ret = -EFAULT;
+                goto free_entries;
+        }
+
+        entries_tmp = newinfo->entries;
+
+        xt_compat_lock(NFPROTO_BRIDGE);
+
+        ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
+        if (ret < 0)
+                goto out_unlock;
+
+        pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
+                tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
+                xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
+
+        size64 = ret;
+        newinfo->entries = vmalloc(size64);
+        if (!newinfo->entries) {
+                vfree(entries_tmp);
+                ret = -ENOMEM;
+                goto out_unlock;
+        }
+
+        memset(&state, 0, sizeof(state));
+        state.buf_kern_start = newinfo->entries;
+        state.buf_kern_len = size64;
+
+        ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
+        BUG_ON(ret < 0);        /* parses same data again */
+
+        vfree(entries_tmp);
+        tmp.entries_size = size64;
+
+        for (i = 0; i < NF_BR_NUMHOOKS; i++) {
+                char __user *usrptr;
+                if (tmp.hook_entry[i]) {
+                        unsigned int delta;
+                        usrptr = (char __user *) tmp.hook_entry[i];
+                        delta = usrptr - tmp.entries;
+                        usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
+                        tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
+                }
+        }
+
+        xt_compat_flush_offsets(NFPROTO_BRIDGE);
+        xt_compat_unlock(NFPROTO_BRIDGE);
+
+        ret = do_replace_finish(net, &tmp, newinfo);
+        if (ret == 0)
+                return ret;
+free_entries:
+        vfree(newinfo->entries);
+free_newinfo:
+        vfree(newinfo);
+        return ret;
+out_unlock:
+        xt_compat_flush_offsets(NFPROTO_BRIDGE);
+        xt_compat_unlock(NFPROTO_BRIDGE);
+        goto free_entries;
+}
+
+static int compat_update_counters(struct net *net, void __user *user,
+                                  unsigned int len)
+{
+        struct compat_ebt_replace hlp;
+
+        if (copy_from_user(&hlp, user, sizeof(hlp)))
+                return -EFAULT;
+
+        /* try real handler in case userland supplied needed padding */
+        if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
+                return update_counters(net, user, len);
+
+        return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
+                                        hlp.num_counters, user, len);
+}
+
+static int compat_do_ebt_set_ctl(struct sock *sk,
+                int cmd, void __user *user, unsigned int len)
+{
+        int ret;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        switch (cmd) {
+        case EBT_SO_SET_ENTRIES:
+                ret = compat_do_replace(sock_net(sk), user, len);
+                break;
+        case EBT_SO_SET_COUNTERS:
+                ret = compat_update_counters(sock_net(sk), user, len);
+                break;
+        default:
+                ret = -EINVAL;
+  }
+        return ret;
+}
+
+static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
+                void __user *user, int *len)
+{
+        int ret;
+        struct compat_ebt_replace tmp;
+        struct ebt_table *t;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        /* try real handler in case userland supplied needed padding */
+        if ((cmd == EBT_SO_GET_INFO ||
+             cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
+                        return do_ebt_get_ctl(sk, cmd, user, len);
+
+        if (copy_from_user(&tmp, user, sizeof(tmp)))
+                return -EFAULT;
+
+        t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
+        if (!t)
+                return ret;
+
+        xt_compat_lock(NFPROTO_BRIDGE);
+        switch (cmd) {
+        case EBT_SO_GET_INFO:
+                tmp.nentries = t->private->nentries;
+                ret = compat_table_info(t->private, &tmp);
+                if (ret)
+                        goto out;
+                tmp.valid_hooks = t->valid_hooks;
+
+                if (copy_to_user(user, &tmp, *len) != 0) {
+                        ret = -EFAULT;
+                        break;
+                }
+                ret = 0;
+                break;
+        case EBT_SO_GET_INIT_INFO:
+                tmp.nentries = t->table->nentries;
+                tmp.entries_size = t->table->entries_size;
+                tmp.valid_hooks = t->table->valid_hooks;
+
+                if (copy_to_user(user, &tmp, *len) != 0) {
+                        ret = -EFAULT;
+                        break;
+                }
+                ret = 0;
+                break;
+        case EBT_SO_GET_ENTRIES:
+        case EBT_SO_GET_INIT_ENTRIES:
+                /*
+                 * try real handler first in case of userland-side padding.
+                 * in case we are dealing with an 'ordinary' 32 bit binary
+                 * without 64bit compatibility padding, this will fail right
+                 * after copy_from_user when the *len argument is validated.
+                 *
+                 * the compat_ variant needs to do one pass over the kernel
+                 * data set to adjust for size differences before it the check.
+                 */
+                if (copy_everything_to_user(t, user, len, cmd) == 0)
+                        ret = 0;
+                else
+                        ret = compat_copy_everything_to_user(t, user, len, cmd);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+ out:
+        xt_compat_flush_offsets(NFPROTO_BRIDGE);
+        xt_compat_unlock(NFPROTO_BRIDGE);
+        mutex_unlock(&ebt_mutex);
+        return ret;
+}
+#endif
+
 static struct nf_sockopt_ops ebt_sockopts =
 {
         .pf             = PF_INET,
         .set_optmin     = EBT_BASE_CTL,
         .set_optmax     = EBT_SO_SET_MAX + 1,
         .set            = do_ebt_set_ctl,
+#ifdef CONFIG_COMPAT
+        .compat_set     = compat_do_ebt_set_ctl,
+#endif
         .get_optmin     = EBT_BASE_CTL,
         .get_optmax     = EBT_SO_GET_MAX + 1,
         .get            = do_ebt_get_ctl,
+#ifdef CONFIG_COMPAT
+        .compat_get     = compat_do_ebt_get_ctl,
+#endif
         .owner          = THIS_MODULE,
 };
 
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 606832115674..702be5a2c956 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -77,8 +77,8 @@ static int stats_timer __read_mostly = 1;
 module_param(stats_timer, int, S_IRUGO);
 MODULE_PARM_DESC(stats_timer, "enable timer for statistics (default:on)");
 
-HLIST_HEAD(can_rx_dev_list);
-static struct dev_rcv_lists can_rx_alldev_list;
+/* receive filters subscribed for 'all' CAN devices */
+struct dev_rcv_lists can_rx_alldev_list;
 static DEFINE_SPINLOCK(can_rcvlists_lock);
 
 static struct kmem_cache *rcv_cache __read_mostly;
@@ -114,7 +114,8 @@ static void can_sock_destruct(struct sock *sk)
         skb_queue_purge(&sk->sk_receive_queue);
 }
 
-static int can_create(struct net *net, struct socket *sock, int protocol)
+static int can_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
         struct sock *sk;
         struct can_proto *cp;
@@ -125,7 +126,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
         if (protocol < 0 || protocol >= CAN_NPROTO)
                 return -EINVAL;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
 #ifdef CONFIG_MODULES
@@ -160,11 +161,6 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
                 goto errout;
         }
 
-        if (cp->capability >= 0 && !capable(cp->capability)) {
-                err = -EPERM;
-                goto errout;
-        }
-
         sock->ops = cp->ops;
 
         sk = sk_alloc(net, PF_CAN, GFP_KERNEL, cp->prot);
@@ -296,28 +292,10 @@ EXPORT_SYMBOL(can_send);
 
 static struct dev_rcv_lists *find_dev_rcv_lists(struct net_device *dev)
 {
-        struct dev_rcv_lists *d = NULL;
-        struct hlist_node *n;
-
-        /*
-         * find receive list for this device
-         *
-         * The hlist_for_each_entry*() macros curse through the list
-         * using the pointer variable n and set d to the containing
-         * struct in each list iteration.  Therefore, after list
-         * iteration, d is unmodified when the list is empty, and it
-         * points to last list element, when the list is non-empty
-         * but no match in the loop body is found.  I.e. d is *not*
-         * NULL when no match is found.  We can, however, use the
-         * cursor variable n to decide if a match was found.
-         */
-
-        hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
-                if (d->dev == dev)
-                        break;
-        }
-
-        return n ? d : NULL;
+        if (!dev)
+                return &can_rx_alldev_list;
+        else
+                return (struct dev_rcv_lists *)dev->ml_priv;
 }
 
 /**
@@ -379,8 +357,8 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
                 return &d->rx[RX_ALL];
 
         /* extra filterlists for the subscription of a single non-RTR can_id */
-        if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS)
-            && !(*can_id & CAN_RTR_FLAG)) {
+        if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS) &&
+            !(*can_id & CAN_RTR_FLAG)) {
 
                 if (*can_id & CAN_EFF_FLAG) {
                         if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) {
@@ -437,6 +415,9 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
 
         /* insert new receiver  (dev,canid,mask) -> (func,data) */
 
+        if (dev && dev->type != ARPHRD_CAN)
+                return -ENODEV;
+
         r = kmem_cache_alloc(rcv_cache, GFP_KERNEL);
         if (!r)
                 return -ENOMEM;
@@ -472,16 +453,6 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
 EXPORT_SYMBOL(can_rx_register);
 
 /*
- * can_rx_delete_device - rcu callback for dev_rcv_lists structure removal
- */
-static void can_rx_delete_device(struct rcu_head *rp)
-{
-        struct dev_rcv_lists *d = container_of(rp, struct dev_rcv_lists, rcu);
-
-        kfree(d);
-}
-
-/*
  * can_rx_delete_receiver - rcu callback for single receiver entry removal
  */
 static void can_rx_delete_receiver(struct rcu_head *rp)
@@ -510,6 +481,9 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
         struct hlist_node *next;
         struct dev_rcv_lists *d;
 
+        if (dev && dev->type != ARPHRD_CAN)
+                return;
+
         spin_lock(&can_rcvlists_lock);
 
         d = find_dev_rcv_lists(dev);
@@ -529,8 +503,8 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
          */
 
         hlist_for_each_entry_rcu(r, next, rl, list) {
-                if (r->can_id == can_id && r->mask == mask
-                    && r->func == func && r->data == data)
+                if (r->can_id == can_id && r->mask == mask &&
+                    r->func == func && r->data == data)
                         break;
         }
 
@@ -545,7 +519,6 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
                        "dev %s, id %03X, mask %03X\n",
                        DNAME(dev), can_id, mask);
                 r = NULL;
-                d = NULL;
                 goto out;
         }
 
@@ -556,10 +529,10 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
                 can_pstats.rcv_entries--;
 
         /* remove device structure requested by NETDEV_UNREGISTER */
-        if (d->remove_on_zero_entries && !d->entries)
-                hlist_del_rcu(&d->list);
-        else
-                d = NULL;
+        if (d->remove_on_zero_entries && !d->entries) {
+                kfree(d);
+                dev->ml_priv = NULL;
+        }
 
  out:
         spin_unlock(&can_rcvlists_lock);
@@ -567,10 +540,6 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
         /* schedule the receiver item for deletion */
         if (r)
                 call_rcu(&r->rcu, can_rx_delete_receiver);
-
-        /* schedule the device structure for deletion */
-        if (d)
-                call_rcu(&d->rcu, can_rx_delete_device);
 }
 EXPORT_SYMBOL(can_rx_unregister);
 
@@ -784,48 +753,35 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
 
         case NETDEV_REGISTER:
 
-                /*
-                 * create new dev_rcv_lists for this device
-                 *
-                 * N.B. zeroing the struct is the correct initialization
-                 * for the embedded hlist_head structs.
-                 * Another list type, e.g. list_head, would require
-                 * explicit initialization.
-                 */
-
+                /* create new dev_rcv_lists for this device */
                 d = kzalloc(sizeof(*d), GFP_KERNEL);
                 if (!d) {
                         printk(KERN_ERR
                                "can: allocation of receive list failed\n");
                         return NOTIFY_DONE;
                 }
-                d->dev = dev;
-
-                spin_lock(&can_rcvlists_lock);
-                hlist_add_head_rcu(&d->list, &can_rx_dev_list);
-                spin_unlock(&can_rcvlists_lock);
+                BUG_ON(dev->ml_priv);
+                dev->ml_priv = d;
 
                 break;
 
         case NETDEV_UNREGISTER:
                 spin_lock(&can_rcvlists_lock);
 
-                d = find_dev_rcv_lists(dev);
+                d = dev->ml_priv;
                 if (d) {
-                        if (d->entries) {
+                        if (d->entries)
                                 d->remove_on_zero_entries = 1;
-                                d = NULL;
-                        } else
-                                hlist_del_rcu(&d->list);
+                        else {
+                                kfree(d);
+                                dev->ml_priv = NULL;
+                        }
                 } else
                         printk(KERN_ERR "can: notifier: receive list not "
                                "found for dev %s\n", dev->name);
 
                 spin_unlock(&can_rcvlists_lock);
 
-                if (d)
-                        call_rcu(&d->rcu, can_rx_delete_device);
-
                 break;
         }
 
@@ -842,7 +798,7 @@ static struct packet_type can_packet __read_mostly = {
         .func = can_rcv,
 };
 
-static struct net_proto_family can_family_ops __read_mostly = {
+static const struct net_proto_family can_family_ops = {
         .family = PF_CAN,
         .create = can_create,
         .owner  = THIS_MODULE,
@@ -857,21 +813,13 @@ static __init int can_init(void)
 {
         printk(banner);
 
+        memset(&can_rx_alldev_list, 0, sizeof(can_rx_alldev_list));
+
         rcv_cache = kmem_cache_create("can_receiver", sizeof(struct receiver),
                                       0, 0, NULL);
         if (!rcv_cache)
                 return -ENOMEM;
 
-        /*
-         * Insert can_rx_alldev_list for reception on all devices.
-         * This struct is zero initialized which is correct for the
-         * embedded hlist heads, the dev pointer, and the entries counter.
-         */
-
-        spin_lock(&can_rcvlists_lock);
-        hlist_add_head_rcu(&can_rx_alldev_list.list, &can_rx_dev_list);
-        spin_unlock(&can_rcvlists_lock);
-
         if (stats_timer) {
                 /* the statistics are updated every second (timer triggered) */
                 setup_timer(&can_stattimer, can_stat_update, 0);
@@ -891,8 +839,7 @@ static __init int can_init(void)
 
 static __exit void can_exit(void)
 {
-        struct dev_rcv_lists *d;
-        struct hlist_node *n, *next;
+        struct net_device *dev;
 
         if (stats_timer)
                 del_timer(&can_stattimer);
@@ -904,14 +851,19 @@ static __exit void can_exit(void)
         unregister_netdevice_notifier(&can_netdev_notifier);
         sock_unregister(PF_CAN);
 
-        /* remove can_rx_dev_list */
-        spin_lock(&can_rcvlists_lock);
-        hlist_del(&can_rx_alldev_list.list);
-        hlist_for_each_entry_safe(d, n, next, &can_rx_dev_list, list) {
-                hlist_del(&d->list);
-                kfree(d);
+        /* remove created dev_rcv_lists from still registered CAN devices */
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
+                if (dev->type == ARPHRD_CAN && dev->ml_priv){
+
+                        struct dev_rcv_lists *d = dev->ml_priv;
+
+                        BUG_ON(d->entries);
+                        kfree(d);
+                        dev->ml_priv = NULL;
+                }
         }
-        spin_unlock(&can_rcvlists_lock);
+        rcu_read_unlock();
 
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
 
diff --git a/net/can/af_can.h b/net/can/af_can.h
index 18f91e37cc30..34253b84e30f 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -63,10 +63,8 @@ struct receiver {
 
 enum { RX_ERR, RX_ALL, RX_FIL, RX_INV, RX_EFF, RX_MAX };
 
+/* per device receive filters linked at dev->ml_priv */
 struct dev_rcv_lists {
-        struct hlist_node list;
-        struct rcu_head rcu;
-        struct net_device *dev;
         struct hlist_head rx[RX_MAX];
         struct hlist_head rx_sff[0x800];
         int remove_on_zero_entries;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index e8d58f33fe09..907dc871fac8 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -56,6 +56,7 @@
 #include <linux/can.h>
 #include <linux/can/core.h>
 #include <linux/can/bcm.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/net_namespace.h>
 
@@ -139,13 +140,13 @@ static char *bcm_proc_getifname(char *result, int ifindex)
         if (!ifindex)
                 return "any";
 
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(&init_net, ifindex);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(&init_net, ifindex);
         if (dev)
                 strcpy(result, dev->name);
         else
                 strcpy(result, "???");
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         return result;
 }
@@ -1478,6 +1479,9 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
         struct sock *sk = sock->sk;
         struct bcm_sock *bo = bcm_sk(sk);
 
+        if (len < sizeof(*addr))
+                return -EINVAL;
+
         if (bo->bound)
                 return -EISCONN;
 
@@ -1539,7 +1543,7 @@ static int bcm_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name) {
                 msg->msg_namelen = sizeof(struct sockaddr_can);
@@ -1581,7 +1585,6 @@ static struct proto bcm_proto __read_mostly = {
 static struct can_proto bcm_can_proto __read_mostly = {
         .type       = SOCK_DGRAM,
         .protocol   = CAN_BCM,
-        .capability = -1,
         .ops        = &bcm_ops,
         .prot       = &bcm_proto,
 };
diff --git a/net/can/proc.c b/net/can/proc.c
index 9b9ad29be567..f4265cc9c3fb 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -45,6 +45,7 @@
 #include <linux/proc_fs.h>
 #include <linux/list.h>
 #include <linux/rcupdate.h>
+#include <linux/if_arp.h>
 #include <linux/can/core.h>
 
 #include "af_can.h"
@@ -84,6 +85,9 @@ static const char rx_list_name[][8] = {
         [RX_EFF] = "rx_eff",
 };
 
+/* receive filters subscribed for 'all' CAN devices */
+extern struct dev_rcv_lists can_rx_alldev_list;
+
 /*
  * af_can statistics stuff
  */
@@ -190,10 +194,6 @@ void can_stat_update(unsigned long data)
 
 /*
  * proc read functions
- *
- * From known use-cases we expect about 10 entries in a receive list to be
- * printed in the proc_fs. So PAGE_SIZE is definitely enough space here.
- *
  */
 
 static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
@@ -202,7 +202,6 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
         struct receiver *r;
         struct hlist_node *n;
 
-        rcu_read_lock();
         hlist_for_each_entry_rcu(r, n, rx_list, list) {
                 char *fmt = (r->can_id & CAN_EFF_FLAG)?
                         "   %-5s  %08X  %08x  %08x  %08x  %8ld  %s\n" :
@@ -212,7 +211,6 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
                                 (unsigned long)r->func, (unsigned long)r->data,
                                 r->matches, r->ident);
         }
-        rcu_read_unlock();
 }
 
 static void can_print_recv_banner(struct seq_file *m)
@@ -346,24 +344,39 @@ static const struct file_operations can_version_proc_fops = {
         .release        = single_release,
 };
 
+static inline void can_rcvlist_proc_show_one(struct seq_file *m, int idx,
+                                             struct net_device *dev,
+                                             struct dev_rcv_lists *d)
+{
+        if (!hlist_empty(&d->rx[idx])) {
+                can_print_recv_banner(m);
+                can_print_rcvlist(m, &d->rx[idx], dev);
+        } else
+                seq_printf(m, "  (%s: no entry)\n", DNAME(dev));
+
+}
+
 static int can_rcvlist_proc_show(struct seq_file *m, void *v)
 {
         /* double cast to prevent GCC warning */
         int idx = (int)(long)m->private;
+        struct net_device *dev;
         struct dev_rcv_lists *d;
-        struct hlist_node *n;
 
         seq_printf(m, "\nreceive list '%s':\n", rx_list_name[idx]);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
 
-                if (!hlist_empty(&d->rx[idx])) {
-                        can_print_recv_banner(m);
-                        can_print_rcvlist(m, &d->rx[idx], d->dev);
-                } else
-                        seq_printf(m, "  (%s: no entry)\n", DNAME(d->dev));
+        /* receive list for 'all' CAN devices (dev == NULL) */
+        d = &can_rx_alldev_list;
+        can_rcvlist_proc_show_one(m, idx, NULL, d);
+
+        /* receive list for registered CAN devices */
+        for_each_netdev_rcu(&init_net, dev) {
+                if (dev->type == ARPHRD_CAN && dev->ml_priv)
+                        can_rcvlist_proc_show_one(m, idx, dev, dev->ml_priv);
         }
+
         rcu_read_unlock();
 
         seq_putc(m, '\n');
@@ -383,34 +396,50 @@ static const struct file_operations can_rcvlist_proc_fops = {
         .release        = single_release,
 };
 
+static inline void can_rcvlist_sff_proc_show_one(struct seq_file *m,
+                                                 struct net_device *dev,
+                                                 struct dev_rcv_lists *d)
+{
+        int i;
+        int all_empty = 1;
+
+        /* check wether at least one list is non-empty */
+        for (i = 0; i < 0x800; i++)
+                if (!hlist_empty(&d->rx_sff[i])) {
+                        all_empty = 0;
+                        break;
+                }
+
+        if (!all_empty) {
+                can_print_recv_banner(m);
+                for (i = 0; i < 0x800; i++) {
+                        if (!hlist_empty(&d->rx_sff[i]))
+                                can_print_rcvlist(m, &d->rx_sff[i], dev);
+                }
+        } else
+                seq_printf(m, "  (%s: no entry)\n", DNAME(dev));
+}
+
 static int can_rcvlist_sff_proc_show(struct seq_file *m, void *v)
 {
+        struct net_device *dev;
         struct dev_rcv_lists *d;
-        struct hlist_node *n;
 
         /* RX_SFF */
         seq_puts(m, "\nreceive list 'rx_sff':\n");
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
-                int i, all_empty = 1;
-                /* check wether at least one list is non-empty */
-                for (i = 0; i < 0x800; i++)
-                        if (!hlist_empty(&d->rx_sff[i])) {
-                                all_empty = 0;
-                                break;
-                        }
-
-                if (!all_empty) {
-                        can_print_recv_banner(m);
-                        for (i = 0; i < 0x800; i++) {
-                                if (!hlist_empty(&d->rx_sff[i]))
-                                        can_print_rcvlist(m, &d->rx_sff[i],
-                                                          d->dev);
-                        }
-                } else
-                        seq_printf(m, "  (%s: no entry)\n", DNAME(d->dev));
+
+        /* sff receive list for 'all' CAN devices (dev == NULL) */
+        d = &can_rx_alldev_list;
+        can_rcvlist_sff_proc_show_one(m, NULL, d);
+
+        /* sff receive list for registered CAN devices */
+        for_each_netdev_rcu(&init_net, dev) {
+                if (dev->type == ARPHRD_CAN && dev->ml_priv)
+                        can_rcvlist_sff_proc_show_one(m, dev, dev->ml_priv);
         }
+
         rcu_read_unlock();
 
         seq_putc(m, '\n');
diff --git a/net/can/raw.c b/net/can/raw.c
index b5e897922d32..da99cf153b33 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -45,6 +45,7 @@
 #include <linux/init.h>
 #include <linux/uio.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/socket.h>
 #include <linux/if_arp.h>
@@ -424,8 +425,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 
         if (level != SOL_CAN_RAW)
                 return -EINVAL;
-        if (optlen < 0)
-                return -EINVAL;
 
         switch (optname) {
 
@@ -446,7 +445,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                                 return -EFAULT;
                         }
                 } else if (count == 1) {
-                        if (copy_from_user(&sfilter, optval, optlen))
+                        if (copy_from_user(&sfilter, optval, sizeof(sfilter)))
                                 return -EFAULT;
                 }
 
@@ -702,7 +701,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name) {
                 msg->msg_namelen = sizeof(struct sockaddr_can);
@@ -744,7 +743,6 @@ static struct proto raw_proto __read_mostly = {
 static struct can_proto raw_can_proto __read_mostly = {
         .type       = SOCK_RAW,
         .protocol   = CAN_RAW,
-        .capability = -1,
         .ops        = &raw_ops,
         .prot       = &raw_proto,
 };
diff --git a/net/compat.c b/net/compat.c
index a407c3addbae..ec24d9edb025 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/gfp.h>
 #include <linux/fs.h>
 #include <linux/types.h>
 #include <linux/file.h>
@@ -390,9 +391,6 @@ asmlinkage long compat_sys_setsockopt(int fd, int level, int optname,
         int err;
         struct socket *sock;
 
-        if (optlen < 0)
-                return -EINVAL;
-
         if ((sock = sockfd_lookup(fd, &err))!=NULL)
         {
                 err = security_socket_setsockopt(sock,level,optname);
@@ -727,10 +725,10 @@ EXPORT_SYMBOL(compat_mc_getsockopt);
 
 /* Argument list sizes for compat_sys_socketcall */
 #define AL(x) ((x) * sizeof(u32))
-static unsigned char nas[19]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
+static unsigned char nas[20]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
                                 AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
                                 AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-                                AL(4)};
+                                AL(4),AL(5)};
 #undef AL
 
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
@@ -755,13 +753,35 @@ asmlinkage long compat_sys_recvfrom(int fd, void __user *buf, size_t len,
         return sys_recvfrom(fd, buf, len, flags | MSG_CMSG_COMPAT, addr, addrlen);
 }
 
+asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+                                    unsigned vlen, unsigned int flags,
+                                    struct compat_timespec __user *timeout)
+{
+        int datagrams;
+        struct timespec ktspec;
+
+        if (timeout == NULL)
+                return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+                                      flags | MSG_CMSG_COMPAT, NULL);
+
+        if (get_compat_timespec(&ktspec, timeout))
+                return -EFAULT;
+
+        datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+                                   flags | MSG_CMSG_COMPAT, &ktspec);
+        if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
+                datagrams = -EFAULT;
+
+        return datagrams;
+}
+
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
         int ret;
         u32 a[6];
         u32 a0, a1;
 
-        if (call < SYS_SOCKET || call > SYS_ACCEPT4)
+        if (call < SYS_SOCKET || call > SYS_RECVMMSG)
                 return -EINVAL;
         if (copy_from_user(a, args, nas[call]))
                 return -EFAULT;
@@ -823,6 +843,10 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
         case SYS_RECVMSG:
                 ret = compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
                 break;
+        case SYS_RECVMMSG:
+                ret = compat_sys_recvmmsg(a0, compat_ptr(a1), a[2], a[3],
+                                          compat_ptr(a[4]));
+                break;
         case SYS_ACCEPT4:
                 ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), a[3]);
                 break;
diff --git a/net/core/Makefile b/net/core/Makefile
index 796f46eece5f..08791ac3e05a 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -6,7 +6,6 @@ obj-y := sock.o request_sock.o skbuff.o iovec.o datagram.o stream.o scm.o \
          gen_stats.o gen_estimator.o net_namespace.o
 
 obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
-obj-$(CONFIG_HAS_DMA) += skb_dma_map.o
 
 obj-y                += dev.o ethtool.o dev_mcast.o dst.o netevent.o \
                         neighbour.o rtnetlink.o utils.o link_watch.o filter.o
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 4ade3011bb3c..2dccd4ee591b 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -48,6 +48,7 @@
 #include <linux/poll.h>
 #include <linux/highmem.h>
 #include <linux/spinlock.h>
+#include <linux/slab.h>
 
 #include <net/protocol.h>
 #include <linux/skbuff.h>
@@ -271,6 +272,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
         }
 
         kfree_skb(skb);
+        atomic_inc(&sk->sk_drops);
         sk_mem_reclaim_partial(sk);
 
         return err;
diff --git a/net/core/dev.c b/net/core/dev.c
index fe10551d3671..264137fce3a2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -79,6 +79,8 @@
 #include <linux/cpu.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/hash.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/mutex.h>
 #include <linux/string.h>
@@ -104,6 +106,7 @@
 #include <net/dst.h>
 #include <net/pkt_sched.h>
 #include <net/checksum.h>
+#include <net/xfrm.h>
 #include <linux/highmem.h>
 #include <linux/init.h>
 #include <linux/kmod.h>
@@ -175,7 +178,7 @@ static struct list_head ptype_all __read_mostly;	/* Taps */
  * The @dev_base_head list is protected by @dev_base_lock and the rtnl
  * semaphore.
  *
- * Pure readers hold dev_base_lock for reading.
+ * Pure readers hold dev_base_lock for reading, or rcu_read_lock()
  *
  * Writers must hold the rtnl semaphore while they loop through the
  * dev_base_head list, and hold dev_base_lock for writing when they do the
@@ -193,18 +196,15 @@ static struct list_head ptype_all __read_mostly;	/* Taps */
 DEFINE_RWLOCK(dev_base_lock);
 EXPORT_SYMBOL(dev_base_lock);
 
-#define NETDEV_HASHBITS 8
-#define NETDEV_HASHENTRIES (1 << NETDEV_HASHBITS)
-
 static inline struct hlist_head *dev_name_hash(struct net *net, const char *name)
 {
         unsigned hash = full_name_hash(name, strnlen(name, IFNAMSIZ));
-        return &net->dev_name_head[hash & ((1 << NETDEV_HASHBITS) - 1)];
+        return &net->dev_name_head[hash_32(hash, NETDEV_HASHBITS)];
 }
 
 static inline struct hlist_head *dev_index_hash(struct net *net, int ifindex)
 {
-        return &net->dev_index_head[ifindex & ((1 << NETDEV_HASHBITS) - 1)];
+        return &net->dev_index_head[ifindex & (NETDEV_HASHENTRIES - 1)];
 }
 
 /* Device list insertion */
@@ -215,23 +215,26 @@ static int list_netdevice(struct net_device *dev)
         ASSERT_RTNL();
 
         write_lock_bh(&dev_base_lock);
-        list_add_tail(&dev->dev_list, &net->dev_base_head);
-        hlist_add_head(&dev->name_hlist, dev_name_hash(net, dev->name));
-        hlist_add_head(&dev->index_hlist, dev_index_hash(net, dev->ifindex));
+        list_add_tail_rcu(&dev->dev_list, &net->dev_base_head);
+        hlist_add_head_rcu(&dev->name_hlist, dev_name_hash(net, dev->name));
+        hlist_add_head_rcu(&dev->index_hlist,
+                           dev_index_hash(net, dev->ifindex));
         write_unlock_bh(&dev_base_lock);
         return 0;
 }
 
-/* Device list removal */
+/* Device list removal
+ * caller must respect a RCU grace period before freeing/reusing dev
+ */
 static void unlist_netdevice(struct net_device *dev)
 {
         ASSERT_RTNL();
 
         /* Unlink dev from the device chain */
         write_lock_bh(&dev_base_lock);
-        list_del(&dev->dev_list);
-        hlist_del(&dev->name_hlist);
-        hlist_del(&dev->index_hlist);
+        list_del_rcu(&dev->dev_list);
+        hlist_del_rcu(&dev->name_hlist);
+        hlist_del_rcu(&dev->index_hlist);
         write_unlock_bh(&dev_base_lock);
 }
 
@@ -587,18 +590,44 @@ __setup("netdev=", netdev_boot_setup);
 struct net_device *__dev_get_by_name(struct net *net, const char *name)
 {
         struct hlist_node *p;
+        struct net_device *dev;
+        struct hlist_head *head = dev_name_hash(net, name);
 
-        hlist_for_each(p, dev_name_hash(net, name)) {
-                struct net_device *dev
-                        = hlist_entry(p, struct net_device, name_hlist);
+        hlist_for_each_entry(dev, p, head, name_hlist)
                 if (!strncmp(dev->name, name, IFNAMSIZ))
                         return dev;
-        }
+
         return NULL;
 }
 EXPORT_SYMBOL(__dev_get_by_name);
 
 /**
+ *      dev_get_by_name_rcu     - find a device by its name
+ *      @net: the applicable net namespace
+ *      @name: name to find
+ *
+ *      Find an interface by name.
+ *      If the name is found a pointer to the device is returned.
+ *      If the name is not found then %NULL is returned.
+ *      The reference counters are not incremented so the caller must be
+ *      careful with locks. The caller must hold RCU lock.
+ */
+
+struct net_device *dev_get_by_name_rcu(struct net *net, const char *name)
+{
+        struct hlist_node *p;
+        struct net_device *dev;
+        struct hlist_head *head = dev_name_hash(net, name);
+
+        hlist_for_each_entry_rcu(dev, p, head, name_hlist)
+                if (!strncmp(dev->name, name, IFNAMSIZ))
+                        return dev;
+
+        return NULL;
+}
+EXPORT_SYMBOL(dev_get_by_name_rcu);
+
+/**
  *      dev_get_by_name         - find a device by its name
  *      @net: the applicable net namespace
  *      @name: name to find
@@ -614,11 +643,11 @@ struct net_device *dev_get_by_name(struct net *net, const char *name)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_name(net, name);
+        rcu_read_lock();
+        dev = dev_get_by_name_rcu(net, name);
         if (dev)
                 dev_hold(dev);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return dev;
 }
 EXPORT_SYMBOL(dev_get_by_name);
@@ -638,17 +667,42 @@ EXPORT_SYMBOL(dev_get_by_name);
 struct net_device *__dev_get_by_index(struct net *net, int ifindex)
 {
         struct hlist_node *p;
+        struct net_device *dev;
+        struct hlist_head *head = dev_index_hash(net, ifindex);
 
-        hlist_for_each(p, dev_index_hash(net, ifindex)) {
-                struct net_device *dev
-                        = hlist_entry(p, struct net_device, index_hlist);
+        hlist_for_each_entry(dev, p, head, index_hlist)
                 if (dev->ifindex == ifindex)
                         return dev;
-        }
+
         return NULL;
 }
 EXPORT_SYMBOL(__dev_get_by_index);
 
+/**
+ *      dev_get_by_index_rcu - find a device by its ifindex
+ *      @net: the applicable net namespace
+ *      @ifindex: index of device
+ *
+ *      Search for an interface by index. Returns %NULL if the device
+ *      is not found or a pointer to the device. The device has not
+ *      had its reference counter increased so the caller must be careful
+ *      about locking. The caller must hold RCU lock.
+ */
+
+struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex)
+{
+        struct hlist_node *p;
+        struct net_device *dev;
+        struct hlist_head *head = dev_index_hash(net, ifindex);
+
+        hlist_for_each_entry_rcu(dev, p, head, index_hlist)
+                if (dev->ifindex == ifindex)
+                        return dev;
+
+        return NULL;
+}
+EXPORT_SYMBOL(dev_get_by_index_rcu);
+
 
 /**
  *      dev_get_by_index - find a device by its ifindex
@@ -665,11 +719,11 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifindex);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
         if (dev)
                 dev_hold(dev);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return dev;
 }
 EXPORT_SYMBOL(dev_get_by_index);
@@ -748,15 +802,15 @@ struct net_device *dev_get_by_flags(struct net *net, unsigned short if_flags,
         struct net_device *dev, *ret;
 
         ret = NULL;
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 if (((dev->flags ^ if_flags) & mask) == 0) {
                         dev_hold(dev);
                         ret = dev;
                         break;
                 }
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return ret;
 }
 EXPORT_SYMBOL(dev_get_by_flags);
@@ -841,7 +895,8 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
                 free_page((unsigned long) inuse);
         }
 
-        snprintf(buf, IFNAMSIZ, name, i);
+        if (buf != name)
+                snprintf(buf, IFNAMSIZ, name, i);
         if (!__dev_get_by_name(net, buf))
                 return i;
 
@@ -881,6 +936,21 @@ int dev_alloc_name(struct net_device *dev, const char *name)
 }
 EXPORT_SYMBOL(dev_alloc_name);
 
+static int dev_get_valid_name(struct net *net, const char *name, char *buf,
+                              bool fmt)
+{
+        if (!dev_valid_name(name))
+                return -EINVAL;
+
+        if (fmt && strchr(name, '%'))
+                return __dev_alloc_name(net, name, buf);
+        else if (__dev_get_by_name(net, name))
+                return -EEXIST;
+        else if (buf != name)
+                strlcpy(buf, name, IFNAMSIZ);
+
+        return 0;
+}
 
 /**
  *      dev_change_name - change name of a device
@@ -904,28 +974,20 @@ int dev_change_name(struct net_device *dev, const char *newname)
         if (dev->flags & IFF_UP)
                 return -EBUSY;
 
-        if (!dev_valid_name(newname))
-                return -EINVAL;
-
         if (strncmp(newname, dev->name, IFNAMSIZ) == 0)
                 return 0;
 
         memcpy(oldname, dev->name, IFNAMSIZ);
 
-        if (strchr(newname, '%')) {
-                err = dev_alloc_name(dev, newname);
-                if (err < 0)
-                        return err;
-        } else if (__dev_get_by_name(net, newname))
-                return -EEXIST;
-        else
-                strlcpy(dev->name, newname, IFNAMSIZ);
+        err = dev_get_valid_name(net, newname, dev->name, 1);
+        if (err < 0)
+                return err;
 
 rollback:
         /* For now only devices in the initial network namespace
          * are in sysfs.
          */
-        if (net == &init_net) {
+        if (net_eq(net, &init_net)) {
                 ret = device_rename(&dev->dev, dev->name);
                 if (ret) {
                         memcpy(dev->name, oldname, IFNAMSIZ);
@@ -935,7 +997,12 @@ rollback:
 
         write_lock_bh(&dev_base_lock);
         hlist_del(&dev->name_hlist);
-        hlist_add_head(&dev->name_hlist, dev_name_hash(net, dev->name));
+        write_unlock_bh(&dev_base_lock);
+
+        synchronize_rcu();
+
+        write_lock_bh(&dev_base_lock);
+        hlist_add_head_rcu(&dev->name_hlist, dev_name_hash(net, dev->name));
         write_unlock_bh(&dev_base_lock);
 
         ret = call_netdevice_notifiers(NETDEV_CHANGENAME, dev);
@@ -1038,28 +1105,16 @@ void dev_load(struct net *net, const char *name)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_name(net, name);
-        read_unlock(&dev_base_lock);
+        rcu_read_lock();
+        dev = dev_get_by_name_rcu(net, name);
+        rcu_read_unlock();
 
         if (!dev && capable(CAP_NET_ADMIN))
                 request_module("%s", name);
 }
 EXPORT_SYMBOL(dev_load);
 
-/**
- *      dev_open        - prepare an interface for use.
- *      @dev:   device to open
- *
- *      Takes a device from down to up state. The device's private open
- *      function is invoked and then the multicast lists are loaded. Finally
- *      the device is moved into the up state and a %NETDEV_UP message is
- *      sent to the netdev notifier chain.
- *
- *      Calling this function on an active interface is a nop. On a failure
- *      a negative errno code is returned.
- */
-int dev_open(struct net_device *dev)
+static int __dev_open(struct net_device *dev)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
         int ret;
@@ -1067,13 +1122,6 @@ int dev_open(struct net_device *dev)
         ASSERT_RTNL();
 
         /*
-         *      Is it already up?
-         */
-
-        if (dev->flags & IFF_UP)
-                return 0;
-
-        /*
          *      Is it even present?
          */
         if (!netif_device_present(dev))
@@ -1121,36 +1169,57 @@ int dev_open(struct net_device *dev)
                  *      Wakeup transmit queue engine
                  */
                 dev_activate(dev);
-
-                /*
-                 *      ... and announce new interface.
-                 */
-                call_netdevice_notifiers(NETDEV_UP, dev);
         }
 
         return ret;
 }
-EXPORT_SYMBOL(dev_open);
 
 /**
- *      dev_close - shutdown an interface.
- *      @dev: device to shutdown
+ *      dev_open        - prepare an interface for use.
+ *      @dev:   device to open
  *
- *      This function moves an active device into down state. A
- *      %NETDEV_GOING_DOWN is sent to the netdev notifier chain. The device
- *      is then deactivated and finally a %NETDEV_DOWN is sent to the notifier
- *      chain.
+ *      Takes a device from down to up state. The device's private open
+ *      function is invoked and then the multicast lists are loaded. Finally
+ *      the device is moved into the up state and a %NETDEV_UP message is
+ *      sent to the netdev notifier chain.
+ *
+ *      Calling this function on an active interface is a nop. On a failure
+ *      a negative errno code is returned.
  */
-int dev_close(struct net_device *dev)
+int dev_open(struct net_device *dev)
+{
+        int ret;
+
+        /*
+         *      Is it already up?
+         */
+        if (dev->flags & IFF_UP)
+                return 0;
+
+        /*
+         *      Open device
+         */
+        ret = __dev_open(dev);
+        if (ret < 0)
+                return ret;
+
+        /*
+         *      ... and announce new interface.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
+        call_netdevice_notifiers(NETDEV_UP, dev);
+
+        return ret;
+}
+EXPORT_SYMBOL(dev_open);
+
+static int __dev_close(struct net_device *dev)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
-        ASSERT_RTNL();
 
+        ASSERT_RTNL();
         might_sleep();
 
-        if (!(dev->flags & IFF_UP))
-                return 0;
-
         /*
          *      Tell people we are going down, so that they can
          *      prepare to death, when device is still operating.
@@ -1186,14 +1255,34 @@ int dev_close(struct net_device *dev)
         dev->flags &= ~IFF_UP;
 
         /*
-         * Tell people we are down
+         *      Shutdown NET_DMA
          */
-        call_netdevice_notifiers(NETDEV_DOWN, dev);
+        net_dmaengine_put();
+
+        return 0;
+}
+
+/**
+ *      dev_close - shutdown an interface.
+ *      @dev: device to shutdown
+ *
+ *      This function moves an active device into down state. A
+ *      %NETDEV_GOING_DOWN is sent to the netdev notifier chain. The device
+ *      is then deactivated and finally a %NETDEV_DOWN is sent to the notifier
+ *      chain.
+ */
+int dev_close(struct net_device *dev)
+{
+        if (!(dev->flags & IFF_UP))
+                return 0;
+
+        __dev_close(dev);
 
         /*
-         *      Shutdown NET_DMA
+         * Tell people we are down
          */
-        net_dmaengine_put();
+        rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
+        call_netdevice_notifiers(NETDEV_DOWN, dev);
 
         return 0;
 }
@@ -1287,6 +1376,7 @@ rollback:
                                 nb->notifier_call(nb, NETDEV_DOWN, dev);
                         }
                         nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                        nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
                 }
         }
 
@@ -1353,6 +1443,41 @@ static inline void net_timestamp(struct sk_buff *skb)
                 skb->tstamp.tv64 = 0;
 }
 
+/**
+ * dev_forward_skb - loopback an skb to another netif
+ *
+ * @dev: destination network device
+ * @skb: buffer to forward
+ *
+ * return values:
+ *      NET_RX_SUCCESS  (no congestion)
+ *      NET_RX_DROP     (packet was dropped, but freed)
+ *
+ * dev_forward_skb can be used for injecting an skb from the
+ * start_xmit function of one device into the receive queue
+ * of another device.
+ *
+ * The receiving device may be in another namespace, so
+ * we have to clear all information in the skb that could
+ * impact namespace isolation.
+ */
+int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
+{
+        skb_orphan(skb);
+
+        if (!(dev->flags & IFF_UP) ||
+            (skb->len > (dev->mtu + dev->hard_header_len))) {
+                kfree_skb(skb);
+                return NET_RX_DROP;
+        }
+        skb_set_dev(skb, dev);
+        skb->tstamp.tv64 = 0;
+        skb->pkt_type = PACKET_HOST;
+        skb->protocol = eth_type_trans(skb, dev);
+        return netif_rx(skb);
+}
+EXPORT_SYMBOL_GPL(dev_forward_skb);
+
 /*
  *      Support routine. Sends outgoing frames to any network
  *      taps currently in use.
@@ -1508,6 +1633,36 @@ static bool dev_can_checksum(struct net_device *dev, struct sk_buff *skb)
         return false;
 }
 
+/**
+ * skb_dev_set -- assign a new device to a buffer
+ * @skb: buffer for the new device
+ * @dev: network device
+ *
+ * If an skb is owned by a device already, we have to reset
+ * all data private to the namespace a device belongs to
+ * before assigning it a new device.
+ */
+#ifdef CONFIG_NET_NS
+void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
+{
+        skb_dst_drop(skb);
+        if (skb->dev && !net_eq(dev_net(skb->dev), dev_net(dev))) {
+                secpath_reset(skb);
+                nf_reset(skb);
+                skb_init_secmark(skb);
+                skb->mark = 0;
+                skb->priority = 0;
+                skb->nf_trace = 0;
+                skb->ipvs_property = 0;
+#ifdef CONFIG_NET_SCHED
+                skb->tc_index = 0;
+#endif
+        }
+        skb->dev = dev;
+}
+EXPORT_SYMBOL(skb_set_dev);
+#endif /* CONFIG_NET_NS */
+
 /*
  * Invalidate hardware checksum when packet is to be mangled, and
  * complete checksum manually on outgoing path.
@@ -1701,7 +1856,7 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                         struct netdev_queue *txq)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
-        int rc;
+        int rc = NETDEV_TX_OK;
 
         if (likely(!skb->next)) {
                 if (!list_empty(&ptype_all))
@@ -1747,8 +1902,18 @@ gso:
 
                 skb->next = nskb->next;
                 nskb->next = NULL;
+
+                /*
+                 * If device doesnt need nskb->dst, release it right now while
+                 * its hot in this cpu cache
+                 */
+                if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
+                        skb_dst_drop(nskb);
+
                 rc = ops->ndo_start_xmit(nskb, dev);
                 if (unlikely(rc != NETDEV_TX_OK)) {
+                        if (rc & ~NETDEV_TX_MASK)
+                                goto out_kfree_gso_skb;
                         nskb->next = skb->next;
                         skb->next = nskb;
                         return rc;
@@ -1758,11 +1923,12 @@ gso:
                         return NETDEV_TX_BUSY;
         } while (skb->next);
 
-        skb->destructor = DEV_GSO_CB(skb)->destructor;
-
+out_kfree_gso_skb:
+        if (likely(skb->next == NULL))
+                skb->destructor = DEV_GSO_CB(skb)->destructor;
 out_kfree_skb:
         kfree_skb(skb);
-        return NETDEV_TX_OK;
+        return rc;
 }
 
 static u32 skb_tx_hashrnd;
@@ -1789,16 +1955,47 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
 }
 EXPORT_SYMBOL(skb_tx_hash);
 
+static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
+{
+        if (unlikely(queue_index >= dev->real_num_tx_queues)) {
+                if (net_ratelimit()) {
+                        WARN(1, "%s selects TX queue %d, but "
+                             "real number of TX queues is %d\n",
+                             dev->name, queue_index,
+                             dev->real_num_tx_queues);
+                }
+                return 0;
+        }
+        return queue_index;
+}
+
 static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                                         struct sk_buff *skb)
 {
-        const struct net_device_ops *ops = dev->netdev_ops;
-        u16 queue_index = 0;
+        u16 queue_index;
+        struct sock *sk = skb->sk;
+
+        if (sk_tx_queue_recorded(sk)) {
+                queue_index = sk_tx_queue_get(sk);
+        } else {
+                const struct net_device_ops *ops = dev->netdev_ops;
+
+                if (ops->ndo_select_queue) {
+                        queue_index = ops->ndo_select_queue(dev, skb);
+                        queue_index = dev_cap_txqueue(dev, queue_index);
+                } else {
+                        queue_index = 0;
+                        if (dev->real_num_tx_queues > 1)
+                                queue_index = skb_tx_hash(dev, skb);
+
+                        if (sk) {
+                                struct dst_entry *dst = rcu_dereference_bh(sk->sk_dst_cache);
 
-        if (ops->ndo_select_queue)
-                queue_index = ops->ndo_select_queue(dev, skb);
-        else if (dev->real_num_tx_queues > 1)
-                queue_index = skb_tx_hash(dev, skb);
+                                if (dst && skb_dst(skb) == dst)
+                                        sk_tx_queue_set(sk, queue_index);
+                        }
+                }
+        }
 
         skb_set_queue_mapping(skb, queue_index);
         return netdev_get_tx_queue(dev, queue_index);
@@ -1838,6 +2035,21 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
         return rc;
 }
 
+/*
+ * Returns true if either:
+ *      1. skb has frag_list and the device doesn't support FRAGLIST, or
+ *      2. skb is fragmented and the device does not support SG, or if
+ *         at least one of fragments is in highmem and device does not
+ *         support DMA from it.
+ */
+static inline int skb_needs_linearize(struct sk_buff *skb,
+                                      struct net_device *dev)
+{
+        return (skb_has_frags(skb) && !(dev->features & NETIF_F_FRAGLIST)) ||
+               (skb_shinfo(skb)->nr_frags && (!(dev->features & NETIF_F_SG) ||
+                                              illegal_highdma(dev, skb)));
+}
+
 /**
  *      dev_queue_xmit - transmit a buffer
  *      @skb: buffer to transmit
@@ -1874,18 +2086,8 @@ int dev_queue_xmit(struct sk_buff *skb)
         if (netif_needs_gso(dev, skb))
                 goto gso;
 
-        if (skb_has_frags(skb) &&
-            !(dev->features & NETIF_F_FRAGLIST) &&
-            __skb_linearize(skb))
-                goto out_kfree_skb;
-
-        /* Fragmented skb is linearized if device does not support SG,
-         * or if at least one of fragments is in highmem and device
-         * does not support DMA from it.
-         */
-        if (skb_shinfo(skb)->nr_frags &&
-            (!(dev->features & NETIF_F_SG) || illegal_highdma(dev, skb)) &&
-            __skb_linearize(skb))
+        /* Convert a paged skb to linear, if required */
+        if (skb_needs_linearize(skb, dev) && __skb_linearize(skb))
                 goto out_kfree_skb;
 
         /* If packet is not checksummed and device does not support
@@ -1905,7 +2107,7 @@ gso:
         rcu_read_lock_bh();
 
         txq = dev_pick_tx(dev, skb);
-        q = rcu_dereference(txq->qdisc);
+        q = rcu_dereference_bh(txq->qdisc);
 
 #ifdef CONFIG_NET_CLS_ACT
         skb->tc_verd = SET_TC_AT(skb->tc_verd, AT_EGRESS);
@@ -1935,8 +2137,8 @@ gso:
                         HARD_TX_LOCK(dev, txq, cpu);
 
                         if (!netif_tx_queue_stopped(txq)) {
-                                rc = NET_XMIT_SUCCESS;
-                                if (!dev_hard_start_xmit(skb, dev, txq)) {
+                                rc = dev_hard_start_xmit(skb, dev, txq);
+                                if (dev_xmit_complete(rc)) {
                                         HARD_TX_UNLOCK(dev, txq);
                                         goto out;
                                 }
@@ -2191,7 +2393,7 @@ static int ing_filter(struct sk_buff *skb)
         if (MAX_RED_LOOP < ttl++) {
                 printk(KERN_WARNING
                        "Redir loop detected Dropping packet (%d->%d)\n",
-                       skb->iif, dev->ifindex);
+                       skb->skb_iif, dev->ifindex);
                 return TC_ACT_SHOT;
         }
 
@@ -2285,30 +2487,33 @@ int netif_receive_skb(struct sk_buff *skb)
 {
         struct packet_type *ptype, *pt_prev;
         struct net_device *orig_dev;
+        struct net_device *master;
         struct net_device *null_or_orig;
+        struct net_device *null_or_bond;
         int ret = NET_RX_DROP;
         __be16 type;
 
         if (!skb->tstamp.tv64)
                 net_timestamp(skb);
 
-        if (skb->vlan_tci && vlan_hwaccel_do_receive(skb))
+        if (vlan_tx_tag_present(skb) && vlan_hwaccel_do_receive(skb))
                 return NET_RX_SUCCESS;
 
         /* if we've gotten here through NAPI, check netpoll */
         if (netpoll_receive_skb(skb))
                 return NET_RX_DROP;
 
-        if (!skb->iif)
-                skb->iif = skb->dev->ifindex;
+        if (!skb->skb_iif)
+                skb->skb_iif = skb->dev->ifindex;
 
         null_or_orig = NULL;
         orig_dev = skb->dev;
-        if (orig_dev->master) {
-                if (skb_bond_should_drop(skb))
+        master = ACCESS_ONCE(orig_dev->master);
+        if (master) {
+                if (skb_bond_should_drop(skb, master))
                         null_or_orig = orig_dev; /* deliver only exact match */
                 else
-                        skb->dev = orig_dev->master;
+                        skb->dev = master;
         }
 
         __get_cpu_var(netdev_rx_stat).total++;
@@ -2351,12 +2556,24 @@ ncls:
         if (!skb)
                 goto out;
 
+        /*
+         * Make sure frames received on VLAN interfaces stacked on
+         * bonding interfaces still make their way to any base bonding
+         * device that may have registered for a specific ptype.  The
+         * handler may have to adjust skb->dev and orig_dev.
+         */
+        null_or_bond = NULL;
+        if ((skb->dev->priv_flags & IFF_802_1Q_VLAN) &&
+            (vlan_dev_real_dev(skb->dev)->priv_flags & IFF_BONDING)) {
+                null_or_bond = vlan_dev_real_dev(skb->dev);
+        }
+
         type = skb->protocol;
         list_for_each_entry_rcu(ptype,
                         &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
-                if (ptype->type == type &&
-                    (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
-                     ptype->dev == orig_dev)) {
+                if (ptype->type == type && (ptype->dev == null_or_orig ||
+                     ptype->dev == skb->dev || ptype->dev == orig_dev ||
+                     ptype->dev == null_or_bond)) {
                         if (pt_prev)
                                 ret = deliver_skb(skb, pt_prev, orig_dev);
                         pt_prev = ptype;
@@ -2425,7 +2642,7 @@ out:
         return netif_receive_skb(skb);
 }
 
-void napi_gro_flush(struct napi_struct *napi)
+static void napi_gro_flush(struct napi_struct *napi)
 {
         struct sk_buff *skb, *next;
 
@@ -2438,9 +2655,8 @@ void napi_gro_flush(struct napi_struct *napi)
         napi->gro_count = 0;
         napi->gro_list = NULL;
 }
-EXPORT_SYMBOL(napi_gro_flush);
 
-int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
+enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff **pp = NULL;
         struct packet_type *ptype;
@@ -2448,7 +2664,7 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
         struct list_head *head = &ptype_base[ntohs(type) & PTYPE_HASH_MASK];
         int same_flow;
         int mac_len;
-        int ret;
+        enum gro_result ret;
 
         if (!(skb->dev->features & NETIF_F_GRO))
                 goto normal;
@@ -2532,7 +2748,8 @@ normal:
 }
 EXPORT_SYMBOL(dev_gro_receive);
 
-static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
+static gro_result_t
+__napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff *p;
 
@@ -2540,33 +2757,35 @@ static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
                 return GRO_NORMAL;
 
         for (p = napi->gro_list; p; p = p->next) {
-                NAPI_GRO_CB(p)->same_flow = (p->dev == skb->dev)
-                        && !compare_ether_header(skb_mac_header(p),
-                                                 skb_gro_mac_header(skb));
+                NAPI_GRO_CB(p)->same_flow =
+                        (p->dev == skb->dev) &&
+                        !compare_ether_header(skb_mac_header(p),
+                                              skb_gro_mac_header(skb));
                 NAPI_GRO_CB(p)->flush = 0;
         }
 
         return dev_gro_receive(napi, skb);
 }
 
-int napi_skb_finish(int ret, struct sk_buff *skb)
+gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
 {
-        int err = NET_RX_SUCCESS;
-
         switch (ret) {
         case GRO_NORMAL:
-                return netif_receive_skb(skb);
+                if (netif_receive_skb(skb))
+                        ret = GRO_DROP;
+                break;
 
         case GRO_DROP:
-                err = NET_RX_DROP;
-                /* fall through */
-
         case GRO_MERGED_FREE:
                 kfree_skb(skb);
                 break;
+
+        case GRO_HELD:
+        case GRO_MERGED:
+                break;
         }
 
-        return err;
+        return ret;
 }
 EXPORT_SYMBOL(napi_skb_finish);
 
@@ -2586,7 +2805,7 @@ void skb_gro_reset_offset(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(skb_gro_reset_offset);
 
-int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
+gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         skb_gro_reset_offset(skb);
 
@@ -2605,49 +2824,41 @@ EXPORT_SYMBOL(napi_reuse_skb);
 
 struct sk_buff *napi_get_frags(struct napi_struct *napi)
 {
-        struct net_device *dev = napi->dev;
         struct sk_buff *skb = napi->skb;
 
         if (!skb) {
-                skb = netdev_alloc_skb(dev, GRO_MAX_HEAD + NET_IP_ALIGN);
-                if (!skb)
-                        goto out;
-
-                skb_reserve(skb, NET_IP_ALIGN);
-
-                napi->skb = skb;
+                skb = netdev_alloc_skb_ip_align(napi->dev, GRO_MAX_HEAD);
+                if (skb)
+                        napi->skb = skb;
         }
-
-out:
         return skb;
 }
 EXPORT_SYMBOL(napi_get_frags);
 
-int napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb, int ret)
+gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb,
+                               gro_result_t ret)
 {
-        int err = NET_RX_SUCCESS;
-
         switch (ret) {
         case GRO_NORMAL:
         case GRO_HELD:
-                skb->protocol = eth_type_trans(skb, napi->dev);
+                skb->protocol = eth_type_trans(skb, skb->dev);
 
-                if (ret == GRO_NORMAL)
-                        return netif_receive_skb(skb);
-
-                skb_gro_pull(skb, -ETH_HLEN);
+                if (ret == GRO_HELD)
+                        skb_gro_pull(skb, -ETH_HLEN);
+                else if (netif_receive_skb(skb))
+                        ret = GRO_DROP;
                 break;
 
         case GRO_DROP:
-                err = NET_RX_DROP;
-                /* fall through */
-
         case GRO_MERGED_FREE:
                 napi_reuse_skb(napi, skb);
                 break;
+
+        case GRO_MERGED:
+                break;
         }
 
-        return err;
+        return ret;
 }
 EXPORT_SYMBOL(napi_frags_finish);
 
@@ -2688,12 +2899,12 @@ out:
 }
 EXPORT_SYMBOL(napi_frags_skb);
 
-int napi_gro_frags(struct napi_struct *napi)
+gro_result_t napi_gro_frags(struct napi_struct *napi)
 {
         struct sk_buff *skb = napi_frags_skb(napi);
 
         if (!skb)
-                return NET_RX_DROP;
+                return GRO_DROP;
 
         return napi_frags_finish(napi, skb, __napi_gro_receive(napi, skb));
 }
@@ -2835,7 +3046,7 @@ static void net_rx_action(struct softirq_action *h)
                  * entries to the tail of this list, and only ->poll()
                  * calls can remove this head entry from the list.
                  */
-                n = list_entry(list->next, struct napi_struct, poll_list);
+                n = list_first_entry(list, struct napi_struct, poll_list);
 
                 have = netpoll_poll_lock(n);
 
@@ -2938,15 +3149,15 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
 
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifr.ifr_ifindex);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifr.ifr_ifindex);
         if (!dev) {
-                read_unlock(&dev_base_lock);
+                rcu_read_unlock();
                 return -ENODEV;
         }
 
         strcpy(ifr.ifr_name, dev->name);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         if (copy_to_user(arg, &ifr, sizeof(struct ifreq)))
                 return -EFAULT;
@@ -3016,18 +3227,18 @@ static int dev_ifconf(struct net *net, char __user *arg)
  *      in detail.
  */
 void *dev_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
         struct net *net = seq_file_net(seq);
         loff_t off;
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         if (!*pos)
                 return SEQ_START_TOKEN;
 
         off = 1;
-        for_each_netdev(net, dev)
+        for_each_netdev_rcu(net, dev)
                 if (off++ == *pos)
                         return dev;
 
@@ -3036,23 +3247,25 @@ void *dev_seq_start(struct seq_file *seq, loff_t *pos)
 
 void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct net *net = seq_file_net(seq);
+        struct net_device *dev = (v == SEQ_START_TOKEN) ?
+                                  first_net_device(seq_file_net(seq)) :
+                                  next_net_device((struct net_device *)v);
+
         ++*pos;
-        return v == SEQ_START_TOKEN ?
-                first_net_device(net) : next_net_device((struct net_device *)v);
+        return rcu_dereference(dev);
 }
 
 void dev_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev)
 {
         const struct net_device_stats *stats = dev_get_stats(dev);
 
-        seq_printf(seq, "%6s:%8lu %7lu %4lu %4lu %4lu %5lu %10lu %9lu "
+        seq_printf(seq, "%6s: %7lu %7lu %4lu %4lu %4lu %5lu %10lu %9lu "
                    "%8lu %7lu %4lu %4lu %4lu %5lu %7lu %10lu\n",
                    dev->name, stats->rx_bytes, stats->rx_packets,
                    stats->rx_errors,
@@ -3507,10 +3720,10 @@ void __dev_set_rx_mode(struct net_device *dev)
                 /* Unicast addresses changes may only happen under the rtnl,
                  * therefore calling __dev_set_promiscuity here is safe.
                  */
-                if (dev->uc.count > 0 && !dev->uc_promisc) {
+                if (!netdev_uc_empty(dev) && !dev->uc_promisc) {
                         __dev_set_promiscuity(dev, 1);
                         dev->uc_promisc = 1;
-                } else if (dev->uc.count == 0 && dev->uc_promisc) {
+                } else if (netdev_uc_empty(dev) && dev->uc_promisc) {
                         __dev_set_promiscuity(dev, -1);
                         dev->uc_promisc = 0;
                 }
@@ -4078,7 +4291,7 @@ static void dev_addr_discard(struct net_device *dev)
         netif_addr_lock_bh(dev);
 
         __dev_addr_discard(&dev->mc_list);
-        dev->mc_count = 0;
+        netdev_mc_count(dev) = 0;
 
         netif_addr_unlock_bh(dev);
 }
@@ -4114,18 +4327,10 @@ unsigned dev_get_flags(const struct net_device *dev)
 }
 EXPORT_SYMBOL(dev_get_flags);
 
-/**
- *      dev_change_flags - change device settings
- *      @dev: device
- *      @flags: device state flags
- *
- *      Change settings on device based state flags. The flags are
- *      in the userspace exported format.
- */
-int dev_change_flags(struct net_device *dev, unsigned flags)
+int __dev_change_flags(struct net_device *dev, unsigned int flags)
 {
-        int ret, changes;
         int old_flags = dev->flags;
+        int ret;
 
         ASSERT_RTNL();
 
@@ -4156,17 +4361,12 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
 
         ret = 0;
         if ((old_flags ^ flags) & IFF_UP) {     /* Bit is different  ? */
-                ret = ((old_flags & IFF_UP) ? dev_close : dev_open)(dev);
+                ret = ((old_flags & IFF_UP) ? __dev_close : __dev_open)(dev);
 
                 if (!ret)
                         dev_set_rx_mode(dev);
         }
 
-        if (dev->flags & IFF_UP &&
-            ((old_flags ^ dev->flags) & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI |
-                                          IFF_VOLATILE)))
-                call_netdevice_notifiers(NETDEV_CHANGE, dev);
-
         if ((flags ^ dev->gflags) & IFF_PROMISC) {
                 int inc = (flags & IFF_PROMISC) ? 1 : -1;
 
@@ -4185,11 +4385,47 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
                 dev_set_allmulti(dev, inc);
         }
 
-        /* Exclude state transition flags, already notified */
-        changes = (old_flags ^ dev->flags) & ~(IFF_UP | IFF_RUNNING);
+        return ret;
+}
+
+void __dev_notify_flags(struct net_device *dev, unsigned int old_flags)
+{
+        unsigned int changes = dev->flags ^ old_flags;
+
+        if (changes & IFF_UP) {
+                if (dev->flags & IFF_UP)
+                        call_netdevice_notifiers(NETDEV_UP, dev);
+                else
+                        call_netdevice_notifiers(NETDEV_DOWN, dev);
+        }
+
+        if (dev->flags & IFF_UP &&
+            (changes & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI | IFF_VOLATILE)))
+                call_netdevice_notifiers(NETDEV_CHANGE, dev);
+}
+
+/**
+ *      dev_change_flags - change device settings
+ *      @dev: device
+ *      @flags: device state flags
+ *
+ *      Change settings on device based state flags. The flags are
+ *      in the userspace exported format.
+ */
+int dev_change_flags(struct net_device *dev, unsigned flags)
+{
+        int ret, changes;
+        int old_flags = dev->flags;
+
+        ret = __dev_change_flags(dev, flags);
+        if (ret < 0)
+                return ret;
+
+        changes = old_flags ^ dev->flags;
         if (changes)
                 rtmsg_ifinfo(RTM_NEWLINK, dev, changes);
 
+        __dev_notify_flags(dev, old_flags);
         return ret;
 }
 EXPORT_SYMBOL(dev_change_flags);
@@ -4254,12 +4490,12 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
 EXPORT_SYMBOL(dev_set_mac_address);
 
 /*
- *      Perform the SIOCxIFxxx calls, inside read_lock(dev_base_lock)
+ *      Perform the SIOCxIFxxx calls, inside rcu_read_lock()
  */
 static int dev_ifsioc_locked(struct net *net, struct ifreq *ifr, unsigned int cmd)
 {
         int err;
-        struct net_device *dev = __dev_get_by_name(net, ifr->ifr_name);
+        struct net_device *dev = dev_get_by_name_rcu(net, ifr->ifr_name);
 
         if (!dev)
                 return -ENODEV;
@@ -4491,9 +4727,9 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         case SIOCGIFINDEX:
         case SIOCGIFTXQLEN:
                 dev_load(net, ifr.ifr_name);
-                read_lock(&dev_base_lock);
+                rcu_read_lock();
                 ret = dev_ifsioc_locked(net, &ifr, cmd);
-                read_unlock(&dev_base_lock);
+                rcu_read_unlock();
                 if (!ret) {
                         if (colon)
                                 *colon = ':';
@@ -4636,59 +4872,86 @@ static void net_set_todo(struct net_device *dev)
         list_add_tail(&dev->todo_list, &net_todo_list);
 }
 
-static void rollback_registered(struct net_device *dev)
+static void rollback_registered_many(struct list_head *head)
 {
+        struct net_device *dev, *tmp;
+
         BUG_ON(dev_boot_phase);
         ASSERT_RTNL();
 
-        /* Some devices call without registering for initialization unwind. */
-        if (dev->reg_state == NETREG_UNINITIALIZED) {
-                printk(KERN_DEBUG "unregister_netdevice: device %s/%p never "
-                                  "was registered\n", dev->name, dev);
+        list_for_each_entry_safe(dev, tmp, head, unreg_list) {
+                /* Some devices call without registering
+                 * for initialization unwind. Remove those
+                 * devices and proceed with the remaining.
+                 */
+                if (dev->reg_state == NETREG_UNINITIALIZED) {
+                        pr_debug("unregister_netdevice: device %s/%p never "
+                                 "was registered\n", dev->name, dev);
 
-                WARN_ON(1);
-                return;
-        }
+                        WARN_ON(1);
+                        list_del(&dev->unreg_list);
+                        continue;
+                }
 
-        BUG_ON(dev->reg_state != NETREG_REGISTERED);
+                BUG_ON(dev->reg_state != NETREG_REGISTERED);
 
-        /* If device is running, close it first. */
-        dev_close(dev);
+                /* If device is running, close it first. */
+                dev_close(dev);
 
-        /* And unlink it from device chain. */
-        unlist_netdevice(dev);
+                /* And unlink it from device chain. */
+                unlist_netdevice(dev);
 
-        dev->reg_state = NETREG_UNREGISTERING;
+                dev->reg_state = NETREG_UNREGISTERING;
+        }
 
         synchronize_net();
 
-        /* Shutdown queueing discipline. */
-        dev_shutdown(dev);
+        list_for_each_entry(dev, head, unreg_list) {
+                /* Shutdown queueing discipline. */
+                dev_shutdown(dev);
 
 
-        /* Notify protocols, that we are about to destroy
-           this device. They should clean all the things.
-        */
-        call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
+                /* Notify protocols, that we are about to destroy
+                   this device. They should clean all the things.
+                */
+                call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
 
-        /*
-         *      Flush the unicast and multicast chains
-         */
-        dev_unicast_flush(dev);
-        dev_addr_discard(dev);
+                if (!dev->rtnl_link_ops ||
+                    dev->rtnl_link_state == RTNL_LINK_INITIALIZED)
+                        rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
 
-        if (dev->netdev_ops->ndo_uninit)
-                dev->netdev_ops->ndo_uninit(dev);
+                /*
+                 *      Flush the unicast and multicast chains
+                 */
+                dev_unicast_flush(dev);
+                dev_addr_discard(dev);
 
-        /* Notifier chain MUST detach us from master device. */
-        WARN_ON(dev->master);
+                if (dev->netdev_ops->ndo_uninit)
+                        dev->netdev_ops->ndo_uninit(dev);
 
-        /* Remove entries from kobject tree */
-        netdev_unregister_kobject(dev);
+                /* Notifier chain MUST detach us from master device. */
+                WARN_ON(dev->master);
+
+                /* Remove entries from kobject tree */
+                netdev_unregister_kobject(dev);
+        }
+
+        /* Process any work delayed until the end of the batch */
+        dev = list_first_entry(head, struct net_device, unreg_list);
+        call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
 
         synchronize_net();
 
-        dev_put(dev);
+        list_for_each_entry(dev, head, unreg_list)
+                dev_put(dev);
+}
+
+static void rollback_registered(struct net_device *dev)
+{
+        LIST_HEAD(single);
+
+        list_add(&dev->unreg_list, &single);
+        rollback_registered_many(&single);
 }
 
 static void __netdev_init_queue_locks_one(struct net_device *dev,
@@ -4747,6 +5010,33 @@ unsigned long netdev_fix_features(unsigned long features, const char *name)
 EXPORT_SYMBOL(netdev_fix_features);
 
 /**
+ *      netif_stacked_transfer_operstate -      transfer operstate
+ *      @rootdev: the root or lower level device to transfer state from
+ *      @dev: the device to transfer operstate to
+ *
+ *      Transfer operational state from root to device. This is normally
+ *      called when a stacking relationship exists between the root
+ *      device and the device(a leaf device).
+ */
+void netif_stacked_transfer_operstate(const struct net_device *rootdev,
+                                        struct net_device *dev)
+{
+        if (rootdev->operstate == IF_OPER_DORMANT)
+                netif_dormant_on(dev);
+        else
+                netif_dormant_off(dev);
+
+        if (netif_carrier_ok(rootdev)) {
+                if (!netif_carrier_ok(dev))
+                        netif_carrier_on(dev);
+        } else {
+                if (netif_carrier_ok(dev))
+                        netif_carrier_off(dev);
+        }
+}
+EXPORT_SYMBOL(netif_stacked_transfer_operstate);
+
+/**
  *      register_netdevice      - register a network device
  *      @dev: device to register
  *
@@ -4765,8 +5055,6 @@ EXPORT_SYMBOL(netdev_fix_features);
 
 int register_netdevice(struct net_device *dev)
 {
-        struct hlist_head *head;
-        struct hlist_node *p;
         int ret;
         struct net *net = dev_net(dev);
 
@@ -4795,26 +5083,14 @@ int register_netdevice(struct net_device *dev)
                 }
         }
 
-        if (!dev_valid_name(dev->name)) {
-                ret = -EINVAL;
+        ret = dev_get_valid_name(net, dev->name, dev->name, 0);
+        if (ret)
                 goto err_uninit;
-        }
 
         dev->ifindex = dev_new_index(net);
         if (dev->iflink == -1)
                 dev->iflink = dev->ifindex;
 
-        /* Check for existence of name */
-        head = dev_name_hash(net, dev->name);
-        hlist_for_each(p, head) {
-                struct net_device *d
-                        = hlist_entry(p, struct net_device, name_hlist);
-                if (!strncmp(d->name, dev->name, IFNAMSIZ)) {
-                        ret = -EEXIST;
-                        goto err_uninit;
-                }
-        }
-
         /* Fix illegal checksum combinations */
         if ((dev->features & NETIF_F_HW_CSUM) &&
             (dev->features & (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))) {
@@ -4837,6 +5113,12 @@ int register_netdevice(struct net_device *dev)
                 dev->features |= NETIF_F_GSO;
 
         netdev_initialize_kobject(dev);
+
+        ret = call_netdevice_notifiers(NETDEV_POST_INIT, dev);
+        ret = notifier_to_errno(ret);
+        if (ret)
+                goto err_uninit;
+
         ret = netdev_register_kobject(dev);
         if (ret)
                 goto err_uninit;
@@ -4860,6 +5142,13 @@ int register_netdevice(struct net_device *dev)
                 rollback_registered(dev);
                 dev->reg_state = NETREG_UNREGISTERED;
         }
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        if (!dev->rtnl_link_ops ||
+            dev->rtnl_link_state == RTNL_LINK_INITIALIZED)
+                rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
 
 out:
         return ret;
@@ -4961,6 +5250,8 @@ static void netdev_wait_allrefs(struct net_device *dev)
 {
         unsigned long rebroadcast_time, warning_time;
 
+        linkwatch_forget_dev(dev);
+
         rebroadcast_time = warning_time = jiffies;
         while (atomic_read(&dev->refcnt) != 0) {
                 if (time_after(jiffies, rebroadcast_time + 1 * HZ)) {
@@ -4968,6 +5259,8 @@ static void netdev_wait_allrefs(struct net_device *dev)
 
                         /* Rebroadcast unregister notification */
                         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
+                        /* don't resend NETDEV_UNREGISTER_BATCH, _BATCH users
+                         * should have already handle it the first time */
 
                         if (test_bit(__LINK_STATE_LINKWATCH_PENDING,
                                      &dev->state)) {
@@ -5032,7 +5325,7 @@ void netdev_run_todo(void)
 
         while (!list_empty(&list)) {
                 struct net_device *dev
-                        = list_entry(list.next, struct net_device, todo_list);
+                        = list_first_entry(&list, struct net_device, todo_list);
                 list_del(&dev->todo_list);
 
                 if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
@@ -5063,6 +5356,32 @@ void netdev_run_todo(void)
 }
 
 /**
+ *      dev_txq_stats_fold - fold tx_queues stats
+ *      @dev: device to get statistics from
+ *      @stats: struct net_device_stats to hold results
+ */
+void dev_txq_stats_fold(const struct net_device *dev,
+                        struct net_device_stats *stats)
+{
+        unsigned long tx_bytes = 0, tx_packets = 0, tx_dropped = 0;
+        unsigned int i;
+        struct netdev_queue *txq;
+
+        for (i = 0; i < dev->num_tx_queues; i++) {
+                txq = netdev_get_tx_queue(dev, i);
+                tx_bytes   += txq->tx_bytes;
+                tx_packets += txq->tx_packets;
+                tx_dropped += txq->tx_dropped;
+        }
+        if (tx_bytes || tx_packets || tx_dropped) {
+                stats->tx_bytes   = tx_bytes;
+                stats->tx_packets = tx_packets;
+                stats->tx_dropped = tx_dropped;
+        }
+}
+EXPORT_SYMBOL(dev_txq_stats_fold);
+
+/**
  *      dev_get_stats   - get network device statistics
  *      @dev: device to get statistics from
  *
@@ -5076,25 +5395,9 @@ const struct net_device_stats *dev_get_stats(struct net_device *dev)
 
         if (ops->ndo_get_stats)
                 return ops->ndo_get_stats(dev);
-        else {
-                unsigned long tx_bytes = 0, tx_packets = 0, tx_dropped = 0;
-                struct net_device_stats *stats = &dev->stats;
-                unsigned int i;
-                struct netdev_queue *txq;
-
-                for (i = 0; i < dev->num_tx_queues; i++) {
-                        txq = netdev_get_tx_queue(dev, i);
-                        tx_bytes   += txq->tx_bytes;
-                        tx_packets += txq->tx_packets;
-                        tx_dropped += txq->tx_dropped;
-                }
-                if (tx_bytes || tx_packets || tx_dropped) {
-                        stats->tx_bytes   = tx_bytes;
-                        stats->tx_packets = tx_packets;
-                        stats->tx_dropped = tx_dropped;
-                }
-                return stats;
-        }
+
+        dev_txq_stats_fold(dev, &dev->stats);
+        return &dev->stats;
 }
 EXPORT_SYMBOL(dev_get_stats);
 
@@ -5173,7 +5476,11 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
 
         netdev_init_queues(dev);
 
+        INIT_LIST_HEAD(&dev->ethtool_ntuple_list.list);
+        dev->ethtool_ntuple_list.count = 0;
         INIT_LIST_HEAD(&dev->napi_list);
+        INIT_LIST_HEAD(&dev->unreg_list);
+        INIT_LIST_HEAD(&dev->link_watch_list);
         dev->priv_flags = IFF_XMIT_DST_RELEASE;
         setup(dev);
         strcpy(dev->name, name);
@@ -5207,6 +5514,9 @@ void free_netdev(struct net_device *dev)
         /* Flush device addresses */
         dev_addr_flush(dev);
 
+        /* Clear ethtool n-tuple list */
+        ethtool_ntuple_flush(dev);
+
         list_for_each_entry_safe(p, n, &dev->napi_list, dev_list)
                 netif_napi_del(p);
 
@@ -5238,25 +5548,47 @@ void synchronize_net(void)
 EXPORT_SYMBOL(synchronize_net);
 
 /**
- *      unregister_netdevice - remove device from the kernel
+ *      unregister_netdevice_queue - remove device from the kernel
  *      @dev: device
+ *      @head: list
  *
  *      This function shuts down a device interface and removes it
  *      from the kernel tables.
+ *      If head not NULL, device is queued to be unregistered later.
  *
  *      Callers must hold the rtnl semaphore.  You may want
  *      unregister_netdev() instead of this.
  */
 
-void unregister_netdevice(struct net_device *dev)
+void unregister_netdevice_queue(struct net_device *dev, struct list_head *head)
 {
         ASSERT_RTNL();
 
-        rollback_registered(dev);
-        /* Finish processing unregister after unlock */
-        net_set_todo(dev);
+        if (head) {
+                list_move_tail(&dev->unreg_list, head);
+        } else {
+                rollback_registered(dev);
+                /* Finish processing unregister after unlock */
+                net_set_todo(dev);
+        }
 }
-EXPORT_SYMBOL(unregister_netdevice);
+EXPORT_SYMBOL(unregister_netdevice_queue);
+
+/**
+ *      unregister_netdevice_many - unregister many devices
+ *      @head: list of devices
+ */
+void unregister_netdevice_many(struct list_head *head)
+{
+        struct net_device *dev;
+
+        if (!list_empty(head)) {
+                rollback_registered_many(head);
+                list_for_each_entry(dev, head, unreg_list)
+                        net_set_todo(dev);
+        }
+}
+EXPORT_SYMBOL(unregister_netdevice_many);
 
 /**
  *      unregister_netdev - remove device from the kernel
@@ -5293,8 +5625,6 @@ EXPORT_SYMBOL(unregister_netdev);
 
 int dev_change_net_namespace(struct net_device *dev, struct net *net, const char *pat)
 {
-        char buf[IFNAMSIZ];
-        const char *destname;
         int err;
 
         ASSERT_RTNL();
@@ -5327,20 +5657,11 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
          * we can use it in the destination network namespace.
          */
         err = -EEXIST;
-        destname = dev->name;
-        if (__dev_get_by_name(net, destname)) {
+        if (__dev_get_by_name(net, dev->name)) {
                 /* We get here if we can't use the current device name */
                 if (!pat)
                         goto out;
-                if (!dev_valid_name(pat))
-                        goto out;
-                if (strchr(pat, '%')) {
-                        if (__dev_alloc_name(net, pat, buf) < 0)
-                                goto out;
-                        destname = buf;
-                } else
-                        destname = pat;
-                if (__dev_get_by_name(net, destname))
+                if (dev_get_valid_name(net, pat, dev->name, 1))
                         goto out;
         }
 
@@ -5364,6 +5685,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
            this device. They should clean all the things.
         */
         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
+        call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
 
         /*
          *      Flush the unicast and multicast chains
@@ -5376,10 +5698,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         /* Actually switch the network namespace */
         dev_net_set(dev, net);
 
-        /* Assign the new device name */
-        if (destname != dev->name)
-                strcpy(dev->name, destname);
-
         /* If there is an ifindex conflict assign a new one */
         if (__dev_get_by_index(net, dev->ifindex)) {
                 int iflink = (dev->iflink == dev->ifindex);
@@ -5398,6 +5716,12 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         /* Notify protocols, that a new device appeared. */
         call_netdevice_notifiers(NETDEV_REGISTER, dev);
 
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
         synchronize_net();
         err = 0;
 out:
@@ -5484,7 +5808,7 @@ unsigned long netdev_increment_features(unsigned long all, unsigned long one,
         one |= NETIF_F_ALL_CSUM;
 
         one |= all & NETIF_F_ONE_FOR_ALL;
-        all &= one | NETIF_F_LLTX | NETIF_F_GSO;
+        all &= one | NETIF_F_LLTX | NETIF_F_GSO | NETIF_F_UFO;
         all |= one & mask & NETIF_F_ONE_FOR_ALL;
 
         return all;
@@ -5566,14 +5890,13 @@ static struct pernet_operations __net_initdata netdev_net_ops = {
 
 static void __net_exit default_device_exit(struct net *net)
 {
-        struct net_device *dev;
+        struct net_device *dev, *aux;
         /*
-         * Push all migratable of the network devices back to the
+         * Push all migratable network devices back to the
          * initial network namespace
          */
         rtnl_lock();
-restart:
-        for_each_netdev(net, dev) {
+        for_each_netdev_safe(net, dev, aux) {
                 int err;
                 char fb_name[IFNAMSIZ];
 
@@ -5581,11 +5904,9 @@ restart:
                 if (dev->features & NETIF_F_NETNS_LOCAL)
                         continue;
 
-                /* Delete virtual devices */
-                if (dev->rtnl_link_ops && dev->rtnl_link_ops->dellink) {
-                        dev->rtnl_link_ops->dellink(dev);
-                        goto restart;
-                }
+                /* Leave virtual devices for the generic cleanup */
+                if (dev->rtnl_link_ops)
+                        continue;
 
                 /* Push remaing network devices to init_net */
                 snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
@@ -5595,13 +5916,37 @@ restart:
                                 __func__, dev->name, err);
                         BUG();
                 }
-                goto restart;
         }
         rtnl_unlock();
 }
 
+static void __net_exit default_device_exit_batch(struct list_head *net_list)
+{
+        /* At exit all network devices most be removed from a network
+         * namespace.  Do this in the reverse order of registeration.
+         * Do this across as many network namespaces as possible to
+         * improve batching efficiency.
+         */
+        struct net_device *dev;
+        struct net *net;
+        LIST_HEAD(dev_kill_list);
+
+        rtnl_lock();
+        list_for_each_entry(net, net_list, exit_list) {
+                for_each_netdev_reverse(net, dev) {
+                        if (dev->rtnl_link_ops)
+                                dev->rtnl_link_ops->dellink(dev, &dev_kill_list);
+                        else
+                                unregister_netdevice_queue(dev, &dev_kill_list);
+                }
+        }
+        unregister_netdevice_many(&dev_kill_list);
+        rtnl_unlock();
+}
+
 static struct pernet_operations __net_initdata default_device_ops = {
         .exit = default_device_exit,
+        .exit_batch = default_device_exit_batch,
 };
 
 /*
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index 9e2fa39f22a3..3dc295beb483 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -96,7 +96,10 @@ int dev_mc_add(struct net_device *dev, void *addr, int alen, int glbl)
         int err;
 
         netif_addr_lock_bh(dev);
-        err = __dev_addr_add(&dev->mc_list, &dev->mc_count, addr, alen, glbl);
+        if (alen != dev->addr_len)
+                err = -EINVAL;
+        else
+                err = __dev_addr_add(&dev->mc_list, &dev->mc_count, addr, alen, glbl);
         if (!err)
                 __dev_set_rx_mode(dev);
         netif_addr_unlock_bh(dev);
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 0a113f26bc9f..cf208d8042b1 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -21,6 +21,7 @@
 #include <linux/percpu.h>
 #include <linux/timer.h>
 #include <linux/bitops.h>
+#include <linux/slab.h>
 #include <net/genetlink.h>
 #include <net/netevent.h>
 
@@ -41,7 +42,7 @@ static void send_dm_alert(struct work_struct *unused);
  * netlink alerts
  */
 static int trace_state = TRACE_OFF;
-static spinlock_t trace_state_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(trace_state_lock);
 
 struct per_cpu_dm_data {
         struct work_struct dm_alert_work;
@@ -296,7 +297,6 @@ static int dropmon_net_event(struct notifier_block *ev_block,
 
                 new_stat->dev = dev;
                 new_stat->last_rx = jiffies;
-                INIT_RCU_HEAD(&new_stat->rcu);
                 spin_lock(&trace_state_lock);
                 list_add_rcu(&new_stat->list, &hw_stats_list);
                 spin_unlock(&trace_state_lock);
diff --git a/net/core/dst.c b/net/core/dst.c
index 57bc4d5b8d08..f307bc18f6a0 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -12,11 +12,13 @@
 #include <linux/workqueue.h>
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <linux/string.h>
 #include <linux/types.h>
 #include <net/net_namespace.h>
+#include <linux/sched.h>
 
 #include <net/dst.h>
 
@@ -79,6 +81,7 @@ loop:
         while ((dst = next) != NULL) {
                 next = dst->next;
                 prefetch(&next->next);
+                cond_resched();
                 if (likely(atomic_read(&dst->__refcnt))) {
                         last->next = dst;
                         last = dst;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 4c12ddb5f5ee..9d55c57f318a 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -17,6 +17,8 @@
 #include <linux/errno.h>
 #include <linux/ethtool.h>
 #include <linux/netdevice.h>
+#include <linux/bitops.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 /*
@@ -120,7 +122,7 @@ int ethtool_op_set_ufo(struct net_device *dev, u32 data)
  * NETIF_F_xxx values in include/linux/netdevice.h
  */
 static const u32 flags_dup_features =
-        ETH_FLAG_LRO;
+        (ETH_FLAG_LRO | ETH_FLAG_NTUPLE);
 
 u32 ethtool_op_get_flags(struct net_device *dev)
 {
@@ -134,19 +136,44 @@ u32 ethtool_op_get_flags(struct net_device *dev)
 
 int ethtool_op_set_flags(struct net_device *dev, u32 data)
 {
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+        unsigned long features = dev->features;
+
         if (data & ETH_FLAG_LRO)
-                dev->features |= NETIF_F_LRO;
+                features |= NETIF_F_LRO;
         else
-                dev->features &= ~NETIF_F_LRO;
+                features &= ~NETIF_F_LRO;
+
+        if (data & ETH_FLAG_NTUPLE) {
+                if (!ops->set_rx_ntuple)
+                        return -EOPNOTSUPP;
+                features |= NETIF_F_NTUPLE;
+        } else {
+                /* safe to clear regardless */
+                features &= ~NETIF_F_NTUPLE;
+        }
 
+        dev->features = features;
         return 0;
 }
 
+void ethtool_ntuple_flush(struct net_device *dev)
+{
+        struct ethtool_rx_ntuple_flow_spec_container *fsc, *f;
+
+        list_for_each_entry_safe(fsc, f, &dev->ethtool_ntuple_list.list, list) {
+                list_del(&fsc->list);
+                kfree(fsc);
+        }
+        dev->ethtool_ntuple_list.count = 0;
+}
+EXPORT_SYMBOL(ethtool_ntuple_flush);
+
 /* Handlers for each ethtool command */
 
 static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
 {
-        struct ethtool_cmd cmd = { ETHTOOL_GSET };
+        struct ethtool_cmd cmd = { .cmd = ETHTOOL_GSET };
         int err;
 
         if (!dev->ethtool_ops->get_settings)
@@ -174,7 +201,7 @@ static int ethtool_set_settings(struct net_device *dev, void __user *useraddr)
         return dev->ethtool_ops->set_settings(dev, &cmd);
 }
 
-static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
+static noinline_for_stack int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_drvinfo info;
         const struct ethtool_ops *ops = dev->ethtool_ops;
@@ -186,6 +213,10 @@ static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
         info.cmd = ETHTOOL_GDRVINFO;
         ops->get_drvinfo(dev, &info);
 
+        /*
+         * this method of obtaining string set info is deprecated;
+         * Use ETHTOOL_GSSET_INFO instead.
+         */
         if (ops->get_sset_count) {
                 int rc;
 
@@ -198,13 +229,6 @@ static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
                 rc = ops->get_sset_count(dev, ETH_SS_PRIV_FLAGS);
                 if (rc >= 0)
                         info.n_priv_flags = rc;
-        } else {
-                /* code path for obsolete hooks */
-
-                if (ops->self_test_count)
-                        info.testinfo_len = ops->self_test_count(dev);
-                if (ops->get_stats_count)
-                        info.n_stats = ops->get_stats_count(dev);
         }
         if (ops->get_regs_len)
                 info.regdump_len = ops->get_regs_len(dev);
@@ -216,7 +240,67 @@ static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
         return 0;
 }
 
-static int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
+static noinline_for_stack int ethtool_get_sset_info(struct net_device *dev,
+                                          void __user *useraddr)
+{
+        struct ethtool_sset_info info;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+        u64 sset_mask;
+        int i, idx = 0, n_bits = 0, ret, rc;
+        u32 *info_buf = NULL;
+
+        if (!ops->get_sset_count)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&info, useraddr, sizeof(info)))
+                return -EFAULT;
+
+        /* store copy of mask, because we zero struct later on */
+        sset_mask = info.sset_mask;
+        if (!sset_mask)
+                return 0;
+
+        /* calculate size of return buffer */
+        n_bits = hweight64(sset_mask);
+
+        memset(&info, 0, sizeof(info));
+        info.cmd = ETHTOOL_GSSET_INFO;
+
+        info_buf = kzalloc(n_bits * sizeof(u32), GFP_USER);
+        if (!info_buf)
+                return -ENOMEM;
+
+        /*
+         * fill return buffer based on input bitmask and successful
+         * get_sset_count return
+         */
+        for (i = 0; i < 64; i++) {
+                if (!(sset_mask & (1ULL << i)))
+                        continue;
+
+                rc = ops->get_sset_count(dev, i);
+                if (rc >= 0) {
+                        info.sset_mask |= (1ULL << i);
+                        info_buf[idx++] = rc;
+                }
+        }
+
+        ret = -EFAULT;
+        if (copy_to_user(useraddr, &info, sizeof(info)))
+                goto out;
+
+        useraddr += offsetof(struct ethtool_sset_info, data);
+        if (copy_to_user(useraddr, info_buf, idx * sizeof(u32)))
+                goto out;
+
+        ret = 0;
+
+out:
+        kfree(info_buf);
+        return ret;
+}
+
+static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_rxnfc cmd;
 
@@ -229,7 +313,7 @@ static int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
         return dev->ethtool_ops->set_rxnfc(dev, &cmd);
 }
 
-static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
+static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_rxnfc info;
         const struct ethtool_ops *ops = dev->ethtool_ops;
@@ -273,6 +357,312 @@ err_out:
         return ret;
 }
 
+static void __rx_ntuple_filter_add(struct ethtool_rx_ntuple_list *list,
+                              struct ethtool_rx_ntuple_flow_spec *spec,
+                              struct ethtool_rx_ntuple_flow_spec_container *fsc)
+{
+
+        /* don't add filters forever */
+        if (list->count >= ETHTOOL_MAX_NTUPLE_LIST_ENTRY) {
+                /* free the container */
+                kfree(fsc);
+                return;
+        }
+
+        /* Copy the whole filter over */
+        fsc->fs.flow_type = spec->flow_type;
+        memcpy(&fsc->fs.h_u, &spec->h_u, sizeof(spec->h_u));
+        memcpy(&fsc->fs.m_u, &spec->m_u, sizeof(spec->m_u));
+
+        fsc->fs.vlan_tag = spec->vlan_tag;
+        fsc->fs.vlan_tag_mask = spec->vlan_tag_mask;
+        fsc->fs.data = spec->data;
+        fsc->fs.data_mask = spec->data_mask;
+        fsc->fs.action = spec->action;
+
+        /* add to the list */
+        list_add_tail_rcu(&fsc->list, &list->list);
+        list->count++;
+}
+
+static noinline_for_stack int ethtool_set_rx_ntuple(struct net_device *dev, void __user *useraddr)
+{
+        struct ethtool_rx_ntuple cmd;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+        struct ethtool_rx_ntuple_flow_spec_container *fsc = NULL;
+        int ret;
+
+        if (!(dev->features & NETIF_F_NTUPLE))
+                return -EINVAL;
+
+        if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
+                return -EFAULT;
+
+        /*
+         * Cache filter in dev struct for GET operation only if
+         * the underlying driver doesn't have its own GET operation, and
+         * only if the filter was added successfully.  First make sure we
+         * can allocate the filter, then continue if successful.
+         */
+        if (!ops->get_rx_ntuple) {
+                fsc = kmalloc(sizeof(*fsc), GFP_ATOMIC);
+                if (!fsc)
+                        return -ENOMEM;
+        }
+
+        ret = ops->set_rx_ntuple(dev, &cmd);
+        if (ret) {
+                kfree(fsc);
+                return ret;
+        }
+
+        if (!ops->get_rx_ntuple)
+                __rx_ntuple_filter_add(&dev->ethtool_ntuple_list, &cmd.fs, fsc);
+
+        return ret;
+}
+
+static int ethtool_get_rx_ntuple(struct net_device *dev, void __user *useraddr)
+{
+        struct ethtool_gstrings gstrings;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+        struct ethtool_rx_ntuple_flow_spec_container *fsc;
+        u8 *data;
+        char *p;
+        int ret, i, num_strings = 0;
+
+        if (!ops->get_sset_count)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&gstrings, useraddr, sizeof(gstrings)))
+                return -EFAULT;
+
+        ret = ops->get_sset_count(dev, gstrings.string_set);
+        if (ret < 0)
+                return ret;
+
+        gstrings.len = ret;
+
+        data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
+        if (!data)
+                return -ENOMEM;
+
+        if (ops->get_rx_ntuple) {
+                /* driver-specific filter grab */
+                ret = ops->get_rx_ntuple(dev, gstrings.string_set, data);
+                goto copy;
+        }
+
+        /* default ethtool filter grab */
+        i = 0;
+        p = (char *)data;
+        list_for_each_entry(fsc, &dev->ethtool_ntuple_list.list, list) {
+                sprintf(p, "Filter %d:\n", i);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+
+                switch (fsc->fs.flow_type) {
+                case TCP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: TCP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case UDP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: UDP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case SCTP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: SCTP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case AH_ESP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: AH ESP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case ESP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: ESP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IP_USER_FLOW:
+                        sprintf(p, "\tFlow Type: Raw IP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IPV4_FLOW:
+                        sprintf(p, "\tFlow Type: IPv4\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                default:
+                        sprintf(p, "\tFlow Type: Unknown\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        goto unknown_filter;
+                };
+
+                /* now the rest of the filters */
+                switch (fsc->fs.flow_type) {
+                case TCP_V4_FLOW:
+                case UDP_V4_FLOW:
+                case SCTP_V4_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.tcp_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.tcp_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc Port: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.psrc,
+                                fsc->fs.m_u.tcp_ip4_spec.psrc);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest Port: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.pdst,
+                                fsc->fs.m_u.tcp_ip4_spec.pdst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tTOS: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.tos,
+                                fsc->fs.m_u.tcp_ip4_spec.tos);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case AH_ESP_V4_FLOW:
+                case ESP_V4_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.ah_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.ah_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSPI: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.spi,
+                                fsc->fs.m_u.ah_ip4_spec.spi);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tTOS: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.tos,
+                                fsc->fs.m_u.ah_ip4_spec.tos);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IP_USER_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.raw_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.raw_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.raw_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.raw_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IPV4_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.usr_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.usr_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tL4 bytes: 0x%x, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.l4_4_bytes,
+                                fsc->fs.m_u.usr_ip4_spec.l4_4_bytes);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tTOS: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.tos,
+                                fsc->fs.m_u.usr_ip4_spec.tos);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tIP Version: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.ip_ver,
+                                fsc->fs.m_u.usr_ip4_spec.ip_ver);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tProtocol: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.proto,
+                                fsc->fs.m_u.usr_ip4_spec.proto);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                };
+                sprintf(p, "\tVLAN: %d, mask: 0x%x\n",
+                        fsc->fs.vlan_tag, fsc->fs.vlan_tag_mask);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+                sprintf(p, "\tUser-defined: 0x%Lx\n", fsc->fs.data);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+                sprintf(p, "\tUser-defined mask: 0x%Lx\n", fsc->fs.data_mask);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+                if (fsc->fs.action == ETHTOOL_RXNTUPLE_ACTION_DROP)
+                        sprintf(p, "\tAction: Drop\n");
+                else
+                        sprintf(p, "\tAction: Direct to queue %d\n",
+                                fsc->fs.action);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+unknown_filter:
+                i++;
+        }
+copy:
+        /* indicate to userspace how many strings we actually have */
+        gstrings.len = num_strings;
+        ret = -EFAULT;
+        if (copy_to_user(useraddr, &gstrings, sizeof(gstrings)))
+                goto out;
+        useraddr += sizeof(gstrings);
+        if (copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))
+                goto out;
+        ret = 0;
+
+out:
+        kfree(data);
+        return ret;
+}
+
 static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
 {
         struct ethtool_regs regs;
@@ -309,9 +699,29 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         return ret;
 }
 
+static int ethtool_reset(struct net_device *dev, char __user *useraddr)
+{
+        struct ethtool_value reset;
+        int ret;
+
+        if (!dev->ethtool_ops->reset)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&reset, useraddr, sizeof(reset)))
+                return -EFAULT;
+
+        ret = dev->ethtool_ops->reset(dev, &reset.data);
+        if (ret)
+                return ret;
+
+        if (copy_to_user(useraddr, &reset, sizeof(reset)))
+                return -EFAULT;
+        return 0;
+}
+
 static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
 {
-        struct ethtool_wolinfo wol = { ETHTOOL_GWOL };
+        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
 
         if (!dev->ethtool_ops->get_wol)
                 return -EOPNOTSUPP;
@@ -443,9 +853,9 @@ static int ethtool_set_eeprom(struct net_device *dev, void __user *useraddr)
         return ret;
 }
 
-static int ethtool_get_coalesce(struct net_device *dev, void __user *useraddr)
+static noinline_for_stack int ethtool_get_coalesce(struct net_device *dev, void __user *useraddr)
 {
-        struct ethtool_coalesce coalesce = { ETHTOOL_GCOALESCE };
+        struct ethtool_coalesce coalesce = { .cmd = ETHTOOL_GCOALESCE };
 
         if (!dev->ethtool_ops->get_coalesce)
                 return -EOPNOTSUPP;
@@ -457,7 +867,7 @@ static int ethtool_get_coalesce(struct net_device *dev, void __user *useraddr)
         return 0;
 }
 
-static int ethtool_set_coalesce(struct net_device *dev, void __user *useraddr)
+static noinline_for_stack int ethtool_set_coalesce(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_coalesce coalesce;
 
@@ -472,7 +882,7 @@ static int ethtool_set_coalesce(struct net_device *dev, void __user *useraddr)
 
 static int ethtool_get_ringparam(struct net_device *dev, void __user *useraddr)
 {
-        struct ethtool_ringparam ringparam = { ETHTOOL_GRINGPARAM };
+        struct ethtool_ringparam ringparam = { .cmd = ETHTOOL_GRINGPARAM };
 
         if (!dev->ethtool_ops->get_ringparam)
                 return -EOPNOTSUPP;
@@ -684,16 +1094,10 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
         u64 *data;
         int ret, test_len;
 
-        if (!ops->self_test)
-                return -EOPNOTSUPP;
-        if (!ops->get_sset_count && !ops->self_test_count)
+        if (!ops->self_test || !ops->get_sset_count)
                 return -EOPNOTSUPP;
 
-        if (ops->get_sset_count)
-                test_len = ops->get_sset_count(dev, ETH_SS_TEST);
-        else
-                /* code path for obsolete hook */
-                test_len = ops->self_test_count(dev);
+        test_len = ops->get_sset_count(dev, ETH_SS_TEST);
         if (test_len < 0)
                 return test_len;
         WARN_ON(test_len == 0);
@@ -728,36 +1132,17 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
         u8 *data;
         int ret;
 
-        if (!ops->get_strings)
+        if (!ops->get_strings || !ops->get_sset_count)
                 return -EOPNOTSUPP;
 
         if (copy_from_user(&gstrings, useraddr, sizeof(gstrings)))
                 return -EFAULT;
 
-        if (ops->get_sset_count) {
-                ret = ops->get_sset_count(dev, gstrings.string_set);
-                if (ret < 0)
-                        return ret;
+        ret = ops->get_sset_count(dev, gstrings.string_set);
+        if (ret < 0)
+                return ret;
 
-                gstrings.len = ret;
-        } else {
-                /* code path for obsolete hooks */
-
-                switch (gstrings.string_set) {
-                case ETH_SS_TEST:
-                        if (!ops->self_test_count)
-                                return -EOPNOTSUPP;
-                        gstrings.len = ops->self_test_count(dev);
-                        break;
-                case ETH_SS_STATS:
-                        if (!ops->get_stats_count)
-                                return -EOPNOTSUPP;
-                        gstrings.len = ops->get_stats_count(dev);
-                        break;
-                default:
-                        return -EINVAL;
-                }
-        }
+        gstrings.len = ret;
 
         data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
         if (!data)
@@ -798,16 +1183,10 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
         u64 *data;
         int ret, n_stats;
 
-        if (!ops->get_ethtool_stats)
-                return -EOPNOTSUPP;
-        if (!ops->get_sset_count && !ops->get_stats_count)
+        if (!ops->get_ethtool_stats || !ops->get_sset_count)
                 return -EOPNOTSUPP;
 
-        if (ops->get_sset_count)
-                n_stats = ops->get_sset_count(dev, ETH_SS_STATS);
-        else
-                /* code path for obsolete hook */
-                n_stats = ops->get_stats_count(dev);
+        n_stats = ops->get_sset_count(dev, ETH_SS_STATS);
         if (n_stats < 0)
                 return n_stats;
         WARN_ON(n_stats == 0);
@@ -857,7 +1236,7 @@ static int ethtool_get_perm_addr(struct net_device *dev, void __user *useraddr)
 static int ethtool_get_value(struct net_device *dev, char __user *useraddr,
                              u32 cmd, u32 (*actor)(struct net_device *))
 {
-        struct ethtool_value edata = { cmd };
+        struct ethtool_value edata = { .cmd = cmd };
 
         if (!actor)
                 return -EOPNOTSUPP;
@@ -898,7 +1277,7 @@ static int ethtool_set_value(struct net_device *dev, char __user *useraddr,
         return actor(dev, edata.data);
 }
 
-static int ethtool_flash_device(struct net_device *dev, char __user *useraddr)
+static noinline_for_stack int ethtool_flash_device(struct net_device *dev, char __user *useraddr)
 {
         struct ethtool_flash efl;
 
@@ -945,6 +1324,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GPERMADDR:
         case ETHTOOL_GUFO:
         case ETHTOOL_GGSO:
+        case ETHTOOL_GGRO:
         case ETHTOOL_GFLAGS:
         case ETHTOOL_GPFLAGS:
         case ETHTOOL_GRXFH:
@@ -1127,6 +1507,18 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_FLASHDEV:
                 rc = ethtool_flash_device(dev, useraddr);
                 break;
+        case ETHTOOL_RESET:
+                rc = ethtool_reset(dev, useraddr);
+                break;
+        case ETHTOOL_SRXNTUPLE:
+                rc = ethtool_set_rx_ntuple(dev, useraddr);
+                break;
+        case ETHTOOL_GRXNTUPLE:
+                rc = ethtool_get_rx_ntuple(dev, useraddr);
+                break;
+        case ETHTOOL_GSSET_INFO:
+                rc = ethtool_get_sset_info(dev, useraddr);
+                break;
         default:
                 rc = -EOPNOTSUPP;
         }
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index bd309384f8b8..d2c3e7dc2e5f 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -10,6 +10,7 @@
 
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -72,7 +73,7 @@ static void flush_route_cache(struct fib_rules_ops *ops)
                 ops->flush_cache(ops);
 }
 
-int fib_rules_register(struct fib_rules_ops *ops)
+static int __fib_rules_register(struct fib_rules_ops *ops)
 {
         int err = -EEXIST;
         struct fib_rules_ops *o;
@@ -102,6 +103,28 @@ errout:
         return err;
 }
 
+struct fib_rules_ops *
+fib_rules_register(struct fib_rules_ops *tmpl, struct net *net)
+{
+        struct fib_rules_ops *ops;
+        int err;
+
+        ops = kmemdup(tmpl, sizeof (*ops), GFP_KERNEL);
+        if (ops == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        INIT_LIST_HEAD(&ops->rules_list);
+        ops->fro_net = net;
+
+        err = __fib_rules_register(ops);
+        if (err) {
+                kfree(ops);
+                ops = ERR_PTR(err);
+        }
+
+        return ops;
+}
+
 EXPORT_SYMBOL_GPL(fib_rules_register);
 
 void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
@@ -115,6 +138,15 @@ void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
 }
 EXPORT_SYMBOL_GPL(fib_rules_cleanup_ops);
 
+static void fib_rules_put_rcu(struct rcu_head *head)
+{
+        struct fib_rules_ops *ops = container_of(head, struct fib_rules_ops, rcu);
+        struct net *net = ops->fro_net;
+
+        release_net(net);
+        kfree(ops);
+}
+
 void fib_rules_unregister(struct fib_rules_ops *ops)
 {
         struct net *net = ops->fro_net;
@@ -124,8 +156,7 @@ void fib_rules_unregister(struct fib_rules_ops *ops)
         fib_rules_cleanup_ops(ops);
         spin_unlock(&net->rules_mod_lock);
 
-        synchronize_rcu();
-        release_net(net);
+        call_rcu(&ops->rcu, fib_rules_put_rcu);
 }
 
 EXPORT_SYMBOL_GPL(fib_rules_unregister);
@@ -135,7 +166,10 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
 {
         int ret = 0;
 
-        if (rule->ifindex && (rule->ifindex != fl->iif))
+        if (rule->iifindex && (rule->iifindex != fl->iif))
+                goto out;
+
+        if (rule->oifindex && (rule->oifindex != fl->oif))
                 goto out;
 
         if ((rule->mark ^ fl->mark) & rule->mark_mask)
@@ -248,14 +282,24 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (tb[FRA_PRIORITY])
                 rule->pref = nla_get_u32(tb[FRA_PRIORITY]);
 
-        if (tb[FRA_IFNAME]) {
+        if (tb[FRA_IIFNAME]) {
+                struct net_device *dev;
+
+                rule->iifindex = -1;
+                nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ);
+                dev = __dev_get_by_name(net, rule->iifname);
+                if (dev)
+                        rule->iifindex = dev->ifindex;
+        }
+
+        if (tb[FRA_OIFNAME]) {
                 struct net_device *dev;
 
-                rule->ifindex = -1;
-                nla_strlcpy(rule->ifname, tb[FRA_IFNAME], IFNAMSIZ);
-                dev = __dev_get_by_name(net, rule->ifname);
+                rule->oifindex = -1;
+                nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ);
+                dev = __dev_get_by_name(net, rule->oifname);
                 if (dev)
-                        rule->ifindex = dev->ifindex;
+                        rule->oifindex = dev->ifindex;
         }
 
         if (tb[FRA_FWMARK]) {
@@ -274,7 +318,7 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         rule->flags = frh->flags;
         rule->table = frh_get_table(frh, tb);
 
-        if (!rule->pref && ops->default_pref)
+        if (!tb[FRA_PRIORITY] && ops->default_pref)
                 rule->pref = ops->default_pref(ops);
 
         err = -EINVAL;
@@ -388,8 +432,12 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                     (rule->pref != nla_get_u32(tb[FRA_PRIORITY])))
                         continue;
 
-                if (tb[FRA_IFNAME] &&
-                    nla_strcmp(tb[FRA_IFNAME], rule->ifname))
+                if (tb[FRA_IIFNAME] &&
+                    nla_strcmp(tb[FRA_IIFNAME], rule->iifname))
+                        continue;
+
+                if (tb[FRA_OIFNAME] &&
+                    nla_strcmp(tb[FRA_OIFNAME], rule->oifname))
                         continue;
 
                 if (tb[FRA_FWMARK] &&
@@ -447,7 +495,8 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
                                          struct fib_rule *rule)
 {
         size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr))
-                         + nla_total_size(IFNAMSIZ) /* FRA_IFNAME */
+                         + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */
+                         + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
                          + nla_total_size(4) /* FRA_PRIORITY */
                          + nla_total_size(4) /* FRA_TABLE */
                          + nla_total_size(4) /* FRA_FWMARK */
@@ -481,11 +530,18 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         if (rule->action == FR_ACT_GOTO && rule->ctarget == NULL)
                 frh->flags |= FIB_RULE_UNRESOLVED;
 
-        if (rule->ifname[0]) {
-                NLA_PUT_STRING(skb, FRA_IFNAME, rule->ifname);
+        if (rule->iifname[0]) {
+                NLA_PUT_STRING(skb, FRA_IIFNAME, rule->iifname);
 
-                if (rule->ifindex == -1)
-                        frh->flags |= FIB_RULE_DEV_DETACHED;
+                if (rule->iifindex == -1)
+                        frh->flags |= FIB_RULE_IIF_DETACHED;
+        }
+
+        if (rule->oifname[0]) {
+                NLA_PUT_STRING(skb, FRA_OIFNAME, rule->oifname);
+
+                if (rule->oifindex == -1)
+                        frh->flags |= FIB_RULE_OIF_DETACHED;
         }
 
         if (rule->pref)
@@ -600,9 +656,12 @@ static void attach_rules(struct list_head *rules, struct net_device *dev)
         struct fib_rule *rule;
 
         list_for_each_entry(rule, rules, list) {
-                if (rule->ifindex == -1 &&
-                    strcmp(dev->name, rule->ifname) == 0)
-                        rule->ifindex = dev->ifindex;
+                if (rule->iifindex == -1 &&
+                    strcmp(dev->name, rule->iifname) == 0)
+                        rule->iifindex = dev->ifindex;
+                if (rule->oifindex == -1 &&
+                    strcmp(dev->name, rule->oifname) == 0)
+                        rule->oifindex = dev->ifindex;
         }
 }
 
@@ -610,9 +669,12 @@ static void detach_rules(struct list_head *rules, struct net_device *dev)
 {
         struct fib_rule *rule;
 
-        list_for_each_entry(rule, rules, list)
-                if (rule->ifindex == dev->ifindex)
-                        rule->ifindex = -1;
+        list_for_each_entry(rule, rules, list) {
+                if (rule->iifindex == dev->ifindex)
+                        rule->iifindex = -1;
+                if (rule->oifindex == dev->ifindex)
+                        rule->oifindex = -1;
+        }
 }
 
 
@@ -647,7 +709,7 @@ static struct notifier_block fib_rules_notifier = {
         .notifier_call = fib_rules_event,
 };
 
-static int fib_rules_net_init(struct net *net)
+static int __net_init fib_rules_net_init(struct net *net)
 {
         INIT_LIST_HEAD(&net->rules_ops);
         spin_lock_init(&net->rules_mod_lock);
diff --git a/net/core/filter.c b/net/core/filter.c
index d1d779ca096d..ff943bed21af 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -25,6 +25,7 @@
 #include <linux/inet.h>
 #include <linux/netdevice.h>
 #include <linux/if_packet.h>
+#include <linux/gfp.h>
 #include <net/ip.h>
 #include <net/protocol.h>
 #include <net/netlink.h>
@@ -86,7 +87,7 @@ int sk_filter(struct sock *sk, struct sk_buff *skb)
                 return err;
 
         rcu_read_lock_bh();
-        filter = rcu_dereference(sk->sk_filter);
+        filter = rcu_dereference_bh(sk->sk_filter);
         if (filter) {
                 unsigned int pkt_len = sk_run_filter(skb, filter->insns,
                                 filter->len);
@@ -303,6 +304,12 @@ load_b:
                 case SKF_AD_IFINDEX:
                         A = skb->dev->ifindex;
                         continue;
+                case SKF_AD_MARK:
+                        A = skb->mark;
+                        continue;
+                case SKF_AD_QUEUE:
+                        A = skb->queue_mapping;
+                        continue;
                 case SKF_AD_NLATTR: {
                         struct nlattr *nla;
 
@@ -515,7 +522,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         }
 
         rcu_read_lock_bh();
-        old_fp = rcu_dereference(sk->sk_filter);
+        old_fp = rcu_dereference_bh(sk->sk_filter);
         rcu_assign_pointer(sk->sk_filter, fp);
         rcu_read_unlock_bh();
 
@@ -523,6 +530,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
                 sk_filter_delayed_uncharge(sk, old_fp);
         return 0;
 }
+EXPORT_SYMBOL_GPL(sk_attach_filter);
 
 int sk_detach_filter(struct sock *sk)
 {
@@ -530,7 +538,7 @@ int sk_detach_filter(struct sock *sk)
         struct sk_filter *filter;
 
         rcu_read_lock_bh();
-        filter = rcu_dereference(sk->sk_filter);
+        filter = rcu_dereference_bh(sk->sk_filter);
         if (filter) {
                 rcu_assign_pointer(sk->sk_filter, NULL);
                 sk_filter_delayed_uncharge(sk, filter);
@@ -539,3 +547,4 @@ int sk_detach_filter(struct sock *sk)
         rcu_read_unlock_bh();
         return ret;
 }
+EXPORT_SYMBOL_GPL(sk_detach_filter);
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 493775f4f2f1..cf8e70392fe0 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -32,6 +32,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/init.h>
 #include <linux/rbtree.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/gen_stats.h>
 
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 8569310268ab..393b1d8618e2 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -127,6 +127,7 @@ gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
 /**
  * gnet_stats_copy_rate_est - copy rate estimator statistics into statistics TLV
  * @d: dumping handle
+ * @b: basic statistics
  * @r: rate estimator statistics
  *
  * Appends the rate estimator statistics to the top level TLV created by
@@ -136,8 +137,13 @@ gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
  * if the room in the socket buffer was not sufficient.
  */
 int
-gnet_stats_copy_rate_est(struct gnet_dump *d, struct gnet_stats_rate_est *r)
+gnet_stats_copy_rate_est(struct gnet_dump *d,
+                         const struct gnet_stats_basic_packed *b,
+                         struct gnet_stats_rate_est *r)
 {
+        if (b && !gen_estimator_active(b, r))
+                return 0;
+
         if (d->compat_tc_stats) {
                 d->tc_stats.bps = r->bps;
                 d->tc_stats.pps = r->pps;
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 16ad45d4882b..1e7f4e91a935 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -20,7 +20,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/net.h>
 #include <linux/in6.h>
 #include <asm/uaccess.h>
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index bf8f7af699d7..bdbce2f5875b 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -19,7 +19,6 @@
 #include <linux/rtnetlink.h>
 #include <linux/jiffies.h>
 #include <linux/spinlock.h>
-#include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/bitops.h>
 #include <asm/types.h>
@@ -35,7 +34,7 @@ static unsigned long linkwatch_nextevent;
 static void linkwatch_event(struct work_struct *dummy);
 static DECLARE_DELAYED_WORK(linkwatch_work, linkwatch_event);
 
-static struct net_device *lweventlist;
+static LIST_HEAD(lweventlist);
 static DEFINE_SPINLOCK(lweventlist_lock);
 
 static unsigned char default_operstate(const struct net_device *dev)
@@ -89,8 +88,10 @@ static void linkwatch_add_event(struct net_device *dev)
         unsigned long flags;
 
         spin_lock_irqsave(&lweventlist_lock, flags);
-        dev->link_watch_next = lweventlist;
-        lweventlist = dev;
+        if (list_empty(&dev->link_watch_list)) {
+                list_add_tail(&dev->link_watch_list, &lweventlist);
+                dev_hold(dev);
+        }
         spin_unlock_irqrestore(&lweventlist_lock, flags);
 }
 
@@ -133,9 +134,35 @@ static void linkwatch_schedule_work(int urgent)
 }
 
 
+static void linkwatch_do_dev(struct net_device *dev)
+{
+        /*
+         * Make sure the above read is complete since it can be
+         * rewritten as soon as we clear the bit below.
+         */
+        smp_mb__before_clear_bit();
+
+        /* We are about to handle this device,
+         * so new events can be accepted
+         */
+        clear_bit(__LINK_STATE_LINKWATCH_PENDING, &dev->state);
+
+        rfc2863_policy(dev);
+        if (dev->flags & IFF_UP) {
+                if (netif_carrier_ok(dev))
+                        dev_activate(dev);
+                else
+                        dev_deactivate(dev);
+
+                netdev_state_change(dev);
+        }
+        dev_put(dev);
+}
+
 static void __linkwatch_run_queue(int urgent_only)
 {
-        struct net_device *next;
+        struct net_device *dev;
+        LIST_HEAD(wrk);
 
         /*
          * Limit the number of linkwatch events to one
@@ -153,46 +180,40 @@ static void __linkwatch_run_queue(int urgent_only)
         clear_bit(LW_URGENT, &linkwatch_flags);
 
         spin_lock_irq(&lweventlist_lock);
-        next = lweventlist;
-        lweventlist = NULL;
-        spin_unlock_irq(&lweventlist_lock);
+        list_splice_init(&lweventlist, &wrk);
 
-        while (next) {
-                struct net_device *dev = next;
+        while (!list_empty(&wrk)) {
 
-                next = dev->link_watch_next;
+                dev = list_first_entry(&wrk, struct net_device, link_watch_list);
+                list_del_init(&dev->link_watch_list);
 
                 if (urgent_only && !linkwatch_urgent_event(dev)) {
-                        linkwatch_add_event(dev);
+                        list_add_tail(&dev->link_watch_list, &lweventlist);
                         continue;
                 }
-
-                /*
-                 * Make sure the above read is complete since it can be
-                 * rewritten as soon as we clear the bit below.
-                 */
-                smp_mb__before_clear_bit();
-
-                /* We are about to handle this device,
-                 * so new events can be accepted
-                 */
-                clear_bit(__LINK_STATE_LINKWATCH_PENDING, &dev->state);
-
-                rfc2863_policy(dev);
-                if (dev->flags & IFF_UP) {
-                        if (netif_carrier_ok(dev))
-                                dev_activate(dev);
-                        else
-                                dev_deactivate(dev);
-
-                        netdev_state_change(dev);
-                }
-
-                dev_put(dev);
+                spin_unlock_irq(&lweventlist_lock);
+                linkwatch_do_dev(dev);
+                spin_lock_irq(&lweventlist_lock);
         }
 
-        if (lweventlist)
+        if (!list_empty(&lweventlist))
                 linkwatch_schedule_work(0);
+        spin_unlock_irq(&lweventlist_lock);
+}
+
+void linkwatch_forget_dev(struct net_device *dev)
+{
+        unsigned long flags;
+        int clean = 0;
+
+        spin_lock_irqsave(&lweventlist_lock, flags);
+        if (!list_empty(&dev->link_watch_list)) {
+                list_del_init(&dev->link_watch_list);
+                clean = 1;
+        }
+        spin_unlock_irqrestore(&lweventlist_lock, flags);
+        if (clean)
+                linkwatch_do_dev(dev);
 }
 
 
@@ -216,8 +237,6 @@ void linkwatch_fire_event(struct net_device *dev)
         bool urgent = linkwatch_urgent_event(dev);
 
         if (!test_and_set_bit(__LINK_STATE_LINKWATCH_PENDING, &dev->state)) {
-                dev_hold(dev);
-
                 linkwatch_add_event(dev);
         } else if (!urgent)
                 return;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e587e6819698..bff37908bd55 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -15,6 +15,7 @@
  *      Harald Welte            Add neighbour cache statistics like rtstat
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -771,6 +772,8 @@ static __inline__ int neigh_max_probes(struct neighbour *n)
 }
 
 static void neigh_invalidate(struct neighbour *neigh)
+        __releases(neigh->lock)
+        __acquires(neigh->lock)
 {
         struct sk_buff *skb;
 
@@ -2092,7 +2095,7 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                 if (h > s_h)
                         s_idx = 0;
                 for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
-                        if (dev_net(n->dev) != net)
+                        if (!net_eq(dev_net(n->dev), net))
                                 continue;
                         if (idx < s_idx)
                                 goto next;
@@ -2417,8 +2420,7 @@ EXPORT_SYMBOL(neigh_seq_stop);
 
 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct proc_dir_entry *pde = seq->private;
-        struct neigh_table *tbl = pde->data;
+        struct neigh_table *tbl = seq->private;
         int cpu;
 
         if (*pos == 0)
@@ -2435,8 +2437,7 @@ static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
 
 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct proc_dir_entry *pde = seq->private;
-        struct neigh_table *tbl = pde->data;
+        struct neigh_table *tbl = seq->private;
         int cpu;
 
         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
@@ -2455,8 +2456,7 @@ static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
 
 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
 {
-        struct proc_dir_entry *pde = seq->private;
-        struct neigh_table *tbl = pde->data;
+        struct neigh_table *tbl = seq->private;
         struct neigh_statistics *st = v;
 
         if (v == SEQ_START_TOKEN) {
@@ -2501,7 +2501,7 @@ static int neigh_stat_seq_open(struct inode *inode, struct file *file)
 
         if (!ret) {
                 struct seq_file *sf = file->private_data;
-                sf->private = PDE(inode);
+                sf->private = PDE(inode)->data;
         }
         return ret;
 };
@@ -2559,28 +2559,27 @@ EXPORT_SYMBOL(neigh_app_ns);
 
 #ifdef CONFIG_SYSCTL
 
+#define NEIGH_VARS_MAX 19
+
 static struct neigh_sysctl_table {
         struct ctl_table_header *sysctl_header;
-        struct ctl_table neigh_vars[__NET_NEIGH_MAX];
+        struct ctl_table neigh_vars[NEIGH_VARS_MAX];
         char *dev_name;
 } neigh_sysctl_template __read_mostly = {
         .neigh_vars = {
                 {
-                        .ctl_name       = NET_NEIGH_MCAST_SOLICIT,
                         .procname       = "mcast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_UCAST_SOLICIT,
                         .procname       = "ucast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_APP_SOLICIT,
                         .procname       = "app_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
@@ -2593,38 +2592,30 @@ static struct neigh_sysctl_table {
                         .proc_handler   = proc_dointvec_userhz_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_REACHABLE_TIME,
                         .procname       = "base_reachable_time",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec_jiffies,
-                        .strategy       = sysctl_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_DELAY_PROBE_TIME,
                         .procname       = "delay_first_probe_time",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec_jiffies,
-                        .strategy       = sysctl_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_GC_STALE_TIME,
                         .procname       = "gc_stale_time",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec_jiffies,
-                        .strategy       = sysctl_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_UNRES_QLEN,
                         .procname       = "unres_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_PROXY_QLEN,
                         .procname       = "proxy_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
@@ -2649,45 +2640,36 @@ static struct neigh_sysctl_table {
                         .proc_handler   = proc_dointvec_userhz_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_RETRANS_TIME_MS,
                         .procname       = "retrans_time_ms",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec_ms_jiffies,
-                        .strategy       = sysctl_ms_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_REACHABLE_TIME_MS,
                         .procname       = "base_reachable_time_ms",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec_ms_jiffies,
-                        .strategy       = sysctl_ms_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_GC_INTERVAL,
                         .procname       = "gc_interval",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec_jiffies,
-                        .strategy       = sysctl_jiffies,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_GC_THRESH1,
                         .procname       = "gc_thresh1",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_GC_THRESH2,
                         .procname       = "gc_thresh2",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
                         .proc_handler   = proc_dointvec,
                 },
                 {
-                        .ctl_name       = NET_NEIGH_GC_THRESH3,
                         .procname       = "gc_thresh3",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
@@ -2698,8 +2680,7 @@ static struct neigh_sysctl_table {
 };
 
 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
-                          int p_id, int pdev_id, char *p_name,
-                          proc_handler *handler, ctl_handler *strategy)
+                          char *p_name, proc_handler *handler)
 {
         struct neigh_sysctl_table *t;
         const char *dev_name_source = NULL;
@@ -2710,10 +2691,10 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
 #define NEIGH_CTL_PATH_DEV      3
 
         struct ctl_path neigh_path[] = {
-                { .procname = "net",     .ctl_name = CTL_NET, },
-                { .procname = "proto",   .ctl_name = 0, },
-                { .procname = "neigh",   .ctl_name = 0, },
-                { .procname = "default", .ctl_name = NET_PROTO_CONF_DEFAULT, },
+                { .procname = "net",     },
+                { .procname = "proto",   },
+                { .procname = "neigh",   },
+                { .procname = "default", },
                 { },
         };
 
@@ -2738,7 +2719,6 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
 
         if (dev) {
                 dev_name_source = dev->name;
-                neigh_path[NEIGH_CTL_PATH_DEV].ctl_name = dev->ifindex;
                 /* Terminate the table early */
                 memset(&t->neigh_vars[14], 0, sizeof(t->neigh_vars[14]));
         } else {
@@ -2750,31 +2730,19 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
         }
 
 
-        if (handler || strategy) {
+        if (handler) {
                 /* RetransTime */
                 t->neigh_vars[3].proc_handler = handler;
-                t->neigh_vars[3].strategy = strategy;
                 t->neigh_vars[3].extra1 = dev;
-                if (!strategy)
-                        t->neigh_vars[3].ctl_name = CTL_UNNUMBERED;
                 /* ReachableTime */
                 t->neigh_vars[4].proc_handler = handler;
-                t->neigh_vars[4].strategy = strategy;
                 t->neigh_vars[4].extra1 = dev;
-                if (!strategy)
-                        t->neigh_vars[4].ctl_name = CTL_UNNUMBERED;
                 /* RetransTime (in milliseconds)*/
                 t->neigh_vars[12].proc_handler = handler;
-                t->neigh_vars[12].strategy = strategy;
                 t->neigh_vars[12].extra1 = dev;
-                if (!strategy)
-                        t->neigh_vars[12].ctl_name = CTL_UNNUMBERED;
                 /* ReachableTime (in milliseconds) */
                 t->neigh_vars[13].proc_handler = handler;
-                t->neigh_vars[13].strategy = strategy;
                 t->neigh_vars[13].extra1 = dev;
-                if (!strategy)
-                        t->neigh_vars[13].ctl_name = CTL_UNNUMBERED;
         }
 
         t->dev_name = kstrdup(dev_name_source, GFP_KERNEL);
@@ -2782,9 +2750,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
                 goto free;
 
         neigh_path[NEIGH_CTL_PATH_DEV].procname = t->dev_name;
-        neigh_path[NEIGH_CTL_PATH_NEIGH].ctl_name = pdev_id;
         neigh_path[NEIGH_CTL_PATH_PROTO].procname = p_name;
-        neigh_path[NEIGH_CTL_PATH_PROTO].ctl_name = p_id;
 
         t->sysctl_header =
                 register_net_sysctl_table(neigh_parms_net(p), neigh_path, t->neigh_vars);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 427ded841224..59cfc7d8fc45 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/rtnetlink.h>
 #include <linux/wireless.h>
@@ -130,6 +131,48 @@ static ssize_t show_carrier(struct device *dev,
         return -EINVAL;
 }
 
+static ssize_t show_speed(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        struct net_device *netdev = to_net_dev(dev);
+        int ret = -EINVAL;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        if (netif_running(netdev) &&
+            netdev->ethtool_ops &&
+            netdev->ethtool_ops->get_settings) {
+                struct ethtool_cmd cmd = { ETHTOOL_GSET };
+
+                if (!netdev->ethtool_ops->get_settings(netdev, &cmd))
+                        ret = sprintf(buf, fmt_dec, ethtool_cmd_speed(&cmd));
+        }
+        rtnl_unlock();
+        return ret;
+}
+
+static ssize_t show_duplex(struct device *dev,
+                           struct device_attribute *attr, char *buf)
+{
+        struct net_device *netdev = to_net_dev(dev);
+        int ret = -EINVAL;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        if (netif_running(netdev) &&
+            netdev->ethtool_ops &&
+            netdev->ethtool_ops->get_settings) {
+                struct ethtool_cmd cmd = { ETHTOOL_GSET };
+
+                if (!netdev->ethtool_ops->get_settings(netdev, &cmd))
+                        ret = sprintf(buf, "%s\n", cmd.duplex ? "full" : "half");
+        }
+        rtnl_unlock();
+        return ret;
+}
+
 static ssize_t show_dormant(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
@@ -259,6 +302,8 @@ static struct device_attribute net_class_attributes[] = {
         __ATTR(address, S_IRUGO, show_address, NULL),
         __ATTR(broadcast, S_IRUGO, show_broadcast, NULL),
         __ATTR(carrier, S_IRUGO, show_carrier, NULL),
+        __ATTR(speed, S_IRUGO, show_speed, NULL),
+        __ATTR(duplex, S_IRUGO, show_duplex, NULL),
         __ATTR(dormant, S_IRUGO, show_dormant, NULL),
         __ATTR(operstate, S_IRUGO, show_operstate, NULL),
         __ATTR(mtu, S_IRUGO | S_IWUSR, show_mtu, store_mtu),
@@ -366,7 +411,8 @@ static ssize_t wireless_show(struct device *d, char *buf,
         const struct iw_statistics *iw;
         ssize_t ret = -EINVAL;
 
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return restart_syscall();
         if (dev_isalive(dev)) {
                 iw = get_wireless_stats(dev);
                 if (iw)
@@ -481,7 +527,7 @@ void netdev_unregister_kobject(struct net_device * net)
 
         kobject_get(&dev->kobj);
 
-        if (dev_net(net) != &init_net)
+        if (!net_eq(dev_net(net), &init_net))
                 return;
 
         device_del(dev);
@@ -500,15 +546,22 @@ int netdev_register_kobject(struct net_device *net)
         dev_set_name(dev, "%s", net->name);
 
 #ifdef CONFIG_SYSFS
-        *groups++ = &netstat_group;
+        /* Allow for a device specific group */
+        if (*groups)
+                groups++;
 
+        *groups++ = &netstat_group;
 #ifdef CONFIG_WIRELESS_EXT_SYSFS
-        if (net->wireless_handlers || net->ieee80211_ptr)
+        if (net->ieee80211_ptr)
                 *groups++ = &wireless_group;
+#ifdef CONFIG_WIRELESS_EXT
+        else if (net->wireless_handlers)
+                *groups++ = &wireless_group;
+#endif
 #endif
 #endif /* CONFIG_SYSFS */
 
-        if (dev_net(net) != &init_net)
+        if (!net_eq(dev_net(net), &init_net))
                 return 0;
 
         return device_add(dev);
diff --git a/net/core/net-traces.c b/net/core/net-traces.c
index f1e982c508bb..afa6380ed88a 100644
--- a/net/core/net-traces.c
+++ b/net/core/net-traces.c
@@ -19,6 +19,7 @@
 #include <linux/workqueue.h>
 #include <linux/netlink.h>
 #include <linux/net_dropmon.h>
+#include <linux/slab.h>
 
 #include <asm/unaligned.h>
 #include <asm/bitops.h>
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1c1af2756f38..bd8c4712ea24 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -27,14 +27,64 @@ EXPORT_SYMBOL(init_net);
 
 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
 
+static int ops_init(const struct pernet_operations *ops, struct net *net)
+{
+        int err;
+        if (ops->id && ops->size) {
+                void *data = kzalloc(ops->size, GFP_KERNEL);
+                if (!data)
+                        return -ENOMEM;
+
+                err = net_assign_generic(net, *ops->id, data);
+                if (err) {
+                        kfree(data);
+                        return err;
+                }
+        }
+        if (ops->init)
+                return ops->init(net);
+        return 0;
+}
+
+static void ops_free(const struct pernet_operations *ops, struct net *net)
+{
+        if (ops->id && ops->size) {
+                int id = *ops->id;
+                kfree(net_generic(net, id));
+        }
+}
+
+static void ops_exit_list(const struct pernet_operations *ops,
+                          struct list_head *net_exit_list)
+{
+        struct net *net;
+        if (ops->exit) {
+                list_for_each_entry(net, net_exit_list, exit_list)
+                        ops->exit(net);
+        }
+        if (ops->exit_batch)
+                ops->exit_batch(net_exit_list);
+}
+
+static void ops_free_list(const struct pernet_operations *ops,
+                          struct list_head *net_exit_list)
+{
+        struct net *net;
+        if (ops->size && ops->id) {
+                list_for_each_entry(net, net_exit_list, exit_list)
+                        ops_free(ops, net);
+        }
+}
+
 /*
  * setup_net runs the initializers for the network namespace object.
  */
 static __net_init int setup_net(struct net *net)
 {
         /* Must be called with net_mutex held */
-        struct pernet_operations *ops;
+        const struct pernet_operations *ops, *saved_ops;
         int error = 0;
+        LIST_HEAD(net_exit_list);
 
         atomic_set(&net->count, 1);
 
@@ -43,11 +93,9 @@ static __net_init int setup_net(struct net *net)
 #endif
 
         list_for_each_entry(ops, &pernet_list, list) {
-                if (ops->init) {
-                        error = ops->init(net);
-                        if (error < 0)
-                                goto out_undo;
-                }
+                error = ops_init(ops, net);
+                if (error < 0)
+                        goto out_undo;
         }
 out:
         return error;
@@ -56,10 +104,14 @@ out_undo:
         /* Walk through the list backwards calling the exit functions
          * for the pernet modules whose init functions did not fail.
          */
-        list_for_each_entry_continue_reverse(ops, &pernet_list, list) {
-                if (ops->exit)
-                        ops->exit(net);
-        }
+        list_add(&net->exit_list, &net_exit_list);
+        saved_ops = ops;
+        list_for_each_entry_continue_reverse(ops, &pernet_list, list)
+                ops_exit_list(ops, &net_exit_list);
+
+        ops = saved_ops;
+        list_for_each_entry_continue_reverse(ops, &pernet_list, list)
+                ops_free_list(ops, &net_exit_list);
 
         rcu_barrier();
         goto out;
@@ -147,18 +199,29 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
         return net_create();
 }
 
+static DEFINE_SPINLOCK(cleanup_list_lock);
+static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
+
 static void cleanup_net(struct work_struct *work)
 {
-        struct pernet_operations *ops;
-        struct net *net;
+        const struct pernet_operations *ops;
+        struct net *net, *tmp;
+        LIST_HEAD(net_kill_list);
+        LIST_HEAD(net_exit_list);
 
-        net = container_of(work, struct net, work);
+        /* Atomically snapshot the list of namespaces to cleanup */
+        spin_lock_irq(&cleanup_list_lock);
+        list_replace_init(&cleanup_list, &net_kill_list);
+        spin_unlock_irq(&cleanup_list_lock);
 
         mutex_lock(&net_mutex);
 
         /* Don't let anyone else find us. */
         rtnl_lock();
-        list_del_rcu(&net->list);
+        list_for_each_entry(net, &net_kill_list, cleanup_list) {
+                list_del_rcu(&net->list);
+                list_add_tail(&net->exit_list, &net_exit_list);
+        }
         rtnl_unlock();
 
         /*
@@ -169,10 +232,12 @@ static void cleanup_net(struct work_struct *work)
         synchronize_rcu();
 
         /* Run all of the network namespace exit methods */
-        list_for_each_entry_reverse(ops, &pernet_list, list) {
-                if (ops->exit)
-                        ops->exit(net);
-        }
+        list_for_each_entry_reverse(ops, &pernet_list, list)
+                ops_exit_list(ops, &net_exit_list);
+
+        /* Free the net generic variables */
+        list_for_each_entry_reverse(ops, &pernet_list, list)
+                ops_free_list(ops, &net_exit_list);
 
         mutex_unlock(&net_mutex);
 
@@ -182,14 +247,23 @@ static void cleanup_net(struct work_struct *work)
         rcu_barrier();
 
         /* Finally it is safe to free my network namespace structure */
-        net_free(net);
+        list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
+                list_del_init(&net->exit_list);
+                net_free(net);
+        }
 }
+static DECLARE_WORK(net_cleanup_work, cleanup_net);
 
 void __put_net(struct net *net)
 {
         /* Cleanup the network namespace in process context */
-        INIT_WORK(&net->work, cleanup_net);
-        queue_work(netns_wq, &net->work);
+        unsigned long flags;
+
+        spin_lock_irqsave(&cleanup_list_lock, flags);
+        list_add(&net->cleanup_list, &cleanup_list);
+        spin_unlock_irqrestore(&cleanup_list_lock, flags);
+
+        queue_work(netns_wq, &net_cleanup_work);
 }
 EXPORT_SYMBOL_GPL(__put_net);
 
@@ -259,18 +333,20 @@ static int __init net_ns_init(void)
 pure_initcall(net_ns_init);
 
 #ifdef CONFIG_NET_NS
-static int register_pernet_operations(struct list_head *list,
-                                      struct pernet_operations *ops)
+static int __register_pernet_operations(struct list_head *list,
+                                        struct pernet_operations *ops)
 {
-        struct net *net, *undo_net;
+        struct net *net;
         int error;
+        LIST_HEAD(net_exit_list);
 
         list_add_tail(&ops->list, list);
-        if (ops->init) {
+        if (ops->init || (ops->id && ops->size)) {
                 for_each_net(net) {
-                        error = ops->init(net);
+                        error = ops_init(ops, net);
                         if (error)
                                 goto out_undo;
+                        list_add_tail(&net->exit_list, &net_exit_list);
                 }
         }
         return 0;
@@ -278,45 +354,82 @@ static int register_pernet_operations(struct list_head *list,
 out_undo:
         /* If I have an error cleanup all namespaces I initialized */
         list_del(&ops->list);
-        if (ops->exit) {
-                for_each_net(undo_net) {
-                        if (undo_net == net)
-                                goto undone;
-                        ops->exit(undo_net);
-                }
-        }
-undone:
+        ops_exit_list(ops, &net_exit_list);
+        ops_free_list(ops, &net_exit_list);
         return error;
 }
 
-static void unregister_pernet_operations(struct pernet_operations *ops)
+static void __unregister_pernet_operations(struct pernet_operations *ops)
 {
         struct net *net;
+        LIST_HEAD(net_exit_list);
 
         list_del(&ops->list);
-        if (ops->exit)
-                for_each_net(net)
-                        ops->exit(net);
+        for_each_net(net)
+                list_add_tail(&net->exit_list, &net_exit_list);
+        ops_exit_list(ops, &net_exit_list);
+        ops_free_list(ops, &net_exit_list);
 }
 
 #else
 
+static int __register_pernet_operations(struct list_head *list,
+                                        struct pernet_operations *ops)
+{
+        int err = 0;
+        err = ops_init(ops, &init_net);
+        if (err)
+                ops_free(ops, &init_net);
+        return err;
+        
+}
+
+static void __unregister_pernet_operations(struct pernet_operations *ops)
+{
+        LIST_HEAD(net_exit_list);
+        list_add(&init_net.exit_list, &net_exit_list);
+        ops_exit_list(ops, &net_exit_list);
+        ops_free_list(ops, &net_exit_list);
+}
+
+#endif /* CONFIG_NET_NS */
+
+static DEFINE_IDA(net_generic_ids);
+
 static int register_pernet_operations(struct list_head *list,
                                       struct pernet_operations *ops)
 {
-        if (ops->init == NULL)
-                return 0;
-        return ops->init(&init_net);
+        int error;
+
+        if (ops->id) {
+again:
+                error = ida_get_new_above(&net_generic_ids, 1, ops->id);
+                if (error < 0) {
+                        if (error == -EAGAIN) {
+                                ida_pre_get(&net_generic_ids, GFP_KERNEL);
+                                goto again;
+                        }
+                        return error;
+                }
+        }
+        error = __register_pernet_operations(list, ops);
+        if (error) {
+                rcu_barrier();
+                if (ops->id)
+                        ida_remove(&net_generic_ids, *ops->id);
+        }
+
+        return error;
 }
 
 static void unregister_pernet_operations(struct pernet_operations *ops)
 {
-        if (ops->exit)
-                ops->exit(&init_net);
+        
+        __unregister_pernet_operations(ops);
+        rcu_barrier();
+        if (ops->id)
+                ida_remove(&net_generic_ids, *ops->id);
 }
-#endif
-
-static DEFINE_IDA(net_generic_ids);
 
 /**
  *      register_pernet_subsys - register a network namespace subsystem
@@ -364,38 +477,6 @@ void unregister_pernet_subsys(struct pernet_operations *module)
 }
 EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
 
-int register_pernet_gen_subsys(int *id, struct pernet_operations *ops)
-{
-        int rv;
-
-        mutex_lock(&net_mutex);
-again:
-        rv = ida_get_new_above(&net_generic_ids, 1, id);
-        if (rv < 0) {
-                if (rv == -EAGAIN) {
-                        ida_pre_get(&net_generic_ids, GFP_KERNEL);
-                        goto again;
-                }
-                goto out;
-        }
-        rv = register_pernet_operations(first_device, ops);
-        if (rv < 0)
-                ida_remove(&net_generic_ids, *id);
-out:
-        mutex_unlock(&net_mutex);
-        return rv;
-}
-EXPORT_SYMBOL_GPL(register_pernet_gen_subsys);
-
-void unregister_pernet_gen_subsys(int id, struct pernet_operations *ops)
-{
-        mutex_lock(&net_mutex);
-        unregister_pernet_operations(ops);
-        ida_remove(&net_generic_ids, id);
-        mutex_unlock(&net_mutex);
-}
-EXPORT_SYMBOL_GPL(unregister_pernet_gen_subsys);
-
 /**
  *      register_pernet_device - register a network namespace device
  *      @ops:  pernet operations structure for the subsystem
@@ -427,30 +508,6 @@ int register_pernet_device(struct pernet_operations *ops)
 }
 EXPORT_SYMBOL_GPL(register_pernet_device);
 
-int register_pernet_gen_device(int *id, struct pernet_operations *ops)
-{
-        int error;
-        mutex_lock(&net_mutex);
-again:
-        error = ida_get_new_above(&net_generic_ids, 1, id);
-        if (error) {
-                if (error == -EAGAIN) {
-                        ida_pre_get(&net_generic_ids, GFP_KERNEL);
-                        goto again;
-                }
-                goto out;
-        }
-        error = register_pernet_operations(&pernet_list, ops);
-        if (error)
-                ida_remove(&net_generic_ids, *id);
-        else if (first_device == &pernet_list)
-                first_device = &ops->list;
-out:
-        mutex_unlock(&net_mutex);
-        return error;
-}
-EXPORT_SYMBOL_GPL(register_pernet_gen_device);
-
 /**
  *      unregister_pernet_device - unregister a network namespace netdevice
  *      @ops: pernet operations structure to manipulate
@@ -470,17 +527,6 @@ void unregister_pernet_device(struct pernet_operations *ops)
 }
 EXPORT_SYMBOL_GPL(unregister_pernet_device);
 
-void unregister_pernet_gen_device(int id, struct pernet_operations *ops)
-{
-        mutex_lock(&net_mutex);
-        if (&ops->list == first_device)
-                first_device = first_device->next;
-        unregister_pernet_operations(ops);
-        ida_remove(&net_generic_ids, id);
-        mutex_unlock(&net_mutex);
-}
-EXPORT_SYMBOL_GPL(unregister_pernet_gen_device);
-
 static void net_generic_release(struct rcu_head *rcu)
 {
         struct net_generic *ng;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 0b4d0d35ef40..a58f59b97597 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/rcupdate.h>
 #include <linux/workqueue.h>
+#include <linux/slab.h>
 #include <net/tcp.h>
 #include <net/udp.h>
 #include <asm/unaligned.h>
@@ -407,11 +408,24 @@ static void arp_reply(struct sk_buff *skb)
         __be32 sip, tip;
         unsigned char *sha;
         struct sk_buff *send_skb;
-        struct netpoll *np = NULL;
+        struct netpoll *np, *tmp;
+        unsigned long flags;
+        int hits = 0;
+
+        if (list_empty(&npinfo->rx_np))
+                return;
+
+        /* Before checking the packet, we do some early
+           inspection whether this is interesting at all */
+        spin_lock_irqsave(&npinfo->rx_lock, flags);
+        list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
+                if (np->dev == skb->dev)
+                        hits++;
+        }
+        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 
-        if (npinfo->rx_np && npinfo->rx_np->dev == skb->dev)
-                np = npinfo->rx_np;
-        if (!np)
+        /* No netpoll struct is using this dev */
+        if (!hits)
                 return;
 
         /* No arp on this interface */
@@ -437,77 +451,91 @@ static void arp_reply(struct sk_buff *skb)
         arp_ptr += skb->dev->addr_len;
         memcpy(&sip, arp_ptr, 4);
         arp_ptr += 4;
-        /* if we actually cared about dst hw addr, it would get copied here */
+        /* If we actually cared about dst hw addr,
+           it would get copied here */
         arp_ptr += skb->dev->addr_len;
         memcpy(&tip, arp_ptr, 4);
 
         /* Should we ignore arp? */
-        if (tip != np->local_ip ||
-            ipv4_is_loopback(tip) || ipv4_is_multicast(tip))
+        if (ipv4_is_loopback(tip) || ipv4_is_multicast(tip))
                 return;
 
         size = arp_hdr_len(skb->dev);
-        send_skb = find_skb(np, size + LL_ALLOCATED_SPACE(np->dev),
-                            LL_RESERVED_SPACE(np->dev));
 
-        if (!send_skb)
-                return;
-
-        skb_reset_network_header(send_skb);
-        arp = (struct arphdr *) skb_put(send_skb, size);
-        send_skb->dev = skb->dev;
-        send_skb->protocol = htons(ETH_P_ARP);
+        spin_lock_irqsave(&npinfo->rx_lock, flags);
+        list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
+                if (tip != np->local_ip)
+                        continue;
 
-        /* Fill the device header for the ARP frame */
-        if (dev_hard_header(send_skb, skb->dev, ptype,
-                            sha, np->dev->dev_addr,
-                            send_skb->len) < 0) {
-                kfree_skb(send_skb);
-                return;
-        }
+                send_skb = find_skb(np, size + LL_ALLOCATED_SPACE(np->dev),
+                                    LL_RESERVED_SPACE(np->dev));
+                if (!send_skb)
+                        continue;
 
-        /*
-         * Fill out the arp protocol part.
-         *
-         * we only support ethernet device type,
-         * which (according to RFC 1390) should always equal 1 (Ethernet).
-         */
+                skb_reset_network_header(send_skb);
+                arp = (struct arphdr *) skb_put(send_skb, size);
+                send_skb->dev = skb->dev;
+                send_skb->protocol = htons(ETH_P_ARP);
 
-        arp->ar_hrd = htons(np->dev->type);
-        arp->ar_pro = htons(ETH_P_IP);
-        arp->ar_hln = np->dev->addr_len;
-        arp->ar_pln = 4;
-        arp->ar_op = htons(type);
+                /* Fill the device header for the ARP frame */
+                if (dev_hard_header(send_skb, skb->dev, ptype,
+                                    sha, np->dev->dev_addr,
+                                    send_skb->len) < 0) {
+                        kfree_skb(send_skb);
+                        continue;
+                }
 
-        arp_ptr=(unsigned char *)(arp + 1);
-        memcpy(arp_ptr, np->dev->dev_addr, np->dev->addr_len);
-        arp_ptr += np->dev->addr_len;
-        memcpy(arp_ptr, &tip, 4);
-        arp_ptr += 4;
-        memcpy(arp_ptr, sha, np->dev->addr_len);
-        arp_ptr += np->dev->addr_len;
-        memcpy(arp_ptr, &sip, 4);
+                /*
+                 * Fill out the arp protocol part.
+                 *
+                 * we only support ethernet device type,
+                 * which (according to RFC 1390) should
+                 * always equal 1 (Ethernet).
+                 */
 
-        netpoll_send_skb(np, send_skb);
+                arp->ar_hrd = htons(np->dev->type);
+                arp->ar_pro = htons(ETH_P_IP);
+                arp->ar_hln = np->dev->addr_len;
+                arp->ar_pln = 4;
+                arp->ar_op = htons(type);
+
+                arp_ptr = (unsigned char *)(arp + 1);
+                memcpy(arp_ptr, np->dev->dev_addr, np->dev->addr_len);
+                arp_ptr += np->dev->addr_len;
+                memcpy(arp_ptr, &tip, 4);
+                arp_ptr += 4;
+                memcpy(arp_ptr, sha, np->dev->addr_len);
+                arp_ptr += np->dev->addr_len;
+                memcpy(arp_ptr, &sip, 4);
+
+                netpoll_send_skb(np, send_skb);
+
+                /* If there are several rx_hooks for the same address,
+                   we're fine by sending a single reply */
+                break;
+        }
+        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 }
 
 int __netpoll_rx(struct sk_buff *skb)
 {
         int proto, len, ulen;
+        int hits = 0;
         struct iphdr *iph;
         struct udphdr *uh;
-        struct netpoll_info *npi = skb->dev->npinfo;
-        struct netpoll *np = npi->rx_np;
+        struct netpoll_info *npinfo = skb->dev->npinfo;
+        struct netpoll *np, *tmp;
 
-        if (!np)
+        if (list_empty(&npinfo->rx_np))
                 goto out;
+
         if (skb->dev->type != ARPHRD_ETHER)
                 goto out;
 
         /* check if netpoll clients need ARP */
         if (skb->protocol == htons(ETH_P_ARP) &&
             atomic_read(&trapped)) {
-                skb_queue_tail(&npi->arp_tx, skb);
+                skb_queue_tail(&npinfo->arp_tx, skb);
                 return 1;
         }
 
@@ -551,16 +579,23 @@ int __netpoll_rx(struct sk_buff *skb)
                 goto out;
         if (checksum_udp(skb, uh, ulen, iph->saddr, iph->daddr))
                 goto out;
-        if (np->local_ip && np->local_ip != iph->daddr)
-                goto out;
-        if (np->remote_ip && np->remote_ip != iph->saddr)
-                goto out;
-        if (np->local_port && np->local_port != ntohs(uh->dest))
-                goto out;
 
-        np->rx_hook(np, ntohs(uh->source),
-                    (char *)(uh+1),
-                    ulen - sizeof(struct udphdr));
+        list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
+                if (np->local_ip && np->local_ip != iph->daddr)
+                        continue;
+                if (np->remote_ip && np->remote_ip != iph->saddr)
+                        continue;
+                if (np->local_port && np->local_port != ntohs(uh->dest))
+                        continue;
+
+                np->rx_hook(np, ntohs(uh->source),
+                               (char *)(uh+1),
+                               ulen - sizeof(struct udphdr));
+                hits++;
+        }
+
+        if (!hits)
+                goto out;
 
         kfree_skb(skb);
         return 1;
@@ -580,7 +615,7 @@ void netpoll_print_options(struct netpoll *np)
                          np->name, np->local_port);
         printk(KERN_INFO "%s: local IP %pI4\n",
                          np->name, &np->local_ip);
-        printk(KERN_INFO "%s: interface %s\n",
+        printk(KERN_INFO "%s: interface '%s'\n",
                          np->name, np->dev_name);
         printk(KERN_INFO "%s: remote port %d\n",
                          np->name, np->remote_port);
@@ -627,6 +662,9 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
                 if ((delim = strchr(cur, '@')) == NULL)
                         goto parse_failed;
                 *delim = 0;
+                if (*cur == ' ' || *cur == '\t')
+                        printk(KERN_INFO "%s: warning: whitespace"
+                                        "is not allowed\n", np->name);
                 np->remote_port = simple_strtol(cur, NULL, 10);
                 cur = delim;
         }
@@ -674,7 +712,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
         return 0;
 
  parse_failed:
-        printk(KERN_INFO "%s: couldn't parse config at %s!\n",
+        printk(KERN_INFO "%s: couldn't parse config at '%s'!\n",
                np->name, cur);
         return -1;
 }
@@ -684,6 +722,7 @@ int netpoll_setup(struct netpoll *np)
         struct net_device *ndev = NULL;
         struct in_device *in_dev;
         struct netpoll_info *npinfo;
+        struct netpoll *npe, *tmp;
         unsigned long flags;
         int err;
 
@@ -700,11 +739,11 @@ int netpoll_setup(struct netpoll *np)
                 npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
                 if (!npinfo) {
                         err = -ENOMEM;
-                        goto release;
+                        goto put;
                 }
 
                 npinfo->rx_flags = 0;
-                npinfo->rx_np = NULL;
+                INIT_LIST_HEAD(&npinfo->rx_np);
 
                 spin_lock_init(&npinfo->rx_lock);
                 skb_queue_head_init(&npinfo->arp_tx);
@@ -785,7 +824,7 @@ int netpoll_setup(struct netpoll *np)
         if (np->rx_hook) {
                 spin_lock_irqsave(&npinfo->rx_lock, flags);
                 npinfo->rx_flags |= NETPOLL_RX_ENABLED;
-                npinfo->rx_np = np;
+                list_add_tail(&np->rx, &npinfo->rx_np);
                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
         }
 
@@ -801,9 +840,16 @@ int netpoll_setup(struct netpoll *np)
         return 0;
 
  release:
-        if (!ndev->npinfo)
+        if (!ndev->npinfo) {
+                spin_lock_irqsave(&npinfo->rx_lock, flags);
+                list_for_each_entry_safe(npe, tmp, &npinfo->rx_np, rx) {
+                        npe->dev = NULL;
+                }
+                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
+
                 kfree(npinfo);
-        np->dev = NULL;
+        }
+put:
         dev_put(ndev);
         return err;
 }
@@ -823,10 +869,11 @@ void netpoll_cleanup(struct netpoll *np)
         if (np->dev) {
                 npinfo = np->dev->npinfo;
                 if (npinfo) {
-                        if (npinfo->rx_np == np) {
+                        if (!list_empty(&npinfo->rx_np)) {
                                 spin_lock_irqsave(&npinfo->rx_lock, flags);
-                                npinfo->rx_np = NULL;
-                                npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
+                                list_del(&np->rx);
+                                if (list_empty(&npinfo->rx_np))
+                                        npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
                                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
                         }
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 6e79e96cb4f2..43923811bd6a 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -250,8 +250,7 @@ struct pktgen_dev {
         __u64 count;            /* Default No packets to send */
         __u64 sofar;            /* How many pkts we've sent so far */
         __u64 tx_bytes;         /* How many bytes we've transmitted */
-        __u64 errors;           /* Errors when trying to transmit,
-                                   pkts will be re-sent */
+        __u64 errors;           /* Errors when trying to transmit, */
 
         /* runtime counters relating to clone_skb */
 
@@ -340,6 +339,7 @@ struct pktgen_dev {
         __u16 cur_udp_src;
         __u16 cur_queue_map;
         __u32 cur_pkt_size;
+        __u32 last_pkt_size;
 
         __u8 hh[14];
         /* = {
@@ -2051,9 +2051,8 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                                 read_lock_bh(&idev->lock);
                                 for (ifp = idev->addr_list; ifp;
                                      ifp = ifp->if_next) {
-                                        if (ifp->scope == IFA_LINK
-                                            && !(ifp->
-                                                 flags & IFA_F_TENTATIVE)) {
+                                        if (ifp->scope == IFA_LINK &&
+                                            !(ifp->flags & IFA_F_TENTATIVE)) {
                                                 ipv6_addr_copy(&pkt_dev->
                                                                cur_in6_saddr,
                                                                &ifp->addr);
@@ -2189,12 +2188,13 @@ static inline int f_pick(struct pktgen_dev *pkt_dev)
 /* If there was already an IPSEC SA, we keep it as is, else
  * we go look for it ...
 */
+#define DUMMY_MARK 0
 static void get_ipsec_sa(struct pktgen_dev *pkt_dev, int flow)
 {
         struct xfrm_state *x = pkt_dev->flows[flow].x;
         if (!x) {
                 /*slow path: we dont already have xfrm_state*/
-                x = xfrm_stateonly_find(&init_net,
+                x = xfrm_stateonly_find(&init_net, DUMMY_MARK,
                                         (xfrm_address_t *)&pkt_dev->cur_daddr,
                                         (xfrm_address_t *)&pkt_dev->cur_saddr,
                                         AF_INET,
@@ -3436,7 +3436,7 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                         pkt_dev->clone_count--; /* back out increment, OOM */
                         return;
                 }
-
+                pkt_dev->last_pkt_size = pkt_dev->skb->len;
                 pkt_dev->allocated_skbs++;
                 pkt_dev->clone_count = 0;       /* reset counter */
         }
@@ -3448,12 +3448,14 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
         txq = netdev_get_tx_queue(odev, queue_map);
 
         __netif_tx_lock_bh(txq);
-        atomic_inc(&(pkt_dev->skb->users));
 
-        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)))
+        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq))) {
                 ret = NETDEV_TX_BUSY;
-        else
-                ret = (*xmit)(pkt_dev->skb, odev);
+                pkt_dev->last_ok = 0;
+                goto unlock;
+        }
+        atomic_inc(&(pkt_dev->skb->users));
+        ret = (*xmit)(pkt_dev->skb, odev);
 
         switch (ret) {
         case NETDEV_TX_OK:
@@ -3461,7 +3463,13 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 pkt_dev->last_ok = 1;
                 pkt_dev->sofar++;
                 pkt_dev->seq_num++;
-                pkt_dev->tx_bytes += pkt_dev->cur_pkt_size;
+                pkt_dev->tx_bytes += pkt_dev->last_pkt_size;
+                break;
+        case NET_XMIT_DROP:
+        case NET_XMIT_CN:
+        case NET_XMIT_POLICED:
+                /* skb has been consumed */
+                pkt_dev->errors++;
                 break;
         default: /* Drivers are not supposed to return other values! */
                 if (net_ratelimit())
@@ -3475,6 +3483,7 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 atomic_dec(&(pkt_dev->skb->users));
                 pkt_dev->last_ok = 0;
         }
+unlock:
         __netif_tx_unlock_bh(txq);
 
         /* If pkt_dev->count is zero, then run forever */
@@ -3516,6 +3525,7 @@ static int pktgen_thread_worker(void *arg)
                         wait_event_interruptible_timeout(t->queue,
                                                          t->control != 0,
                                                          HZ/10);
+                        try_to_freeze();
                         continue;
                 }
 
@@ -3622,6 +3632,7 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
 {
         struct pktgen_dev *pkt_dev;
         int err;
+        int node = cpu_to_node(t->cpu);
 
         /* We don't allow a device to be on several threads */
 
@@ -3631,12 +3642,13 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
                 return -EBUSY;
         }
 
-        pkt_dev = kzalloc(sizeof(struct pktgen_dev), GFP_KERNEL);
+        pkt_dev = kzalloc_node(sizeof(struct pktgen_dev), GFP_KERNEL, node);
         if (!pkt_dev)
                 return -ENOMEM;
 
         strcpy(pkt_dev->odevname, ifname);
-        pkt_dev->flows = vmalloc(MAX_CFLOWS * sizeof(struct flow_state));
+        pkt_dev->flows = vmalloc_node(MAX_CFLOWS * sizeof(struct flow_state),
+                                      node);
         if (pkt_dev->flows == NULL) {
                 kfree(pkt_dev);
                 return -ENOMEM;
@@ -3698,7 +3710,8 @@ static int __init pktgen_create_thread(int cpu)
         struct proc_dir_entry *pe;
         struct task_struct *p;
 
-        t = kzalloc(sizeof(struct pktgen_thread), GFP_KERNEL);
+        t = kzalloc_node(sizeof(struct pktgen_thread), GFP_KERNEL,
+                         cpu_to_node(cpu));
         if (!t) {
                 printk(KERN_ERR "pktgen: ERROR: out of memory, can't "
                        "create new thread.\n");
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index eb42873f2a3a..31e85d327aa2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -35,10 +35,10 @@
 #include <linux/security.h>
 #include <linux/mutex.h>
 #include <linux/if_addr.h>
+#include <linux/pci.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
-#include <asm/string.h>
 
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -53,8 +53,7 @@
 #include <net/rtnetlink.h>
 #include <net/net_namespace.h>
 
-struct rtnl_link
-{
+struct rtnl_link {
         rtnl_doit_func          doit;
         rtnl_dumpit_func        dumpit;
 };
@@ -65,6 +64,7 @@ void rtnl_lock(void)
 {
         mutex_lock(&rtnl_mutex);
 }
+EXPORT_SYMBOL(rtnl_lock);
 
 void __rtnl_unlock(void)
 {
@@ -76,16 +76,27 @@ void rtnl_unlock(void)
         /* This fellow will unlock it for us. */
         netdev_run_todo();
 }
+EXPORT_SYMBOL(rtnl_unlock);
 
 int rtnl_trylock(void)
 {
         return mutex_trylock(&rtnl_mutex);
 }
+EXPORT_SYMBOL(rtnl_trylock);
 
 int rtnl_is_locked(void)
 {
         return mutex_is_locked(&rtnl_mutex);
 }
+EXPORT_SYMBOL(rtnl_is_locked);
+
+#ifdef CONFIG_PROVE_LOCKING
+int lockdep_rtnl_is_held(void)
+{
+        return lockdep_is_held(&rtnl_mutex);
+}
+EXPORT_SYMBOL(lockdep_rtnl_is_held);
+#endif /* #ifdef CONFIG_PROVE_LOCKING */
 
 static struct rtnl_link *rtnl_msg_handlers[NPROTO];
 
@@ -168,7 +179,6 @@ int __rtnl_register(int protocol, int msgtype,
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(__rtnl_register);
 
 /**
@@ -188,7 +198,6 @@ void rtnl_register(int protocol, int msgtype,
                       "protocol = %d, message type = %d\n",
                       protocol, msgtype);
 }
-
 EXPORT_SYMBOL_GPL(rtnl_register);
 
 /**
@@ -213,7 +222,6 @@ int rtnl_unregister(int protocol, int msgtype)
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(rtnl_unregister);
 
 /**
@@ -230,7 +238,6 @@ void rtnl_unregister_all(int protocol)
         kfree(rtnl_msg_handlers[protocol]);
         rtnl_msg_handlers[protocol] = NULL;
 }
-
 EXPORT_SYMBOL_GPL(rtnl_unregister_all);
 
 static LIST_HEAD(link_ops);
@@ -248,12 +255,11 @@ static LIST_HEAD(link_ops);
 int __rtnl_link_register(struct rtnl_link_ops *ops)
 {
         if (!ops->dellink)
-                ops->dellink = unregister_netdevice;
+                ops->dellink = unregister_netdevice_queue;
 
         list_add_tail(&ops->list, &link_ops);
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(__rtnl_link_register);
 
 /**
@@ -271,19 +277,18 @@ int rtnl_link_register(struct rtnl_link_ops *ops)
         rtnl_unlock();
         return err;
 }
-
 EXPORT_SYMBOL_GPL(rtnl_link_register);
 
 static void __rtnl_kill_links(struct net *net, struct rtnl_link_ops *ops)
 {
         struct net_device *dev;
-restart:
+        LIST_HEAD(list_kill);
+
         for_each_netdev(net, dev) {
-                if (dev->rtnl_link_ops == ops) {
-                        ops->dellink(dev);
-                        goto restart;
-                }
+                if (dev->rtnl_link_ops == ops)
+                        ops->dellink(dev, &list_kill);
         }
+        unregister_netdevice_many(&list_kill);
 }
 
 void rtnl_kill_links(struct net *net, struct rtnl_link_ops *ops)
@@ -309,7 +314,6 @@ void __rtnl_link_unregister(struct rtnl_link_ops *ops)
         }
         list_del(&ops->list);
 }
-
 EXPORT_SYMBOL_GPL(__rtnl_link_unregister);
 
 /**
@@ -322,7 +326,6 @@ void rtnl_link_unregister(struct rtnl_link_ops *ops)
         __rtnl_link_unregister(ops);
         rtnl_unlock();
 }
-
 EXPORT_SYMBOL_GPL(rtnl_link_unregister);
 
 static const struct rtnl_link_ops *rtnl_link_ops_get(const char *kind)
@@ -427,12 +430,13 @@ void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data
         struct rtattr *rta;
         int size = RTA_LENGTH(attrlen);
 
-        rta = (struct rtattr*)skb_put(skb, RTA_ALIGN(size));
+        rta = (struct rtattr *)skb_put(skb, RTA_ALIGN(size));
         rta->rta_type = attrtype;
         rta->rta_len = size;
         memcpy(RTA_DATA(rta), data, attrlen);
         memset(RTA_DATA(rta) + attrlen, 0, RTA_ALIGN(size) - size);
 }
+EXPORT_SYMBOL(__rta_fill);
 
 int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned group, int echo)
 {
@@ -454,6 +458,7 @@ int rtnl_unicast(struct sk_buff *skb, struct net *net, u32 pid)
 
         return nlmsg_unicast(rtnl, skb, pid);
 }
+EXPORT_SYMBOL(rtnl_unicast);
 
 void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid, u32 group,
                  struct nlmsghdr *nlh, gfp_t flags)
@@ -466,6 +471,7 @@ void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid, u32 group,
 
         nlmsg_notify(rtnl, skb, pid, group, report, flags);
 }
+EXPORT_SYMBOL(rtnl_notify);
 
 void rtnl_set_sk_err(struct net *net, u32 group, int error)
 {
@@ -473,6 +479,7 @@ void rtnl_set_sk_err(struct net *net, u32 group, int error)
 
         netlink_set_err(rtnl, 0, group, error);
 }
+EXPORT_SYMBOL(rtnl_set_sk_err);
 
 int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics)
 {
@@ -501,6 +508,7 @@ nla_put_failure:
         nla_nest_cancel(skb, mx);
         return -EMSGSIZE;
 }
+EXPORT_SYMBOL(rtnetlink_put_metrics);
 
 int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
                        u32 ts, u32 tsage, long expires, u32 error)
@@ -520,14 +528,13 @@ int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
 
         return nla_put(skb, RTA_CACHEINFO, sizeof(ci), &ci);
 }
-
 EXPORT_SYMBOL_GPL(rtnl_put_cacheinfo);
 
 static void set_operstate(struct net_device *dev, unsigned char transition)
 {
         unsigned char operstate = dev->operstate;
 
-        switch(transition) {
+        switch (transition) {
         case IF_OPER_UP:
                 if ((operstate == IF_OPER_DORMANT ||
                      operstate == IF_OPER_UNKNOWN) &&
@@ -550,6 +557,19 @@ static void set_operstate(struct net_device *dev, unsigned char transition)
         }
 }
 
+static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
+                                           const struct ifinfomsg *ifm)
+{
+        unsigned int flags = ifm->ifi_flags;
+
+        /* bugwards compatibility: ifi_change == 0 is treated as ~0 */
+        if (ifm->ifi_change)
+                flags = (flags & ifm->ifi_change) |
+                        (dev->flags & ~ifm->ifi_change);
+
+        return flags;
+}
+
 static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
                                  const struct net_device_stats *b)
 {
@@ -582,6 +602,22 @@ static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
         a->tx_compressed = b->tx_compressed;
 };
 
+/* All VF info */
+static inline int rtnl_vfinfo_size(const struct net_device *dev)
+{
+        if (dev->dev.parent && dev_is_pci(dev->dev.parent)) {
+
+                int num_vfs = dev_num_vf(dev->dev.parent);
+                size_t size = nlmsg_total_size(sizeof(struct nlattr));
+                size += nlmsg_total_size(num_vfs * sizeof(struct nlattr));
+                size += num_vfs * (sizeof(struct ifla_vf_mac) +
+                                  sizeof(struct ifla_vf_vlan) +
+                                  sizeof(struct ifla_vf_tx_rate));
+                return size;
+        } else
+                return 0;
+}
+
 static inline size_t if_nlmsg_size(const struct net_device *dev)
 {
         return NLMSG_ALIGN(sizeof(struct ifinfomsg))
@@ -599,6 +635,8 @@ static inline size_t if_nlmsg_size(const struct net_device *dev)
                + nla_total_size(4) /* IFLA_MASTER */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
+               + nla_total_size(4) /* IFLA_NUM_VF */
+               + rtnl_vfinfo_size(dev) /* IFLA_VFINFO_LIST */
                + rtnl_link_get_size(dev); /* IFLA_LINKINFO */
 }
 
@@ -667,6 +705,40 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         stats = dev_get_stats(dev);
         copy_rtnl_link_stats(nla_data(attr), stats);
 
+        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent) {
+                int i;
+
+                struct nlattr *vfinfo, *vf;
+                int num_vfs = dev_num_vf(dev->dev.parent);
+
+                NLA_PUT_U32(skb, IFLA_NUM_VF, num_vfs);
+                vfinfo = nla_nest_start(skb, IFLA_VFINFO_LIST);
+                if (!vfinfo)
+                        goto nla_put_failure;
+                for (i = 0; i < num_vfs; i++) {
+                        struct ifla_vf_info ivi;
+                        struct ifla_vf_mac vf_mac;
+                        struct ifla_vf_vlan vf_vlan;
+                        struct ifla_vf_tx_rate vf_tx_rate;
+                        if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
+                                break;
+                        vf_mac.vf = vf_vlan.vf = vf_tx_rate.vf = ivi.vf;
+                        memcpy(vf_mac.mac, ivi.mac, sizeof(ivi.mac));
+                        vf_vlan.vlan = ivi.vlan;
+                        vf_vlan.qos = ivi.qos;
+                        vf_tx_rate.rate = ivi.tx_rate;
+                        vf = nla_nest_start(skb, IFLA_VF_INFO);
+                        if (!vf) {
+                                nla_nest_cancel(skb, vfinfo);
+                                goto nla_put_failure;
+                        }
+                        NLA_PUT(skb, IFLA_VF_MAC, sizeof(vf_mac), &vf_mac);
+                        NLA_PUT(skb, IFLA_VF_VLAN, sizeof(vf_vlan), &vf_vlan);
+                        NLA_PUT(skb, IFLA_VF_TX_RATE, sizeof(vf_tx_rate), &vf_tx_rate);
+                        nla_nest_end(skb, vf);
+                }
+                nla_nest_end(skb, vfinfo);
+        }
         if (dev->rtnl_link_ops) {
                 if (rtnl_link_fill(skb, dev) < 0)
                         goto nla_put_failure;
@@ -682,22 +754,33 @@ nla_put_failure:
 static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        int idx;
-        int s_idx = cb->args[0];
+        int h, s_h;
+        int idx = 0, s_idx;
         struct net_device *dev;
-
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
-                                     NETLINK_CB(cb->skb).pid,
-                                     cb->nlh->nlmsg_seq, 0, NLM_F_MULTI) <= 0)
-                        break;
+        struct hlist_head *head;
+        struct hlist_node *node;
+
+        s_h = cb->args[0];
+        s_idx = cb->args[1];
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                hlist_for_each_entry(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+                                             NETLINK_CB(cb->skb).pid,
+                                             cb->nlh->nlmsg_seq, 0,
+                                             NLM_F_MULTI) <= 0)
+                                goto out;
 cont:
-                idx++;
+                        idx++;
+                }
         }
-        cb->args[0] = idx;
+out:
+        cb->args[1] = idx;
+        cb->args[0] = h;
 
         return skb->len;
 }
@@ -716,13 +799,42 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_LINKINFO]         = { .type = NLA_NESTED },
         [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
         [IFLA_IFALIAS]          = { .type = NLA_STRING, .len = IFALIASZ-1 },
+        [IFLA_VFINFO_LIST]      = {. type = NLA_NESTED },
 };
+EXPORT_SYMBOL(ifla_policy);
 
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
         [IFLA_INFO_KIND]        = { .type = NLA_STRING },
         [IFLA_INFO_DATA]        = { .type = NLA_NESTED },
 };
 
+static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
+        [IFLA_VF_INFO]          = { .type = NLA_NESTED },
+};
+
+static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
+        [IFLA_VF_MAC]           = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_mac) },
+        [IFLA_VF_VLAN]          = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_vlan) },
+        [IFLA_VF_TX_RATE]       = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_tx_rate) },
+};
+
+struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[])
+{
+        struct net *net;
+        /* Examine the link attributes and figure out which
+         * network namespace we are talking about.
+         */
+        if (tb[IFLA_NET_NS_PID])
+                net = get_net_ns_by_pid(nla_get_u32(tb[IFLA_NET_NS_PID]));
+        else
+                net = get_net(src_net);
+        return net;
+}
+EXPORT_SYMBOL(rtnl_link_get_net);
+
 static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
 {
         if (dev) {
@@ -738,6 +850,52 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
         return 0;
 }
 
+static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
+{
+        int rem, err = -EINVAL;
+        struct nlattr *vf;
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        nla_for_each_nested(vf, attr, rem) {
+                switch (nla_type(vf)) {
+                case IFLA_VF_MAC: {
+                        struct ifla_vf_mac *ivm;
+                        ivm = nla_data(vf);
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_set_vf_mac)
+                                err = ops->ndo_set_vf_mac(dev, ivm->vf,
+                                                          ivm->mac);
+                        break;
+                }
+                case IFLA_VF_VLAN: {
+                        struct ifla_vf_vlan *ivv;
+                        ivv = nla_data(vf);
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_set_vf_vlan)
+                                err = ops->ndo_set_vf_vlan(dev, ivv->vf,
+                                                           ivv->vlan,
+                                                           ivv->qos);
+                        break;
+                }
+                case IFLA_VF_TX_RATE: {
+                        struct ifla_vf_tx_rate *ivt;
+                        ivt = nla_data(vf);
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_set_vf_tx_rate)
+                                err = ops->ndo_set_vf_tx_rate(dev, ivt->vf,
+                                                              ivt->rate);
+                        break;
+                }
+                default:
+                        err = -EINVAL;
+                        break;
+                }
+                if (err)
+                        break;
+        }
+        return err;
+}
+
 static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                       struct nlattr **tb, char *ifname, int modified)
 {
@@ -746,8 +904,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
         int err;
 
         if (tb[IFLA_NET_NS_PID]) {
-                struct net *net;
-                net = get_net_ns_by_pid(nla_get_u32(tb[IFLA_NET_NS_PID]));
+                struct net *net = rtnl_link_get_net(dev_net(dev), tb);
                 if (IS_ERR(net)) {
                         err = PTR_ERR(net);
                         goto errout;
@@ -852,13 +1009,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
         }
 
         if (ifm->ifi_flags || ifm->ifi_change) {
-                unsigned int flags = ifm->ifi_flags;
-
-                /* bugwards compatibility: ifi_change == 0 is treated as ~0 */
-                if (ifm->ifi_change)
-                        flags = (flags & ifm->ifi_change) |
-                                (dev->flags & ~ifm->ifi_change);
-                err = dev_change_flags(dev, flags);
+                err = dev_change_flags(dev, rtnl_dev_combine_flags(dev, ifm));
                 if (err < 0)
                         goto errout;
         }
@@ -875,6 +1026,18 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 write_unlock_bh(&dev_base_lock);
         }
 
+        if (tb[IFLA_VFINFO_LIST]) {
+                struct nlattr *attr;
+                int rem;
+                nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
+                        if (nla_type(attr) != IFLA_VF_INFO)
+                                goto errout;
+                        err = do_setvfinfo(dev, attr);
+                        if (err < 0)
+                                goto errout;
+                        modified = 1;
+                }
+        }
         err = 0;
 
 errout:
@@ -910,9 +1073,9 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         err = -EINVAL;
         ifm = nlmsg_data(nlh);
         if (ifm->ifi_index > 0)
-                dev = dev_get_by_index(net, ifm->ifi_index);
+                dev = __dev_get_by_index(net, ifm->ifi_index);
         else if (tb[IFLA_IFNAME])
-                dev = dev_get_by_name(net, ifname);
+                dev = __dev_get_by_name(net, ifname);
         else
                 goto errout;
 
@@ -921,12 +1084,11 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 goto errout;
         }
 
-        if ((err = validate_linkmsg(dev, tb)) < 0)
-                goto errout_dev;
+        err = validate_linkmsg(dev, tb);
+        if (err < 0)
+                goto errout;
 
         err = do_setlink(dev, ifm, tb, ifname, 0);
-errout_dev:
-        dev_put(dev);
 errout:
         return err;
 }
@@ -963,12 +1125,32 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         if (!ops)
                 return -EOPNOTSUPP;
 
-        ops->dellink(dev);
+        ops->dellink(dev, NULL);
         return 0;
 }
 
-struct net_device *rtnl_create_link(struct net *net, char *ifname,
-                const struct rtnl_link_ops *ops, struct nlattr *tb[])
+int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm)
+{
+        unsigned int old_flags;
+        int err;
+
+        old_flags = dev->flags;
+        if (ifm && (ifm->ifi_flags || ifm->ifi_change)) {
+                err = __dev_change_flags(dev, rtnl_dev_combine_flags(dev, ifm));
+                if (err < 0)
+                        return err;
+        }
+
+        dev->rtnl_link_state = RTNL_LINK_INITIALIZED;
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
+        __dev_notify_flags(dev, old_flags);
+        return 0;
+}
+EXPORT_SYMBOL(rtnl_configure_link);
+
+struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
+        char *ifname, const struct rtnl_link_ops *ops, struct nlattr *tb[])
 {
         int err;
         struct net_device *dev;
@@ -976,7 +1158,8 @@ struct net_device *rtnl_create_link(struct net *net, char *ifname,
         unsigned int real_num_queues = 1;
 
         if (ops->get_tx_queues) {
-                err = ops->get_tx_queues(net, tb, &num_queues, &real_num_queues);
+                err = ops->get_tx_queues(src_net, tb, &num_queues,
+                                         &real_num_queues);
                 if (err)
                         goto err;
         }
@@ -985,16 +1168,17 @@ struct net_device *rtnl_create_link(struct net *net, char *ifname,
         if (!dev)
                 goto err;
 
+        dev_net_set(dev, net);
+        dev->rtnl_link_ops = ops;
+        dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
         dev->real_num_tx_queues = real_num_queues;
+
         if (strchr(dev->name, '%')) {
                 err = dev_alloc_name(dev, dev->name);
                 if (err < 0)
                         goto err_free;
         }
 
-        dev_net_set(dev, net);
-        dev->rtnl_link_ops = ops;
-
         if (tb[IFLA_MTU])
                 dev->mtu = nla_get_u32(tb[IFLA_MTU]);
         if (tb[IFLA_ADDRESS])
@@ -1017,6 +1201,7 @@ err_free:
 err:
         return ERR_PTR(err);
 }
+EXPORT_SYMBOL(rtnl_create_link);
 
 static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
@@ -1050,7 +1235,8 @@ replay:
         else
                 dev = NULL;
 
-        if ((err = validate_linkmsg(dev, tb)) < 0)
+        err = validate_linkmsg(dev, tb);
+        if (err < 0)
                 return err;
 
         if (tb[IFLA_LINKINFO]) {
@@ -1071,6 +1257,7 @@ replay:
 
         if (1) {
                 struct nlattr *attr[ops ? ops->maxtype + 1 : 0], **data = NULL;
+                struct net *dest_net;
 
                 if (ops) {
                         if (ops->maxtype && linkinfo[IFLA_INFO_DATA]) {
@@ -1113,7 +1300,7 @@ replay:
                 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
                         return -ENODEV;
 
-                if (ifm->ifi_index || ifm->ifi_flags || ifm->ifi_change)
+                if (ifm->ifi_index)
                         return -EOPNOTSUPP;
                 if (tb[IFLA_MAP] || tb[IFLA_MASTER] || tb[IFLA_PROTINFO])
                         return -EOPNOTSUPP;
@@ -1135,17 +1322,26 @@ replay:
                 if (!ifname[0])
                         snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
 
-                dev = rtnl_create_link(net, ifname, ops, tb);
+                dest_net = rtnl_link_get_net(net, tb);
+                dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
 
                 if (IS_ERR(dev))
                         err = PTR_ERR(dev);
                 else if (ops->newlink)
-                        err = ops->newlink(dev, tb, data);
+                        err = ops->newlink(net, dev, tb, data);
                 else
                         err = register_netdevice(dev);
 
                 if (err < 0 && !IS_ERR(dev))
                         free_netdev(dev);
+                if (err < 0)
+                        goto out;
+
+                err = rtnl_configure_link(dev, ifm);
+                if (err < 0)
+                        unregister_netdevice(dev);
+out:
+                put_net(dest_net);
                 return err;
         }
 }
@@ -1154,6 +1350,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
         struct net *net = sock_net(skb->sk);
         struct ifinfomsg *ifm;
+        char ifname[IFNAMSIZ];
         struct nlattr *tb[IFLA_MAX+1];
         struct net_device *dev = NULL;
         struct sk_buff *nskb;
@@ -1163,19 +1360,23 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 return err;
 
+        if (tb[IFLA_IFNAME])
+                nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
+
         ifm = nlmsg_data(nlh);
-        if (ifm->ifi_index > 0) {
-                dev = dev_get_by_index(net, ifm->ifi_index);
-                if (dev == NULL)
-                        return -ENODEV;
-        } else
+        if (ifm->ifi_index > 0)
+                dev = __dev_get_by_index(net, ifm->ifi_index);
+        else if (tb[IFLA_IFNAME])
+                dev = __dev_get_by_name(net, ifname);
+        else
                 return -EINVAL;
 
+        if (dev == NULL)
+                return -ENODEV;
+
         nskb = nlmsg_new(if_nlmsg_size(dev), GFP_KERNEL);
-        if (nskb == NULL) {
-                err = -ENOBUFS;
-                goto errout;
-        }
+        if (nskb == NULL)
+                return -ENOBUFS;
 
         err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).pid,
                                nlh->nlmsg_seq, 0, 0);
@@ -1183,11 +1384,8 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
                 kfree_skb(nskb);
-                goto errout;
-        }
-        err = rtnl_unicast(nskb, net, NETLINK_CB(skb).pid);
-errout:
-        dev_put(dev);
+        } else
+                err = rtnl_unicast(nskb, net, NETLINK_CB(skb).pid);
 
         return err;
 }
@@ -1199,7 +1397,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
 
         if (s_idx == 0)
                 s_idx = 1;
-        for (idx=1; idx<NPROTO; idx++) {
+        for (idx = 1; idx < NPROTO; idx++) {
                 int type = cb->nlh->nlmsg_type-RTM_BASE;
                 if (idx < s_idx || idx == PF_PACKET)
                         continue;
@@ -1266,7 +1464,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (nlh->nlmsg_len < NLMSG_LENGTH(sizeof(struct rtgenmsg)))
                 return 0;
 
-        family = ((struct rtgenmsg*)NLMSG_DATA(nlh))->rtgen_family;
+        family = ((struct rtgenmsg *)NLMSG_DATA(nlh))->rtgen_family;
         if (family >= NPROTO)
                 return -EAFNOSUPPORT;
 
@@ -1299,7 +1497,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
         if (nlh->nlmsg_len > min_len) {
                 int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
-                struct rtattr *attr = (void*)nlh + NLMSG_ALIGN(min_len);
+                struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
 
                 while (RTA_OK(attr, attrlen)) {
                         unsigned flavor = attr->rta_type;
@@ -1331,18 +1529,15 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
         struct net_device *dev = ptr;
 
         switch (event) {
-        case NETDEV_UNREGISTER:
-                rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
-                break;
-        case NETDEV_REGISTER:
-                rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
-                break;
         case NETDEV_UP:
         case NETDEV_DOWN:
-                rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
-                break;
+        case NETDEV_PRE_UP:
+        case NETDEV_POST_INIT:
+        case NETDEV_REGISTER:
         case NETDEV_CHANGE:
         case NETDEV_GOING_DOWN:
+        case NETDEV_UNREGISTER:
+        case NETDEV_UNREGISTER_BATCH:
                 break;
         default:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
@@ -1356,7 +1551,7 @@ static struct notifier_block rtnetlink_dev_notifier = {
 };
 
 
-static int rtnetlink_net_init(struct net *net)
+static int __net_init rtnetlink_net_init(struct net *net)
 {
         struct sock *sk;
         sk = netlink_kernel_create(net, NETLINK_ROUTE, RTNLGRP_MAX,
@@ -1367,7 +1562,7 @@ static int rtnetlink_net_init(struct net *net)
         return 0;
 }
 
-static void rtnetlink_net_exit(struct net *net)
+static void __net_exit rtnetlink_net_exit(struct net *net)
 {
         netlink_kernel_release(net->rtnl);
         net->rtnl = NULL;
@@ -1405,14 +1600,3 @@ void __init rtnetlink_init(void)
         rtnl_register(PF_UNSPEC, RTM_GETROUTE, NULL, rtnl_dump_all);
 }
 
-EXPORT_SYMBOL(__rta_fill);
-EXPORT_SYMBOL(rtnetlink_put_metrics);
-EXPORT_SYMBOL(rtnl_lock);
-EXPORT_SYMBOL(rtnl_trylock);
-EXPORT_SYMBOL(rtnl_unlock);
-EXPORT_SYMBOL(rtnl_is_locked);
-EXPORT_SYMBOL(rtnl_unicast);
-EXPORT_SYMBOL(rtnl_notify);
-EXPORT_SYMBOL(rtnl_set_sk_err);
-EXPORT_SYMBOL(rtnl_create_link);
-EXPORT_SYMBOL(ifla_policy);
diff --git a/net/core/scm.c b/net/core/scm.c
index b7ba91b074b3..b88f6f9d0b97 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -26,6 +26,7 @@
 #include <linux/security.h>
 #include <linux/pid.h>
 #include <linux/nsproxy.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -156,6 +157,8 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                 switch (cmsg->cmsg_type)
                 {
                 case SCM_RIGHTS:
+                        if (!sock->ops || sock->ops->family != PF_UNIX)
+                                goto error;
                         err=scm_fp_copy(cmsg, &p->fp);
                         if (err<0)
                                 goto error;
diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c
deleted file mode 100644
index 79687dfd6957..000000000000
--- a/net/core/skb_dma_map.c
+++ /dev/null
@@ -1,65 +0,0 @@
-/* skb_dma_map.c: DMA mapping helpers for socket buffers.
- *
- * Copyright (C) David S. Miller <davem@davemloft.net>
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/dma-mapping.h>
-#include <linux/skbuff.h>
-
-int skb_dma_map(struct device *dev, struct sk_buff *skb,
-                enum dma_data_direction dir)
-{
-        struct skb_shared_info *sp = skb_shinfo(skb);
-        dma_addr_t map;
-        int i;
-
-        map = dma_map_single(dev, skb->data,
-                             skb_headlen(skb), dir);
-        if (dma_mapping_error(dev, map))
-                goto out_err;
-
-        sp->dma_head = map;
-        for (i = 0; i < sp->nr_frags; i++) {
-                skb_frag_t *fp = &sp->frags[i];
-
-                map = dma_map_page(dev, fp->page, fp->page_offset,
-                                   fp->size, dir);
-                if (dma_mapping_error(dev, map))
-                        goto unwind;
-                sp->dma_maps[i] = map;
-        }
-
-        return 0;
-
-unwind:
-        while (--i >= 0) {
-                skb_frag_t *fp = &sp->frags[i];
-
-                dma_unmap_page(dev, sp->dma_maps[i],
-                               fp->size, dir);
-        }
-        dma_unmap_single(dev, sp->dma_head,
-                         skb_headlen(skb), dir);
-out_err:
-        return -ENOMEM;
-}
-EXPORT_SYMBOL(skb_dma_map);
-
-void skb_dma_unmap(struct device *dev, struct sk_buff *skb,
-                   enum dma_data_direction dir)
-{
-        struct skb_shared_info *sp = skb_shinfo(skb);
-        int i;
-
-        dma_unmap_single(dev, sp->dma_head,
-                         skb_headlen(skb), dir);
-        for (i = 0; i < sp->nr_frags; i++) {
-                skb_frag_t *fp = &sp->frags[i];
-
-                dma_unmap_page(dev, sp->dma_maps[i],
-                               fp->size, dir);
-        }
-}
-EXPORT_SYMBOL(skb_dma_unmap);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ec85681a7dd8..93c4e060c91e 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -93,7 +93,7 @@ static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
 
 
 /* Pipe buffer operations for a socket. */
-static struct pipe_buf_operations sock_pipe_buf_ops = {
+static const struct pipe_buf_operations sock_pipe_buf_ops = {
         .can_merge = 0,
         .map = generic_pipe_buf_map,
         .unmap = generic_pipe_buf_unmap,
@@ -493,6 +493,9 @@ int skb_recycle_check(struct sk_buff *skb, int skb_size)
 {
         struct skb_shared_info *shinfo;
 
+        if (irqs_disabled())
+                return 0;
+
         if (skb_is_nonlinear(skb) || skb->fclone != SKB_FCLONE_UNAVAILABLE)
                 return 0;
 
@@ -546,7 +549,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 #endif
         new->protocol           = old->protocol;
         new->mark               = old->mark;
-        new->iif                = old->iif;
+        new->skb_iif            = old->skb_iif;
         __nf_copy(new, old);
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
diff --git a/net/core/sock.c b/net/core/sock.c
index 7626b6aacd68..c5812bbc2cc9 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -274,25 +274,27 @@ static void sock_disable_timestamp(struct sock *sk, int flag)
 
 int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int err = 0;
+        int err;
         int skb_len;
+        unsigned long flags;
+        struct sk_buff_head *list = &sk->sk_receive_queue;
 
         /* Cast sk->rcvbuf to unsigned... It's pointless, but reduces
            number of warnings when compiling with -W --ANK
          */
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned)sk->sk_rcvbuf) {
-                err = -ENOMEM;
-                goto out;
+                atomic_inc(&sk->sk_drops);
+                return -ENOMEM;
         }
 
         err = sk_filter(sk, skb);
         if (err)
-                goto out;
+                return err;
 
         if (!sk_rmem_schedule(sk, skb->truesize)) {
-                err = -ENOBUFS;
-                goto out;
+                atomic_inc(&sk->sk_drops);
+                return -ENOBUFS;
         }
 
         skb->dev = NULL;
@@ -305,12 +307,14 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
          */
         skb_len = skb->len;
 
-        skb_queue_tail(&sk->sk_receive_queue, skb);
+        spin_lock_irqsave(&list->lock, flags);
+        skb->dropcount = atomic_read(&sk->sk_drops);
+        __skb_queue_tail(list, skb);
+        spin_unlock_irqrestore(&list->lock, flags);
 
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_data_ready(sk, skb_len);
-out:
-        return err;
+        return 0;
 }
 EXPORT_SYMBOL(sock_queue_rcv_skb);
 
@@ -336,8 +340,12 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
                 rc = sk_backlog_rcv(sk, skb);
 
                 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
-        } else
-                sk_add_backlog(sk, skb);
+        } else if (sk_add_backlog(sk, skb)) {
+                bh_unlock_sock(sk);
+                atomic_inc(&sk->sk_drops);
+                goto discard_and_relse;
+        }
+
         bh_unlock_sock(sk);
 out:
         sock_put(sk);
@@ -348,11 +356,18 @@ discard_and_relse:
 }
 EXPORT_SYMBOL(sk_receive_skb);
 
+void sk_reset_txq(struct sock *sk)
+{
+        sk_tx_queue_clear(sk);
+}
+EXPORT_SYMBOL(sk_reset_txq);
+
 struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
 {
         struct dst_entry *dst = sk->sk_dst_cache;
 
         if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
+                sk_tx_queue_clear(sk);
                 sk->sk_dst_cache = NULL;
                 dst_release(dst);
                 return NULL;
@@ -406,17 +421,18 @@ static int sock_bindtodevice(struct sock *sk, char __user *optval, int optlen)
         if (copy_from_user(devname, optval, optlen))
                 goto out;
 
-        if (devname[0] == '\0') {
-                index = 0;
-        } else {
-                struct net_device *dev = dev_get_by_name(net, devname);
+        index = 0;
+        if (devname[0] != '\0') {
+                struct net_device *dev;
 
+                rcu_read_lock();
+                dev = dev_get_by_name_rcu(net, devname);
+                if (dev)
+                        index = dev->ifindex;
+                rcu_read_unlock();
                 ret = -ENODEV;
                 if (!dev)
                         goto out;
-
-                index = dev->ifindex;
-                dev_put(dev);
         }
 
         lock_sock(sk);
@@ -702,6 +718,12 @@ set_rcvbuf:
 
                 /* We implement the SO_SNDLOWAT etc to
                    not be settable (1003.1g 5.3) */
+        case SO_RXQ_OVFL:
+                if (valbool)
+                        sock_set_flag(sk, SOCK_RXQ_OVFL);
+                else
+                        sock_reset_flag(sk, SOCK_RXQ_OVFL);
+                break;
         default:
                 ret = -ENOPROTOOPT;
                 break;
@@ -723,7 +745,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 struct timeval tm;
         } v;
 
-        unsigned int lv = sizeof(int);
+        int lv = sizeof(int);
         int len;
 
         if (get_user(len, optlen))
@@ -901,6 +923,10 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 v.val = sk->sk_mark;
                 break;
 
+        case SO_RXQ_OVFL:
+                v.val = !!sock_flag(sk, SOCK_RXQ_OVFL);
+                break;
+
         default:
                 return -ENOPROTOOPT;
         }
@@ -939,7 +965,8 @@ static void sock_copy(struct sock *nsk, const struct sock *osk)
         void *sptr = nsk->sk_security;
 #endif
         BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
-                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt));
+                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt) +
+                     sizeof(osk->sk_tx_queue_mapping));
         memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
                osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
 #ifdef CONFIG_SECURITY_NETWORK
@@ -983,6 +1010,7 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
 
                 if (!try_module_get(prot->owner))
                         goto out_free_sec;
+                sk_tx_queue_clear(sk);
         }
 
         return sk;
@@ -1049,7 +1077,8 @@ static void __sk_free(struct sock *sk)
         if (sk->sk_destruct)
                 sk->sk_destruct(sk);
 
-        filter = rcu_dereference(sk->sk_filter);
+        filter = rcu_dereference_check(sk->sk_filter,
+                                       atomic_read(&sk->sk_wmem_alloc) == 0);
         if (filter) {
                 sk_filter_uncharge(sk, filter);
                 rcu_assign_pointer(sk->sk_filter, NULL);
@@ -1114,6 +1143,7 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
                 sock_lock_init(newsk);
                 bh_lock_sock(newsk);
                 newsk->sk_backlog.head  = newsk->sk_backlog.tail = NULL;
+                newsk->sk_backlog.len = 0;
 
                 atomic_set(&newsk->sk_rmem_alloc, 0);
                 /*
@@ -1181,6 +1211,10 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
 
                 if (newsk->sk_prot->sockets_allocated)
                         percpu_counter_inc(newsk->sk_prot->sockets_allocated);
+
+                if (sock_flag(newsk, SOCK_TIMESTAMP) ||
+                    sock_flag(newsk, SOCK_TIMESTAMPING_RX_SOFTWARE))
+                        net_enable_timestamp();
         }
 out:
         return newsk;
@@ -1513,6 +1547,12 @@ static void __release_sock(struct sock *sk)
 
                 bh_lock_sock(sk);
         } while ((skb = sk->sk_backlog.head) != NULL);
+
+        /*
+         * Doing the zeroing here guarantee we can not loop forever
+         * while a wild producer attempts to flood us.
+         */
+        sk->sk_backlog.len = 0;
 }
 
 /**
@@ -1845,6 +1885,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         sk->sk_allocation       =       GFP_KERNEL;
         sk->sk_rcvbuf           =       sysctl_rmem_default;
         sk->sk_sndbuf           =       sysctl_wmem_default;
+        sk->sk_backlog.limit    =       sk->sk_rcvbuf << 1;
         sk->sk_state            =       TCP_CLOSE;
         sk_set_socket(sk, sock);
 
@@ -2112,13 +2153,13 @@ int sock_prot_inuse_get(struct net *net, struct proto *prot)
 }
 EXPORT_SYMBOL_GPL(sock_prot_inuse_get);
 
-static int sock_inuse_init_net(struct net *net)
+static int __net_init sock_inuse_init_net(struct net *net)
 {
         net->core.inuse = alloc_percpu(struct prot_inuse);
         return net->core.inuse ? 0 : -ENOMEM;
 }
 
-static void sock_inuse_exit_net(struct net *net)
+static void __net_exit sock_inuse_exit_net(struct net *net)
 {
         free_percpu(net->core.inuse);
 }
@@ -2200,13 +2241,10 @@ int proto_register(struct proto *prot, int alloc_slab)
                 }
 
                 if (prot->rsk_prot != NULL) {
-                        static const char mask[] = "request_sock_%s";
-
-                        prot->rsk_prot->slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->rsk_prot->slab_name = kasprintf(GFP_KERNEL, "request_sock_%s", prot->name);
                         if (prot->rsk_prot->slab_name == NULL)
                                 goto out_free_sock_slab;
 
-                        sprintf(prot->rsk_prot->slab_name, mask, prot->name);
                         prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name,
                                                                  prot->rsk_prot->obj_size, 0,
                                                                  SLAB_HWCACHE_ALIGN, NULL);
@@ -2219,14 +2257,11 @@ int proto_register(struct proto *prot, int alloc_slab)
                 }
 
                 if (prot->twsk_prot != NULL) {
-                        static const char mask[] = "tw_sock_%s";
-
-                        prot->twsk_prot->twsk_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->twsk_prot->twsk_slab_name = kasprintf(GFP_KERNEL, "tw_sock_%s", prot->name);
 
                         if (prot->twsk_prot->twsk_slab_name == NULL)
                                 goto out_free_request_sock_slab;
 
-                        sprintf(prot->twsk_prot->twsk_slab_name, mask, prot->name);
                         prot->twsk_prot->twsk_slab =
                                 kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                   prot->twsk_prot->twsk_obj_size,
@@ -2253,7 +2288,8 @@ out_free_request_sock_slab:
                 prot->rsk_prot->slab = NULL;
         }
 out_free_request_sock_slab_name:
-        kfree(prot->rsk_prot->slab_name);
+        if (prot->rsk_prot)
+                kfree(prot->rsk_prot->slab_name);
 out_free_sock_slab:
         kmem_cache_destroy(prot->slab);
         prot->slab = NULL;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 7db1de0497c6..b7b6b8208f75 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -10,14 +10,16 @@
 #include <linux/module.h>
 #include <linux/socket.h>
 #include <linux/netdevice.h>
+#include <linux/ratelimit.h>
 #include <linux/init.h>
+#include <linux/slab.h>
+
 #include <net/ip.h>
 #include <net/sock.h>
 
 static struct ctl_table net_core_table[] = {
 #ifdef CONFIG_NET
         {
-                .ctl_name       = NET_CORE_WMEM_MAX,
                 .procname       = "wmem_max",
                 .data           = &sysctl_wmem_max,
                 .maxlen         = sizeof(int),
@@ -25,7 +27,6 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_RMEM_MAX,
                 .procname       = "rmem_max",
                 .data           = &sysctl_rmem_max,
                 .maxlen         = sizeof(int),
@@ -33,7 +34,6 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_WMEM_DEFAULT,
                 .procname       = "wmem_default",
                 .data           = &sysctl_wmem_default,
                 .maxlen         = sizeof(int),
@@ -41,7 +41,6 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_RMEM_DEFAULT,
                 .procname       = "rmem_default",
                 .data           = &sysctl_rmem_default,
                 .maxlen         = sizeof(int),
@@ -49,7 +48,6 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_DEV_WEIGHT,
                 .procname       = "dev_weight",
                 .data           = &weight_p,
                 .maxlen         = sizeof(int),
@@ -57,7 +55,6 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_MAX_BACKLOG,
                 .procname       = "netdev_max_backlog",
                 .data           = &netdev_max_backlog,
                 .maxlen         = sizeof(int),
@@ -65,16 +62,13 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_MSG_COST,
                 .procname       = "message_cost",
                 .data           = &net_ratelimit_state.interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_CORE_MSG_BURST,
                 .procname       = "message_burst",
                 .data           = &net_ratelimit_state.burst,
                 .maxlen         = sizeof(int),
@@ -82,7 +76,6 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_CORE_OPTMEM_MAX,
                 .procname       = "optmem_max",
                 .data           = &sysctl_optmem_max,
                 .maxlen         = sizeof(int),
@@ -91,7 +84,6 @@ static struct ctl_table net_core_table[] = {
         },
 #endif /* CONFIG_NET */
         {
-                .ctl_name       = NET_CORE_BUDGET,
                 .procname       = "netdev_budget",
                 .data           = &netdev_budget,
                 .maxlen         = sizeof(int),
@@ -99,31 +91,29 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_WARNINGS,
                 .procname       = "warnings",
                 .data           = &net_msg_warn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_table netns_core_table[] = {
         {
-                .ctl_name       = NET_CORE_SOMAXCONN,
                 .procname       = "somaxconn",
                 .data           = &init_net.core.sysctl_somaxconn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 __net_initdata struct ctl_path net_core_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "core", .ctl_name = NET_CORE, },
+        { .procname = "net", },
+        { .procname = "core", },
         { },
 };
 
@@ -134,7 +124,7 @@ static __net_init int sysctl_core_net_init(struct net *net)
         net->core.sysctl_somaxconn = SOMAXCONN;
 
         tbl = netns_core_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
                 if (tbl == NULL)
                         goto err_dup;
diff --git a/net/core/utils.c b/net/core/utils.c
index 83221aee7084..838250241d26 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -24,6 +24,8 @@
 #include <linux/types.h>
 #include <linux/percpu.h>
 #include <linux/init.h>
+#include <linux/ratelimit.h>
+
 #include <net/sock.h>
 
 #include <asm/byteorder.h>
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index ac1205df6c86..19ac2b985485 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -19,6 +19,7 @@
 
 #include <linux/netdevice.h>
 #include <linux/netlink.h>
+#include <linux/slab.h>
 #include <net/netlink.h>
 #include <net/rtnetlink.h>
 #include <linux/dcbnl.h>
@@ -54,7 +55,7 @@ MODULE_LICENSE("GPL");
 /**************** DCB attribute policies *************************************/
 
 /* DCB netlink attributes policy */
-static struct nla_policy dcbnl_rtnl_policy[DCB_ATTR_MAX + 1] = {
+static const struct nla_policy dcbnl_rtnl_policy[DCB_ATTR_MAX + 1] = {
         [DCB_ATTR_IFNAME]      = {.type = NLA_NUL_STRING, .len = IFNAMSIZ - 1},
         [DCB_ATTR_STATE]       = {.type = NLA_U8},
         [DCB_ATTR_PFC_CFG]     = {.type = NLA_NESTED},
@@ -68,7 +69,7 @@ static struct nla_policy dcbnl_rtnl_policy[DCB_ATTR_MAX + 1] = {
 };
 
 /* DCB priority flow control to User Priority nested attributes */
-static struct nla_policy dcbnl_pfc_up_nest[DCB_PFC_UP_ATTR_MAX + 1] = {
+static const struct nla_policy dcbnl_pfc_up_nest[DCB_PFC_UP_ATTR_MAX + 1] = {
         [DCB_PFC_UP_ATTR_0]   = {.type = NLA_U8},
         [DCB_PFC_UP_ATTR_1]   = {.type = NLA_U8},
         [DCB_PFC_UP_ATTR_2]   = {.type = NLA_U8},
@@ -81,7 +82,7 @@ static struct nla_policy dcbnl_pfc_up_nest[DCB_PFC_UP_ATTR_MAX + 1] = {
 };
 
 /* DCB priority grouping nested attributes */
-static struct nla_policy dcbnl_pg_nest[DCB_PG_ATTR_MAX + 1] = {
+static const struct nla_policy dcbnl_pg_nest[DCB_PG_ATTR_MAX + 1] = {
         [DCB_PG_ATTR_TC_0]      = {.type = NLA_NESTED},
         [DCB_PG_ATTR_TC_1]      = {.type = NLA_NESTED},
         [DCB_PG_ATTR_TC_2]      = {.type = NLA_NESTED},
@@ -103,7 +104,7 @@ static struct nla_policy dcbnl_pg_nest[DCB_PG_ATTR_MAX + 1] = {
 };
 
 /* DCB traffic class nested attributes. */
-static struct nla_policy dcbnl_tc_param_nest[DCB_TC_ATTR_PARAM_MAX + 1] = {
+static const struct nla_policy dcbnl_tc_param_nest[DCB_TC_ATTR_PARAM_MAX + 1] = {
         [DCB_TC_ATTR_PARAM_PGID]            = {.type = NLA_U8},
         [DCB_TC_ATTR_PARAM_UP_MAPPING]      = {.type = NLA_U8},
         [DCB_TC_ATTR_PARAM_STRICT_PRIO]     = {.type = NLA_U8},
@@ -112,7 +113,7 @@ static struct nla_policy dcbnl_tc_param_nest[DCB_TC_ATTR_PARAM_MAX + 1] = {
 };
 
 /* DCB capabilities nested attributes. */
-static struct nla_policy dcbnl_cap_nest[DCB_CAP_ATTR_MAX + 1] = {
+static const struct nla_policy dcbnl_cap_nest[DCB_CAP_ATTR_MAX + 1] = {
         [DCB_CAP_ATTR_ALL]     = {.type = NLA_FLAG},
         [DCB_CAP_ATTR_PG]      = {.type = NLA_U8},
         [DCB_CAP_ATTR_PFC]     = {.type = NLA_U8},
@@ -124,14 +125,14 @@ static struct nla_policy dcbnl_cap_nest[DCB_CAP_ATTR_MAX + 1] = {
 };
 
 /* DCB capabilities nested attributes. */
-static struct nla_policy dcbnl_numtcs_nest[DCB_NUMTCS_ATTR_MAX + 1] = {
+static const struct nla_policy dcbnl_numtcs_nest[DCB_NUMTCS_ATTR_MAX + 1] = {
         [DCB_NUMTCS_ATTR_ALL]     = {.type = NLA_FLAG},
         [DCB_NUMTCS_ATTR_PG]      = {.type = NLA_U8},
         [DCB_NUMTCS_ATTR_PFC]     = {.type = NLA_U8},
 };
 
 /* DCB BCN nested attributes. */
-static struct nla_policy dcbnl_bcn_nest[DCB_BCN_ATTR_MAX + 1] = {
+static const struct nla_policy dcbnl_bcn_nest[DCB_BCN_ATTR_MAX + 1] = {
         [DCB_BCN_ATTR_RP_0]         = {.type = NLA_U8},
         [DCB_BCN_ATTR_RP_1]         = {.type = NLA_U8},
         [DCB_BCN_ATTR_RP_2]         = {.type = NLA_U8},
@@ -160,7 +161,7 @@ static struct nla_policy dcbnl_bcn_nest[DCB_BCN_ATTR_MAX + 1] = {
 };
 
 /* DCB APP nested attributes. */
-static struct nla_policy dcbnl_app_nest[DCB_APP_ATTR_MAX + 1] = {
+static const struct nla_policy dcbnl_app_nest[DCB_APP_ATTR_MAX + 1] = {
         [DCB_APP_ATTR_IDTYPE]       = {.type = NLA_U8},
         [DCB_APP_ATTR_ID]           = {.type = NLA_U16},
         [DCB_APP_ATTR_PRIORITY]     = {.type = NLA_U8},
@@ -1085,8 +1086,8 @@ static int dcbnl_bcn_setcfg(struct net_device *netdev, struct nlattr **tb,
         u8 value_byte;
         u32 value_int;
 
-        if (!tb[DCB_ATTR_BCN] || !netdev->dcbnl_ops->setbcncfg
-            || !netdev->dcbnl_ops->setbcnrp)
+        if (!tb[DCB_ATTR_BCN] || !netdev->dcbnl_ops->setbcncfg ||
+            !netdev->dcbnl_ops->setbcnrp)
                 return ret;
 
         ret = nla_parse_nested(data, DCB_BCN_ATTR_MAX,
@@ -1126,7 +1127,7 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         u32 pid = skb ? NETLINK_CB(skb).pid : 0;
         int ret = -EINVAL;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         ret = nlmsg_parse(nlh, sizeof(*dcb), tb, DCB_ATTR_MAX,
diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index f3e9ba1cfd01..36479ca61e03 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -11,6 +11,8 @@
  *      published by the Free Software Foundation.
  */
 
+#include <linux/slab.h>
+
 #include "ccid.h"
 #include "ccids/lib/tfrc.h"
 
@@ -63,48 +65,37 @@ int ccid_getsockopt_builtin_ccids(struct sock *sk, int len,
         u8 *ccid_array, array_len;
         int err = 0;
 
-        if (len < ARRAY_SIZE(ccids))
-                return -EINVAL;
-
         if (ccid_get_builtin_ccids(&ccid_array, &array_len))
                 return -ENOBUFS;
 
-        if (put_user(array_len, optlen) ||
-            copy_to_user(optval, ccid_array, array_len))
+        if (put_user(array_len, optlen))
+                err = -EFAULT;
+        else if (len > 0 && copy_to_user(optval, ccid_array,
+                                         len > array_len ? array_len : len))
                 err = -EFAULT;
 
         kfree(ccid_array);
         return err;
 }
 
-static struct kmem_cache *ccid_kmem_cache_create(int obj_size, const char *fmt,...)
+static struct kmem_cache *ccid_kmem_cache_create(int obj_size, char *slab_name_fmt, const char *fmt,...)
 {
         struct kmem_cache *slab;
-        char slab_name_fmt[32], *slab_name;
         va_list args;
 
         va_start(args, fmt);
-        vsnprintf(slab_name_fmt, sizeof(slab_name_fmt), fmt, args);
+        vsnprintf(slab_name_fmt, CCID_SLAB_NAME_LENGTH, fmt, args);
         va_end(args);
 
-        slab_name = kstrdup(slab_name_fmt, GFP_KERNEL);
-        if (slab_name == NULL)
-                return NULL;
-        slab = kmem_cache_create(slab_name, sizeof(struct ccid) + obj_size, 0,
+        slab = kmem_cache_create(slab_name_fmt, sizeof(struct ccid) + obj_size, 0,
                                  SLAB_HWCACHE_ALIGN, NULL);
-        if (slab == NULL)
-                kfree(slab_name);
         return slab;
 }
 
 static void ccid_kmem_cache_destroy(struct kmem_cache *slab)
 {
-        if (slab != NULL) {
-                const char *name = kmem_cache_name(slab);
-
+        if (slab != NULL)
                 kmem_cache_destroy(slab);
-                kfree(name);
-        }
 }
 
 static int ccid_activate(struct ccid_operations *ccid_ops)
@@ -113,6 +104,7 @@ static int ccid_activate(struct ccid_operations *ccid_ops)
 
         ccid_ops->ccid_hc_rx_slab =
                         ccid_kmem_cache_create(ccid_ops->ccid_hc_rx_obj_size,
+                                               ccid_ops->ccid_hc_rx_slab_name,
                                                "ccid%u_hc_rx_sock",
                                                ccid_ops->ccid_id);
         if (ccid_ops->ccid_hc_rx_slab == NULL)
@@ -120,6 +112,7 @@ static int ccid_activate(struct ccid_operations *ccid_ops)
 
         ccid_ops->ccid_hc_tx_slab =
                         ccid_kmem_cache_create(ccid_ops->ccid_hc_tx_obj_size,
+                                               ccid_ops->ccid_hc_tx_slab_name,
                                                "ccid%u_hc_tx_sock",
                                                ccid_ops->ccid_id);
         if (ccid_ops->ccid_hc_tx_slab == NULL)
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index facedd20b531..6df6f8ac9636 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -19,7 +19,9 @@
 #include <linux/list.h>
 #include <linux/module.h>
 
-#define CCID_MAX 255
+/* maximum value for a CCID (RFC 4340, 19.5) */
+#define CCID_MAX                255
+#define CCID_SLAB_NAME_LENGTH   32
 
 struct tcp_info;
 
@@ -49,6 +51,8 @@ struct ccid_operations {
         const char              *ccid_name;
         struct kmem_cache       *ccid_hc_rx_slab,
                                 *ccid_hc_tx_slab;
+        char                    ccid_hc_rx_slab_name[CCID_SLAB_NAME_LENGTH];
+        char                    ccid_hc_tx_slab_name[CCID_SLAB_NAME_LENGTH];
         __u32                   ccid_hc_rx_obj_size,
                                 ccid_hc_tx_obj_size;
         /* Interface Routines */
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index e8cf99e880b0..9b3ae9922be1 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -23,6 +23,7 @@
 /*
  * This implementation should follow RFC 4341
  */
+#include <linux/slab.h>
 #include "../feat.h"
 #include "../ccid.h"
 #include "../dccp.h"
@@ -33,20 +34,20 @@
 static int ccid2_debug;
 #define ccid2_pr_debug(format, a...)    DCCP_PR_DEBUG(ccid2_debug, format, ##a)
 
-static void ccid2_hc_tx_check_sanity(const struct ccid2_hc_tx_sock *hctx)
+static void ccid2_hc_tx_check_sanity(const struct ccid2_hc_tx_sock *hc)
 {
         int len = 0;
         int pipe = 0;
-        struct ccid2_seq *seqp = hctx->ccid2hctx_seqh;
+        struct ccid2_seq *seqp = hc->tx_seqh;
 
         /* there is data in the chain */
-        if (seqp != hctx->ccid2hctx_seqt) {
+        if (seqp != hc->tx_seqt) {
                 seqp = seqp->ccid2s_prev;
                 len++;
                 if (!seqp->ccid2s_acked)
                         pipe++;
 
-                while (seqp != hctx->ccid2hctx_seqt) {
+                while (seqp != hc->tx_seqt) {
                         struct ccid2_seq *prev = seqp->ccid2s_prev;
 
                         len++;
@@ -63,30 +64,30 @@ static void ccid2_hc_tx_check_sanity(const struct ccid2_hc_tx_sock *hctx)
                 }
         }
 
-        BUG_ON(pipe != hctx->ccid2hctx_pipe);
+        BUG_ON(pipe != hc->tx_pipe);
         ccid2_pr_debug("len of chain=%d\n", len);
 
         do {
                 seqp = seqp->ccid2s_prev;
                 len++;
-        } while (seqp != hctx->ccid2hctx_seqh);
+        } while (seqp != hc->tx_seqh);
 
         ccid2_pr_debug("total len=%d\n", len);
-        BUG_ON(len != hctx->ccid2hctx_seqbufc * CCID2_SEQBUF_LEN);
+        BUG_ON(len != hc->tx_seqbufc * CCID2_SEQBUF_LEN);
 }
 #else
 #define ccid2_pr_debug(format, a...)
-#define ccid2_hc_tx_check_sanity(hctx)
+#define ccid2_hc_tx_check_sanity(hc)
 #endif
 
-static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hctx)
+static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hc)
 {
         struct ccid2_seq *seqp;
         int i;
 
         /* check if we have space to preserve the pointer to the buffer */
-        if (hctx->ccid2hctx_seqbufc >= (sizeof(hctx->ccid2hctx_seqbuf) /
-                                        sizeof(struct ccid2_seq*)))
+        if (hc->tx_seqbufc >= (sizeof(hc->tx_seqbuf) /
+                               sizeof(struct ccid2_seq *)))
                 return -ENOMEM;
 
         /* allocate buffer and initialize linked list */
@@ -102,29 +103,29 @@ static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hctx)
         seqp->ccid2s_prev = &seqp[CCID2_SEQBUF_LEN - 1];
 
         /* This is the first allocation.  Initiate the head and tail.  */
-        if (hctx->ccid2hctx_seqbufc == 0)
-                hctx->ccid2hctx_seqh = hctx->ccid2hctx_seqt = seqp;
+        if (hc->tx_seqbufc == 0)
+                hc->tx_seqh = hc->tx_seqt = seqp;
         else {
                 /* link the existing list with the one we just created */
-                hctx->ccid2hctx_seqh->ccid2s_next = seqp;
-                seqp->ccid2s_prev = hctx->ccid2hctx_seqh;
+                hc->tx_seqh->ccid2s_next = seqp;
+                seqp->ccid2s_prev = hc->tx_seqh;
 
-                hctx->ccid2hctx_seqt->ccid2s_prev = &seqp[CCID2_SEQBUF_LEN - 1];
-                seqp[CCID2_SEQBUF_LEN - 1].ccid2s_next = hctx->ccid2hctx_seqt;
+                hc->tx_seqt->ccid2s_prev = &seqp[CCID2_SEQBUF_LEN - 1];
+                seqp[CCID2_SEQBUF_LEN - 1].ccid2s_next = hc->tx_seqt;
         }
 
         /* store the original pointer to the buffer so we can free it */
-        hctx->ccid2hctx_seqbuf[hctx->ccid2hctx_seqbufc] = seqp;
-        hctx->ccid2hctx_seqbufc++;
+        hc->tx_seqbuf[hc->tx_seqbufc] = seqp;
+        hc->tx_seqbufc++;
 
         return 0;
 }
 
 static int ccid2_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (hctx->ccid2hctx_pipe < hctx->ccid2hctx_cwnd)
+        if (hc->tx_pipe < hc->tx_cwnd)
                 return 0;
 
         return 1; /* XXX CCID should dequeue when ready instead of polling */
@@ -133,7 +134,7 @@ static int ccid2_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 static void ccid2_change_l_ack_ratio(struct sock *sk, u32 val)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        u32 max_ratio = DIV_ROUND_UP(ccid2_hc_tx_sk(sk)->ccid2hctx_cwnd, 2);
+        u32 max_ratio = DIV_ROUND_UP(ccid2_hc_tx_sk(sk)->tx_cwnd, 2);
 
         /*
          * Ensure that Ack Ratio does not exceed ceil(cwnd/2), which is (2) from
@@ -155,10 +156,10 @@ static void ccid2_change_l_ack_ratio(struct sock *sk, u32 val)
         dp->dccps_l_ack_ratio = val;
 }
 
-static void ccid2_change_srtt(struct ccid2_hc_tx_sock *hctx, long val)
+static void ccid2_change_srtt(struct ccid2_hc_tx_sock *hc, long val)
 {
         ccid2_pr_debug("change SRTT to %ld\n", val);
-        hctx->ccid2hctx_srtt = val;
+        hc->tx_srtt = val;
 }
 
 static void ccid2_start_rto_timer(struct sock *sk);
@@ -166,45 +167,44 @@ static void ccid2_start_rto_timer(struct sock *sk);
 static void ccid2_hc_tx_rto_expire(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         long s;
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk)) {
-                sk_reset_timer(sk, &hctx->ccid2hctx_rtotimer,
-                               jiffies + HZ / 5);
+                sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + HZ / 5);
                 goto out;
         }
 
         ccid2_pr_debug("RTO_EXPIRE\n");
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 
         /* back-off timer */
-        hctx->ccid2hctx_rto <<= 1;
+        hc->tx_rto <<= 1;
 
-        s = hctx->ccid2hctx_rto / HZ;
+        s = hc->tx_rto / HZ;
         if (s > 60)
-                hctx->ccid2hctx_rto = 60 * HZ;
+                hc->tx_rto = 60 * HZ;
 
         ccid2_start_rto_timer(sk);
 
         /* adjust pipe, cwnd etc */
-        hctx->ccid2hctx_ssthresh = hctx->ccid2hctx_cwnd / 2;
-        if (hctx->ccid2hctx_ssthresh < 2)
-                hctx->ccid2hctx_ssthresh = 2;
-        hctx->ccid2hctx_cwnd     = 1;
-        hctx->ccid2hctx_pipe     = 0;
+        hc->tx_ssthresh = hc->tx_cwnd / 2;
+        if (hc->tx_ssthresh < 2)
+                hc->tx_ssthresh = 2;
+        hc->tx_cwnd      = 1;
+        hc->tx_pipe      = 0;
 
         /* clear state about stuff we sent */
-        hctx->ccid2hctx_seqt = hctx->ccid2hctx_seqh;
-        hctx->ccid2hctx_packets_acked = 0;
+        hc->tx_seqt = hc->tx_seqh;
+        hc->tx_packets_acked = 0;
 
         /* clear ack ratio state. */
-        hctx->ccid2hctx_rpseq    = 0;
-        hctx->ccid2hctx_rpdupack = -1;
+        hc->tx_rpseq    = 0;
+        hc->tx_rpdupack = -1;
         ccid2_change_l_ack_ratio(sk, 1);
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 out:
         bh_unlock_sock(sk);
         sock_put(sk);
@@ -212,42 +212,40 @@ out:
 
 static void ccid2_start_rto_timer(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        ccid2_pr_debug("setting RTO timeout=%ld\n", hctx->ccid2hctx_rto);
+        ccid2_pr_debug("setting RTO timeout=%ld\n", hc->tx_rto);
 
-        BUG_ON(timer_pending(&hctx->ccid2hctx_rtotimer));
-        sk_reset_timer(sk, &hctx->ccid2hctx_rtotimer,
-                       jiffies + hctx->ccid2hctx_rto);
+        BUG_ON(timer_pending(&hc->tx_rtotimer));
+        sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 }
 
 static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         struct ccid2_seq *next;
 
-        hctx->ccid2hctx_pipe++;
+        hc->tx_pipe++;
 
-        hctx->ccid2hctx_seqh->ccid2s_seq   = dp->dccps_gss;
-        hctx->ccid2hctx_seqh->ccid2s_acked = 0;
-        hctx->ccid2hctx_seqh->ccid2s_sent  = jiffies;
+        hc->tx_seqh->ccid2s_seq   = dp->dccps_gss;
+        hc->tx_seqh->ccid2s_acked = 0;
+        hc->tx_seqh->ccid2s_sent  = jiffies;
 
-        next = hctx->ccid2hctx_seqh->ccid2s_next;
+        next = hc->tx_seqh->ccid2s_next;
         /* check if we need to alloc more space */
-        if (next == hctx->ccid2hctx_seqt) {
-                if (ccid2_hc_tx_alloc_seq(hctx)) {
+        if (next == hc->tx_seqt) {
+                if (ccid2_hc_tx_alloc_seq(hc)) {
                         DCCP_CRIT("packet history - out of memory!");
                         /* FIXME: find a more graceful way to bail out */
                         return;
                 }
-                next = hctx->ccid2hctx_seqh->ccid2s_next;
-                BUG_ON(next == hctx->ccid2hctx_seqt);
+                next = hc->tx_seqh->ccid2s_next;
+                BUG_ON(next == hc->tx_seqt);
         }
-        hctx->ccid2hctx_seqh = next;
+        hc->tx_seqh = next;
 
-        ccid2_pr_debug("cwnd=%d pipe=%d\n", hctx->ccid2hctx_cwnd,
-                       hctx->ccid2hctx_pipe);
+        ccid2_pr_debug("cwnd=%d pipe=%d\n", hc->tx_cwnd, hc->tx_pipe);
 
         /*
          * FIXME: The code below is broken and the variables have been removed
@@ -270,12 +268,12 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
          */
 #if 0
         /* Ack Ratio.  Need to maintain a concept of how many windows we sent */
-        hctx->ccid2hctx_arsent++;
+        hc->tx_arsent++;
         /* We had an ack loss in this window... */
-        if (hctx->ccid2hctx_ackloss) {
-                if (hctx->ccid2hctx_arsent >= hctx->ccid2hctx_cwnd) {
-                        hctx->ccid2hctx_arsent  = 0;
-                        hctx->ccid2hctx_ackloss = 0;
+        if (hc->tx_ackloss) {
+                if (hc->tx_arsent >= hc->tx_cwnd) {
+                        hc->tx_arsent  = 0;
+                        hc->tx_ackloss = 0;
                 }
         } else {
                 /* No acks lost up to now... */
@@ -285,28 +283,28 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
                         int denom = dp->dccps_l_ack_ratio * dp->dccps_l_ack_ratio -
                                     dp->dccps_l_ack_ratio;
 
-                        denom = hctx->ccid2hctx_cwnd * hctx->ccid2hctx_cwnd / denom;
+                        denom = hc->tx_cwnd * hc->tx_cwnd / denom;
 
-                        if (hctx->ccid2hctx_arsent >= denom) {
+                        if (hc->tx_arsent >= denom) {
                                 ccid2_change_l_ack_ratio(sk, dp->dccps_l_ack_ratio - 1);
-                                hctx->ccid2hctx_arsent = 0;
+                                hc->tx_arsent = 0;
                         }
                 } else {
                         /* we can't increase ack ratio further [1] */
-                        hctx->ccid2hctx_arsent = 0; /* or maybe set it to cwnd*/
+                        hc->tx_arsent = 0; /* or maybe set it to cwnd*/
                 }
         }
 #endif
 
         /* setup RTO timer */
-        if (!timer_pending(&hctx->ccid2hctx_rtotimer))
+        if (!timer_pending(&hc->tx_rtotimer))
                 ccid2_start_rto_timer(sk);
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
         do {
-                struct ccid2_seq *seqp = hctx->ccid2hctx_seqt;
+                struct ccid2_seq *seqp = hc->tx_seqt;
 
-                while (seqp != hctx->ccid2hctx_seqh) {
+                while (seqp != hc->tx_seqh) {
                         ccid2_pr_debug("out seq=%llu acked=%d time=%lu\n",
                                        (unsigned long long)seqp->ccid2s_seq,
                                        seqp->ccid2s_acked, seqp->ccid2s_sent);
@@ -314,7 +312,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
                 }
         } while (0);
         ccid2_pr_debug("=========\n");
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 #endif
 }
 
@@ -382,9 +380,9 @@ out_invalid_option:
 
 static void ccid2_hc_tx_kill_rto_timer(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        sk_stop_timer(sk, &hctx->ccid2hctx_rtotimer);
+        sk_stop_timer(sk, &hc->tx_rtotimer);
         ccid2_pr_debug("deleted RTO timer\n");
 }
 
@@ -392,75 +390,75 @@ static inline void ccid2_new_ack(struct sock *sk,
                                  struct ccid2_seq *seqp,
                                  unsigned int *maxincr)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (hctx->ccid2hctx_cwnd < hctx->ccid2hctx_ssthresh) {
-                if (*maxincr > 0 && ++hctx->ccid2hctx_packets_acked == 2) {
-                        hctx->ccid2hctx_cwnd += 1;
-                        *maxincr             -= 1;
-                        hctx->ccid2hctx_packets_acked = 0;
+        if (hc->tx_cwnd < hc->tx_ssthresh) {
+                if (*maxincr > 0 && ++hc->tx_packets_acked == 2) {
+                        hc->tx_cwnd += 1;
+                        *maxincr    -= 1;
+                        hc->tx_packets_acked = 0;
                 }
-        } else if (++hctx->ccid2hctx_packets_acked >= hctx->ccid2hctx_cwnd) {
-                        hctx->ccid2hctx_cwnd += 1;
-                        hctx->ccid2hctx_packets_acked = 0;
+        } else if (++hc->tx_packets_acked >= hc->tx_cwnd) {
+                        hc->tx_cwnd += 1;
+                        hc->tx_packets_acked = 0;
         }
 
         /* update RTO */
-        if (hctx->ccid2hctx_srtt == -1 ||
-            time_after(jiffies, hctx->ccid2hctx_lastrtt + hctx->ccid2hctx_srtt)) {
+        if (hc->tx_srtt == -1 ||
+            time_after(jiffies, hc->tx_lastrtt + hc->tx_srtt)) {
                 unsigned long r = (long)jiffies - (long)seqp->ccid2s_sent;
                 int s;
 
                 /* first measurement */
-                if (hctx->ccid2hctx_srtt == -1) {
+                if (hc->tx_srtt == -1) {
                         ccid2_pr_debug("R: %lu Time=%lu seq=%llu\n",
                                        r, jiffies,
                                        (unsigned long long)seqp->ccid2s_seq);
-                        ccid2_change_srtt(hctx, r);
-                        hctx->ccid2hctx_rttvar = r >> 1;
+                        ccid2_change_srtt(hc, r);
+                        hc->tx_rttvar = r >> 1;
                 } else {
                         /* RTTVAR */
-                        long tmp = hctx->ccid2hctx_srtt - r;
+                        long tmp = hc->tx_srtt - r;
                         long srtt;
 
                         if (tmp < 0)
                                 tmp *= -1;
 
                         tmp >>= 2;
-                        hctx->ccid2hctx_rttvar *= 3;
-                        hctx->ccid2hctx_rttvar >>= 2;
-                        hctx->ccid2hctx_rttvar += tmp;
+                        hc->tx_rttvar *= 3;
+                        hc->tx_rttvar >>= 2;
+                        hc->tx_rttvar += tmp;
 
                         /* SRTT */
-                        srtt = hctx->ccid2hctx_srtt;
+                        srtt = hc->tx_srtt;
                         srtt *= 7;
                         srtt >>= 3;
                         tmp = r >> 3;
                         srtt += tmp;
-                        ccid2_change_srtt(hctx, srtt);
+                        ccid2_change_srtt(hc, srtt);
                 }
-                s = hctx->ccid2hctx_rttvar << 2;
+                s = hc->tx_rttvar << 2;
                 /* clock granularity is 1 when based on jiffies */
                 if (!s)
                         s = 1;
-                hctx->ccid2hctx_rto = hctx->ccid2hctx_srtt + s;
+                hc->tx_rto = hc->tx_srtt + s;
 
                 /* must be at least a second */
-                s = hctx->ccid2hctx_rto / HZ;
+                s = hc->tx_rto / HZ;
                 /* DCCP doesn't require this [but I like it cuz my code sux] */
 #if 1
                 if (s < 1)
-                        hctx->ccid2hctx_rto = HZ;
+                        hc->tx_rto = HZ;
 #endif
                 /* max 60 seconds */
                 if (s > 60)
-                        hctx->ccid2hctx_rto = HZ * 60;
+                        hc->tx_rto = HZ * 60;
 
-                hctx->ccid2hctx_lastrtt = jiffies;
+                hc->tx_lastrtt = jiffies;
 
                 ccid2_pr_debug("srtt: %ld rttvar: %ld rto: %ld (HZ=%d) R=%lu\n",
-                               hctx->ccid2hctx_srtt, hctx->ccid2hctx_rttvar,
-                               hctx->ccid2hctx_rto, HZ, r);
+                               hc->tx_srtt, hc->tx_rttvar,
+                               hc->tx_rto, HZ, r);
         }
 
         /* we got a new ack, so re-start RTO timer */
@@ -470,40 +468,40 @@ static inline void ccid2_new_ack(struct sock *sk,
 
 static void ccid2_hc_tx_dec_pipe(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (hctx->ccid2hctx_pipe == 0)
+        if (hc->tx_pipe == 0)
                 DCCP_BUG("pipe == 0");
         else
-                hctx->ccid2hctx_pipe--;
+                hc->tx_pipe--;
 
-        if (hctx->ccid2hctx_pipe == 0)
+        if (hc->tx_pipe == 0)
                 ccid2_hc_tx_kill_rto_timer(sk);
 }
 
 static void ccid2_congestion_event(struct sock *sk, struct ccid2_seq *seqp)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (time_before(seqp->ccid2s_sent, hctx->ccid2hctx_last_cong)) {
+        if (time_before(seqp->ccid2s_sent, hc->tx_last_cong)) {
                 ccid2_pr_debug("Multiple losses in an RTT---treating as one\n");
                 return;
         }
 
-        hctx->ccid2hctx_last_cong = jiffies;
+        hc->tx_last_cong = jiffies;
 
-        hctx->ccid2hctx_cwnd     = hctx->ccid2hctx_cwnd / 2 ? : 1U;
-        hctx->ccid2hctx_ssthresh = max(hctx->ccid2hctx_cwnd, 2U);
+        hc->tx_cwnd      = hc->tx_cwnd / 2 ? : 1U;
+        hc->tx_ssthresh  = max(hc->tx_cwnd, 2U);
 
         /* Avoid spurious timeouts resulting from Ack Ratio > cwnd */
-        if (dccp_sk(sk)->dccps_l_ack_ratio > hctx->ccid2hctx_cwnd)
-                ccid2_change_l_ack_ratio(sk, hctx->ccid2hctx_cwnd);
+        if (dccp_sk(sk)->dccps_l_ack_ratio > hc->tx_cwnd)
+                ccid2_change_l_ack_ratio(sk, hc->tx_cwnd);
 }
 
 static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         u64 ackno, seqno;
         struct ccid2_seq *seqp;
         unsigned char *vector;
@@ -512,7 +510,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         int done = 0;
         unsigned int maxincr = 0;
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
         /* check reverse path congestion */
         seqno = DCCP_SKB_CB(skb)->dccpd_seq;
 
@@ -521,21 +519,21 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
          * -sorbo.
          */
         /* need to bootstrap */
-        if (hctx->ccid2hctx_rpdupack == -1) {
-                hctx->ccid2hctx_rpdupack = 0;
-                hctx->ccid2hctx_rpseq = seqno;
+        if (hc->tx_rpdupack == -1) {
+                hc->tx_rpdupack = 0;
+                hc->tx_rpseq    = seqno;
         } else {
                 /* check if packet is consecutive */
-                if (dccp_delta_seqno(hctx->ccid2hctx_rpseq, seqno) == 1)
-                        hctx->ccid2hctx_rpseq = seqno;
+                if (dccp_delta_seqno(hc->tx_rpseq, seqno) == 1)
+                        hc->tx_rpseq = seqno;
                 /* it's a later packet */
-                else if (after48(seqno, hctx->ccid2hctx_rpseq)) {
-                        hctx->ccid2hctx_rpdupack++;
+                else if (after48(seqno, hc->tx_rpseq)) {
+                        hc->tx_rpdupack++;
 
                         /* check if we got enough dupacks */
-                        if (hctx->ccid2hctx_rpdupack >= NUMDUPACK) {
-                                hctx->ccid2hctx_rpdupack = -1; /* XXX lame */
-                                hctx->ccid2hctx_rpseq = 0;
+                        if (hc->tx_rpdupack >= NUMDUPACK) {
+                                hc->tx_rpdupack = -1; /* XXX lame */
+                                hc->tx_rpseq    = 0;
 
                                 ccid2_change_l_ack_ratio(sk, 2 * dp->dccps_l_ack_ratio);
                         }
@@ -544,7 +542,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 
         /* check forward path congestion */
         /* still didn't send out new data packets */
-        if (hctx->ccid2hctx_seqh == hctx->ccid2hctx_seqt)
+        if (hc->tx_seqh == hc->tx_seqt)
                 return;
 
         switch (DCCP_SKB_CB(skb)->dccpd_type) {
@@ -556,14 +554,14 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         }
 
         ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq;
-        if (after48(ackno, hctx->ccid2hctx_high_ack))
-                hctx->ccid2hctx_high_ack = ackno;
+        if (after48(ackno, hc->tx_high_ack))
+                hc->tx_high_ack = ackno;
 
-        seqp = hctx->ccid2hctx_seqt;
+        seqp = hc->tx_seqt;
         while (before48(seqp->ccid2s_seq, ackno)) {
                 seqp = seqp->ccid2s_next;
-                if (seqp == hctx->ccid2hctx_seqh) {
-                        seqp = hctx->ccid2hctx_seqh->ccid2s_prev;
+                if (seqp == hc->tx_seqh) {
+                        seqp = hc->tx_seqh->ccid2s_prev;
                         break;
                 }
         }
@@ -573,7 +571,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
          * packets per acknowledgement. Rounding up avoids that cwnd is not
          * advanced when Ack Ratio is 1 and gives a slight edge otherwise.
          */
-        if (hctx->ccid2hctx_cwnd < hctx->ccid2hctx_ssthresh)
+        if (hc->tx_cwnd < hc->tx_ssthresh)
                 maxincr = DIV_ROUND_UP(dp->dccps_l_ack_ratio, 2);
 
         /* go through all ack vectors */
@@ -592,7 +590,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                          * seqnos.
                          */
                         while (after48(seqp->ccid2s_seq, ackno)) {
-                                if (seqp == hctx->ccid2hctx_seqt) {
+                                if (seqp == hc->tx_seqt) {
                                         done = 1;
                                         break;
                                 }
@@ -624,7 +622,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                                        (unsigned long long)seqp->ccid2s_seq);
                                         ccid2_hc_tx_dec_pipe(sk);
                                 }
-                                if (seqp == hctx->ccid2hctx_seqt) {
+                                if (seqp == hc->tx_seqt) {
                                         done = 1;
                                         break;
                                 }
@@ -643,11 +641,11 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         /* The state about what is acked should be correct now
          * Check for NUMDUPACK
          */
-        seqp = hctx->ccid2hctx_seqt;
-        while (before48(seqp->ccid2s_seq, hctx->ccid2hctx_high_ack)) {
+        seqp = hc->tx_seqt;
+        while (before48(seqp->ccid2s_seq, hc->tx_high_ack)) {
                 seqp = seqp->ccid2s_next;
-                if (seqp == hctx->ccid2hctx_seqh) {
-                        seqp = hctx->ccid2hctx_seqh->ccid2s_prev;
+                if (seqp == hc->tx_seqh) {
+                        seqp = hc->tx_seqh->ccid2s_prev;
                         break;
                 }
         }
@@ -658,7 +656,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                         if (done == NUMDUPACK)
                                 break;
                 }
-                if (seqp == hctx->ccid2hctx_seqt)
+                if (seqp == hc->tx_seqt)
                         break;
                 seqp = seqp->ccid2s_prev;
         }
@@ -681,86 +679,86 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                 ccid2_congestion_event(sk, seqp);
                                 ccid2_hc_tx_dec_pipe(sk);
                         }
-                        if (seqp == hctx->ccid2hctx_seqt)
+                        if (seqp == hc->tx_seqt)
                                 break;
                         seqp = seqp->ccid2s_prev;
                 }
 
-                hctx->ccid2hctx_seqt = last_acked;
+                hc->tx_seqt = last_acked;
         }
 
         /* trim acked packets in tail */
-        while (hctx->ccid2hctx_seqt != hctx->ccid2hctx_seqh) {
-                if (!hctx->ccid2hctx_seqt->ccid2s_acked)
+        while (hc->tx_seqt != hc->tx_seqh) {
+                if (!hc->tx_seqt->ccid2s_acked)
                         break;
 
-                hctx->ccid2hctx_seqt = hctx->ccid2hctx_seqt->ccid2s_next;
+                hc->tx_seqt = hc->tx_seqt->ccid2s_next;
         }
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 }
 
 static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid_priv(ccid);
+        struct ccid2_hc_tx_sock *hc = ccid_priv(ccid);
         struct dccp_sock *dp = dccp_sk(sk);
         u32 max_ratio;
 
         /* RFC 4341, 5: initialise ssthresh to arbitrarily high (max) value */
-        hctx->ccid2hctx_ssthresh  = ~0U;
+        hc->tx_ssthresh = ~0U;
 
         /*
          * RFC 4341, 5: "The cwnd parameter is initialized to at most four
          * packets for new connections, following the rules from [RFC3390]".
          * We need to convert the bytes of RFC3390 into the packets of RFC 4341.
          */
-        hctx->ccid2hctx_cwnd = clamp(4380U / dp->dccps_mss_cache, 2U, 4U);
+        hc->tx_cwnd = clamp(4380U / dp->dccps_mss_cache, 2U, 4U);
 
         /* Make sure that Ack Ratio is enabled and within bounds. */
-        max_ratio = DIV_ROUND_UP(hctx->ccid2hctx_cwnd, 2);
+        max_ratio = DIV_ROUND_UP(hc->tx_cwnd, 2);
         if (dp->dccps_l_ack_ratio == 0 || dp->dccps_l_ack_ratio > max_ratio)
                 dp->dccps_l_ack_ratio = max_ratio;
 
         /* XXX init ~ to window size... */
-        if (ccid2_hc_tx_alloc_seq(hctx))
+        if (ccid2_hc_tx_alloc_seq(hc))
                 return -ENOMEM;
 
-        hctx->ccid2hctx_rto      = 3 * HZ;
-        ccid2_change_srtt(hctx, -1);
-        hctx->ccid2hctx_rttvar   = -1;
-        hctx->ccid2hctx_rpdupack = -1;
-        hctx->ccid2hctx_last_cong = jiffies;
-        setup_timer(&hctx->ccid2hctx_rtotimer, ccid2_hc_tx_rto_expire,
+        hc->tx_rto       = 3 * HZ;
+        ccid2_change_srtt(hc, -1);
+        hc->tx_rttvar    = -1;
+        hc->tx_rpdupack  = -1;
+        hc->tx_last_cong = jiffies;
+        setup_timer(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire,
                         (unsigned long)sk);
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
         return 0;
 }
 
 static void ccid2_hc_tx_exit(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         int i;
 
         ccid2_hc_tx_kill_rto_timer(sk);
 
-        for (i = 0; i < hctx->ccid2hctx_seqbufc; i++)
-                kfree(hctx->ccid2hctx_seqbuf[i]);
-        hctx->ccid2hctx_seqbufc = 0;
+        for (i = 0; i < hc->tx_seqbufc; i++)
+                kfree(hc->tx_seqbuf[i]);
+        hc->tx_seqbufc = 0;
 }
 
 static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
         const struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid2_hc_rx_sock *hcrx = ccid2_hc_rx_sk(sk);
+        struct ccid2_hc_rx_sock *hc = ccid2_hc_rx_sk(sk);
 
         switch (DCCP_SKB_CB(skb)->dccpd_type) {
         case DCCP_PKT_DATA:
         case DCCP_PKT_DATAACK:
-                hcrx->ccid2hcrx_data++;
-                if (hcrx->ccid2hcrx_data >= dp->dccps_r_ack_ratio) {
+                hc->rx_data++;
+                if (hc->rx_data >= dp->dccps_r_ack_ratio) {
                         dccp_send_ack(sk);
-                        hcrx->ccid2hcrx_data = 0;
+                        hc->rx_data = 0;
                 }
                 break;
         }
diff --git a/net/dccp/ccids/ccid2.h b/net/dccp/ccids/ccid2.h
index 326ac90fb909..1ec6a30103bb 100644
--- a/net/dccp/ccids/ccid2.h
+++ b/net/dccp/ccids/ccid2.h
@@ -40,34 +40,34 @@ struct ccid2_seq {
 
 /**
  * struct ccid2_hc_tx_sock - CCID2 TX half connection
- * @ccid2hctx_{cwnd,ssthresh,pipe}: as per RFC 4341, section 5
- * @ccid2hctx_packets_acked - Ack counter for deriving cwnd growth (RFC 3465)
- * @ccid2hctx_lastrtt -time RTT was last measured
- * @ccid2hctx_rpseq - last consecutive seqno
- * @ccid2hctx_rpdupack - dupacks since rpseq
+ * @tx_{cwnd,ssthresh,pipe}: as per RFC 4341, section 5
+ * @tx_packets_acked:        Ack counter for deriving cwnd growth (RFC 3465)
+ * @tx_lastrtt:              time RTT was last measured
+ * @tx_rpseq:                last consecutive seqno
+ * @tx_rpdupack:             dupacks since rpseq
  */
 struct ccid2_hc_tx_sock {
-        u32                     ccid2hctx_cwnd;
-        u32                     ccid2hctx_ssthresh;
-        u32                     ccid2hctx_pipe;
-        u32                     ccid2hctx_packets_acked;
-        struct ccid2_seq        *ccid2hctx_seqbuf[CCID2_SEQBUF_MAX];
-        int                     ccid2hctx_seqbufc;
-        struct ccid2_seq        *ccid2hctx_seqh;
-        struct ccid2_seq        *ccid2hctx_seqt;
-        long                    ccid2hctx_rto;
-        long                    ccid2hctx_srtt;
-        long                    ccid2hctx_rttvar;
-        unsigned long           ccid2hctx_lastrtt;
-        struct timer_list       ccid2hctx_rtotimer;
-        u64                     ccid2hctx_rpseq;
-        int                     ccid2hctx_rpdupack;
-        unsigned long           ccid2hctx_last_cong;
-        u64                     ccid2hctx_high_ack;
+        u32                     tx_cwnd;
+        u32                     tx_ssthresh;
+        u32                     tx_pipe;
+        u32                     tx_packets_acked;
+        struct ccid2_seq        *tx_seqbuf[CCID2_SEQBUF_MAX];
+        int                     tx_seqbufc;
+        struct ccid2_seq        *tx_seqh;
+        struct ccid2_seq        *tx_seqt;
+        long                    tx_rto;
+        long                    tx_srtt;
+        long                    tx_rttvar;
+        unsigned long           tx_lastrtt;
+        struct timer_list       tx_rtotimer;
+        u64                     tx_rpseq;
+        int                     tx_rpdupack;
+        unsigned long           tx_last_cong;
+        u64                     tx_high_ack;
 };
 
 struct ccid2_hc_rx_sock {
-        int     ccid2hcrx_data;
+        int     rx_data;
 };
 
 static inline struct ccid2_hc_tx_sock *ccid2_hc_tx_sk(const struct sock *sk)
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 34dcc798c457..bcd7632299f5 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -64,14 +64,14 @@ static const char *ccid3_tx_state_name(enum ccid3_hc_tx_states state)
 static void ccid3_hc_tx_set_state(struct sock *sk,
                                   enum ccid3_hc_tx_states state)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
-        enum ccid3_hc_tx_states oldstate = hctx->ccid3hctx_state;
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        enum ccid3_hc_tx_states oldstate = hc->tx_state;
 
         ccid3_pr_debug("%s(%p) %-8.8s -> %s\n",
                        dccp_role(sk), sk, ccid3_tx_state_name(oldstate),
                        ccid3_tx_state_name(state));
         WARN_ON(state == oldstate);
-        hctx->ccid3hctx_state = state;
+        hc->tx_state = state;
 }
 
 /*
@@ -85,37 +85,32 @@ static void ccid3_hc_tx_set_state(struct sock *sk,
  */
 static inline u64 rfc3390_initial_rate(struct sock *sk)
 {
-        const struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
-        const __u32 w_init = clamp_t(__u32, 4380U,
-                        2 * hctx->ccid3hctx_s, 4 * hctx->ccid3hctx_s);
+        const struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        const __u32 w_init = clamp_t(__u32, 4380U, 2 * hc->tx_s, 4 * hc->tx_s);
 
-        return scaled_div(w_init << 6, hctx->ccid3hctx_rtt);
+        return scaled_div(w_init << 6, hc->tx_rtt);
 }
 
 /*
  * Recalculate t_ipi and delta (should be called whenever X changes)
  */
-static void ccid3_update_send_interval(struct ccid3_hc_tx_sock *hctx)
+static void ccid3_update_send_interval(struct ccid3_hc_tx_sock *hc)
 {
         /* Calculate new t_ipi = s / X_inst (X_inst is in 64 * bytes/second) */
-        hctx->ccid3hctx_t_ipi = scaled_div32(((u64)hctx->ccid3hctx_s) << 6,
-                                             hctx->ccid3hctx_x);
+        hc->tx_t_ipi = scaled_div32(((u64)hc->tx_s) << 6, hc->tx_x);
 
         /* Calculate new delta by delta = min(t_ipi / 2, t_gran / 2) */
-        hctx->ccid3hctx_delta = min_t(u32, hctx->ccid3hctx_t_ipi / 2,
-                                           TFRC_OPSYS_HALF_TIME_GRAN);
-
-        ccid3_pr_debug("t_ipi=%u, delta=%u, s=%u, X=%u\n",
-                       hctx->ccid3hctx_t_ipi, hctx->ccid3hctx_delta,
-                       hctx->ccid3hctx_s, (unsigned)(hctx->ccid3hctx_x >> 6));
+        hc->tx_delta = min_t(u32, hc->tx_t_ipi / 2, TFRC_OPSYS_HALF_TIME_GRAN);
 
+        ccid3_pr_debug("t_ipi=%u, delta=%u, s=%u, X=%u\n", hc->tx_t_ipi,
+                       hc->tx_delta, hc->tx_s, (unsigned)(hc->tx_x >> 6));
 }
 
-static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hctx, ktime_t now)
+static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hc, ktime_t now)
 {
-        u32 delta = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count);
+        u32 delta = ktime_us_delta(now, hc->tx_t_last_win_count);
 
-        return delta / hctx->ccid3hctx_rtt;
+        return delta / hc->tx_rtt;
 }
 
 /**
@@ -130,9 +125,9 @@ static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hctx, ktime_t now)
  */
 static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
-        __u64 min_rate = 2 * hctx->ccid3hctx_x_recv;
-        const  __u64 old_x = hctx->ccid3hctx_x;
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        __u64 min_rate = 2 * hc->tx_x_recv;
+        const __u64 old_x = hc->tx_x;
         ktime_t now = stamp ? *stamp : ktime_get_real();
 
         /*
@@ -141,37 +136,31 @@ static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
          * a sender is idle if it has not sent anything over a 2-RTT-period.
          * For consistency with X and X_recv, min_rate is also scaled by 2^6.
          */
-        if (ccid3_hc_tx_idle_rtt(hctx, now) >= 2) {
+        if (ccid3_hc_tx_idle_rtt(hc, now) >= 2) {
                 min_rate = rfc3390_initial_rate(sk);
-                min_rate = max(min_rate, 2 * hctx->ccid3hctx_x_recv);
+                min_rate = max(min_rate, 2 * hc->tx_x_recv);
         }
 
-        if (hctx->ccid3hctx_p > 0) {
+        if (hc->tx_p > 0) {
 
-                hctx->ccid3hctx_x = min(((__u64)hctx->ccid3hctx_x_calc) << 6,
-                                        min_rate);
-                hctx->ccid3hctx_x = max(hctx->ccid3hctx_x,
-                                        (((__u64)hctx->ccid3hctx_s) << 6) /
-                                                                TFRC_T_MBI);
+                hc->tx_x = min(((__u64)hc->tx_x_calc) << 6, min_rate);
+                hc->tx_x = max(hc->tx_x, (((__u64)hc->tx_s) << 6) / TFRC_T_MBI);
 
-        } else if (ktime_us_delta(now, hctx->ccid3hctx_t_ld)
-                                - (s64)hctx->ccid3hctx_rtt >= 0) {
+        } else if (ktime_us_delta(now, hc->tx_t_ld) - (s64)hc->tx_rtt >= 0) {
 
-                hctx->ccid3hctx_x = min(2 * hctx->ccid3hctx_x, min_rate);
-                hctx->ccid3hctx_x = max(hctx->ccid3hctx_x,
-                            scaled_div(((__u64)hctx->ccid3hctx_s) << 6,
-                                       hctx->ccid3hctx_rtt));
-                hctx->ccid3hctx_t_ld = now;
+                hc->tx_x = min(2 * hc->tx_x, min_rate);
+                hc->tx_x = max(hc->tx_x,
+                               scaled_div(((__u64)hc->tx_s) << 6, hc->tx_rtt));
+                hc->tx_t_ld = now;
         }
 
-        if (hctx->ccid3hctx_x != old_x) {
+        if (hc->tx_x != old_x) {
                 ccid3_pr_debug("X_prev=%u, X_now=%u, X_calc=%u, "
                                "X_recv=%u\n", (unsigned)(old_x >> 6),
-                               (unsigned)(hctx->ccid3hctx_x >> 6),
-                               hctx->ccid3hctx_x_calc,
-                               (unsigned)(hctx->ccid3hctx_x_recv >> 6));
+                               (unsigned)(hc->tx_x >> 6), hc->tx_x_calc,
+                               (unsigned)(hc->tx_x_recv >> 6));
 
-                ccid3_update_send_interval(hctx);
+                ccid3_update_send_interval(hc);
         }
 }
 
@@ -179,37 +168,37 @@ static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
  *      Track the mean packet size `s' (cf. RFC 4342, 5.3 and  RFC 3448, 4.1)
  *      @len: DCCP packet payload size in bytes
  */
-static inline void ccid3_hc_tx_update_s(struct ccid3_hc_tx_sock *hctx, int len)
+static inline void ccid3_hc_tx_update_s(struct ccid3_hc_tx_sock *hc, int len)
 {
-        const u16 old_s = hctx->ccid3hctx_s;
+        const u16 old_s = hc->tx_s;
 
-        hctx->ccid3hctx_s = tfrc_ewma(hctx->ccid3hctx_s, len, 9);
+        hc->tx_s = tfrc_ewma(hc->tx_s, len, 9);
 
-        if (hctx->ccid3hctx_s != old_s)
-                ccid3_update_send_interval(hctx);
+        if (hc->tx_s != old_s)
+                ccid3_update_send_interval(hc);
 }
 
 /*
  *      Update Window Counter using the algorithm from [RFC 4342, 8.1].
  *      As elsewhere, RTT > 0 is assumed by using dccp_sample_rtt().
  */
-static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hctx,
+static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hc,
                                                 ktime_t now)
 {
-        u32 delta = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count),
-            quarter_rtts = (4 * delta) / hctx->ccid3hctx_rtt;
+        u32 delta = ktime_us_delta(now, hc->tx_t_last_win_count),
+            quarter_rtts = (4 * delta) / hc->tx_rtt;
 
         if (quarter_rtts > 0) {
-                hctx->ccid3hctx_t_last_win_count = now;
-                hctx->ccid3hctx_last_win_count  += min(quarter_rtts, 5U);
-                hctx->ccid3hctx_last_win_count  &= 0xF;         /* mod 16 */
+                hc->tx_t_last_win_count = now;
+                hc->tx_last_win_count  += min(quarter_rtts, 5U);
+                hc->tx_last_win_count  &= 0xF;          /* mod 16 */
         }
 }
 
 static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         unsigned long t_nfb = USEC_PER_SEC / 5;
 
         bh_lock_sock(sk);
@@ -220,24 +209,23 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
         }
 
         ccid3_pr_debug("%s(%p, state=%s) - entry \n", dccp_role(sk), sk,
-                       ccid3_tx_state_name(hctx->ccid3hctx_state));
+                       ccid3_tx_state_name(hc->tx_state));
 
-        if (hctx->ccid3hctx_state == TFRC_SSTATE_FBACK)
+        if (hc->tx_state == TFRC_SSTATE_FBACK)
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_NO_FBACK);
-        else if (hctx->ccid3hctx_state != TFRC_SSTATE_NO_FBACK)
+        else if (hc->tx_state != TFRC_SSTATE_NO_FBACK)
                 goto out;
 
         /*
          * Determine new allowed sending rate X as per draft rfc3448bis-00, 4.4
          */
-        if (hctx->ccid3hctx_t_rto == 0 ||       /* no feedback received yet */
-            hctx->ccid3hctx_p == 0) {
+        if (hc->tx_t_rto == 0 ||        /* no feedback received yet */
+            hc->tx_p == 0) {
 
                 /* halve send rate directly */
-                hctx->ccid3hctx_x = max(hctx->ccid3hctx_x / 2,
-                                        (((__u64)hctx->ccid3hctx_s) << 6) /
-                                                                    TFRC_T_MBI);
-                ccid3_update_send_interval(hctx);
+                hc->tx_x = max(hc->tx_x / 2,
+                               (((__u64)hc->tx_s) << 6) / TFRC_T_MBI);
+                ccid3_update_send_interval(hc);
         } else {
                 /*
                  *  Modify the cached value of X_recv
@@ -249,33 +237,32 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
                  *
                  *  Note that X_recv is scaled by 2^6 while X_calc is not
                  */
-                BUG_ON(hctx->ccid3hctx_p && !hctx->ccid3hctx_x_calc);
+                BUG_ON(hc->tx_p && !hc->tx_x_calc);
 
-                if (hctx->ccid3hctx_x_calc > (hctx->ccid3hctx_x_recv >> 5))
-                        hctx->ccid3hctx_x_recv =
-                                max(hctx->ccid3hctx_x_recv / 2,
-                                    (((__u64)hctx->ccid3hctx_s) << 6) /
-                                                              (2 * TFRC_T_MBI));
+                if (hc->tx_x_calc > (hc->tx_x_recv >> 5))
+                        hc->tx_x_recv =
+                                max(hc->tx_x_recv / 2,
+                                    (((__u64)hc->tx_s) << 6) / (2*TFRC_T_MBI));
                 else {
-                        hctx->ccid3hctx_x_recv = hctx->ccid3hctx_x_calc;
-                        hctx->ccid3hctx_x_recv <<= 4;
+                        hc->tx_x_recv = hc->tx_x_calc;
+                        hc->tx_x_recv <<= 4;
                 }
                 ccid3_hc_tx_update_x(sk, NULL);
         }
         ccid3_pr_debug("Reduced X to %llu/64 bytes/sec\n",
-                        (unsigned long long)hctx->ccid3hctx_x);
+                        (unsigned long long)hc->tx_x);
 
         /*
          * Set new timeout for the nofeedback timer.
          * See comments in packet_recv() regarding the value of t_RTO.
          */
-        if (unlikely(hctx->ccid3hctx_t_rto == 0))       /* no feedback yet */
+        if (unlikely(hc->tx_t_rto == 0))        /* no feedback yet */
                 t_nfb = TFRC_INITIAL_TIMEOUT;
         else
-                t_nfb = max(hctx->ccid3hctx_t_rto, 2 * hctx->ccid3hctx_t_ipi);
+                t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi);
 
 restart_timer:
-        sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
+        sk_reset_timer(sk, &hc->tx_no_feedback_timer,
                            jiffies + usecs_to_jiffies(t_nfb));
 out:
         bh_unlock_sock(sk);
@@ -291,7 +278,7 @@ out:
 static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         ktime_t now = ktime_get_real();
         s64 delay;
 
@@ -303,18 +290,17 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
         if (unlikely(skb->len == 0))
                 return -EBADMSG;
 
-        switch (hctx->ccid3hctx_state) {
+        switch (hc->tx_state) {
         case TFRC_SSTATE_NO_SENT:
-                sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
-                               (jiffies +
-                                usecs_to_jiffies(TFRC_INITIAL_TIMEOUT)));
-                hctx->ccid3hctx_last_win_count   = 0;
-                hctx->ccid3hctx_t_last_win_count = now;
+                sk_reset_timer(sk, &hc->tx_no_feedback_timer, (jiffies +
+                               usecs_to_jiffies(TFRC_INITIAL_TIMEOUT)));
+                hc->tx_last_win_count   = 0;
+                hc->tx_t_last_win_count = now;
 
                 /* Set t_0 for initial packet */
-                hctx->ccid3hctx_t_nom = now;
+                hc->tx_t_nom = now;
 
-                hctx->ccid3hctx_s = skb->len;
+                hc->tx_s = skb->len;
 
                 /*
                  * Use initial RTT sample when available: recommended by erratum
@@ -323,9 +309,9 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                  */
                 if (dp->dccps_syn_rtt) {
                         ccid3_pr_debug("SYN RTT = %uus\n", dp->dccps_syn_rtt);
-                        hctx->ccid3hctx_rtt  = dp->dccps_syn_rtt;
-                        hctx->ccid3hctx_x    = rfc3390_initial_rate(sk);
-                        hctx->ccid3hctx_t_ld = now;
+                        hc->tx_rtt  = dp->dccps_syn_rtt;
+                        hc->tx_x    = rfc3390_initial_rate(sk);
+                        hc->tx_t_ld = now;
                 } else {
                         /*
                          * Sender does not have RTT sample:
@@ -333,17 +319,17 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                          *   is needed in several parts (e.g.  window counter);
                          * - set sending rate X_pps = 1pps as per RFC 3448, 4.2.
                          */
-                        hctx->ccid3hctx_rtt = DCCP_FALLBACK_RTT;
-                        hctx->ccid3hctx_x   = hctx->ccid3hctx_s;
-                        hctx->ccid3hctx_x <<= 6;
+                        hc->tx_rtt = DCCP_FALLBACK_RTT;
+                        hc->tx_x   = hc->tx_s;
+                        hc->tx_x <<= 6;
                 }
-                ccid3_update_send_interval(hctx);
+                ccid3_update_send_interval(hc);
 
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_NO_FBACK);
                 break;
         case TFRC_SSTATE_NO_FBACK:
         case TFRC_SSTATE_FBACK:
-                delay = ktime_us_delta(hctx->ccid3hctx_t_nom, now);
+                delay = ktime_us_delta(hc->tx_t_nom, now);
                 ccid3_pr_debug("delay=%ld\n", (long)delay);
                 /*
                  *      Scheduling of packet transmissions [RFC 3448, 4.6]
@@ -353,10 +339,10 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                  * else
                  *       // send the packet in (t_nom - t_now) milliseconds.
                  */
-                if (delay - (s64)hctx->ccid3hctx_delta >= 1000)
+                if (delay - (s64)hc->tx_delta >= 1000)
                         return (u32)delay / 1000L;
 
-                ccid3_hc_tx_update_win_count(hctx, now);
+                ccid3_hc_tx_update_win_count(hc, now);
                 break;
         case TFRC_SSTATE_TERM:
                 DCCP_BUG("%s(%p) - Illegal state TERM", dccp_role(sk), sk);
@@ -365,28 +351,27 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 
         /* prepare to send now (add options etc.) */
         dp->dccps_hc_tx_insert_options = 1;
-        DCCP_SKB_CB(skb)->dccpd_ccval = hctx->ccid3hctx_last_win_count;
+        DCCP_SKB_CB(skb)->dccpd_ccval  = hc->tx_last_win_count;
 
         /* set the nominal send time for the next following packet */
-        hctx->ccid3hctx_t_nom = ktime_add_us(hctx->ccid3hctx_t_nom,
-                                             hctx->ccid3hctx_t_ipi);
+        hc->tx_t_nom = ktime_add_us(hc->tx_t_nom, hc->tx_t_ipi);
         return 0;
 }
 
 static void ccid3_hc_tx_packet_sent(struct sock *sk, int more,
                                     unsigned int len)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
 
-        ccid3_hc_tx_update_s(hctx, len);
+        ccid3_hc_tx_update_s(hc, len);
 
-        if (tfrc_tx_hist_add(&hctx->ccid3hctx_hist, dccp_sk(sk)->dccps_gss))
+        if (tfrc_tx_hist_add(&hc->tx_hist, dccp_sk(sk)->dccps_gss))
                 DCCP_CRIT("packet history - out of memory!");
 }
 
 static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         struct ccid3_options_received *opt_recv;
         ktime_t now;
         unsigned long t_nfb;
@@ -397,15 +382,15 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
               DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_DATAACK))
                 return;
         /* ... and only in the established state */
-        if (hctx->ccid3hctx_state != TFRC_SSTATE_FBACK &&
-            hctx->ccid3hctx_state != TFRC_SSTATE_NO_FBACK)
+        if (hc->tx_state != TFRC_SSTATE_FBACK &&
+            hc->tx_state != TFRC_SSTATE_NO_FBACK)
                 return;
 
-        opt_recv = &hctx->ccid3hctx_options_received;
+        opt_recv = &hc->tx_options_received;
         now = ktime_get_real();
 
         /* Estimate RTT from history if ACK number is valid */
-        r_sample = tfrc_tx_hist_rtt(hctx->ccid3hctx_hist,
+        r_sample = tfrc_tx_hist_rtt(hc->tx_hist,
                                     DCCP_SKB_CB(skb)->dccpd_ack_seq, now);
         if (r_sample == 0) {
                 DCCP_WARN("%s(%p): %s with bogus ACK-%llu\n", dccp_role(sk), sk,
@@ -415,37 +400,37 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         }
 
         /* Update receive rate in units of 64 * bytes/second */
-        hctx->ccid3hctx_x_recv = opt_recv->ccid3or_receive_rate;
-        hctx->ccid3hctx_x_recv <<= 6;
+        hc->tx_x_recv = opt_recv->ccid3or_receive_rate;
+        hc->tx_x_recv <<= 6;
 
         /* Update loss event rate (which is scaled by 1e6) */
         pinv = opt_recv->ccid3or_loss_event_rate;
         if (pinv == ~0U || pinv == 0)          /* see RFC 4342, 8.5   */
-                hctx->ccid3hctx_p = 0;
+                hc->tx_p = 0;
         else                                   /* can not exceed 100% */
-                hctx->ccid3hctx_p = scaled_div(1, pinv);
+                hc->tx_p = scaled_div(1, pinv);
         /*
          * Validate new RTT sample and update moving average
          */
         r_sample = dccp_sample_rtt(sk, r_sample);
-        hctx->ccid3hctx_rtt = tfrc_ewma(hctx->ccid3hctx_rtt, r_sample, 9);
+        hc->tx_rtt = tfrc_ewma(hc->tx_rtt, r_sample, 9);
         /*
          * Update allowed sending rate X as per draft rfc3448bis-00, 4.2/3
          */
-        if (hctx->ccid3hctx_state == TFRC_SSTATE_NO_FBACK) {
+        if (hc->tx_state == TFRC_SSTATE_NO_FBACK) {
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_FBACK);
 
-                if (hctx->ccid3hctx_t_rto == 0) {
+                if (hc->tx_t_rto == 0) {
                         /*
                          * Initial feedback packet: Larger Initial Windows (4.2)
                          */
-                        hctx->ccid3hctx_x    = rfc3390_initial_rate(sk);
-                        hctx->ccid3hctx_t_ld = now;
+                        hc->tx_x    = rfc3390_initial_rate(sk);
+                        hc->tx_t_ld = now;
 
-                        ccid3_update_send_interval(hctx);
+                        ccid3_update_send_interval(hc);
 
                         goto done_computing_x;
-                } else if (hctx->ccid3hctx_p == 0) {
+                } else if (hc->tx_p == 0) {
                         /*
                          * First feedback after nofeedback timer expiry (4.3)
                          */
@@ -454,25 +439,20 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         }
 
         /* Update sending rate (step 4 of [RFC 3448, 4.3]) */
-        if (hctx->ccid3hctx_p > 0)
-                hctx->ccid3hctx_x_calc =
-                                tfrc_calc_x(hctx->ccid3hctx_s,
-                                            hctx->ccid3hctx_rtt,
-                                            hctx->ccid3hctx_p);
+        if (hc->tx_p > 0)
+                hc->tx_x_calc = tfrc_calc_x(hc->tx_s, hc->tx_rtt, hc->tx_p);
         ccid3_hc_tx_update_x(sk, &now);
 
 done_computing_x:
         ccid3_pr_debug("%s(%p), RTT=%uus (sample=%uus), s=%u, "
                                "p=%u, X_calc=%u, X_recv=%u, X=%u\n",
-                               dccp_role(sk),
-                               sk, hctx->ccid3hctx_rtt, r_sample,
-                               hctx->ccid3hctx_s, hctx->ccid3hctx_p,
-                               hctx->ccid3hctx_x_calc,
-                               (unsigned)(hctx->ccid3hctx_x_recv >> 6),
-                               (unsigned)(hctx->ccid3hctx_x >> 6));
+                               dccp_role(sk), sk, hc->tx_rtt, r_sample,
+                               hc->tx_s, hc->tx_p, hc->tx_x_calc,
+                               (unsigned)(hc->tx_x_recv >> 6),
+                               (unsigned)(hc->tx_x >> 6));
 
         /* unschedule no feedback timer */
-        sk_stop_timer(sk, &hctx->ccid3hctx_no_feedback_timer);
+        sk_stop_timer(sk, &hc->tx_no_feedback_timer);
 
         /*
          * As we have calculated new ipi, delta, t_nom it is possible
@@ -486,21 +466,19 @@ done_computing_x:
          * This can help avoid triggering the nofeedback timer too
          * often ('spinning') on LANs with small RTTs.
          */
-        hctx->ccid3hctx_t_rto = max_t(u32, 4 * hctx->ccid3hctx_rtt,
-                                           (CONFIG_IP_DCCP_CCID3_RTO *
-                                            (USEC_PER_SEC / 1000)));
+        hc->tx_t_rto = max_t(u32, 4 * hc->tx_rtt, (CONFIG_IP_DCCP_CCID3_RTO *
+                                                       (USEC_PER_SEC / 1000)));
         /*
          * Schedule no feedback timer to expire in
          * max(t_RTO, 2 * s/X)  =  max(t_RTO, 2 * t_ipi)
          */
-        t_nfb = max(hctx->ccid3hctx_t_rto, 2 * hctx->ccid3hctx_t_ipi);
+        t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi);
 
         ccid3_pr_debug("%s(%p), Scheduled no feedback timer to "
                        "expire in %lu jiffies (%luus)\n",
-                       dccp_role(sk),
-                       sk, usecs_to_jiffies(t_nfb), t_nfb);
+                       dccp_role(sk), sk, usecs_to_jiffies(t_nfb), t_nfb);
 
-        sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
+        sk_reset_timer(sk, &hc->tx_no_feedback_timer,
                            jiffies + usecs_to_jiffies(t_nfb));
 }
 
@@ -510,11 +488,11 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
 {
         int rc = 0;
         const struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         struct ccid3_options_received *opt_recv;
         __be32 opt_val;
 
-        opt_recv = &hctx->ccid3hctx_options_received;
+        opt_recv = &hc->tx_options_received;
 
         if (opt_recv->ccid3or_seqno != dp->dccps_gsr) {
                 opt_recv->ccid3or_seqno              = dp->dccps_gsr;
@@ -568,56 +546,55 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
 
 static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid_priv(ccid);
+        struct ccid3_hc_tx_sock *hc = ccid_priv(ccid);
 
-        hctx->ccid3hctx_state = TFRC_SSTATE_NO_SENT;
-        hctx->ccid3hctx_hist = NULL;
-        setup_timer(&hctx->ccid3hctx_no_feedback_timer,
+        hc->tx_state = TFRC_SSTATE_NO_SENT;
+        hc->tx_hist  = NULL;
+        setup_timer(&hc->tx_no_feedback_timer,
                         ccid3_hc_tx_no_feedback_timer, (unsigned long)sk);
-
         return 0;
 }
 
 static void ccid3_hc_tx_exit(struct sock *sk)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
 
         ccid3_hc_tx_set_state(sk, TFRC_SSTATE_TERM);
-        sk_stop_timer(sk, &hctx->ccid3hctx_no_feedback_timer);
+        sk_stop_timer(sk, &hc->tx_no_feedback_timer);
 
-        tfrc_tx_hist_purge(&hctx->ccid3hctx_hist);
+        tfrc_tx_hist_purge(&hc->tx_hist);
 }
 
 static void ccid3_hc_tx_get_info(struct sock *sk, struct tcp_info *info)
 {
-        struct ccid3_hc_tx_sock *hctx;
+        struct ccid3_hc_tx_sock *hc;
 
         /* Listen socks doesn't have a private CCID block */
         if (sk->sk_state == DCCP_LISTEN)
                 return;
 
-        hctx = ccid3_hc_tx_sk(sk);
-        info->tcpi_rto = hctx->ccid3hctx_t_rto;
-        info->tcpi_rtt = hctx->ccid3hctx_rtt;
+        hc = ccid3_hc_tx_sk(sk);
+        info->tcpi_rto = hc->tx_t_rto;
+        info->tcpi_rtt = hc->tx_rtt;
 }
 
 static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
                                   u32 __user *optval, int __user *optlen)
 {
-        const struct ccid3_hc_tx_sock *hctx;
+        const struct ccid3_hc_tx_sock *hc;
         const void *val;
 
         /* Listen socks doesn't have a private CCID block */
         if (sk->sk_state == DCCP_LISTEN)
                 return -EINVAL;
 
-        hctx = ccid3_hc_tx_sk(sk);
+        hc = ccid3_hc_tx_sk(sk);
         switch (optname) {
         case DCCP_SOCKOPT_CCID_TX_INFO:
-                if (len < sizeof(hctx->ccid3hctx_tfrc))
+                if (len < sizeof(hc->tx_tfrc))
                         return -EINVAL;
-                len = sizeof(hctx->ccid3hctx_tfrc);
-                val = &hctx->ccid3hctx_tfrc;
+                len = sizeof(hc->tx_tfrc);
+                val = &hc->tx_tfrc;
                 break;
         default:
                 return -ENOPROTOOPT;
@@ -657,34 +634,34 @@ static const char *ccid3_rx_state_name(enum ccid3_hc_rx_states state)
 static void ccid3_hc_rx_set_state(struct sock *sk,
                                   enum ccid3_hc_rx_states state)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
-        enum ccid3_hc_rx_states oldstate = hcrx->ccid3hcrx_state;
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
+        enum ccid3_hc_rx_states oldstate = hc->rx_state;
 
         ccid3_pr_debug("%s(%p) %-8.8s -> %s\n",
                        dccp_role(sk), sk, ccid3_rx_state_name(oldstate),
                        ccid3_rx_state_name(state));
         WARN_ON(state == oldstate);
-        hcrx->ccid3hcrx_state = state;
+        hc->rx_state = state;
 }
 
 static void ccid3_hc_rx_send_feedback(struct sock *sk,
                                       const struct sk_buff *skb,
                                       enum ccid3_fback_type fbtype)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         struct dccp_sock *dp = dccp_sk(sk);
         ktime_t now;
         s64 delta = 0;
 
-        if (unlikely(hcrx->ccid3hcrx_state == TFRC_RSTATE_TERM))
+        if (unlikely(hc->rx_state == TFRC_RSTATE_TERM))
                 return;
 
         now = ktime_get_real();
 
         switch (fbtype) {
         case CCID3_FBACK_INITIAL:
-                hcrx->ccid3hcrx_x_recv = 0;
-                hcrx->ccid3hcrx_pinv   = ~0U;   /* see RFC 4342, 8.5 */
+                hc->rx_x_recv = 0;
+                hc->rx_pinv   = ~0U;   /* see RFC 4342, 8.5 */
                 break;
         case CCID3_FBACK_PARAM_CHANGE:
                 /*
@@ -697,27 +674,26 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
                  * the number of bytes since last feedback.
                  * This is a safe fallback, since X is bounded above by X_calc.
                  */
-                if (hcrx->ccid3hcrx_x_recv > 0)
+                if (hc->rx_x_recv > 0)
                         break;
                 /* fall through */
         case CCID3_FBACK_PERIODIC:
-                delta = ktime_us_delta(now, hcrx->ccid3hcrx_tstamp_last_feedback);
+                delta = ktime_us_delta(now, hc->rx_tstamp_last_feedback);
                 if (delta <= 0)
                         DCCP_BUG("delta (%ld) <= 0", (long)delta);
                 else
-                        hcrx->ccid3hcrx_x_recv =
-                                scaled_div32(hcrx->ccid3hcrx_bytes_recv, delta);
+                        hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta);
                 break;
         default:
                 return;
         }
 
         ccid3_pr_debug("Interval %ldusec, X_recv=%u, 1/p=%u\n", (long)delta,
-                       hcrx->ccid3hcrx_x_recv, hcrx->ccid3hcrx_pinv);
+                       hc->rx_x_recv, hc->rx_pinv);
 
-        hcrx->ccid3hcrx_tstamp_last_feedback = now;
-        hcrx->ccid3hcrx_last_counter         = dccp_hdr(skb)->dccph_ccval;
-        hcrx->ccid3hcrx_bytes_recv           = 0;
+        hc->rx_tstamp_last_feedback = now;
+        hc->rx_last_counter         = dccp_hdr(skb)->dccph_ccval;
+        hc->rx_bytes_recv           = 0;
 
         dp->dccps_hc_rx_insert_options = 1;
         dccp_send_ack(sk);
@@ -725,19 +701,19 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
 
 static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
 {
-        const struct ccid3_hc_rx_sock *hcrx;
+        const struct ccid3_hc_rx_sock *hc;
         __be32 x_recv, pinv;
 
         if (!(sk->sk_state == DCCP_OPEN || sk->sk_state == DCCP_PARTOPEN))
                 return 0;
 
-        hcrx = ccid3_hc_rx_sk(sk);
+        hc = ccid3_hc_rx_sk(sk);
 
         if (dccp_packet_without_ack(skb))
                 return 0;
 
-        x_recv = htonl(hcrx->ccid3hcrx_x_recv);
-        pinv   = htonl(hcrx->ccid3hcrx_pinv);
+        x_recv = htonl(hc->rx_x_recv);
+        pinv   = htonl(hc->rx_pinv);
 
         if (dccp_insert_option(sk, skb, TFRC_OPT_LOSS_EVENT_RATE,
                                &pinv, sizeof(pinv)) ||
@@ -760,26 +736,26 @@ static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
  */
 static u32 ccid3_first_li(struct sock *sk)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         u32 x_recv, p, delta;
         u64 fval;
 
-        if (hcrx->ccid3hcrx_rtt == 0) {
+        if (hc->rx_rtt == 0) {
                 DCCP_WARN("No RTT estimate available, using fallback RTT\n");
-                hcrx->ccid3hcrx_rtt = DCCP_FALLBACK_RTT;
+                hc->rx_rtt = DCCP_FALLBACK_RTT;
         }
 
-        delta = ktime_to_us(net_timedelta(hcrx->ccid3hcrx_tstamp_last_feedback));
-        x_recv = scaled_div32(hcrx->ccid3hcrx_bytes_recv, delta);
+        delta  = ktime_to_us(net_timedelta(hc->rx_tstamp_last_feedback));
+        x_recv = scaled_div32(hc->rx_bytes_recv, delta);
         if (x_recv == 0) {              /* would also trigger divide-by-zero */
                 DCCP_WARN("X_recv==0\n");
-                if ((x_recv = hcrx->ccid3hcrx_x_recv) == 0) {
+                if ((x_recv = hc->rx_x_recv) == 0) {
                         DCCP_BUG("stored value of X_recv is zero");
                         return ~0U;
                 }
         }
 
-        fval = scaled_div(hcrx->ccid3hcrx_s, hcrx->ccid3hcrx_rtt);
+        fval = scaled_div(hc->rx_s, hc->rx_rtt);
         fval = scaled_div32(fval, x_recv);
         p = tfrc_calc_x_reverse_lookup(fval);
 
@@ -791,19 +767,19 @@ static u32 ccid3_first_li(struct sock *sk)
 
 static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         enum ccid3_fback_type do_feedback = CCID3_FBACK_NONE;
         const u64 ndp = dccp_sk(sk)->dccps_options_received.dccpor_ndp;
         const bool is_data_packet = dccp_data_packet(skb);
 
-        if (unlikely(hcrx->ccid3hcrx_state == TFRC_RSTATE_NO_DATA)) {
+        if (unlikely(hc->rx_state == TFRC_RSTATE_NO_DATA)) {
                 if (is_data_packet) {
                         const u32 payload = skb->len - dccp_hdr(skb)->dccph_doff * 4;
                         do_feedback = CCID3_FBACK_INITIAL;
                         ccid3_hc_rx_set_state(sk, TFRC_RSTATE_DATA);
-                        hcrx->ccid3hcrx_s = payload;
+                        hc->rx_s = payload;
                         /*
-                         * Not necessary to update ccid3hcrx_bytes_recv here,
+                         * Not necessary to update rx_bytes_recv here,
                          * since X_recv = 0 for the first feedback packet (cf.
                          * RFC 3448, 6.3) -- gerrit
                          */
@@ -811,7 +787,7 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 goto update_records;
         }
 
-        if (tfrc_rx_hist_duplicate(&hcrx->ccid3hcrx_hist, skb))
+        if (tfrc_rx_hist_duplicate(&hc->rx_hist, skb))
                 return; /* done receiving */
 
         if (is_data_packet) {
@@ -819,20 +795,20 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 /*
                  * Update moving-average of s and the sum of received payload bytes
                  */
-                hcrx->ccid3hcrx_s = tfrc_ewma(hcrx->ccid3hcrx_s, payload, 9);
-                hcrx->ccid3hcrx_bytes_recv += payload;
+                hc->rx_s = tfrc_ewma(hc->rx_s, payload, 9);
+                hc->rx_bytes_recv += payload;
         }
 
         /*
          * Perform loss detection and handle pending losses
          */
-        if (tfrc_rx_handle_loss(&hcrx->ccid3hcrx_hist, &hcrx->ccid3hcrx_li_hist,
+        if (tfrc_rx_handle_loss(&hc->rx_hist, &hc->rx_li_hist,
                                 skb, ndp, ccid3_first_li, sk)) {
                 do_feedback = CCID3_FBACK_PARAM_CHANGE;
                 goto done_receiving;
         }
 
-        if (tfrc_rx_hist_loss_pending(&hcrx->ccid3hcrx_hist))
+        if (tfrc_rx_hist_loss_pending(&hc->rx_hist))
                 return; /* done receiving */
 
         /*
@@ -841,17 +817,17 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
         if (unlikely(!is_data_packet))
                 goto update_records;
 
-        if (!tfrc_lh_is_initialised(&hcrx->ccid3hcrx_li_hist)) {
-                const u32 sample = tfrc_rx_hist_sample_rtt(&hcrx->ccid3hcrx_hist, skb);
+        if (!tfrc_lh_is_initialised(&hc->rx_li_hist)) {
+                const u32 sample = tfrc_rx_hist_sample_rtt(&hc->rx_hist, skb);
                 /*
                  * Empty loss history: no loss so far, hence p stays 0.
                  * Sample RTT values, since an RTT estimate is required for the
                  * computation of p when the first loss occurs; RFC 3448, 6.3.1.
                  */
                 if (sample != 0)
-                        hcrx->ccid3hcrx_rtt = tfrc_ewma(hcrx->ccid3hcrx_rtt, sample, 9);
+                        hc->rx_rtt = tfrc_ewma(hc->rx_rtt, sample, 9);
 
-        } else if (tfrc_lh_update_i_mean(&hcrx->ccid3hcrx_li_hist, skb)) {
+        } else if (tfrc_lh_update_i_mean(&hc->rx_li_hist, skb)) {
                 /*
                  * Step (3) of [RFC 3448, 6.1]: Recompute I_mean and, if I_mean
                  * has decreased (resp. p has increased), send feedback now.
@@ -862,11 +838,11 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
         /*
          * Check if the periodic once-per-RTT feedback is due; RFC 4342, 10.3
          */
-        if (SUB16(dccp_hdr(skb)->dccph_ccval, hcrx->ccid3hcrx_last_counter) > 3)
+        if (SUB16(dccp_hdr(skb)->dccph_ccval, hc->rx_last_counter) > 3)
                 do_feedback = CCID3_FBACK_PERIODIC;
 
 update_records:
-        tfrc_rx_hist_add_packet(&hcrx->ccid3hcrx_hist, skb, ndp);
+        tfrc_rx_hist_add_packet(&hc->rx_hist, skb, ndp);
 
 done_receiving:
         if (do_feedback)
@@ -875,41 +851,41 @@ done_receiving:
 
 static int ccid3_hc_rx_init(struct ccid *ccid, struct sock *sk)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid_priv(ccid);
+        struct ccid3_hc_rx_sock *hc = ccid_priv(ccid);
 
-        hcrx->ccid3hcrx_state = TFRC_RSTATE_NO_DATA;
-        tfrc_lh_init(&hcrx->ccid3hcrx_li_hist);
-        return tfrc_rx_hist_alloc(&hcrx->ccid3hcrx_hist);
+        hc->rx_state = TFRC_RSTATE_NO_DATA;
+        tfrc_lh_init(&hc->rx_li_hist);
+        return tfrc_rx_hist_alloc(&hc->rx_hist);
 }
 
 static void ccid3_hc_rx_exit(struct sock *sk)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
 
         ccid3_hc_rx_set_state(sk, TFRC_RSTATE_TERM);
 
-        tfrc_rx_hist_purge(&hcrx->ccid3hcrx_hist);
-        tfrc_lh_cleanup(&hcrx->ccid3hcrx_li_hist);
+        tfrc_rx_hist_purge(&hc->rx_hist);
+        tfrc_lh_cleanup(&hc->rx_li_hist);
 }
 
 static void ccid3_hc_rx_get_info(struct sock *sk, struct tcp_info *info)
 {
-        const struct ccid3_hc_rx_sock *hcrx;
+        const struct ccid3_hc_rx_sock *hc;
 
         /* Listen socks doesn't have a private CCID block */
         if (sk->sk_state == DCCP_LISTEN)
                 return;
 
-        hcrx = ccid3_hc_rx_sk(sk);
-        info->tcpi_ca_state = hcrx->ccid3hcrx_state;
+        hc = ccid3_hc_rx_sk(sk);
+        info->tcpi_ca_state = hc->rx_state;
         info->tcpi_options  |= TCPI_OPT_TIMESTAMPS;
-        info->tcpi_rcv_rtt  = hcrx->ccid3hcrx_rtt;
+        info->tcpi_rcv_rtt  = hc->rx_rtt;
 }
 
 static int ccid3_hc_rx_getsockopt(struct sock *sk, const int optname, int len,
                                   u32 __user *optval, int __user *optlen)
 {
-        const struct ccid3_hc_rx_sock *hcrx;
+        const struct ccid3_hc_rx_sock *hc;
         struct tfrc_rx_info rx_info;
         const void *val;
 
@@ -917,15 +893,15 @@ static int ccid3_hc_rx_getsockopt(struct sock *sk, const int optname, int len,
         if (sk->sk_state == DCCP_LISTEN)
                 return -EINVAL;
 
-        hcrx = ccid3_hc_rx_sk(sk);
+        hc = ccid3_hc_rx_sk(sk);
         switch (optname) {
         case DCCP_SOCKOPT_CCID_RX_INFO:
                 if (len < sizeof(rx_info))
                         return -EINVAL;
-                rx_info.tfrcrx_x_recv = hcrx->ccid3hcrx_x_recv;
-                rx_info.tfrcrx_rtt    = hcrx->ccid3hcrx_rtt;
-                rx_info.tfrcrx_p      = hcrx->ccid3hcrx_pinv == 0 ? ~0U :
-                                           scaled_div(1, hcrx->ccid3hcrx_pinv);
+                rx_info.tfrcrx_x_recv = hc->rx_x_recv;
+                rx_info.tfrcrx_rtt    = hc->rx_rtt;
+                rx_info.tfrcrx_p      = hc->rx_pinv == 0 ? ~0U :
+                                           scaled_div(1, hc->rx_pinv);
                 len = sizeof(rx_info);
                 val = &rx_info;
                 break;
diff --git a/net/dccp/ccids/ccid3.h b/net/dccp/ccids/ccid3.h
index e5a244143846..032635776653 100644
--- a/net/dccp/ccids/ccid3.h
+++ b/net/dccp/ccids/ccid3.h
@@ -75,44 +75,44 @@ enum ccid3_hc_tx_states {
 
 /**
  * struct ccid3_hc_tx_sock - CCID3 sender half-connection socket
- * @ccid3hctx_x - Current sending rate in 64 * bytes per second
- * @ccid3hctx_x_recv - Receive rate    in 64 * bytes per second
- * @ccid3hctx_x_calc - Calculated rate in bytes per second
- * @ccid3hctx_rtt - Estimate of current round trip time in usecs
- * @ccid3hctx_p - Current loss event rate (0-1) scaled by 1000000
- * @ccid3hctx_s - Packet size in bytes
- * @ccid3hctx_t_rto - Nofeedback Timer setting in usecs
- * @ccid3hctx_t_ipi - Interpacket (send) interval (RFC 3448, 4.6) in usecs
- * @ccid3hctx_state - Sender state, one of %ccid3_hc_tx_states
- * @ccid3hctx_last_win_count - Last window counter sent
- * @ccid3hctx_t_last_win_count - Timestamp of earliest packet
- *                               with last_win_count value sent
- * @ccid3hctx_no_feedback_timer - Handle to no feedback timer
- * @ccid3hctx_t_ld - Time last doubled during slow start
- * @ccid3hctx_t_nom - Nominal send time of next packet
- * @ccid3hctx_delta - Send timer delta (RFC 3448, 4.6) in usecs
- * @ccid3hctx_hist - Packet history
- * @ccid3hctx_options_received - Parsed set of retrieved options
+ * @tx_x:                 Current sending rate in 64 * bytes per second
+ * @tx_x_recv:            Receive rate in 64 * bytes per second
+ * @tx_x_calc:            Calculated rate in bytes per second
+ * @tx_rtt:               Estimate of current round trip time in usecs
+ * @tx_p:                 Current loss event rate (0-1) scaled by 1000000
+ * @tx_s:                 Packet size in bytes
+ * @tx_t_rto:             Nofeedback Timer setting in usecs
+ * @tx_t_ipi:             Interpacket (send) interval (RFC 3448, 4.6) in usecs
+ * @tx_state:             Sender state, one of %ccid3_hc_tx_states
+ * @tx_last_win_count:    Last window counter sent
+ * @tx_t_last_win_count:  Timestamp of earliest packet
+ *                        with last_win_count value sent
+ * @tx_no_feedback_timer: Handle to no feedback timer
+ * @tx_t_ld:              Time last doubled during slow start
+ * @tx_t_nom:             Nominal send time of next packet
+ * @tx_delta:             Send timer delta (RFC 3448, 4.6) in usecs
+ * @tx_hist:              Packet history
+ * @tx_options_received:  Parsed set of retrieved options
  */
 struct ccid3_hc_tx_sock {
-        struct tfrc_tx_info             ccid3hctx_tfrc;
-#define ccid3hctx_x                     ccid3hctx_tfrc.tfrctx_x
-#define ccid3hctx_x_recv                ccid3hctx_tfrc.tfrctx_x_recv
-#define ccid3hctx_x_calc                ccid3hctx_tfrc.tfrctx_x_calc
-#define ccid3hctx_rtt                   ccid3hctx_tfrc.tfrctx_rtt
-#define ccid3hctx_p                     ccid3hctx_tfrc.tfrctx_p
-#define ccid3hctx_t_rto                 ccid3hctx_tfrc.tfrctx_rto
-#define ccid3hctx_t_ipi                 ccid3hctx_tfrc.tfrctx_ipi
-        u16                             ccid3hctx_s;
-        enum ccid3_hc_tx_states         ccid3hctx_state:8;
-        u8                              ccid3hctx_last_win_count;
-        ktime_t                         ccid3hctx_t_last_win_count;
-        struct timer_list               ccid3hctx_no_feedback_timer;
-        ktime_t                         ccid3hctx_t_ld;
-        ktime_t                         ccid3hctx_t_nom;
-        u32                             ccid3hctx_delta;
-        struct tfrc_tx_hist_entry       *ccid3hctx_hist;
-        struct ccid3_options_received   ccid3hctx_options_received;
+        struct tfrc_tx_info             tx_tfrc;
+#define tx_x                            tx_tfrc.tfrctx_x
+#define tx_x_recv                       tx_tfrc.tfrctx_x_recv
+#define tx_x_calc                       tx_tfrc.tfrctx_x_calc
+#define tx_rtt                          tx_tfrc.tfrctx_rtt
+#define tx_p                            tx_tfrc.tfrctx_p
+#define tx_t_rto                        tx_tfrc.tfrctx_rto
+#define tx_t_ipi                        tx_tfrc.tfrctx_ipi
+        u16                             tx_s;
+        enum ccid3_hc_tx_states         tx_state:8;
+        u8                              tx_last_win_count;
+        ktime_t                         tx_t_last_win_count;
+        struct timer_list               tx_no_feedback_timer;
+        ktime_t                         tx_t_ld;
+        ktime_t                         tx_t_nom;
+        u32                             tx_delta;
+        struct tfrc_tx_hist_entry       *tx_hist;
+        struct ccid3_options_received   tx_options_received;
 };
 
 static inline struct ccid3_hc_tx_sock *ccid3_hc_tx_sk(const struct sock *sk)
@@ -131,32 +131,32 @@ enum ccid3_hc_rx_states {
 
 /**
  * struct ccid3_hc_rx_sock - CCID3 receiver half-connection socket
- * @ccid3hcrx_x_recv  -  Receiver estimate of send rate (RFC 3448 4.3)
- * @ccid3hcrx_rtt  -  Receiver estimate of rtt (non-standard)
- * @ccid3hcrx_p  -  Current loss event rate (RFC 3448 5.4)
- * @ccid3hcrx_last_counter  -  Tracks window counter (RFC 4342, 8.1)
- * @ccid3hcrx_state  -  Receiver state, one of %ccid3_hc_rx_states
- * @ccid3hcrx_bytes_recv  -  Total sum of DCCP payload bytes
- * @ccid3hcrx_x_recv  -  Receiver estimate of send rate (RFC 3448, sec. 4.3)
- * @ccid3hcrx_rtt  -  Receiver estimate of RTT
- * @ccid3hcrx_tstamp_last_feedback  -  Time at which last feedback was sent
- * @ccid3hcrx_tstamp_last_ack  -  Time at which last feedback was sent
- * @ccid3hcrx_hist  -  Packet history (loss detection + RTT sampling)
- * @ccid3hcrx_li_hist  -  Loss Interval database
- * @ccid3hcrx_s  -  Received packet size in bytes
- * @ccid3hcrx_pinv  -  Inverse of Loss Event Rate (RFC 4342, sec. 8.5)
+ * @rx_x_recv:               Receiver estimate of send rate (RFC 3448 4.3)
+ * @rx_rtt:                  Receiver estimate of rtt (non-standard)
+ * @rx_p:                    Current loss event rate (RFC 3448 5.4)
+ * @rx_last_counter:         Tracks window counter (RFC 4342, 8.1)
+ * @rx_state:                Receiver state, one of %ccid3_hc_rx_states
+ * @rx_bytes_recv:           Total sum of DCCP payload bytes
+ * @rx_x_recv:               Receiver estimate of send rate (RFC 3448, sec. 4.3)
+ * @rx_rtt:                  Receiver estimate of RTT
+ * @rx_tstamp_last_feedback: Time at which last feedback was sent
+ * @rx_tstamp_last_ack:      Time at which last feedback was sent
+ * @rx_hist:                 Packet history (loss detection + RTT sampling)
+ * @rx_li_hist:              Loss Interval database
+ * @rx_s:                    Received packet size in bytes
+ * @rx_pinv:                 Inverse of Loss Event Rate (RFC 4342, sec. 8.5)
  */
 struct ccid3_hc_rx_sock {
-        u8                              ccid3hcrx_last_counter:4;
-        enum ccid3_hc_rx_states         ccid3hcrx_state:8;
-        u32                             ccid3hcrx_bytes_recv;
-        u32                             ccid3hcrx_x_recv;
-        u32                             ccid3hcrx_rtt;
-        ktime_t                         ccid3hcrx_tstamp_last_feedback;
-        struct tfrc_rx_hist             ccid3hcrx_hist;
-        struct tfrc_loss_hist           ccid3hcrx_li_hist;
-        u16                             ccid3hcrx_s;
-#define ccid3hcrx_pinv                  ccid3hcrx_li_hist.i_mean
+        u8                              rx_last_counter:4;
+        enum ccid3_hc_rx_states         rx_state:8;
+        u32                             rx_bytes_recv;
+        u32                             rx_x_recv;
+        u32                             rx_rtt;
+        ktime_t                         rx_tstamp_last_feedback;
+        struct tfrc_rx_hist             rx_hist;
+        struct tfrc_loss_hist           rx_li_hist;
+        u16                             rx_s;
+#define rx_pinv                         rx_li_hist.i_mean
 };
 
 static inline struct ccid3_hc_rx_sock *ccid3_hc_rx_sk(const struct sock *sk)
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index 972b8dc918d6..df7dd26cf07e 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -22,6 +22,7 @@
  *  2 of the License, or (at your option) any later version.
  */
 #include <linux/module.h>
+#include <linux/slab.h>
 #include "ccid.h"
 #include "feat.h"
 
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 7648f316310f..9ec717426024 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -12,6 +12,7 @@
 
 #include <linux/dccp.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include <net/sock.h>
 
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 7302e1498d46..52ffa1cde15a 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -12,6 +12,7 @@
 
 #include <linux/dccp.h>
 #include <linux/icmp.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/random.h>
@@ -62,10 +63,10 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 nexthop = inet->opt->faddr;
         }
 
-        tmp = ip_route_connect(&rt, nexthop, inet->saddr,
+        tmp = ip_route_connect(&rt, nexthop, inet->inet_saddr,
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_DCCP,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (tmp < 0)
                 return tmp;
 
@@ -77,12 +78,12 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (inet->opt == NULL || !inet->opt->srr)
                 daddr = rt->rt_dst;
 
-        if (inet->saddr == 0)
-                inet->saddr = rt->rt_src;
-        inet->rcv_saddr = inet->saddr;
+        if (inet->inet_saddr == 0)
+                inet->inet_saddr = rt->rt_src;
+        inet->inet_rcv_saddr = inet->inet_saddr;
 
-        inet->dport = usin->sin_port;
-        inet->daddr = daddr;
+        inet->inet_dport = usin->sin_port;
+        inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet->opt != NULL)
@@ -98,17 +99,19 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (err != 0)
                 goto failure;
 
-        err = ip_route_newports(&rt, IPPROTO_DCCP, inet->sport, inet->dport,
-                                sk);
+        err = ip_route_newports(&rt, IPPROTO_DCCP, inet->inet_sport,
+                                inet->inet_dport, sk);
         if (err != 0)
                 goto failure;
 
         /* OK, now commit destination to socket.  */
         sk_setup_caps(sk, &rt->u.dst);
 
-        dp->dccps_iss = secure_dccp_sequence_number(inet->saddr, inet->daddr,
-                                                    inet->sport, inet->dport);
-        inet->id = dp->dccps_iss ^ jiffies;
+        dp->dccps_iss = secure_dccp_sequence_number(inet->inet_saddr,
+                                                    inet->inet_daddr,
+                                                    inet->inet_sport,
+                                                    inet->inet_dport);
+        inet->inet_id = dp->dccps_iss ^ jiffies;
 
         err = dccp_connect(sk);
         rt = NULL;
@@ -123,7 +126,7 @@ failure:
         dccp_set_state(sk, DCCP_CLOSED);
         ip_rt_put(rt);
         sk->sk_route_caps = 0;
-        inet->dport = 0;
+        inet->inet_dport = 0;
         goto out;
 }
 
@@ -352,7 +355,9 @@ void dccp_v4_send_check(struct sock *sk, int unused, struct sk_buff *skb)
         struct dccp_hdr *dh = dccp_hdr(skb);
 
         dccp_csum_outgoing(skb);
-        dh->dccph_checksum = dccp_v4_csum_finish(skb, inet->saddr, inet->daddr);
+        dh->dccph_checksum = dccp_v4_csum_finish(skb,
+                                                 inet->inet_saddr,
+                                                 inet->inet_daddr);
 }
 
 EXPORT_SYMBOL_GPL(dccp_v4_send_check);
@@ -393,18 +398,18 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newinet            = inet_sk(newsk);
         ireq               = inet_rsk(req);
-        newinet->daddr     = ireq->rmt_addr;
-        newinet->rcv_saddr = ireq->loc_addr;
-        newinet->saddr     = ireq->loc_addr;
+        newinet->inet_daddr     = ireq->rmt_addr;
+        newinet->inet_rcv_saddr = ireq->loc_addr;
+        newinet->inet_saddr     = ireq->loc_addr;
         newinet->opt       = ireq->opt;
         ireq->opt          = NULL;
         newinet->mc_index  = inet_iif(skb);
         newinet->mc_ttl    = ip_hdr(skb)->ttl;
-        newinet->id        = jiffies;
+        newinet->inet_id   = jiffies;
 
         dccp_sync_mss(newsk, dst_mtu(dst));
 
-        __inet_hash_nolisten(newsk);
+        __inet_hash_nolisten(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
@@ -473,7 +478,8 @@ static struct dst_entry* dccp_v4_route_skb(struct net *net, struct sock *sk,
         return &rt->u.dst;
 }
 
-static int dccp_v4_send_response(struct sock *sk, struct request_sock *req)
+static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
+                                 struct request_values *rv_unused)
 {
         int err = -1;
         struct sk_buff *skb;
@@ -622,7 +628,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         dreq->dreq_iss     = dccp_v4_init_sequence(skb);
         dreq->dreq_service = service;
 
-        if (dccp_v4_send_response(sk, req))
+        if (dccp_v4_send_response(sk, req, NULL))
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
@@ -987,21 +993,20 @@ static struct inet_protosw dccp_v4_protosw = {
         .protocol       = IPPROTO_DCCP,
         .prot           = &dccp_v4_prot,
         .ops            = &inet_dccp_ops,
-        .capability     = -1,
         .no_check       = 0,
         .flags          = INET_PROTOSW_ICSK,
 };
 
-static int dccp_v4_init_net(struct net *net)
+static int __net_init dccp_v4_init_net(struct net *net)
 {
-        int err;
+        if (dccp_hashinfo.bhash == NULL)
+                return -ESOCKTNOSUPPORT;
 
-        err = inet_ctl_sock_create(&net->dccp.v4_ctl_sk, PF_INET,
-                                   SOCK_DCCP, IPPROTO_DCCP, net);
-        return err;
+        return inet_ctl_sock_create(&net->dccp.v4_ctl_sk, PF_INET,
+                                    SOCK_DCCP, IPPROTO_DCCP, net);
 }
 
-static void dccp_v4_exit_net(struct net *net)
+static void __net_exit dccp_v4_exit_net(struct net *net)
 {
         inet_ctl_sock_destroy(net->dccp.v4_ctl_sk);
 }
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index e48ca5d45658..3b11e41a2929 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -14,6 +14,7 @@
 
 #include <linux/module.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <linux/xfrm.h>
 
 #include <net/addrconf.h>
@@ -46,7 +47,7 @@ static void dccp_v6_hash(struct sock *sk)
                         return;
                 }
                 local_bh_disable();
-                __inet6_hash(sk);
+                __inet6_hash(sk, NULL);
                 local_bh_enable();
         }
 }
@@ -158,8 +159,8 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                         fl.oif = sk->sk_bound_dev_if;
-                        fl.fl_ip_dport = inet->dport;
-                        fl.fl_ip_sport = inet->sport;
+                        fl.fl_ip_dport = inet->inet_dport;
+                        fl.fl_ip_sport = inet->inet_sport;
                         security_sk_classify_flow(sk, &fl);
 
                         err = ip6_dst_lookup(sk, &dst, &fl);
@@ -241,7 +242,8 @@ out:
 }
 
 
-static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
+static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
+                                 struct request_values *rv_unused)
 {
         struct inet6_request_sock *ireq6 = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -468,7 +470,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         dreq->dreq_iss     = dccp_v6_init_sequence(skb);
         dreq->dreq_service = service;
 
-        if (dccp_v6_send_response(sk, req))
+        if (dccp_v6_send_response(sk, req, NULL))
                 goto drop_and_free;
 
         inet6_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
@@ -510,11 +512,9 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
 
                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
-                ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->daddr);
+                ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
 
-                ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->saddr);
+                ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
 
                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 
@@ -642,9 +642,10 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
 
         dccp_sync_mss(newsk, dst_mtu(dst));
 
-        newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
+        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
+        newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
-        __inet6_hash(newsk);
+        __inet6_hash(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
@@ -970,12 +971,9 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                         icsk->icsk_af_ops = &dccp_ipv6_af_ops;
                         sk->sk_backlog_rcv = dccp_v6_do_rcv;
                         goto failure;
-                } else {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->saddr);
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->rcv_saddr);
                 }
+                ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
+                ipv6_addr_set_v4mapped(inet->inet_rcv_saddr, &np->rcv_saddr);
 
                 return err;
         }
@@ -988,7 +986,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         ipv6_addr_copy(&fl.fl6_src, saddr ? saddr : &np->saddr);
         fl.oif = sk->sk_bound_dev_if;
         fl.fl_ip_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
         security_sk_classify_flow(sk, &fl);
 
         if (np->opt != NULL && np->opt->srcrt != NULL) {
@@ -1021,7 +1019,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         /* set the source address */
         ipv6_addr_copy(&np->saddr, saddr);
-        inet->rcv_saddr = LOOPBACK4_IPV6;
+        inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
         __ip6_dst_store(sk, dst, NULL, NULL);
 
@@ -1030,7 +1028,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
                                           np->opt->opt_nflen);
 
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
 
         dccp_set_state(sk, DCCP_REQUESTING);
         err = inet6_hash_connect(&dccp_death_row, sk);
@@ -1039,7 +1037,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         dp->dccps_iss = secure_dccpv6_sequence_number(np->saddr.s6_addr32,
                                                       np->daddr.s6_addr32,
-                                                      inet->sport, inet->dport);
+                                                      inet->inet_sport,
+                                                      inet->inet_dport);
         err = dccp_connect(sk);
         if (err)
                 goto late_failure;
@@ -1050,7 +1049,7 @@ late_failure:
         dccp_set_state(sk, DCCP_CLOSED);
         __sk_dst_reset(sk);
 failure:
-        inet->dport = 0;
+        inet->inet_dport = 0;
         sk->sk_route_caps = 0;
         return err;
 }
@@ -1188,20 +1187,19 @@ static struct inet_protosw dccp_v6_protosw = {
         .protocol       = IPPROTO_DCCP,
         .prot           = &dccp_v6_prot,
         .ops            = &inet6_dccp_ops,
-        .capability     = -1,
         .flags          = INET_PROTOSW_ICSK,
 };
 
-static int dccp_v6_init_net(struct net *net)
+static int __net_init dccp_v6_init_net(struct net *net)
 {
-        int err;
+        if (dccp_hashinfo.bhash == NULL)
+                return -ESOCKTNOSUPPORT;
 
-        err = inet_ctl_sock_create(&net->dccp.v6_ctl_sk, PF_INET6,
-                                   SOCK_DCCP, IPPROTO_DCCP, net);
-        return err;
+        return inet_ctl_sock_create(&net->dccp.v6_ctl_sk, PF_INET6,
+                                    SOCK_DCCP, IPPROTO_DCCP, net);
 }
 
-static void dccp_v6_exit_net(struct net *net)
+static void __net_exit dccp_v6_exit_net(struct net *net)
 {
         inet_ctl_sock_destroy(net->dccp.v6_ctl_sk);
 }
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 5ca49cec95f5..128b089d3aef 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/dccp.h>
+#include <linux/gfp.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/timer.h>
@@ -184,7 +185,7 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
                          * counter (backoff, monitored by dccp_response_timer).
                          */
                         req->retrans++;
-                        req->rsk_ops->rtx_syn_ack(sk, req);
+                        req->rsk_ops->rtx_syn_ack(sk, req, NULL);
                 }
                 /* Network Duplicate, discard packet */
                 return NULL;
@@ -254,7 +255,7 @@ int dccp_child_process(struct sock *parent, struct sock *child,
                  * in main socket hash table and lock on listening
                  * socket does not protect us more.
                  */
-                sk_add_backlog(child, skb);
+                __sk_add_backlog(child, skb);
         }
 
         bh_unlock_sock(child);
diff --git a/net/dccp/output.c b/net/dccp/output.c
index c96119fda688..fc3f436440b4 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -13,6 +13,7 @@
 #include <linux/dccp.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include <net/inet_sock.h>
 #include <net/sock.h>
@@ -99,8 +100,8 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 /* Build DCCP header and checksum it. */
                 dh = dccp_zeroed_hdr(skb, dccp_header_size);
                 dh->dccph_type  = dcb->dccpd_type;
-                dh->dccph_sport = inet->sport;
-                dh->dccph_dport = inet->dport;
+                dh->dccph_sport = inet->inet_sport;
+                dh->dccph_dport = inet->inet_dport;
                 dh->dccph_doff  = (dccp_header_size + dcb->dccpd_opt_len) / 4;
                 dh->dccph_ccval = dcb->dccpd_ccval;
                 dh->dccph_cscov = dp->dccps_pcslen;
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 37731da41481..078e48d442fd 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/kfifo.h>
 #include <linux/vmalloc.h>
+#include <linux/gfp.h>
 #include <net/net_namespace.h>
 
 #include "dccp.h"
@@ -43,7 +44,7 @@ static int bufsize = 64 * 1024;
 static const char procname[] = "dccpprobe";
 
 static struct {
-        struct kfifo      *fifo;
+        struct kfifo      fifo;
         spinlock_t        lock;
         wait_queue_head_t wait;
         struct timespec   tstart;
@@ -67,7 +68,7 @@ static void printl(const char *fmt, ...)
         len += vscnprintf(tbuf+len, sizeof(tbuf)-len, fmt, args);
         va_end(args);
 
-        kfifo_put(dccpw.fifo, tbuf, len);
+        kfifo_in_locked(&dccpw.fifo, tbuf, len, &dccpw.lock);
         wake_up(&dccpw.wait);
 }
 
@@ -75,26 +76,25 @@ static int jdccp_sendmsg(struct kiocb *iocb, struct sock *sk,
                          struct msghdr *msg, size_t size)
 {
         const struct inet_sock *inet = inet_sk(sk);
-        struct ccid3_hc_tx_sock *hctx = NULL;
+        struct ccid3_hc_tx_sock *hc = NULL;
 
         if (ccid_get_current_tx_ccid(dccp_sk(sk)) == DCCPC_CCID3)
-                hctx = ccid3_hc_tx_sk(sk);
-
-        if (port == 0 || ntohs(inet->dport) == port ||
-            ntohs(inet->sport) == port) {
-                if (hctx)
-                        printl("%pI4:%u %pI4:%u %d %d %d %d %u "
-                               "%llu %llu %d\n",
-                               &inet->saddr, ntohs(inet->sport),
-                               &inet->daddr, ntohs(inet->dport), size,
-                               hctx->ccid3hctx_s, hctx->ccid3hctx_rtt,
-                               hctx->ccid3hctx_p, hctx->ccid3hctx_x_calc,
-                               hctx->ccid3hctx_x_recv >> 6,
-                               hctx->ccid3hctx_x >> 6, hctx->ccid3hctx_t_ipi);
+                hc = ccid3_hc_tx_sk(sk);
+
+        if (port == 0 || ntohs(inet->inet_dport) == port ||
+            ntohs(inet->inet_sport) == port) {
+                if (hc)
+                        printl("%pI4:%u %pI4:%u %d %d %d %d %u %llu %llu %d\n",
+                               &inet->inet_saddr, ntohs(inet->inet_sport),
+                               &inet->inet_daddr, ntohs(inet->inet_dport), size,
+                               hc->tx_s, hc->tx_rtt, hc->tx_p,
+                               hc->tx_x_calc, hc->tx_x_recv >> 6,
+                               hc->tx_x >> 6, hc->tx_t_ipi);
                 else
                         printl("%pI4:%u %pI4:%u %d\n",
-                               &inet->saddr, ntohs(inet->sport),
-                               &inet->daddr, ntohs(inet->dport), size);
+                               &inet->inet_saddr, ntohs(inet->inet_sport),
+                               &inet->inet_daddr, ntohs(inet->inet_dport),
+                               size);
         }
 
         jprobe_return();
@@ -110,7 +110,7 @@ static struct jprobe dccp_send_probe = {
 
 static int dccpprobe_open(struct inode *inode, struct file *file)
 {
-        kfifo_reset(dccpw.fifo);
+        kfifo_reset(&dccpw.fifo);
         getnstimeofday(&dccpw.tstart);
         return 0;
 }
@@ -132,11 +132,11 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
                 return -ENOMEM;
 
         error = wait_event_interruptible(dccpw.wait,
-                                         __kfifo_len(dccpw.fifo) != 0);
+                                         kfifo_len(&dccpw.fifo) != 0);
         if (error)
                 goto out_free;
 
-        cnt = kfifo_get(dccpw.fifo, tbuf, len);
+        cnt = kfifo_out_locked(&dccpw.fifo, tbuf, len, &dccpw.lock);
         error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
 
 out_free:
@@ -157,14 +157,13 @@ static __init int dccpprobe_init(void)
 
         init_waitqueue_head(&dccpw.wait);
         spin_lock_init(&dccpw.lock);
-        dccpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &dccpw.lock);
-        if (IS_ERR(dccpw.fifo))
-                return PTR_ERR(dccpw.fifo);
-
+        if (kfifo_alloc(&dccpw.fifo, bufsize, GFP_KERNEL))
+                return ret;
         if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &dccpprobe_fops))
                 goto err0;
 
-        ret = register_jprobe(&dccp_send_probe);
+        try_then_request_module((ret = register_jprobe(&dccp_send_probe)) == 0,
+                                "dccp");
         if (ret)
                 goto err1;
 
@@ -173,14 +172,14 @@ static __init int dccpprobe_init(void)
 err1:
         proc_net_remove(&init_net, procname);
 err0:
-        kfifo_free(dccpw.fifo);
+        kfifo_free(&dccpw.fifo);
         return ret;
 }
 module_init(dccpprobe_init);
 
 static __exit void dccpprobe_exit(void)
 {
-        kfifo_free(dccpw.fifo);
+        kfifo_free(&dccpw.fifo);
         proc_net_remove(&init_net, procname);
         unregister_jprobe(&dccp_send_probe);
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index a156319fd0ac..a0e38d8018f5 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -20,6 +20,7 @@
 #include <linux/if_arp.h>
 #include <linux/init.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <net/checksum.h>
 
 #include <net/inet_sock.h>
@@ -278,7 +279,7 @@ int dccp_disconnect(struct sock *sk, int flags)
                 sk->sk_send_head = NULL;
         }
 
-        inet->dport = 0;
+        inet->inet_dport = 0;
 
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -290,7 +291,7 @@ int dccp_disconnect(struct sock *sk, int flags)
         inet_csk_delack_init(sk);
         __sk_dst_reset(sk);
 
-        WARN_ON(inet->num && !icsk->icsk_bind_hash);
+        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -835,6 +836,8 @@ verify_sock_status:
                         len = -EFAULT;
                         break;
                 }
+                if (flags & MSG_TRUNC)
+                        len = skb->len;
         found_fin_ok:
                 if (!(flags & MSG_PEEK))
                         sk_eat_skb(sk, skb, 0);
@@ -1003,12 +1006,13 @@ EXPORT_SYMBOL_GPL(dccp_shutdown);
 
 static inline int dccp_mib_init(void)
 {
-        return snmp_mib_init((void**)dccp_statistics, sizeof(struct dccp_mib));
+        return snmp_mib_init((void __percpu **)dccp_statistics,
+                             sizeof(struct dccp_mib));
 }
 
 static inline void dccp_mib_exit(void)
 {
-        snmp_mib_free((void**)dccp_statistics);
+        snmp_mib_free((void __percpu **)dccp_statistics);
 }
 
 static int thash_entries;
@@ -1033,7 +1037,7 @@ static int __init dccp_init(void)
                      FIELD_SIZEOF(struct sk_buff, cb));
         rc = percpu_counter_init(&dccp_orphan_count, 0);
         if (rc)
-                goto out;
+                goto out_fail;
         rc = -ENOBUFS;
         inet_hashinfo_init(&dccp_hashinfo);
         dccp_hashinfo.bind_bucket_cachep =
@@ -1060,11 +1064,12 @@ static int __init dccp_init(void)
         for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
                 ;
         do {
-                dccp_hashinfo.ehash_size = (1UL << ehash_order) * PAGE_SIZE /
+                unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
                                         sizeof(struct inet_ehash_bucket);
-                while (dccp_hashinfo.ehash_size &
-                       (dccp_hashinfo.ehash_size - 1))
-                        dccp_hashinfo.ehash_size--;
+
+                while (hash_size & (hash_size - 1))
+                        hash_size--;
+                dccp_hashinfo.ehash_mask = hash_size - 1;
                 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
         } while (!dccp_hashinfo.ehash && --ehash_order > 0);
@@ -1074,7 +1079,7 @@ static int __init dccp_init(void)
                 goto out_free_bind_bucket_cachep;
         }
 
-        for (i = 0; i < dccp_hashinfo.ehash_size; i++) {
+        for (i = 0; i <= dccp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].twchain, i);
         }
@@ -1121,8 +1126,9 @@ static int __init dccp_init(void)
                 goto out_sysctl_exit;
 
         dccp_timestamping_init();
-out:
-        return rc;
+
+        return 0;
+
 out_sysctl_exit:
         dccp_sysctl_exit();
 out_ackvec_exit:
@@ -1131,18 +1137,19 @@ out_free_dccp_mib:
         dccp_mib_exit();
 out_free_dccp_bhash:
         free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
-        dccp_hashinfo.bhash = NULL;
 out_free_dccp_locks:
         inet_ehash_locks_free(&dccp_hashinfo);
 out_free_dccp_ehash:
         free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
-        dccp_hashinfo.ehash = NULL;
 out_free_bind_bucket_cachep:
         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
-        dccp_hashinfo.bind_bucket_cachep = NULL;
 out_free_percpu:
         percpu_counter_destroy(&dccp_orphan_count);
-        goto out;
+out_fail:
+        dccp_hashinfo.bhash = NULL;
+        dccp_hashinfo.ehash = NULL;
+        dccp_hashinfo.bind_bucket_cachep = NULL;
+        return rc;
 }
 
 static void __exit dccp_fini(void)
@@ -1153,7 +1160,7 @@ static void __exit dccp_fini(void)
                    get_order(dccp_hashinfo.bhash_size *
                              sizeof(struct inet_bind_hashbucket)));
         free_pages((unsigned long)dccp_hashinfo.ehash,
-                   get_order(dccp_hashinfo.ehash_size *
+                   get_order((dccp_hashinfo.ehash_mask + 1) *
                              sizeof(struct inet_ehash_bucket)));
         inet_ehash_locks_free(&dccp_hashinfo);
         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
diff --git a/net/dccp/sysctl.c b/net/dccp/sysctl.c
index a5a1856234e7..563943822e58 100644
--- a/net/dccp/sysctl.c
+++ b/net/dccp/sysctl.c
@@ -93,13 +93,13 @@ static struct ctl_table dccp_default_table[] = {
                 .proc_handler   = proc_dointvec_ms_jiffies,
         },
 
-        { .ctl_name = 0, }
+        { }
 };
 
 static struct ctl_path dccp_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "dccp", .ctl_name = NET_DCCP, },
-        { .procname = "default", .ctl_name = NET_DCCP_DEFAULT, },
+        { .procname = "net", },
+        { .procname = "dccp", },
+        { .procname = "default", },
         { }
 };
 
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 162d1e683c39..bbfeb5eae46a 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -38,7 +38,7 @@ static int dccp_write_timeout(struct sock *sk)
 
         if (sk->sk_state == DCCP_REQUESTING || sk->sk_state == DCCP_PARTOPEN) {
                 if (icsk->icsk_retransmits != 0)
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 retry_until = icsk->icsk_syn_retries ?
                             : sysctl_dccp_request_retries;
         } else {
@@ -63,7 +63,7 @@ static int dccp_write_timeout(struct sock *sk)
                            Golden words :-).
                    */
 
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 }
 
                 retry_until = sysctl_dccp_retries2;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 7a58c87baf17..2b494fac9468 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -675,11 +675,12 @@ char *dn_addr2asc(__u16 addr, char *buf)
 
 
 
-static int dn_create(struct net *net, struct socket *sock, int protocol)
+static int dn_create(struct net *net, struct socket *sock, int protocol,
+                     int kern)
 {
         struct sock *sk;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         switch(sock->type) {
@@ -749,9 +750,9 @@ static int dn_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         if (!(saddr->sdn_flags & SDF_WILD)) {
                 if (le16_to_cpu(saddr->sdn_nodeaddrl)) {
-                        read_lock(&dev_base_lock);
+                        rcu_read_lock();
                         ldev = NULL;
-                        for_each_netdev(&init_net, dev) {
+                        for_each_netdev_rcu(&init_net, dev) {
                                 if (!dev->dn_ptr)
                                         continue;
                                 if (dn_dev_islocal(dev, dn_saddr2dn(saddr))) {
@@ -759,7 +760,7 @@ static int dn_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                         break;
                                 }
                         }
-                        read_unlock(&dev_base_lock);
+                        rcu_read_unlock();
                         if (ldev == NULL)
                                 return -EADDRNOTAVAIL;
                 }
@@ -1955,7 +1956,7 @@ static int dn_sendmsg(struct kiocb *iocb, struct socket *sock,
         }
 
         if ((flags & MSG_TRYHARD) && sk->sk_dst_cache)
-                dst_negative_advice(&sk->sk_dst_cache);
+                dst_negative_advice(&sk->sk_dst_cache, sk);
 
         mss = scp->segsize_rem;
         fctype = scp->services_rem & NSP_FC_MASK;
@@ -2325,7 +2326,7 @@ static const struct file_operations dn_socket_seq_fops = {
 };
 #endif
 
-static struct net_proto_family  dn_family_ops = {
+static const struct net_proto_family    dn_family_ops = {
         .family =       AF_DECnet,
         .create =       dn_create,
         .owner  =       THIS_MODULE,
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 6e1f085db06a..cead68eb254c 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -40,6 +40,7 @@
 #include <linux/skbuff.h>
 #include <linux/sysctl.h>
 #include <linux/notifier.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <net/net_namespace.h>
@@ -68,7 +69,7 @@ extern struct neigh_table dn_neigh_table;
  */
 __le16 decnet_address = 0;
 
-static DEFINE_RWLOCK(dndev_lock);
+static DEFINE_SPINLOCK(dndev_lock);
 static struct net_device *decnet_default_device;
 static BLOCKING_NOTIFIER_HEAD(dnaddr_chain);
 
@@ -89,7 +90,6 @@ static struct dn_dev_parms dn_dev_list[] =  {
         .t2 =           1,
         .t3 =           10,
         .name =         "ethernet",
-        .ctl_name =     NET_DECNET_CONF_ETHER,
         .up =           dn_eth_up,
         .down =         dn_eth_down,
         .timer3 =       dn_send_brd_hello,
@@ -101,7 +101,6 @@ static struct dn_dev_parms dn_dev_list[] =  {
         .t2 =           1,
         .t3 =           10,
         .name =         "ipgre",
-        .ctl_name =     NET_DECNET_CONF_GRE,
         .timer3 =       dn_send_brd_hello,
 },
 #if 0
@@ -112,7 +111,6 @@ static struct dn_dev_parms dn_dev_list[] =  {
         .t2 =           1,
         .t3 =           120,
         .name =         "x25",
-        .ctl_name =     NET_DECNET_CONF_X25,
         .timer3 =       dn_send_ptp_hello,
 },
 #endif
@@ -124,7 +122,6 @@ static struct dn_dev_parms dn_dev_list[] =  {
         .t2 =           1,
         .t3 =           10,
         .name =         "ppp",
-        .ctl_name =     NET_DECNET_CONF_PPP,
         .timer3 =       dn_send_brd_hello,
 },
 #endif
@@ -135,7 +132,6 @@ static struct dn_dev_parms dn_dev_list[] =  {
         .t2 =           1,
         .t3 =           120,
         .name =         "ddcmp",
-        .ctl_name =     NET_DECNET_CONF_DDCMP,
         .timer3 =       dn_send_ptp_hello,
 },
 {
@@ -145,7 +141,6 @@ static struct dn_dev_parms dn_dev_list[] =  {
         .t2 =           1,
         .t3 =           10,
         .name =         "loopback",
-        .ctl_name =     NET_DECNET_CONF_LOOPBACK,
         .timer3 =       dn_send_brd_hello,
 }
 };
@@ -166,10 +161,6 @@ static int max_priority[] = { 127 }; /* From DECnet spec */
 
 static int dn_forwarding_proc(ctl_table *, int,
                         void __user *, size_t *, loff_t *);
-static int dn_forwarding_sysctl(ctl_table *table,
-                        void __user *oldval, size_t __user *oldlenp,
-                        void __user *newval, size_t newlen);
-
 static struct dn_dev_sysctl_table {
         struct ctl_table_header *sysctl_header;
         ctl_table dn_dev_vars[5];
@@ -177,44 +168,36 @@ static struct dn_dev_sysctl_table {
         NULL,
         {
         {
-                .ctl_name = NET_DECNET_CONF_DEV_FORWARDING,
                 .procname = "forwarding",
                 .data = (void *)DN_DEV_PARMS_OFFSET(forwarding),
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = dn_forwarding_proc,
-                .strategy = dn_forwarding_sysctl,
         },
         {
-                .ctl_name = NET_DECNET_CONF_DEV_PRIORITY,
                 .procname = "priority",
                 .data = (void *)DN_DEV_PARMS_OFFSET(priority),
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_priority,
                 .extra2 = &max_priority
         },
         {
-                .ctl_name = NET_DECNET_CONF_DEV_T2,
                 .procname = "t2",
                 .data = (void *)DN_DEV_PARMS_OFFSET(t2),
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_t2,
                 .extra2 = &max_t2
         },
         {
-                .ctl_name = NET_DECNET_CONF_DEV_T3,
                 .procname = "t3",
                 .data = (void *)DN_DEV_PARMS_OFFSET(t3),
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_t3,
                 .extra2 = &max_t3
         },
@@ -230,9 +213,9 @@ static void dn_dev_sysctl_register(struct net_device *dev, struct dn_dev_parms *
 #define DN_CTL_PATH_DEV 3
 
         struct ctl_path dn_ctl_path[] = {
-                { .procname = "net", .ctl_name = CTL_NET, },
-                { .procname = "decnet", .ctl_name = NET_DECNET, },
-                { .procname = "conf", .ctl_name = NET_DECNET_CONF, },
+                { .procname = "net",  },
+                { .procname = "decnet",  },
+                { .procname = "conf",  },
                 { /* to be set */ },
                 { },
         };
@@ -248,10 +231,8 @@ static void dn_dev_sysctl_register(struct net_device *dev, struct dn_dev_parms *
 
         if (dev) {
                 dn_ctl_path[DN_CTL_PATH_DEV].procname = dev->name;
-                dn_ctl_path[DN_CTL_PATH_DEV].ctl_name = dev->ifindex;
         } else {
                 dn_ctl_path[DN_CTL_PATH_DEV].procname = parms->name;
-                dn_ctl_path[DN_CTL_PATH_DEV].ctl_name = parms->ctl_name;
         }
 
         t->dn_dev_vars[0].extra1 = (void *)dev;
@@ -317,44 +298,6 @@ static int dn_forwarding_proc(ctl_table *table, int write,
 #endif
 }
 
-static int dn_forwarding_sysctl(ctl_table *table,
-                        void __user *oldval, size_t __user *oldlenp,
-                        void __user *newval, size_t newlen)
-{
-#ifdef CONFIG_DECNET_ROUTER
-        struct net_device *dev = table->extra1;
-        struct dn_dev *dn_db;
-        int value;
-
-        if (table->extra1 == NULL)
-                return -EINVAL;
-
-        dn_db = dev->dn_ptr;
-
-        if (newval && newlen) {
-                if (newlen != sizeof(int))
-                        return -EINVAL;
-
-                if (get_user(value, (int __user *)newval))
-                        return -EFAULT;
-                if (value < 0)
-                        return -EINVAL;
-                if (value > 2)
-                        return -EINVAL;
-
-                if (dn_db->parms.down)
-                        dn_db->parms.down(dev);
-                dn_db->parms.forwarding = value;
-                if (dn_db->parms.up)
-                        dn_db->parms.up(dev);
-        }
-
-        return 0;
-#else
-        return -EINVAL;
-#endif
-}
-
 #else /* CONFIG_SYSCTL */
 static void dn_dev_sysctl_unregister(struct dn_dev_parms *parms)
 {
@@ -557,7 +500,8 @@ rarok:
 struct net_device *dn_dev_get_default(void)
 {
         struct net_device *dev;
-        read_lock(&dndev_lock);
+
+        spin_lock(&dndev_lock);
         dev = decnet_default_device;
         if (dev) {
                 if (dev->dn_ptr)
@@ -565,7 +509,8 @@ struct net_device *dn_dev_get_default(void)
                 else
                         dev = NULL;
         }
-        read_unlock(&dndev_lock);
+        spin_unlock(&dndev_lock);
+
         return dev;
 }
 
@@ -575,13 +520,15 @@ int dn_dev_set_default(struct net_device *dev, int force)
         int rv = -EBUSY;
         if (!dev->dn_ptr)
                 return -ENODEV;
-        write_lock(&dndev_lock);
+
+        spin_lock(&dndev_lock);
         if (force || decnet_default_device == NULL) {
                 old = decnet_default_device;
                 decnet_default_device = dev;
                 rv = 0;
         }
-        write_unlock(&dndev_lock);
+        spin_unlock(&dndev_lock);
+
         if (old)
                 dev_put(old);
         return rv;
@@ -589,26 +536,29 @@ int dn_dev_set_default(struct net_device *dev, int force)
 
 static void dn_dev_check_default(struct net_device *dev)
 {
-        write_lock(&dndev_lock);
+        spin_lock(&dndev_lock);
         if (dev == decnet_default_device) {
                 decnet_default_device = NULL;
         } else {
                 dev = NULL;
         }
-        write_unlock(&dndev_lock);
+        spin_unlock(&dndev_lock);
+
         if (dev)
                 dev_put(dev);
 }
 
+/*
+ * Called with RTNL
+ */
 static struct dn_dev *dn_dev_by_index(int ifindex)
 {
         struct net_device *dev;
         struct dn_dev *dn_dev = NULL;
-        dev = dev_get_by_index(&init_net, ifindex);
-        if (dev) {
+
+        dev = __dev_get_by_index(&init_net, ifindex);
+        if (dev)
                 dn_dev = dev->dn_ptr;
-                dev_put(dev);
-        }
 
         return dn_dev;
 }
@@ -629,7 +579,7 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         struct dn_ifaddr *ifa, **ifap;
         int err = -EINVAL;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 goto errout;
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, dn_ifa_policy);
@@ -668,7 +618,7 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         struct dn_ifaddr *ifa;
         int err;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, dn_ifa_policy);
@@ -782,7 +732,7 @@ static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
         struct dn_dev *dn_db;
         struct dn_ifaddr *ifa;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return 0;
 
         skip_ndevs = cb->args[0];
@@ -826,13 +776,17 @@ static int dn_dev_get_first(struct net_device *dev, __le16 *addr)
         struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
         struct dn_ifaddr *ifa;
         int rv = -ENODEV;
+
         if (dn_db == NULL)
                 goto out;
+
+        rtnl_lock();
         ifa = dn_db->ifa_list;
         if (ifa != NULL) {
                 *addr = ifa->ifa_local;
                 rv = 0;
         }
+        rtnl_unlock();
 out:
         return rv;
 }
@@ -854,9 +808,7 @@ int dn_dev_bind_default(__le16 *addr)
         dev = dn_dev_get_default();
 last_chance:
         if (dev) {
-                read_lock(&dev_base_lock);
                 rv = dn_dev_get_first(dev, addr);
-                read_unlock(&dev_base_lock);
                 dev_put(dev);
                 if (rv == 0 || dev == init_net.loopback_dev)
                         return rv;
@@ -1321,18 +1273,18 @@ static inline int is_dn_dev(struct net_device *dev)
 }
 
 static void *dn_dev_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(&dev_base_lock)
+        __acquires(rcu)
 {
         int i;
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
 
         if (*pos == 0)
                 return SEQ_START_TOKEN;
 
         i = 1;
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev_rcu(&init_net, dev) {
                 if (!is_dn_dev(dev))
                         continue;
 
@@ -1353,7 +1305,7 @@ static void *dn_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         if (v == SEQ_START_TOKEN)
                 dev = net_device_entry(&init_net.dev_base_head);
 
-        for_each_netdev_continue(&init_net, dev) {
+        for_each_netdev_continue_rcu(&init_net, dev) {
                 if (!is_dn_dev(dev))
                         continue;
 
@@ -1364,9 +1316,9 @@ static void *dn_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void dn_dev_seq_stop(struct seq_file *seq, void *v)
-        __releases(&dev_base_lock)
+        __releases(rcu)
 {
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static char *dn_type2asc(char type)
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 27ea2e9b080a..4ab96c15166d 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -20,6 +20,7 @@
 #include <linux/string.h>
 #include <linux/net.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/sockios.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
@@ -509,7 +510,7 @@ static int dn_fib_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *
         struct rtattr **rta = arg;
         struct rtmsg *r = NLMSG_DATA(nlh);
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         if (dn_fib_check_attr(r, rta))
@@ -529,7 +530,7 @@ static int dn_fib_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *
         struct rtattr **rta = arg;
         struct rtmsg *r = NLMSG_DATA(nlh);
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         if (dn_fib_check_attr(r, rta))
@@ -607,8 +608,8 @@ static void dn_fib_del_ifaddr(struct dn_ifaddr *ifa)
         ASSERT_RTNL();
 
         /* Scan device list */
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
                 dn_db = dev->dn_ptr;
                 if (dn_db == NULL)
                         continue;
@@ -619,7 +620,7 @@ static void dn_fib_del_ifaddr(struct dn_ifaddr *ifa)
                         }
                 }
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         if (found_it == 0) {
                 fib_magic(RTM_DELROUTE, RTN_LOCAL, ifa->ifa_local, 16, ifa);
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index 794b5bf95af1..deb723dba44b 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -28,6 +28,7 @@
 #include <linux/module.h>
 #include <linux/socket.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <linux/if_ether.h>
 #include <linux/init.h>
 #include <linux/proc_fs.h>
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index 932408dca86d..25a37299bc65 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -57,6 +57,7 @@
 #include <linux/netdevice.h>
 #include <linux/inet.h>
 #include <linux/route.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/system.h>
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index a65e929ce76c..baeb1eaf011b 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -50,6 +50,7 @@
 #include <linux/netdevice.h>
 #include <linux/inet.h>
 #include <linux/route.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 57662cabaf9b..70ebe74027d5 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -66,6 +66,7 @@
 #include <linux/inet.h>
 #include <linux/route.h>
 #include <linux/in_route.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/mm.h>
 #include <linux/proc_fs.h>
@@ -908,8 +909,8 @@ static int dn_route_output_slow(struct dst_entry **pprt, const struct flowi *old
                         dev_put(dev_out);
                         goto out;
                 }
-                read_lock(&dev_base_lock);
-                for_each_netdev(&init_net, dev) {
+                rcu_read_lock();
+                for_each_netdev_rcu(&init_net, dev) {
                         if (!dev->dn_ptr)
                                 continue;
                         if (!dn_dev_islocal(dev, oldflp->fld_src))
@@ -922,7 +923,7 @@ static int dn_route_output_slow(struct dst_entry **pprt, const struct flowi *old
                         dev_out = dev;
                         break;
                 }
-                read_unlock(&dev_base_lock);
+                rcu_read_unlock();
                 if (dev_out == NULL)
                         goto out;
                 dev_hold(dev_out);
@@ -1155,8 +1156,8 @@ static int __dn_route_output_key(struct dst_entry **pprt, const struct flowi *fl
 
         if (!(flags & MSG_TRYHARD)) {
                 rcu_read_lock_bh();
-                for(rt = rcu_dereference(dn_rt_hash_table[hash].chain); rt;
-                        rt = rcu_dereference(rt->u.dst.dn_next)) {
+                for (rt = rcu_dereference_bh(dn_rt_hash_table[hash].chain); rt;
+                        rt = rcu_dereference_bh(rt->u.dst.dn_next)) {
                         if ((flp->fld_dst == rt->fl.fld_dst) &&
                             (flp->fld_src == rt->fl.fld_src) &&
                             (flp->mark == rt->fl.mark) &&
@@ -1517,7 +1518,7 @@ static int dn_cache_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, void
         struct sk_buff *skb;
         struct flowi fl;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         memset(&fl, 0, sizeof(fl));
@@ -1602,7 +1603,7 @@ int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int h, s_h;
         int idx, s_idx;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return 0;
 
         if (NLMSG_PAYLOAD(cb->nlh, 0) < sizeof(struct rtmsg))
@@ -1618,9 +1619,9 @@ int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb)
                 if (h > s_h)
                         s_idx = 0;
                 rcu_read_lock_bh();
-                for(rt = rcu_dereference(dn_rt_hash_table[h].chain), idx = 0;
+                for(rt = rcu_dereference_bh(dn_rt_hash_table[h].chain), idx = 0;
                         rt;
-                        rt = rcu_dereference(rt->u.dst.dn_next), idx++) {
+                        rt = rcu_dereference_bh(rt->u.dst.dn_next), idx++) {
                         if (idx < s_idx)
                                 continue;
                         skb_dst_set(skb, dst_clone(&rt->u.dst));
@@ -1654,12 +1655,12 @@ static struct dn_route *dn_rt_cache_get_first(struct seq_file *seq)
 
         for(s->bucket = dn_rt_hash_mask; s->bucket >= 0; --s->bucket) {
                 rcu_read_lock_bh();
-                rt = dn_rt_hash_table[s->bucket].chain;
+                rt = rcu_dereference_bh(dn_rt_hash_table[s->bucket].chain);
                 if (rt)
                         break;
                 rcu_read_unlock_bh();
         }
-        return rcu_dereference(rt);
+        return rt;
 }
 
 static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_route *rt)
@@ -1674,7 +1675,7 @@ static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_rou
                 rcu_read_lock_bh();
                 rt = dn_rt_hash_table[s->bucket].chain;
         }
-        return rcu_dereference(rt);
+        return rcu_dereference_bh(rt);
 }
 
 static void *dn_rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 72495f25269f..7466c546f286 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -33,7 +33,7 @@
 #include <net/dn_dev.h>
 #include <net/dn_route.h>
 
-static struct fib_rules_ops dn_fib_rules_ops;
+static struct fib_rules_ops *dn_fib_rules_ops;
 
 struct dn_fib_rule
 {
@@ -56,7 +56,7 @@ int dn_fib_lookup(struct flowi *flp, struct dn_fib_res *res)
         };
         int err;
 
-        err = fib_rules_lookup(&dn_fib_rules_ops, flp, 0, &arg);
+        err = fib_rules_lookup(dn_fib_rules_ops, flp, 0, &arg);
         res->r = arg.rule;
 
         return err;
@@ -217,9 +217,9 @@ static u32 dn_fib_rule_default_pref(struct fib_rules_ops *ops)
         struct list_head *pos;
         struct fib_rule *rule;
 
-        if (!list_empty(&dn_fib_rules_ops.rules_list)) {
-                pos = dn_fib_rules_ops.rules_list.next;
-                if (pos->next != &dn_fib_rules_ops.rules_list) {
+        if (!list_empty(&dn_fib_rules_ops->rules_list)) {
+                pos = dn_fib_rules_ops->rules_list.next;
+                if (pos->next != &dn_fib_rules_ops->rules_list) {
                         rule = list_entry(pos->next, struct fib_rule, list);
                         if (rule->pref)
                                 return rule->pref - 1;
@@ -234,7 +234,7 @@ static void dn_fib_rule_flush_cache(struct fib_rules_ops *ops)
         dn_rt_cache_flush(-1);
 }
 
-static struct fib_rules_ops dn_fib_rules_ops = {
+static struct fib_rules_ops dn_fib_rules_ops_template = {
         .family         = AF_DECnet,
         .rule_size      = sizeof(struct dn_fib_rule),
         .addr_size      = sizeof(u16),
@@ -247,21 +247,23 @@ static struct fib_rules_ops dn_fib_rules_ops = {
         .flush_cache    = dn_fib_rule_flush_cache,
         .nlgroup        = RTNLGRP_DECnet_RULE,
         .policy         = dn_fib_rule_policy,
-        .rules_list     = LIST_HEAD_INIT(dn_fib_rules_ops.rules_list),
         .owner          = THIS_MODULE,
         .fro_net        = &init_net,
 };
 
 void __init dn_fib_rules_init(void)
 {
-        BUG_ON(fib_default_rule_add(&dn_fib_rules_ops, 0x7fff,
+        dn_fib_rules_ops =
+                fib_rules_register(&dn_fib_rules_ops_template, &init_net);
+        BUG_ON(IS_ERR(dn_fib_rules_ops));
+        BUG_ON(fib_default_rule_add(dn_fib_rules_ops, 0x7fff,
                                     RT_TABLE_MAIN, 0));
-        fib_rules_register(&dn_fib_rules_ops);
 }
 
 void __exit dn_fib_rules_cleanup(void)
 {
-        fib_rules_unregister(&dn_fib_rules_ops);
+        fib_rules_unregister(dn_fib_rules_ops);
+        rcu_barrier();
 }
 
 
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 67054b0d550f..f2abd3755690 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -15,6 +15,7 @@
 #include <linux/string.h>
 #include <linux/net.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/sockios.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
@@ -471,7 +472,7 @@ int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb)
         struct hlist_node *node;
         int dumped = 0;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return 0;
 
         if (NLMSG_PAYLOAD(cb->nlh, 0) >= sizeof(struct rtmsg) &&
@@ -581,8 +582,9 @@ static int dn_fib_table_insert(struct dn_fib_table *tb, struct rtmsg *r, struct
                 DN_FIB_SCAN_KEY(f, fp, key) {
                         if (fi->fib_priority != DN_FIB_INFO(f)->fib_priority)
                                 break;
-                        if (f->fn_type == type && f->fn_scope == r->rtm_scope
-                                        && DN_FIB_INFO(f) == fi)
+                        if (f->fn_type == type &&
+                            f->fn_scope == r->rtm_scope &&
+                            DN_FIB_INFO(f) == fi)
                                 goto out;
                 }
 
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 6d2bd3202048..64a7f39e069f 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -14,6 +14,7 @@
  */
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/netfilter.h>
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 2036568beea9..be3eb8e23288 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -131,39 +131,6 @@ static int parse_addr(__le16 *addr, char *str)
         return 0;
 }
 
-
-static int dn_node_address_strategy(ctl_table *table,
-                                void __user *oldval, size_t __user *oldlenp,
-                                void __user *newval, size_t newlen)
-{
-        size_t len;
-        __le16 addr;
-
-        if (oldval && oldlenp) {
-                if (get_user(len, oldlenp))
-                        return -EFAULT;
-                if (len) {
-                        if (len != sizeof(unsigned short))
-                                return -EINVAL;
-                        if (put_user(decnet_address, (__le16 __user *)oldval))
-                                return -EFAULT;
-                }
-        }
-        if (newval && newlen) {
-                if (newlen != sizeof(unsigned short))
-                        return -EINVAL;
-                if (get_user(addr, (__le16 __user *)newval))
-                        return -EFAULT;
-
-                dn_dev_devices_off();
-
-                decnet_address = addr;
-
-                dn_dev_devices_on();
-        }
-        return 0;
-}
-
 static int dn_node_address_handler(ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
@@ -215,64 +182,6 @@ static int dn_node_address_handler(ctl_table *table, int write,
         return 0;
 }
 
-
-static int dn_def_dev_strategy(ctl_table *table,
-                                void __user *oldval, size_t __user *oldlenp,
-                                void __user *newval, size_t newlen)
-{
-        size_t len;
-        struct net_device *dev;
-        char devname[17];
-        size_t namel;
-        int rv = 0;
-
-        devname[0] = 0;
-
-        if (oldval && oldlenp) {
-                if (get_user(len, oldlenp))
-                        return -EFAULT;
-                if (len) {
-                        dev = dn_dev_get_default();
-                        if (dev) {
-                                strcpy(devname, dev->name);
-                                dev_put(dev);
-                        }
-
-                        namel = strlen(devname) + 1;
-                        if (len > namel) len = namel;
-
-                        if (copy_to_user(oldval, devname, len))
-                                return -EFAULT;
-
-                        if (put_user(len, oldlenp))
-                                return -EFAULT;
-                }
-        }
-
-        if (newval && newlen) {
-                if (newlen > 16)
-                        return -E2BIG;
-
-                if (copy_from_user(devname, newval, newlen))
-                        return -EFAULT;
-
-                devname[newlen] = 0;
-
-                dev = dev_get_by_name(&init_net, devname);
-                if (dev == NULL)
-                        return -ENODEV;
-
-                rv = -ENODEV;
-                if (dev->dn_ptr != NULL)
-                        rv = dn_dev_set_default(dev, 1);
-                if (rv)
-                        dev_put(dev);
-        }
-
-        return rv;
-}
-
-
 static int dn_def_dev_handler(ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
@@ -338,138 +247,112 @@ static int dn_def_dev_handler(ctl_table *table, int write,
 
 static ctl_table dn_table[] = {
         {
-                .ctl_name = NET_DECNET_NODE_ADDRESS,
                 .procname = "node_address",
                 .maxlen = 7,
                 .mode = 0644,
                 .proc_handler = dn_node_address_handler,
-                .strategy = dn_node_address_strategy,
         },
         {
-                .ctl_name = NET_DECNET_NODE_NAME,
                 .procname = "node_name",
                 .data = node_name,
                 .maxlen = 7,
                 .mode = 0644,
                 .proc_handler = proc_dostring,
-                .strategy = sysctl_string,
         },
         {
-                .ctl_name = NET_DECNET_DEFAULT_DEVICE,
                 .procname = "default_device",
                 .maxlen = 16,
                 .mode = 0644,
                 .proc_handler = dn_def_dev_handler,
-                .strategy = dn_def_dev_strategy,
         },
         {
-                .ctl_name = NET_DECNET_TIME_WAIT,
                 .procname = "time_wait",
                 .data = &decnet_time_wait,
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_decnet_time_wait,
                 .extra2 = &max_decnet_time_wait
         },
         {
-                .ctl_name = NET_DECNET_DN_COUNT,
                 .procname = "dn_count",
                 .data = &decnet_dn_count,
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_state_count,
                 .extra2 = &max_state_count
         },
         {
-                .ctl_name = NET_DECNET_DI_COUNT,
                 .procname = "di_count",
                 .data = &decnet_di_count,
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_state_count,
                 .extra2 = &max_state_count
         },
         {
-                .ctl_name = NET_DECNET_DR_COUNT,
                 .procname = "dr_count",
                 .data = &decnet_dr_count,
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_state_count,
                 .extra2 = &max_state_count
         },
         {
-                .ctl_name = NET_DECNET_DST_GC_INTERVAL,
                 .procname = "dst_gc_interval",
                 .data = &decnet_dst_gc_interval,
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_decnet_dst_gc_interval,
                 .extra2 = &max_decnet_dst_gc_interval
         },
         {
-                .ctl_name = NET_DECNET_NO_FC_MAX_CWND,
                 .procname = "no_fc_max_cwnd",
                 .data = &decnet_no_fc_max_cwnd,
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy = sysctl_intvec,
                 .extra1 = &min_decnet_no_fc_max_cwnd,
                 .extra2 = &max_decnet_no_fc_max_cwnd
         },
        {
-                .ctl_name = NET_DECNET_MEM,
                 .procname = "decnet_mem",
                 .data = &sysctl_decnet_mem,
                 .maxlen = sizeof(sysctl_decnet_mem),
                 .mode = 0644,
                 .proc_handler = proc_dointvec,
-                .strategy = sysctl_intvec,
         },
         {
-                .ctl_name = NET_DECNET_RMEM,
                 .procname = "decnet_rmem",
                 .data = &sysctl_decnet_rmem,
                 .maxlen = sizeof(sysctl_decnet_rmem),
                 .mode = 0644,
                 .proc_handler = proc_dointvec,
-                .strategy = sysctl_intvec,
         },
         {
-                .ctl_name = NET_DECNET_WMEM,
                 .procname = "decnet_wmem",
                 .data = &sysctl_decnet_wmem,
                 .maxlen = sizeof(sysctl_decnet_wmem),
                 .mode = 0644,
                 .proc_handler = proc_dointvec,
-                .strategy = sysctl_intvec,
         },
         {
-                .ctl_name = NET_DECNET_DEBUG_LEVEL,
                 .procname = "debug",
                 .data = &decnet_debug_level,
                 .maxlen = sizeof(int),
                 .mode = 0644,
                 .proc_handler = proc_dointvec,
-                .strategy = sysctl_intvec,
         },
-        {0}
+        { }
 };
 
 static struct ctl_path dn_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "decnet", .ctl_name = NET_DECNET, },
+        { .procname = "net", },
+        { .procname = "decnet", },
         { }
 };
 
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 71489f69a42c..6112a12578b2 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -11,6 +11,7 @@
 #include <linux/list.h>
 #include <linux/netdevice.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <net/dsa.h>
 #include "dsa_priv.h"
 
diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c
index cdf2d28a0297..98dfe80b4538 100644
--- a/net/dsa/tag_dsa.c
+++ b/net/dsa/tag_dsa.c
@@ -11,6 +11,7 @@
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include "dsa_priv.h"
 
 #define DSA_HLEN        4
diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c
index 8f53948cff4f..6f383322ad25 100644
--- a/net/dsa/tag_edsa.c
+++ b/net/dsa/tag_edsa.c
@@ -11,6 +11,7 @@
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include "dsa_priv.h"
 
 #define DSA_HLEN        4
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index a85c829853c0..d6d7d0add3cb 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -11,6 +11,7 @@
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include "dsa_priv.h"
 
 netdev_tx_t trailer_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 0e0254fd767d..2a5a8053e000 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -30,6 +30,7 @@
 #include <linux/wireless.h>
 #include <linux/skbuff.h>
 #include <linux/udp.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/inet_common.h>
 #include <linux/stat.h>
@@ -457,15 +458,15 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
         iov[0].iov_len = size;
         for (i = 0; i < msg->msg_iovlen; i++) {
                 void __user *base = msg->msg_iov[i].iov_base;
-                size_t len = msg->msg_iov[i].iov_len;
+                size_t iov_len = msg->msg_iov[i].iov_len;
                 /* Check it now since we switch to KERNEL_DS later. */
-                if (!access_ok(VERIFY_READ, base, len)) {
+                if (!access_ok(VERIFY_READ, base, iov_len)) {
                         mutex_unlock(&econet_mutex);
                         return -EFAULT;
                 }
                 iov[i+1].iov_base = base;
-                iov[i+1].iov_len = len;
-                size += len;
+                iov[i+1].iov_len = iov_len;
+                size += iov_len;
         }
 
         /* Get a skbuff (no data, just holds our cb information) */
@@ -605,13 +606,14 @@ static struct proto econet_proto = {
  *      Create an Econet socket
  */
 
-static int econet_create(struct net *net, struct socket *sock, int protocol)
+static int econet_create(struct net *net, struct socket *sock, int protocol,
+                         int kern)
 {
         struct sock *sk;
         struct econet_sock *eo;
         int err;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         /* Econet only provides datagram services. */
@@ -742,7 +744,7 @@ static int econet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg
         return 0;
 }
 
-static struct net_proto_family econet_family_ops = {
+static const struct net_proto_family econet_family_ops = {
         .family =       PF_ECONET,
         .create =       econet_create,
         .owner  =       THIS_MODULE,
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 5a883affecd3..205a1c12f3c0 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -73,8 +73,8 @@ __setup("ether=", netdev_boot_setup);
  * @len:   packet length (<= skb->len)
  *
  *
- * Set the protocol type. For a packet of type ETH_P_802_3 we put the length
- * in here instead. It is up to the 802.2 layer to carry protocol information.
+ * Set the protocol type. For a packet of type ETH_P_802_3/2 we put the length
+ * in here instead.
  */
 int eth_header(struct sk_buff *skb, struct net_device *dev,
                unsigned short type,
@@ -82,7 +82,7 @@ int eth_header(struct sk_buff *skb, struct net_device *dev,
 {
         struct ethhdr *eth = (struct ethhdr *)skb_push(skb, ETH_HLEN);
 
-        if (type != ETH_P_802_3)
+        if (type != ETH_P_802_3 && type != ETH_P_802_2)
                 eth->h_proto = htons(type);
         else
                 eth->h_proto = htons(len);
@@ -393,10 +393,3 @@ ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len)
         return ((ssize_t) l);
 }
 EXPORT_SYMBOL(sysfs_format_mac);
-
-char *print_mac(char *buf, const unsigned char *addr)
-{
-        _format_mac_addr(buf, MAC_BUF_SIZE, addr, ETH_ALEN);
-        return buf;
-}
-EXPORT_SYMBOL(print_mac);
diff --git a/net/ethernet/pe2.c b/net/ethernet/pe2.c
index d60e15d9365e..eb00796758c3 100644
--- a/net/ethernet/pe2.c
+++ b/net/ethernet/pe2.c
@@ -3,6 +3,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include <net/datalink.h>
 
diff --git a/net/ieee802154/Makefile b/net/ieee802154/Makefile
index 4068a9f5113e..ce2d33582859 100644
--- a/net/ieee802154/Makefile
+++ b/net/ieee802154/Makefile
@@ -1,5 +1,5 @@
-obj-$(CONFIG_IEEE802154) +=     nl802154.o af_802154.o wpan-class.o
-nl802154-y              := netlink.o nl_policy.o
+obj-$(CONFIG_IEEE802154) +=     ieee802154.o af_802154.o
+ieee802154-y            := netlink.o nl-mac.o nl-phy.o nl_policy.o wpan-class.o
 af_802154-y             := af_ieee802154.o raw.o dgram.o
 
 ccflags-y += -Wall -DDEBUG
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index cd949d5e451b..93c91b633a56 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -28,6 +28,7 @@
 #include <linux/if.h>
 #include <linux/termios.h>      /* For TIOCOUTQ/INQ */
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/datalink.h>
 #include <net/psnap.h>
 #include <net/sock.h>
@@ -126,6 +127,9 @@ static int ieee802154_sock_connect(struct socket *sock, struct sockaddr *uaddr,
 {
         struct sock *sk = sock->sk;
 
+        if (addr_len < sizeof(uaddr->sa_family))
+                return -EINVAL;
+
         if (uaddr->sa_family == AF_UNSPEC)
                 return sk->sk_prot->disconnect(sk, flags);
 
@@ -147,6 +151,9 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
         dev_load(sock_net(sk), ifr.ifr_name);
         dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
 
+        if (!dev)
+                return -ENODEV;
+
         if (dev->type == ARPHRD_IEEE802154 && dev->netdev_ops->ndo_do_ioctl)
                 ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
 
@@ -234,14 +241,14 @@ static const struct proto_ops ieee802154_dgram_ops = {
  * set the state.
  */
 static int ieee802154_create(struct net *net, struct socket *sock,
-                int protocol)
+                             int protocol, int kern)
 {
         struct sock *sk;
         int rc;
         struct proto *proto;
         const struct proto_ops *ops;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         switch (sock->type) {
@@ -285,7 +292,7 @@ out:
         return rc;
 }
 
-static struct net_proto_family ieee802154_family_ops = {
+static const struct net_proto_family ieee802154_family_ops = {
         .family         = PF_IEEE802154,
         .create         = ieee802154_create,
         .owner          = THIS_MODULE,
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index a413b1bf4465..1a3334c2609a 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/if_arp.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_ieee802154.h>
 #include <net/ieee802154.h>
@@ -303,7 +304,7 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
@@ -318,7 +319,6 @@ out:
 static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
diff --git a/net/ieee802154/ieee802154.h b/net/ieee802154/ieee802154.h
new file mode 100644
index 000000000000..aadec428e6ec
--- /dev/null
+++ b/net/ieee802154/ieee802154.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+#ifndef IEEE_802154_LOCAL_H
+#define IEEE_802154_LOCAL_H
+
+int __init ieee802154_nl_init(void);
+void __exit ieee802154_nl_exit(void);
+
+#define IEEE802154_OP(_cmd, _func)                      \
+        {                                               \
+                .cmd    = _cmd,                         \
+                .policy = ieee802154_policy,            \
+                .doit   = _func,                        \
+                .dumpit = NULL,                         \
+                .flags  = GENL_ADMIN_PERM,              \
+        }
+
+#define IEEE802154_DUMP(_cmd, _func, _dump)             \
+        {                                               \
+                .cmd    = _cmd,                         \
+                .policy = ieee802154_policy,            \
+                .doit   = _func,                        \
+                .dumpit = _dump,                        \
+        }
+
+struct genl_info;
+
+struct sk_buff *ieee802154_nl_create(int flags, u8 req);
+int ieee802154_nl_mcast(struct sk_buff *msg, unsigned int group);
+struct sk_buff *ieee802154_nl_new_reply(struct genl_info *info,
+                int flags, u8 req);
+int ieee802154_nl_reply(struct sk_buff *msg, struct genl_info *info);
+
+extern struct genl_family nl802154_family;
+int nl802154_mac_register(void);
+int nl802154_phy_register(void);
+
+#endif
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index ca767bde17a4..c8097ae2482f 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -23,21 +23,16 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/if_arp.h>
-#include <linux/netdevice.h>
-#include <net/netlink.h>
+#include <linux/gfp.h>
 #include <net/genetlink.h>
-#include <net/sock.h>
 #include <linux/nl802154.h>
-#include <net/af_ieee802154.h>
-#include <net/nl802154.h>
-#include <net/ieee802154.h>
-#include <net/ieee802154_netdev.h>
+
+#include "ieee802154.h"
 
 static unsigned int ieee802154_seq_num;
 static DEFINE_SPINLOCK(ieee802154_seq_lock);
 
-static struct genl_family ieee802154_coordinator_family = {
+struct genl_family nl802154_family = {
         .id             = GENL_ID_GENERATE,
         .hdrsize        = 0,
         .name           = IEEE802154_NL_NAME,
@@ -45,16 +40,8 @@ static struct genl_family ieee802154_coordinator_family = {
         .maxattr        = IEEE802154_ATTR_MAX,
 };
 
-static struct genl_multicast_group ieee802154_coord_mcgrp = {
-        .name           = IEEE802154_MCAST_COORD_NAME,
-};
-
-static struct genl_multicast_group ieee802154_beacon_mcgrp = {
-        .name           = IEEE802154_MCAST_BEACON_NAME,
-};
-
 /* Requests to userspace */
-static struct sk_buff *ieee802154_nl_create(int flags, u8 req)
+struct sk_buff *ieee802154_nl_create(int flags, u8 req)
 {
         void *hdr;
         struct sk_buff *msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
@@ -65,7 +52,7 @@ static struct sk_buff *ieee802154_nl_create(int flags, u8 req)
 
         spin_lock_irqsave(&ieee802154_seq_lock, f);
         hdr = genlmsg_put(msg, 0, ieee802154_seq_num++,
-                        &ieee802154_coordinator_family, flags, req);
+                        &nl802154_family, flags, req);
         spin_unlock_irqrestore(&ieee802154_seq_lock, f);
         if (!hdr) {
                 nlmsg_free(msg);
@@ -75,7 +62,7 @@ static struct sk_buff *ieee802154_nl_create(int flags, u8 req)
         return msg;
 }
 
-static int ieee802154_nl_finish(struct sk_buff *msg)
+int ieee802154_nl_mcast(struct sk_buff *msg, unsigned int group)
 {
         /* XXX: nlh is right at the start of msg */
         void *hdr = genlmsg_data(NLMSG_DATA(msg->data));
@@ -83,607 +70,70 @@ static int ieee802154_nl_finish(struct sk_buff *msg)
         if (genlmsg_end(msg, hdr) < 0)
                 goto out;
 
-        return genlmsg_multicast(msg, 0, ieee802154_coord_mcgrp.id,
-                        GFP_ATOMIC);
+        return genlmsg_multicast(msg, 0, group, GFP_ATOMIC);
 out:
         nlmsg_free(msg);
         return -ENOBUFS;
 }
 
-int ieee802154_nl_assoc_indic(struct net_device *dev,
-                struct ieee802154_addr *addr, u8 cap)
-{
-        struct sk_buff *msg;
-
-        pr_debug("%s\n", __func__);
-
-        if (addr->addr_type != IEEE802154_ADDR_LONG) {
-                pr_err("%s: received non-long source address!\n", __func__);
-                return -EINVAL;
-        }
-
-        msg = ieee802154_nl_create(0, IEEE802154_ASSOCIATE_INDIC);
-        if (!msg)
-                return -ENOBUFS;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
-                        addr->hwaddr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_CAPABILITY, cap);
-
-        return ieee802154_nl_finish(msg);
-
-nla_put_failure:
-        nlmsg_free(msg);
-        return -ENOBUFS;
-}
-EXPORT_SYMBOL(ieee802154_nl_assoc_indic);
-
-int ieee802154_nl_assoc_confirm(struct net_device *dev, u16 short_addr,
-                u8 status)
-{
-        struct sk_buff *msg;
-
-        pr_debug("%s\n", __func__);
-
-        msg = ieee802154_nl_create(0, IEEE802154_ASSOCIATE_CONF);
-        if (!msg)
-                return -ENOBUFS;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr);
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-
-        return ieee802154_nl_finish(msg);
-
-nla_put_failure:
-        nlmsg_free(msg);
-        return -ENOBUFS;
-}
-EXPORT_SYMBOL(ieee802154_nl_assoc_confirm);
-
-int ieee802154_nl_disassoc_indic(struct net_device *dev,
-                struct ieee802154_addr *addr, u8 reason)
-{
-        struct sk_buff *msg;
-
-        pr_debug("%s\n", __func__);
-
-        msg = ieee802154_nl_create(0, IEEE802154_DISASSOCIATE_INDIC);
-        if (!msg)
-                return -ENOBUFS;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        if (addr->addr_type == IEEE802154_ADDR_LONG)
-                NLA_PUT(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
-                                addr->hwaddr);
-        else
-                NLA_PUT_U16(msg, IEEE802154_ATTR_SRC_SHORT_ADDR,
-                                addr->short_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_REASON, reason);
-
-        return ieee802154_nl_finish(msg);
-
-nla_put_failure:
-        nlmsg_free(msg);
-        return -ENOBUFS;
-}
-EXPORT_SYMBOL(ieee802154_nl_disassoc_indic);
-
-int ieee802154_nl_disassoc_confirm(struct net_device *dev, u8 status)
-{
-        struct sk_buff *msg;
-
-        pr_debug("%s\n", __func__);
-
-        msg = ieee802154_nl_create(0, IEEE802154_DISASSOCIATE_CONF);
-        if (!msg)
-                return -ENOBUFS;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-
-        return ieee802154_nl_finish(msg);
-
-nla_put_failure:
-        nlmsg_free(msg);
-        return -ENOBUFS;
-}
-EXPORT_SYMBOL(ieee802154_nl_disassoc_confirm);
-
-int ieee802154_nl_beacon_indic(struct net_device *dev,
-                u16 panid, u16 coord_addr)
-{
-        struct sk_buff *msg;
-
-        pr_debug("%s\n", __func__);
-
-        msg = ieee802154_nl_create(0, IEEE802154_BEACON_NOTIFY_INDIC);
-        if (!msg)
-                return -ENOBUFS;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-        NLA_PUT_U16(msg, IEEE802154_ATTR_COORD_SHORT_ADDR, coord_addr);
-        NLA_PUT_U16(msg, IEEE802154_ATTR_COORD_PAN_ID, panid);
-
-        return ieee802154_nl_finish(msg);
-
-nla_put_failure:
-        nlmsg_free(msg);
-        return -ENOBUFS;
-}
-EXPORT_SYMBOL(ieee802154_nl_beacon_indic);
-
-int ieee802154_nl_scan_confirm(struct net_device *dev,
-                u8 status, u8 scan_type, u32 unscanned, u8 page,
-                u8 *edl/* , struct list_head *pan_desc_list */)
-{
-        struct sk_buff *msg;
-
-        pr_debug("%s\n", __func__);
-
-        msg = ieee802154_nl_create(0, IEEE802154_SCAN_CONF);
-        if (!msg)
-                return -ENOBUFS;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-        NLA_PUT_U8(msg, IEEE802154_ATTR_SCAN_TYPE, scan_type);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_CHANNELS, unscanned);
-        NLA_PUT_U8(msg, IEEE802154_ATTR_PAGE, page);
-
-        if (edl)
-                NLA_PUT(msg, IEEE802154_ATTR_ED_LIST, 27, edl);
-
-        return ieee802154_nl_finish(msg);
-
-nla_put_failure:
-        nlmsg_free(msg);
-        return -ENOBUFS;
-}
-EXPORT_SYMBOL(ieee802154_nl_scan_confirm);
-
-int ieee802154_nl_start_confirm(struct net_device *dev, u8 status)
-{
-        struct sk_buff *msg;
-
-        pr_debug("%s\n", __func__);
-
-        msg = ieee802154_nl_create(0, IEEE802154_START_CONF);
-        if (!msg)
-                return -ENOBUFS;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                        dev->dev_addr);
-
-        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
-
-        return ieee802154_nl_finish(msg);
-
-nla_put_failure:
-        nlmsg_free(msg);
-        return -ENOBUFS;
-}
-EXPORT_SYMBOL(ieee802154_nl_start_confirm);
-
-static int ieee802154_nl_fill_iface(struct sk_buff *msg, u32 pid,
-        u32 seq, int flags, struct net_device *dev)
+struct sk_buff *ieee802154_nl_new_reply(struct genl_info *info,
+                int flags, u8 req)
 {
         void *hdr;
+        struct sk_buff *msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
 
-        pr_debug("%s\n", __func__);
-
-        hdr = genlmsg_put(msg, 0, seq, &ieee802154_coordinator_family, flags,
-                IEEE802154_LIST_IFACE);
-        if (!hdr)
-                goto out;
-
-        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
-        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
-
-        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
-                dev->dev_addr);
-        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR,
-                ieee802154_mlme_ops(dev)->get_short_addr(dev));
-        NLA_PUT_U16(msg, IEEE802154_ATTR_PAN_ID,
-                ieee802154_mlme_ops(dev)->get_pan_id(dev));
-        return genlmsg_end(msg, hdr);
-
-nla_put_failure:
-        genlmsg_cancel(msg, hdr);
-out:
-        return -EMSGSIZE;
-}
-
-/* Requests from userspace */
-static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
-{
-        struct net_device *dev;
-
-        if (info->attrs[IEEE802154_ATTR_DEV_NAME]) {
-                char name[IFNAMSIZ + 1];
-                nla_strlcpy(name, info->attrs[IEEE802154_ATTR_DEV_NAME],
-                                sizeof(name));
-                dev = dev_get_by_name(&init_net, name);
-        } else if (info->attrs[IEEE802154_ATTR_DEV_INDEX])
-                dev = dev_get_by_index(&init_net,
-                        nla_get_u32(info->attrs[IEEE802154_ATTR_DEV_INDEX]));
-        else
-                return NULL;
-
-        if (!dev)
+        if (!msg)
                 return NULL;
 
-        if (dev->type != ARPHRD_IEEE802154) {
-                dev_put(dev);
+        hdr = genlmsg_put_reply(msg, info,
+                        &nl802154_family, flags, req);
+        if (!hdr) {
+                nlmsg_free(msg);
                 return NULL;
         }
 
-        return dev;
-}
-
-static int ieee802154_associate_req(struct sk_buff *skb,
-                struct genl_info *info)
-{
-        struct net_device *dev;
-        struct ieee802154_addr addr;
-        u8 page;
-        int ret = -EINVAL;
-
-        if (!info->attrs[IEEE802154_ATTR_CHANNEL] ||
-            !info->attrs[IEEE802154_ATTR_COORD_PAN_ID] ||
-            (!info->attrs[IEEE802154_ATTR_COORD_HW_ADDR] &&
-                !info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]) ||
-            !info->attrs[IEEE802154_ATTR_CAPABILITY])
-                return -EINVAL;
-
-        dev = ieee802154_nl_get_dev(info);
-        if (!dev)
-                return -ENODEV;
-
-        if (info->attrs[IEEE802154_ATTR_COORD_HW_ADDR]) {
-                addr.addr_type = IEEE802154_ADDR_LONG;
-                nla_memcpy(addr.hwaddr,
-                                info->attrs[IEEE802154_ATTR_COORD_HW_ADDR],
-                                IEEE802154_ADDR_LEN);
-        } else {
-                addr.addr_type = IEEE802154_ADDR_SHORT;
-                addr.short_addr = nla_get_u16(
-                                info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]);
-        }
-        addr.pan_id = nla_get_u16(info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
-
-        if (info->attrs[IEEE802154_ATTR_PAGE])
-                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
-        else
-                page = 0;
-
-        ret = ieee802154_mlme_ops(dev)->assoc_req(dev, &addr,
-                        nla_get_u8(info->attrs[IEEE802154_ATTR_CHANNEL]),
-                        page,
-                        nla_get_u8(info->attrs[IEEE802154_ATTR_CAPABILITY]));
-
-        dev_put(dev);
-        return ret;
-}
-
-static int ieee802154_associate_resp(struct sk_buff *skb,
-                struct genl_info *info)
-{
-        struct net_device *dev;
-        struct ieee802154_addr addr;
-        int ret = -EINVAL;
-
-        if (!info->attrs[IEEE802154_ATTR_STATUS] ||
-            !info->attrs[IEEE802154_ATTR_DEST_HW_ADDR] ||
-            !info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR])
-                return -EINVAL;
-
-        dev = ieee802154_nl_get_dev(info);
-        if (!dev)
-                return -ENODEV;
-
-        addr.addr_type = IEEE802154_ADDR_LONG;
-        nla_memcpy(addr.hwaddr, info->attrs[IEEE802154_ATTR_DEST_HW_ADDR],
-                        IEEE802154_ADDR_LEN);
-        addr.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
-
-
-        ret = ieee802154_mlme_ops(dev)->assoc_resp(dev, &addr,
-                nla_get_u16(info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]),
-                nla_get_u8(info->attrs[IEEE802154_ATTR_STATUS]));
-
-        dev_put(dev);
-        return ret;
-}
-
-static int ieee802154_disassociate_req(struct sk_buff *skb,
-                struct genl_info *info)
-{
-        struct net_device *dev;
-        struct ieee802154_addr addr;
-        int ret = -EINVAL;
-
-        if ((!info->attrs[IEEE802154_ATTR_DEST_HW_ADDR] &&
-                !info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]) ||
-            !info->attrs[IEEE802154_ATTR_REASON])
-                return -EINVAL;
-
-        dev = ieee802154_nl_get_dev(info);
-        if (!dev)
-                return -ENODEV;
-
-        if (info->attrs[IEEE802154_ATTR_DEST_HW_ADDR]) {
-                addr.addr_type = IEEE802154_ADDR_LONG;
-                nla_memcpy(addr.hwaddr,
-                                info->attrs[IEEE802154_ATTR_DEST_HW_ADDR],
-                                IEEE802154_ADDR_LEN);
-        } else {
-                addr.addr_type = IEEE802154_ADDR_SHORT;
-                addr.short_addr = nla_get_u16(
-                                info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]);
-        }
-        addr.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
-
-        ret = ieee802154_mlme_ops(dev)->disassoc_req(dev, &addr,
-                        nla_get_u8(info->attrs[IEEE802154_ATTR_REASON]));
-
-        dev_put(dev);
-        return ret;
-}
-
-/*
- * PANid, channel, beacon_order = 15, superframe_order = 15,
- * PAN_coordinator, battery_life_extension = 0,
- * coord_realignment = 0, security_enable = 0
-*/
-static int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
-{
-        struct net_device *dev;
-        struct ieee802154_addr addr;
-
-        u8 channel, bcn_ord, sf_ord;
-        u8 page;
-        int pan_coord, blx, coord_realign;
-        int ret;
-
-        if (!info->attrs[IEEE802154_ATTR_COORD_PAN_ID] ||
-            !info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR] ||
-            !info->attrs[IEEE802154_ATTR_CHANNEL] ||
-            !info->attrs[IEEE802154_ATTR_BCN_ORD] ||
-            !info->attrs[IEEE802154_ATTR_SF_ORD] ||
-            !info->attrs[IEEE802154_ATTR_PAN_COORD] ||
-            !info->attrs[IEEE802154_ATTR_BAT_EXT] ||
-            !info->attrs[IEEE802154_ATTR_COORD_REALIGN]
-         )
-                return -EINVAL;
-
-        dev = ieee802154_nl_get_dev(info);
-        if (!dev)
-                return -ENODEV;
-
-        addr.addr_type = IEEE802154_ADDR_SHORT;
-        addr.short_addr = nla_get_u16(
-                        info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]);
-        addr.pan_id = nla_get_u16(info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
-
-        channel = nla_get_u8(info->attrs[IEEE802154_ATTR_CHANNEL]);
-        bcn_ord = nla_get_u8(info->attrs[IEEE802154_ATTR_BCN_ORD]);
-        sf_ord = nla_get_u8(info->attrs[IEEE802154_ATTR_SF_ORD]);
-        pan_coord = nla_get_u8(info->attrs[IEEE802154_ATTR_PAN_COORD]);
-        blx = nla_get_u8(info->attrs[IEEE802154_ATTR_BAT_EXT]);
-        coord_realign = nla_get_u8(info->attrs[IEEE802154_ATTR_COORD_REALIGN]);
-
-        if (info->attrs[IEEE802154_ATTR_PAGE])
-                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
-        else
-                page = 0;
-
-
-        if (addr.short_addr == IEEE802154_ADDR_BROADCAST) {
-                ieee802154_nl_start_confirm(dev, IEEE802154_NO_SHORT_ADDRESS);
-                dev_put(dev);
-                return -EINVAL;
-        }
-
-        ret = ieee802154_mlme_ops(dev)->start_req(dev, &addr, channel, page,
-                bcn_ord, sf_ord, pan_coord, blx, coord_realign);
-
-        dev_put(dev);
-        return ret;
-}
-
-static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
-{
-        struct net_device *dev;
-        int ret;
-        u8 type;
-        u32 channels;
-        u8 duration;
-        u8 page;
-
-        if (!info->attrs[IEEE802154_ATTR_SCAN_TYPE] ||
-            !info->attrs[IEEE802154_ATTR_CHANNELS] ||
-            !info->attrs[IEEE802154_ATTR_DURATION])
-                return -EINVAL;
-
-        dev = ieee802154_nl_get_dev(info);
-        if (!dev)
-                return -ENODEV;
-
-        type = nla_get_u8(info->attrs[IEEE802154_ATTR_SCAN_TYPE]);
-        channels = nla_get_u32(info->attrs[IEEE802154_ATTR_CHANNELS]);
-        duration = nla_get_u8(info->attrs[IEEE802154_ATTR_DURATION]);
-
-        if (info->attrs[IEEE802154_ATTR_PAGE])
-                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
-        else
-                page = 0;
-
-
-        ret = ieee802154_mlme_ops(dev)->scan_req(dev, type, channels, page,
-                        duration);
-
-        dev_put(dev);
-        return ret;
+        return msg;
 }
 
-static int ieee802154_list_iface(struct sk_buff *skb,
-        struct genl_info *info)
+int ieee802154_nl_reply(struct sk_buff *msg, struct genl_info *info)
 {
-        /* Request for interface name, index, type, IEEE address,
-           PAN Id, short address */
-        struct sk_buff *msg;
-        struct net_device *dev = NULL;
-        int rc = -ENOBUFS;
-
-        pr_debug("%s\n", __func__);
-
-        dev = ieee802154_nl_get_dev(info);
-        if (!dev)
-                return -ENODEV;
-
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
-        if (!msg)
-                goto out_dev;
-
-        rc = ieee802154_nl_fill_iface(msg, info->snd_pid, info->snd_seq,
-                        0, dev);
-        if (rc < 0)
-                goto out_free;
+        /* XXX: nlh is right at the start of msg */
+        void *hdr = genlmsg_data(NLMSG_DATA(msg->data));
 
-        dev_put(dev);
+        if (genlmsg_end(msg, hdr) < 0)
+                goto out;
 
-        return genlmsg_unicast(&init_net, msg, info->snd_pid);
-out_free:
+        return genlmsg_reply(msg, info);
+out:
         nlmsg_free(msg);
-out_dev:
-        dev_put(dev);
-        return rc;
-
-}
-
-static int ieee802154_dump_iface(struct sk_buff *skb,
-        struct netlink_callback *cb)
-{
-        struct net *net = sock_net(skb->sk);
-        struct net_device *dev;
-        int idx;
-        int s_idx = cb->args[0];
-
-        pr_debug("%s\n", __func__);
-
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx || (dev->type != ARPHRD_IEEE802154))
-                        goto cont;
-
-                if (ieee802154_nl_fill_iface(skb, NETLINK_CB(cb->skb).pid,
-                        cb->nlh->nlmsg_seq, NLM_F_MULTI, dev) < 0)
-                        break;
-cont:
-                idx++;
-        }
-        cb->args[0] = idx;
-
-        return skb->len;
+        return -ENOBUFS;
 }
 
-#define IEEE802154_OP(_cmd, _func)                      \
-        {                                               \
-                .cmd    = _cmd,                         \
-                .policy = ieee802154_policy,            \
-                .doit   = _func,                        \
-                .dumpit = NULL,                         \
-                .flags  = GENL_ADMIN_PERM,              \
-        }
-
-#define IEEE802154_DUMP(_cmd, _func, _dump)             \
-        {                                               \
-                .cmd    = _cmd,                         \
-                .policy = ieee802154_policy,            \
-                .doit   = _func,                        \
-                .dumpit = _dump,                        \
-        }
-
-static struct genl_ops ieee802154_coordinator_ops[] = {
-        IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
-        IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
-        IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
-        IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
-        IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
-        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
-                                                        ieee802154_dump_iface),
-};
-
-static int __init ieee802154_nl_init(void)
+int __init ieee802154_nl_init(void)
 {
         int rc;
-        int i;
 
-        rc = genl_register_family(&ieee802154_coordinator_family);
+        rc = genl_register_family(&nl802154_family);
         if (rc)
                 goto fail;
 
-        rc = genl_register_mc_group(&ieee802154_coordinator_family,
-                        &ieee802154_coord_mcgrp);
+        rc = nl802154_mac_register();
         if (rc)
                 goto fail;
 
-        rc = genl_register_mc_group(&ieee802154_coordinator_family,
-                        &ieee802154_beacon_mcgrp);
+        rc = nl802154_phy_register();
         if (rc)
                 goto fail;
 
-
-        for (i = 0; i < ARRAY_SIZE(ieee802154_coordinator_ops); i++) {
-                rc = genl_register_ops(&ieee802154_coordinator_family,
-                                &ieee802154_coordinator_ops[i]);
-                if (rc)
-                        goto fail;
-        }
-
         return 0;
 
 fail:
-        genl_unregister_family(&ieee802154_coordinator_family);
+        genl_unregister_family(&nl802154_family);
         return rc;
 }
-module_init(ieee802154_nl_init);
 
-static void __exit ieee802154_nl_exit(void)
+void __exit ieee802154_nl_exit(void)
 {
-        genl_unregister_family(&ieee802154_coordinator_family);
+        genl_unregister_family(&nl802154_family);
 }
-module_exit(ieee802154_nl_exit);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("ieee 802.15.4 configuration interface");
 
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
new file mode 100644
index 000000000000..71ee1108d4f8
--- /dev/null
+++ b/net/ieee802154/nl-mac.c
@@ -0,0 +1,618 @@
+/*
+ * Netlink inteface for IEEE 802.15.4 stack
+ *
+ * Copyright 2007, 2008 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Sergey Lapin <slapin@ossfans.org>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
+ */
+
+#include <linux/gfp.h>
+#include <linux/kernel.h>
+#include <linux/if_arp.h>
+#include <linux/netdevice.h>
+#include <net/netlink.h>
+#include <net/genetlink.h>
+#include <net/sock.h>
+#include <linux/nl802154.h>
+#include <net/af_ieee802154.h>
+#include <net/nl802154.h>
+#include <net/ieee802154.h>
+#include <net/ieee802154_netdev.h>
+#include <net/wpan-phy.h>
+
+#include "ieee802154.h"
+
+static struct genl_multicast_group ieee802154_coord_mcgrp = {
+        .name           = IEEE802154_MCAST_COORD_NAME,
+};
+
+static struct genl_multicast_group ieee802154_beacon_mcgrp = {
+        .name           = IEEE802154_MCAST_BEACON_NAME,
+};
+
+int ieee802154_nl_assoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 cap)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        if (addr->addr_type != IEEE802154_ADDR_LONG) {
+                pr_err("%s: received non-long source address!\n", __func__);
+                return -EINVAL;
+        }
+
+        msg = ieee802154_nl_create(0, IEEE802154_ASSOCIATE_INDIC);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        NLA_PUT(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
+                        addr->hwaddr);
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_CAPABILITY, cap);
+
+        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_assoc_indic);
+
+int ieee802154_nl_assoc_confirm(struct net_device *dev, u16 short_addr,
+                u8 status)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_ASSOCIATE_CONF);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr);
+        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
+
+        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_assoc_confirm);
+
+int ieee802154_nl_disassoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 reason)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_DISASSOCIATE_INDIC);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        if (addr->addr_type == IEEE802154_ADDR_LONG)
+                NLA_PUT(msg, IEEE802154_ATTR_SRC_HW_ADDR, IEEE802154_ADDR_LEN,
+                                addr->hwaddr);
+        else
+                NLA_PUT_U16(msg, IEEE802154_ATTR_SRC_SHORT_ADDR,
+                                addr->short_addr);
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_REASON, reason);
+
+        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_disassoc_indic);
+
+int ieee802154_nl_disassoc_confirm(struct net_device *dev, u8 status)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_DISASSOCIATE_CONF);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
+
+        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_disassoc_confirm);
+
+int ieee802154_nl_beacon_indic(struct net_device *dev,
+                u16 panid, u16 coord_addr)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_BEACON_NOTIFY_INDIC);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+        NLA_PUT_U16(msg, IEEE802154_ATTR_COORD_SHORT_ADDR, coord_addr);
+        NLA_PUT_U16(msg, IEEE802154_ATTR_COORD_PAN_ID, panid);
+
+        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_beacon_indic);
+
+int ieee802154_nl_scan_confirm(struct net_device *dev,
+                u8 status, u8 scan_type, u32 unscanned, u8 page,
+                u8 *edl/* , struct list_head *pan_desc_list */)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_SCAN_CONF);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
+        NLA_PUT_U8(msg, IEEE802154_ATTR_SCAN_TYPE, scan_type);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_CHANNELS, unscanned);
+        NLA_PUT_U8(msg, IEEE802154_ATTR_PAGE, page);
+
+        if (edl)
+                NLA_PUT(msg, IEEE802154_ATTR_ED_LIST, 27, edl);
+
+        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_scan_confirm);
+
+int ieee802154_nl_start_confirm(struct net_device *dev, u8 status)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_START_CONF);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
+
+        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_start_confirm);
+
+static int ieee802154_nl_fill_iface(struct sk_buff *msg, u32 pid,
+        u32 seq, int flags, struct net_device *dev)
+{
+        void *hdr;
+        struct wpan_phy *phy;
+
+        pr_debug("%s\n", __func__);
+
+        hdr = genlmsg_put(msg, 0, seq, &nl802154_family, flags,
+                IEEE802154_LIST_IFACE);
+        if (!hdr)
+                goto out;
+
+        phy = ieee802154_mlme_ops(dev)->get_phy(dev);
+        BUG_ON(!phy);
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                dev->dev_addr);
+        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR,
+                ieee802154_mlme_ops(dev)->get_short_addr(dev));
+        NLA_PUT_U16(msg, IEEE802154_ATTR_PAN_ID,
+                ieee802154_mlme_ops(dev)->get_pan_id(dev));
+        wpan_phy_put(phy);
+        return genlmsg_end(msg, hdr);
+
+nla_put_failure:
+        wpan_phy_put(phy);
+        genlmsg_cancel(msg, hdr);
+out:
+        return -EMSGSIZE;
+}
+
+/* Requests from userspace */
+static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
+{
+        struct net_device *dev;
+
+        if (info->attrs[IEEE802154_ATTR_DEV_NAME]) {
+                char name[IFNAMSIZ + 1];
+                nla_strlcpy(name, info->attrs[IEEE802154_ATTR_DEV_NAME],
+                                sizeof(name));
+                dev = dev_get_by_name(&init_net, name);
+        } else if (info->attrs[IEEE802154_ATTR_DEV_INDEX])
+                dev = dev_get_by_index(&init_net,
+                        nla_get_u32(info->attrs[IEEE802154_ATTR_DEV_INDEX]));
+        else
+                return NULL;
+
+        if (!dev)
+                return NULL;
+
+        if (dev->type != ARPHRD_IEEE802154) {
+                dev_put(dev);
+                return NULL;
+        }
+
+        return dev;
+}
+
+static int ieee802154_associate_req(struct sk_buff *skb,
+                struct genl_info *info)
+{
+        struct net_device *dev;
+        struct ieee802154_addr addr;
+        u8 page;
+        int ret = -EINVAL;
+
+        if (!info->attrs[IEEE802154_ATTR_CHANNEL] ||
+            !info->attrs[IEEE802154_ATTR_COORD_PAN_ID] ||
+            (!info->attrs[IEEE802154_ATTR_COORD_HW_ADDR] &&
+                !info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]) ||
+            !info->attrs[IEEE802154_ATTR_CAPABILITY])
+                return -EINVAL;
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        if (info->attrs[IEEE802154_ATTR_COORD_HW_ADDR]) {
+                addr.addr_type = IEEE802154_ADDR_LONG;
+                nla_memcpy(addr.hwaddr,
+                                info->attrs[IEEE802154_ATTR_COORD_HW_ADDR],
+                                IEEE802154_ADDR_LEN);
+        } else {
+                addr.addr_type = IEEE802154_ADDR_SHORT;
+                addr.short_addr = nla_get_u16(
+                                info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]);
+        }
+        addr.pan_id = nla_get_u16(info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
+
+        if (info->attrs[IEEE802154_ATTR_PAGE])
+                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
+        else
+                page = 0;
+
+        ret = ieee802154_mlme_ops(dev)->assoc_req(dev, &addr,
+                        nla_get_u8(info->attrs[IEEE802154_ATTR_CHANNEL]),
+                        page,
+                        nla_get_u8(info->attrs[IEEE802154_ATTR_CAPABILITY]));
+
+        dev_put(dev);
+        return ret;
+}
+
+static int ieee802154_associate_resp(struct sk_buff *skb,
+                struct genl_info *info)
+{
+        struct net_device *dev;
+        struct ieee802154_addr addr;
+        int ret = -EINVAL;
+
+        if (!info->attrs[IEEE802154_ATTR_STATUS] ||
+            !info->attrs[IEEE802154_ATTR_DEST_HW_ADDR] ||
+            !info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR])
+                return -EINVAL;
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        addr.addr_type = IEEE802154_ADDR_LONG;
+        nla_memcpy(addr.hwaddr, info->attrs[IEEE802154_ATTR_DEST_HW_ADDR],
+                        IEEE802154_ADDR_LEN);
+        addr.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
+
+
+        ret = ieee802154_mlme_ops(dev)->assoc_resp(dev, &addr,
+                nla_get_u16(info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]),
+                nla_get_u8(info->attrs[IEEE802154_ATTR_STATUS]));
+
+        dev_put(dev);
+        return ret;
+}
+
+static int ieee802154_disassociate_req(struct sk_buff *skb,
+                struct genl_info *info)
+{
+        struct net_device *dev;
+        struct ieee802154_addr addr;
+        int ret = -EINVAL;
+
+        if ((!info->attrs[IEEE802154_ATTR_DEST_HW_ADDR] &&
+                !info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]) ||
+            !info->attrs[IEEE802154_ATTR_REASON])
+                return -EINVAL;
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        if (info->attrs[IEEE802154_ATTR_DEST_HW_ADDR]) {
+                addr.addr_type = IEEE802154_ADDR_LONG;
+                nla_memcpy(addr.hwaddr,
+                                info->attrs[IEEE802154_ATTR_DEST_HW_ADDR],
+                                IEEE802154_ADDR_LEN);
+        } else {
+                addr.addr_type = IEEE802154_ADDR_SHORT;
+                addr.short_addr = nla_get_u16(
+                                info->attrs[IEEE802154_ATTR_DEST_SHORT_ADDR]);
+        }
+        addr.pan_id = ieee802154_mlme_ops(dev)->get_pan_id(dev);
+
+        ret = ieee802154_mlme_ops(dev)->disassoc_req(dev, &addr,
+                        nla_get_u8(info->attrs[IEEE802154_ATTR_REASON]));
+
+        dev_put(dev);
+        return ret;
+}
+
+/*
+ * PANid, channel, beacon_order = 15, superframe_order = 15,
+ * PAN_coordinator, battery_life_extension = 0,
+ * coord_realignment = 0, security_enable = 0
+*/
+static int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
+{
+        struct net_device *dev;
+        struct ieee802154_addr addr;
+
+        u8 channel, bcn_ord, sf_ord;
+        u8 page;
+        int pan_coord, blx, coord_realign;
+        int ret;
+
+        if (!info->attrs[IEEE802154_ATTR_COORD_PAN_ID] ||
+            !info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR] ||
+            !info->attrs[IEEE802154_ATTR_CHANNEL] ||
+            !info->attrs[IEEE802154_ATTR_BCN_ORD] ||
+            !info->attrs[IEEE802154_ATTR_SF_ORD] ||
+            !info->attrs[IEEE802154_ATTR_PAN_COORD] ||
+            !info->attrs[IEEE802154_ATTR_BAT_EXT] ||
+            !info->attrs[IEEE802154_ATTR_COORD_REALIGN]
+         )
+                return -EINVAL;
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        addr.addr_type = IEEE802154_ADDR_SHORT;
+        addr.short_addr = nla_get_u16(
+                        info->attrs[IEEE802154_ATTR_COORD_SHORT_ADDR]);
+        addr.pan_id = nla_get_u16(info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
+
+        channel = nla_get_u8(info->attrs[IEEE802154_ATTR_CHANNEL]);
+        bcn_ord = nla_get_u8(info->attrs[IEEE802154_ATTR_BCN_ORD]);
+        sf_ord = nla_get_u8(info->attrs[IEEE802154_ATTR_SF_ORD]);
+        pan_coord = nla_get_u8(info->attrs[IEEE802154_ATTR_PAN_COORD]);
+        blx = nla_get_u8(info->attrs[IEEE802154_ATTR_BAT_EXT]);
+        coord_realign = nla_get_u8(info->attrs[IEEE802154_ATTR_COORD_REALIGN]);
+
+        if (info->attrs[IEEE802154_ATTR_PAGE])
+                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
+        else
+                page = 0;
+
+
+        if (addr.short_addr == IEEE802154_ADDR_BROADCAST) {
+                ieee802154_nl_start_confirm(dev, IEEE802154_NO_SHORT_ADDRESS);
+                dev_put(dev);
+                return -EINVAL;
+        }
+
+        ret = ieee802154_mlme_ops(dev)->start_req(dev, &addr, channel, page,
+                bcn_ord, sf_ord, pan_coord, blx, coord_realign);
+
+        dev_put(dev);
+        return ret;
+}
+
+static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
+{
+        struct net_device *dev;
+        int ret;
+        u8 type;
+        u32 channels;
+        u8 duration;
+        u8 page;
+
+        if (!info->attrs[IEEE802154_ATTR_SCAN_TYPE] ||
+            !info->attrs[IEEE802154_ATTR_CHANNELS] ||
+            !info->attrs[IEEE802154_ATTR_DURATION])
+                return -EINVAL;
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        type = nla_get_u8(info->attrs[IEEE802154_ATTR_SCAN_TYPE]);
+        channels = nla_get_u32(info->attrs[IEEE802154_ATTR_CHANNELS]);
+        duration = nla_get_u8(info->attrs[IEEE802154_ATTR_DURATION]);
+
+        if (info->attrs[IEEE802154_ATTR_PAGE])
+                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
+        else
+                page = 0;
+
+
+        ret = ieee802154_mlme_ops(dev)->scan_req(dev, type, channels, page,
+                        duration);
+
+        dev_put(dev);
+        return ret;
+}
+
+static int ieee802154_list_iface(struct sk_buff *skb,
+        struct genl_info *info)
+{
+        /* Request for interface name, index, type, IEEE address,
+           PAN Id, short address */
+        struct sk_buff *msg;
+        struct net_device *dev = NULL;
+        int rc = -ENOBUFS;
+
+        pr_debug("%s\n", __func__);
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                goto out_dev;
+
+        rc = ieee802154_nl_fill_iface(msg, info->snd_pid, info->snd_seq,
+                        0, dev);
+        if (rc < 0)
+                goto out_free;
+
+        dev_put(dev);
+
+        return genlmsg_reply(msg, info);
+out_free:
+        nlmsg_free(msg);
+out_dev:
+        dev_put(dev);
+        return rc;
+
+}
+
+static int ieee802154_dump_iface(struct sk_buff *skb,
+        struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        int idx;
+        int s_idx = cb->args[0];
+
+        pr_debug("%s\n", __func__);
+
+        idx = 0;
+        for_each_netdev(net, dev) {
+                if (idx < s_idx || (dev->type != ARPHRD_IEEE802154))
+                        goto cont;
+
+                if (ieee802154_nl_fill_iface(skb, NETLINK_CB(cb->skb).pid,
+                        cb->nlh->nlmsg_seq, NLM_F_MULTI, dev) < 0)
+                        break;
+cont:
+                idx++;
+        }
+        cb->args[0] = idx;
+
+        return skb->len;
+}
+
+static struct genl_ops ieee802154_coordinator_ops[] = {
+        IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
+        IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
+        IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
+        IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
+        IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
+        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
+                                                        ieee802154_dump_iface),
+};
+
+/*
+ * No need to unregister as family unregistration will do it.
+ */
+int nl802154_mac_register(void)
+{
+        int i;
+        int rc;
+
+        rc = genl_register_mc_group(&nl802154_family,
+                        &ieee802154_coord_mcgrp);
+        if (rc)
+                return rc;
+
+        rc = genl_register_mc_group(&nl802154_family,
+                        &ieee802154_beacon_mcgrp);
+        if (rc)
+                return rc;
+
+        for (i = 0; i < ARRAY_SIZE(ieee802154_coordinator_ops); i++) {
+                rc = genl_register_ops(&nl802154_family,
+                                &ieee802154_coordinator_ops[i]);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
new file mode 100644
index 000000000000..ed0eab39f531
--- /dev/null
+++ b/net/ieee802154/nl-phy.c
@@ -0,0 +1,345 @@
+/*
+ * Netlink inteface for IEEE 802.15.4 stack
+ *
+ * Copyright 2007, 2008 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Sergey Lapin <slapin@ossfans.org>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <net/netlink.h>
+#include <net/genetlink.h>
+#include <net/wpan-phy.h>
+#include <net/af_ieee802154.h>
+#include <net/ieee802154_netdev.h>
+#include <net/rtnetlink.h> /* for rtnl_{un,}lock */
+#include <linux/nl802154.h>
+
+#include "ieee802154.h"
+
+static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
+        u32 seq, int flags, struct wpan_phy *phy)
+{
+        void *hdr;
+        int i, pages = 0;
+        uint32_t *buf = kzalloc(32 * sizeof(uint32_t), GFP_KERNEL);
+
+        pr_debug("%s\n", __func__);
+
+        if (!buf)
+                goto out;
+
+        hdr = genlmsg_put(msg, 0, seq, &nl802154_family, flags,
+                IEEE802154_LIST_PHY);
+        if (!hdr)
+                goto out;
+
+        mutex_lock(&phy->pib_lock);
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_PAGE, phy->current_page);
+        NLA_PUT_U8(msg, IEEE802154_ATTR_CHANNEL, phy->current_channel);
+        for (i = 0; i < 32; i++) {
+                if (phy->channels_supported[i])
+                        buf[pages++] = phy->channels_supported[i] | (i << 27);
+        }
+        if (pages)
+                NLA_PUT(msg, IEEE802154_ATTR_CHANNEL_PAGE_LIST,
+                                pages * sizeof(uint32_t), buf);
+
+        mutex_unlock(&phy->pib_lock);
+        return genlmsg_end(msg, hdr);
+
+nla_put_failure:
+        mutex_unlock(&phy->pib_lock);
+        genlmsg_cancel(msg, hdr);
+out:
+        kfree(buf);
+        return -EMSGSIZE;
+}
+
+static int ieee802154_list_phy(struct sk_buff *skb,
+        struct genl_info *info)
+{
+        /* Request for interface name, index, type, IEEE address,
+           PAN Id, short address */
+        struct sk_buff *msg;
+        struct wpan_phy *phy;
+        const char *name;
+        int rc = -ENOBUFS;
+
+        pr_debug("%s\n", __func__);
+
+        if (!info->attrs[IEEE802154_ATTR_PHY_NAME])
+                return -EINVAL;
+
+        name = nla_data(info->attrs[IEEE802154_ATTR_PHY_NAME]);
+        if (name[nla_len(info->attrs[IEEE802154_ATTR_PHY_NAME]) - 1] != '\0')
+                return -EINVAL; /* phy name should be null-terminated */
+
+
+        phy = wpan_phy_find(name);
+        if (!phy)
+                return -ENODEV;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                goto out_dev;
+
+        rc = ieee802154_nl_fill_phy(msg, info->snd_pid, info->snd_seq,
+                        0, phy);
+        if (rc < 0)
+                goto out_free;
+
+        wpan_phy_put(phy);
+
+        return genlmsg_reply(msg, info);
+out_free:
+        nlmsg_free(msg);
+out_dev:
+        wpan_phy_put(phy);
+        return rc;
+
+}
+
+struct dump_phy_data {
+        struct sk_buff *skb;
+        struct netlink_callback *cb;
+        int idx, s_idx;
+};
+
+static int ieee802154_dump_phy_iter(struct wpan_phy *phy, void *_data)
+{
+        int rc;
+        struct dump_phy_data *data = _data;
+
+        pr_debug("%s\n", __func__);
+
+        if (data->idx++ < data->s_idx)
+                return 0;
+
+        rc = ieee802154_nl_fill_phy(data->skb,
+                        NETLINK_CB(data->cb->skb).pid,
+                        data->cb->nlh->nlmsg_seq,
+                        NLM_F_MULTI,
+                        phy);
+
+        if (rc < 0) {
+                data->idx--;
+                return rc;
+        }
+
+        return 0;
+}
+
+static int ieee802154_dump_phy(struct sk_buff *skb,
+        struct netlink_callback *cb)
+{
+        struct dump_phy_data data = {
+                .cb = cb,
+                .skb = skb,
+                .s_idx = cb->args[0],
+                .idx = 0,
+        };
+
+        pr_debug("%s\n", __func__);
+
+        wpan_phy_for_each(ieee802154_dump_phy_iter, &data);
+
+        cb->args[0] = data.idx;
+
+        return skb->len;
+}
+
+static int ieee802154_add_iface(struct sk_buff *skb,
+                struct genl_info *info)
+{
+        struct sk_buff *msg;
+        struct wpan_phy *phy;
+        const char *name;
+        const char *devname;
+        int rc = -ENOBUFS;
+        struct net_device *dev;
+
+        pr_debug("%s\n", __func__);
+
+        if (!info->attrs[IEEE802154_ATTR_PHY_NAME])
+                return -EINVAL;
+
+        name = nla_data(info->attrs[IEEE802154_ATTR_PHY_NAME]);
+        if (name[nla_len(info->attrs[IEEE802154_ATTR_PHY_NAME]) - 1] != '\0')
+                return -EINVAL; /* phy name should be null-terminated */
+
+        if (info->attrs[IEEE802154_ATTR_DEV_NAME]) {
+                devname = nla_data(info->attrs[IEEE802154_ATTR_DEV_NAME]);
+                if (devname[nla_len(info->attrs[IEEE802154_ATTR_DEV_NAME]) - 1]
+                                != '\0')
+                        return -EINVAL; /* phy name should be null-terminated */
+        } else  {
+                devname = "wpan%d";
+        }
+
+        if (strlen(devname) >= IFNAMSIZ)
+                return -ENAMETOOLONG;
+
+        phy = wpan_phy_find(name);
+        if (!phy)
+                return -ENODEV;
+
+        msg = ieee802154_nl_new_reply(info, 0, IEEE802154_ADD_IFACE);
+        if (!msg)
+                goto out_dev;
+
+        if (!phy->add_iface) {
+                rc = -EINVAL;
+                goto nla_put_failure;
+        }
+
+        dev = phy->add_iface(phy, devname);
+        if (IS_ERR(dev)) {
+                rc = PTR_ERR(dev);
+                goto nla_put_failure;
+        }
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+
+        dev_put(dev);
+
+        wpan_phy_put(phy);
+
+        return ieee802154_nl_reply(msg, info);
+
+nla_put_failure:
+        nlmsg_free(msg);
+out_dev:
+        wpan_phy_put(phy);
+        return rc;
+}
+
+static int ieee802154_del_iface(struct sk_buff *skb,
+                struct genl_info *info)
+{
+        struct sk_buff *msg;
+        struct wpan_phy *phy;
+        const char *name;
+        int rc;
+        struct net_device *dev;
+
+        pr_debug("%s\n", __func__);
+
+        if (!info->attrs[IEEE802154_ATTR_DEV_NAME])
+                return -EINVAL;
+
+        name = nla_data(info->attrs[IEEE802154_ATTR_DEV_NAME]);
+        if (name[nla_len(info->attrs[IEEE802154_ATTR_DEV_NAME]) - 1] != '\0')
+                return -EINVAL; /* name should be null-terminated */
+
+        dev = dev_get_by_name(genl_info_net(info), name);
+        if (!dev)
+                return -ENODEV;
+
+        phy = ieee802154_mlme_ops(dev)->get_phy(dev);
+        BUG_ON(!phy);
+
+        rc = -EINVAL;
+        /* phy name is optional, but should be checked if it's given */
+        if (info->attrs[IEEE802154_ATTR_PHY_NAME]) {
+                struct wpan_phy *phy2;
+
+                const char *pname =
+                        nla_data(info->attrs[IEEE802154_ATTR_PHY_NAME]);
+                if (pname[nla_len(info->attrs[IEEE802154_ATTR_PHY_NAME]) - 1]
+                                != '\0')
+                        /* name should be null-terminated */
+                        goto out_dev;
+
+                phy2 = wpan_phy_find(pname);
+                if (!phy2)
+                        goto out_dev;
+
+                if (phy != phy2) {
+                        wpan_phy_put(phy2);
+                        goto out_dev;
+                }
+        }
+
+        rc = -ENOBUFS;
+
+        msg = ieee802154_nl_new_reply(info, 0, IEEE802154_DEL_IFACE);
+        if (!msg)
+                goto out_dev;
+
+        if (!phy->del_iface) {
+                rc = -EINVAL;
+                goto nla_put_failure;
+        }
+
+        rtnl_lock();
+        phy->del_iface(phy, dev);
+
+        /* We don't have device anymore */
+        dev_put(dev);
+        dev = NULL;
+
+        rtnl_unlock();
+
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy));
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, name);
+
+        wpan_phy_put(phy);
+
+        return ieee802154_nl_reply(msg, info);
+
+nla_put_failure:
+        nlmsg_free(msg);
+out_dev:
+        wpan_phy_put(phy);
+        if (dev)
+                dev_put(dev);
+
+        return rc;
+}
+
+static struct genl_ops ieee802154_phy_ops[] = {
+        IEEE802154_DUMP(IEEE802154_LIST_PHY, ieee802154_list_phy,
+                                                        ieee802154_dump_phy),
+        IEEE802154_OP(IEEE802154_ADD_IFACE, ieee802154_add_iface),
+        IEEE802154_OP(IEEE802154_DEL_IFACE, ieee802154_del_iface),
+};
+
+/*
+ * No need to unregister as family unregistration will do it.
+ */
+int nl802154_phy_register(void)
+{
+        int i;
+        int rc;
+
+        for (i = 0; i < ARRAY_SIZE(ieee802154_phy_ops); i++) {
+                rc = genl_register_ops(&nl802154_family,
+                                &ieee802154_phy_ops[i]);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
index 2363ebee02e7..6adda4d46f95 100644
--- a/net/ieee802154/nl_policy.c
+++ b/net/ieee802154/nl_policy.c
@@ -27,6 +27,7 @@
 const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_DEV_NAME] = { .type = NLA_STRING, },
         [IEEE802154_ATTR_DEV_INDEX] = { .type = NLA_U32, },
+        [IEEE802154_ATTR_PHY_NAME] = { .type = NLA_STRING, },
 
         [IEEE802154_ATTR_STATUS] = { .type = NLA_U8, },
         [IEEE802154_ATTR_SHORT_ADDR] = { .type = NLA_U16, },
@@ -50,5 +51,6 @@ const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_CHANNELS] = { .type = NLA_U32, },
         [IEEE802154_ATTR_DURATION] = { .type = NLA_U8, },
         [IEEE802154_ATTR_ED_LIST] = { .len = 27 },
+        [IEEE802154_ATTR_CHANNEL_PAGE_LIST] = { .len = 32 * 4, },
 };
 
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 30e74eee07d6..10970ca85748 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/if_arp.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_ieee802154.h>
 
@@ -191,7 +192,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
@@ -206,7 +207,6 @@ out:
 static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
diff --git a/net/ieee802154/wpan-class.c b/net/ieee802154/wpan-class.c
index f306604da67a..3d803a1b9fb6 100644
--- a/net/ieee802154/wpan-class.c
+++ b/net/ieee802154/wpan-class.c
@@ -16,12 +16,15 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/device.h>
 
 #include <net/wpan-phy.h>
 
+#include "ieee802154.h"
+
 #define MASTER_SHOW_COMPLEX(name, format_string, args...)               \
 static ssize_t name ## _show(struct device *dev,                        \
                             struct device_attribute *attr, char *buf)   \
@@ -30,7 +33,7 @@ static ssize_t name ## _show(struct device *dev,			\
         int ret;                                                        \
                                                                         \
         mutex_lock(&phy->pib_lock);                                     \
-        ret = sprintf(buf, format_string "\n", args);                   \
+        ret = snprintf(buf, PAGE_SIZE, format_string "\n", args);       \
         mutex_unlock(&phy->pib_lock);                                   \
         return ret;                                                     \
 }
@@ -40,12 +43,30 @@ static ssize_t name ## _show(struct device *dev,			\
 
 MASTER_SHOW(current_channel, "%d");
 MASTER_SHOW(current_page, "%d");
-MASTER_SHOW(channels_supported, "%#x");
 MASTER_SHOW_COMPLEX(transmit_power, "%d +- %d dB",
         ((signed char) (phy->transmit_power << 2)) >> 2,
         (phy->transmit_power >> 6) ? (phy->transmit_power >> 6) * 3 : 1 );
 MASTER_SHOW(cca_mode, "%d");
 
+static ssize_t channels_supported_show(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev);
+        int ret;
+        int i, len = 0;
+
+        mutex_lock(&phy->pib_lock);
+        for (i = 0; i < 32; i++) {
+                ret = snprintf(buf + len, PAGE_SIZE - len,
+                                "%#09x\n", phy->channels_supported[i]);
+                if (ret < 0)
+                        break;
+                len += ret;
+        }
+        mutex_unlock(&phy->pib_lock);
+        return len;
+}
+
 static struct device_attribute pmib_attrs[] = {
         __ATTR_RO(current_channel),
         __ATTR_RO(current_page),
@@ -91,6 +112,31 @@ struct wpan_phy *wpan_phy_find(const char *str)
 }
 EXPORT_SYMBOL(wpan_phy_find);
 
+struct wpan_phy_iter_data {
+        int (*fn)(struct wpan_phy *phy, void *data);
+        void *data;
+};
+
+static int wpan_phy_iter(struct device *dev, void *_data)
+{
+        struct wpan_phy_iter_data *wpid = _data;
+        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev);
+        return wpid->fn(phy, wpid->data);
+}
+
+int wpan_phy_for_each(int (*fn)(struct wpan_phy *phy, void *data),
+                void *data)
+{
+        struct wpan_phy_iter_data wpid = {
+                .fn = fn,
+                .data = data,
+        };
+
+        return class_for_each_device(&wpan_phy_class, NULL,
+                        &wpid, wpan_phy_iter);
+}
+EXPORT_SYMBOL(wpan_phy_for_each);
+
 static int wpan_phy_idx_valid(int idx)
 {
         return idx >= 0;
@@ -118,14 +164,15 @@ struct wpan_phy *wpan_phy_alloc(size_t priv_size)
 
         phy->dev.class = &wpan_phy_class;
 
+        phy->current_channel = -1; /* not initialised */
+        phy->current_page = 0; /* for compatibility */
+
         return phy;
 }
 EXPORT_SYMBOL(wpan_phy_alloc);
 
-int wpan_phy_register(struct device *parent, struct wpan_phy *phy)
+int wpan_phy_register(struct wpan_phy *phy)
 {
-        phy->dev.parent = parent;
-
         return device_add(&phy->dev);
 }
 EXPORT_SYMBOL(wpan_phy_register);
@@ -144,16 +191,31 @@ EXPORT_SYMBOL(wpan_phy_free);
 
 static int __init wpan_phy_class_init(void)
 {
-        return class_register(&wpan_phy_class);
+        int rc;
+        rc = class_register(&wpan_phy_class);
+        if (rc)
+                goto err;
+
+        rc = ieee802154_nl_init();
+        if (rc)
+                goto err_nl;
+
+        return 0;
+err_nl:
+        class_unregister(&wpan_phy_class);
+err:
+        return rc;
 }
 subsys_initcall(wpan_phy_class_init);
 
 static void __exit wpan_phy_class_exit(void)
 {
+        ieee802154_nl_exit();
         class_unregister(&wpan_phy_class);
 }
 module_exit(wpan_phy_class_exit);
 
-MODULE_DESCRIPTION("IEEE 802.15.4 device class");
 MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("IEEE 802.15.4 configuration interface");
+MODULE_AUTHOR("Dmitry Eremin-Solenikov");
 
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 70491d9035eb..0c94a1ac2946 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -166,7 +166,7 @@ config IP_PNP_DHCP
 
           If unsure, say Y. Note that if you want to use DHCP, a DHCP server
           must be operating on your network.  Read
-          <file:Documentation/filesystems/nfsroot.txt> for details.
+          <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 config IP_PNP_BOOTP
         bool "IP: BOOTP support"
@@ -181,7 +181,7 @@ config IP_PNP_BOOTP
           does BOOTP itself, providing all necessary information on the kernel
           command line, you can say N here. If unsure, say Y. Note that if you
           want to use BOOTP, a BOOTP server must be operating on your network.
-          Read <file:Documentation/filesystems/nfsroot.txt> for details.
+          Read <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 config IP_PNP_RARP
         bool "IP: RARP support"
@@ -194,7 +194,7 @@ config IP_PNP_RARP
           older protocol which is being obsoleted by BOOTP and DHCP), say Y
           here. Note that if you want to use RARP, a RARP server must be
           operating on your network. Read
-          <file:Documentation/filesystems/nfsroot.txt> for details.
+          <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 # not yet ready..
 #   bool '    IP: ARP support' CONFIG_IP_PNP_ARP
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 57737b8d1711..f71357422380 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -86,6 +86,7 @@
 #include <linux/poll.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -174,12 +175,12 @@ static int inet_autobind(struct sock *sk)
         /* We may need to bind the socket. */
         lock_sock(sk);
         inet = inet_sk(sk);
-        if (!inet->num) {
+        if (!inet->inet_num) {
                 if (sk->sk_prot->get_port(sk, 0)) {
                         release_sock(sk);
                         return -EAGAIN;
                 }
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
         }
         release_sock(sk);
         return 0;
@@ -262,7 +263,8 @@ static inline int inet_netns_ok(struct net *net, int protocol)
  *      Create an inet socket.
  */
 
-static int inet_create(struct net *net, struct socket *sock, int protocol)
+static int inet_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         struct inet_protosw *answer;
@@ -325,7 +327,7 @@ lookup_protocol:
         }
 
         err = -EPERM;
-        if (answer->capability > 0 && !capable(answer->capability))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 goto out_rcu_unlock;
 
         err = -EAFNOSUPPORT;
@@ -354,7 +356,7 @@ lookup_protocol:
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                 if (IPPROTO_RAW == protocol)
                         inet->hdrincl = 1;
         }
@@ -364,7 +366,7 @@ lookup_protocol:
         else
                 inet->pmtudisc = IP_PMTUDISC_WANT;
 
-        inet->id = 0;
+        inet->inet_id = 0;
 
         sock_init_data(sock, sk);
 
@@ -381,13 +383,13 @@ lookup_protocol:
 
         sk_refcnt_debug_inc(sk);
 
-        if (inet->num) {
+        if (inet->inet_num) {
                 /* It assumes that any protocol which allows
                  * the user to assign a number at socket
                  * creation time automatically
                  * shares.
                  */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                 /* Add to protocol hash chains. */
                 sk->sk_prot->hash(sk);
         }
@@ -494,27 +496,27 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         /* Check these errors (active socket, double bind). */
         err = -EINVAL;
-        if (sk->sk_state != TCP_CLOSE || inet->num)
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num)
                 goto out_release_sock;
 
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
 
         /* Make sure we are allowed to bind here. */
         if (sk->sk_prot->get_port(sk, snum)) {
-                inet->saddr = inet->rcv_saddr = 0;
+                inet->inet_saddr = inet->inet_rcv_saddr = 0;
                 err = -EADDRINUSE;
                 goto out_release_sock;
         }
 
-        if (inet->rcv_saddr)
+        if (inet->inet_rcv_saddr)
                 sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_sport = htons(inet->inet_num);
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk_dst_reset(sk);
         err = 0;
 out_release_sock:
@@ -529,10 +531,12 @@ int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
 {
         struct sock *sk = sock->sk;
 
+        if (addr_len < sizeof(uaddr->sa_family))
+                return -EINVAL;
         if (uaddr->sa_family == AF_UNSPEC)
                 return sk->sk_prot->disconnect(sk, flags);
 
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
         return sk->sk_prot->connect(sk, (struct sockaddr *)uaddr, addr_len);
 }
@@ -572,6 +576,9 @@ int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
         int err;
         long timeo;
 
+        if (addr_len < sizeof(uaddr->sa_family))
+                return -EINVAL;
+
         lock_sock(sk);
 
         if (uaddr->sa_family == AF_UNSPEC) {
@@ -685,21 +692,21 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr,
 {
         struct sock *sk         = sock->sk;
         struct inet_sock *inet  = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, uaddr);
 
         sin->sin_family = AF_INET;
         if (peer) {
-                if (!inet->dport ||
+                if (!inet->inet_dport ||
                     (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                      peer == 1))
                         return -ENOTCONN;
-                sin->sin_port = inet->dport;
-                sin->sin_addr.s_addr = inet->daddr;
+                sin->sin_port = inet->inet_dport;
+                sin->sin_addr.s_addr = inet->inet_daddr;
         } else {
-                __be32 addr = inet->rcv_saddr;
+                __be32 addr = inet->inet_rcv_saddr;
                 if (!addr)
-                        addr = inet->saddr;
-                sin->sin_port = inet->sport;
+                        addr = inet->inet_saddr;
+                sin->sin_port = inet->inet_sport;
                 sin->sin_addr.s_addr = addr;
         }
         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
@@ -714,7 +721,7 @@ int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         return sk->sk_prot->sendmsg(iocb, sk, msg, size);
@@ -728,7 +735,7 @@ static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         if (sk->sk_prot->sendpage)
@@ -931,7 +938,7 @@ static const struct proto_ops inet_sockraw_ops = {
 #endif
 };
 
-static struct net_proto_family inet_family_ops = {
+static const struct net_proto_family inet_family_ops = {
         .family = PF_INET,
         .create = inet_create,
         .owner  = THIS_MODULE,
@@ -947,7 +954,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_TCP,
                 .prot =       &tcp_prot,
                 .ops =        &inet_stream_ops,
-                .capability = -1,
                 .no_check =   0,
                 .flags =      INET_PROTOSW_PERMANENT |
                               INET_PROTOSW_ICSK,
@@ -958,7 +964,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_UDP,
                 .prot =       &udp_prot,
                 .ops =        &inet_dgram_ops,
-                .capability = -1,
                 .no_check =   UDP_CSUM_DEFAULT,
                 .flags =      INET_PROTOSW_PERMANENT,
        },
@@ -969,7 +974,6 @@ static struct inet_protosw inetsw_array[] =
                .protocol =   IPPROTO_IP,        /* wild card */
                .prot =       &raw_prot,
                .ops =        &inet_sockraw_ops,
-               .capability = CAP_NET_RAW,
                .no_check =   UDP_CSUM_DEFAULT,
                .flags =      INET_PROTOSW_REUSE,
        }
@@ -1059,9 +1063,9 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         struct inet_sock *inet = inet_sk(sk);
         int err;
         struct rtable *rt;
-        __be32 old_saddr = inet->saddr;
+        __be32 old_saddr = inet->inet_saddr;
         __be32 new_saddr;
-        __be32 daddr = inet->daddr;
+        __be32 daddr = inet->inet_daddr;
 
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
@@ -1071,7 +1075,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                                RT_CONN_FLAGS(sk),
                                sk->sk_bound_dev_if,
                                sk->sk_protocol,
-                               inet->sport, inet->dport, sk, 0);
+                               inet->inet_sport, inet->inet_dport, sk, 0);
         if (err)
                 return err;
 
@@ -1087,7 +1091,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                        __func__, &old_saddr, &new_saddr);
         }
 
-        inet->saddr = inet->rcv_saddr = new_saddr;
+        inet->inet_saddr = inet->inet_rcv_saddr = new_saddr;
 
         /*
          * XXX The only one ugly spot where we need to
@@ -1113,7 +1117,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 return 0;
 
         /* Reroute. */
-        daddr = inet->daddr;
+        daddr = inet->inet_daddr;
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
 {
@@ -1123,7 +1127,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .nl_u = {
                         .ip4_u = {
                                 .daddr  = daddr,
-                                .saddr  = inet->saddr,
+                                .saddr  = inet->inet_saddr,
                                 .tos    = RT_CONN_FLAGS(sk),
                         },
                 },
@@ -1131,8 +1135,8 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .flags = inet_sk_flowi_flags(sk),
                 .uli_u = {
                         .ports = {
-                                .sport = inet->sport,
-                                .dport = inet->dport,
+                                .sport = inet->inet_sport,
+                                .dport = inet->inet_dport,
                         },
                 },
         };
@@ -1387,7 +1391,7 @@ int inet_ctl_sock_create(struct sock **sk, unsigned short family,
 }
 EXPORT_SYMBOL_GPL(inet_ctl_sock_create);
 
-unsigned long snmp_fold_field(void *mib[], int offt)
+unsigned long snmp_fold_field(void __percpu *mib[], int offt)
 {
         unsigned long res = 0;
         int i;
@@ -1400,7 +1404,7 @@ unsigned long snmp_fold_field(void *mib[], int offt)
 }
 EXPORT_SYMBOL_GPL(snmp_fold_field);
 
-int snmp_mib_init(void *ptr[2], size_t mibsize)
+int snmp_mib_init(void __percpu *ptr[2], size_t mibsize)
 {
         BUG_ON(ptr == NULL);
         ptr[0] = __alloc_percpu(mibsize, __alignof__(unsigned long long));
@@ -1418,7 +1422,7 @@ err0:
 }
 EXPORT_SYMBOL_GPL(snmp_mib_init);
 
-void snmp_mib_free(void *ptr[2])
+void snmp_mib_free(void __percpu *ptr[2])
 {
         BUG_ON(ptr == NULL);
         free_percpu(ptr[0]);
@@ -1462,25 +1466,25 @@ static const struct net_protocol icmp_protocol = {
 
 static __net_init int ipv4_mib_init_net(struct net *net)
 {
-        if (snmp_mib_init((void **)net->mib.tcp_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.tcp_statistics,
                           sizeof(struct tcp_mib)) < 0)
                 goto err_tcp_mib;
-        if (snmp_mib_init((void **)net->mib.ip_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.ip_statistics,
                           sizeof(struct ipstats_mib)) < 0)
                 goto err_ip_mib;
-        if (snmp_mib_init((void **)net->mib.net_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.net_statistics,
                           sizeof(struct linux_mib)) < 0)
                 goto err_net_mib;
-        if (snmp_mib_init((void **)net->mib.udp_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.udp_statistics,
                           sizeof(struct udp_mib)) < 0)
                 goto err_udp_mib;
-        if (snmp_mib_init((void **)net->mib.udplite_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.udplite_statistics,
                           sizeof(struct udp_mib)) < 0)
                 goto err_udplite_mib;
-        if (snmp_mib_init((void **)net->mib.icmp_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.icmp_statistics,
                           sizeof(struct icmp_mib)) < 0)
                 goto err_icmp_mib;
-        if (snmp_mib_init((void **)net->mib.icmpmsg_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.icmpmsg_statistics,
                           sizeof(struct icmpmsg_mib)) < 0)
                 goto err_icmpmsg_mib;
 
@@ -1488,30 +1492,30 @@ static __net_init int ipv4_mib_init_net(struct net *net)
         return 0;
 
 err_icmpmsg_mib:
-        snmp_mib_free((void **)net->mib.icmp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmp_statistics);
 err_icmp_mib:
-        snmp_mib_free((void **)net->mib.udplite_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udplite_statistics);
 err_udplite_mib:
-        snmp_mib_free((void **)net->mib.udp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udp_statistics);
 err_udp_mib:
-        snmp_mib_free((void **)net->mib.net_statistics);
+        snmp_mib_free((void __percpu **)net->mib.net_statistics);
 err_net_mib:
-        snmp_mib_free((void **)net->mib.ip_statistics);
+        snmp_mib_free((void __percpu **)net->mib.ip_statistics);
 err_ip_mib:
-        snmp_mib_free((void **)net->mib.tcp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.tcp_statistics);
 err_tcp_mib:
         return -ENOMEM;
 }
 
 static __net_exit void ipv4_mib_exit_net(struct net *net)
 {
-        snmp_mib_free((void **)net->mib.icmpmsg_statistics);
-        snmp_mib_free((void **)net->mib.icmp_statistics);
-        snmp_mib_free((void **)net->mib.udplite_statistics);
-        snmp_mib_free((void **)net->mib.udp_statistics);
-        snmp_mib_free((void **)net->mib.net_statistics);
-        snmp_mib_free((void **)net->mib.ip_statistics);
-        snmp_mib_free((void **)net->mib.tcp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpmsg_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udplite_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.net_statistics);
+        snmp_mib_free((void __percpu **)net->mib.ip_statistics);
+        snmp_mib_free((void __percpu **)net->mib.tcp_statistics);
 }
 
 static __net_initdata struct pernet_operations ipv4_mib_ops = {
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 5c662703eb1e..880a5ec6dce0 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -1,14 +1,73 @@
+#include <crypto/hash.h>
 #include <linux/err.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline u8 *ah_tmp_auth(void *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+
+        ahash_request_set_tfm(req, ahash);
+
+        return req;
+}
+
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
 
 /* Clear mutable options and find final destination to substitute
  * into IP header for icv calculation. Options are already checked
@@ -54,20 +113,72 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
         return 0;
 }
 
+static void ah_output_done(struct crypto_async_request *base, int err)
+{
+        u8 *icv;
+        struct iphdr *iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct iphdr *top_iph = ip_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+
+        iph = AH_SKB_CB(skb)->tmp;
+        icv = ah_tmp_icv(ahp->ahash, iph, ihl);
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+
+        top_iph->tos = iph->tos;
+        top_iph->ttl = iph->ttl;
+        top_iph->frag_off = iph->frag_off;
+        if (top_iph->ihl != 5) {
+                top_iph->daddr = iph->daddr;
+                memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
+        }
+
+        err = ah->nexthdr;
+
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        int nfrags;
+        int ihl;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct iphdr *iph, *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        union {
-                struct iphdr    iph;
-                char            buf[60];
-        } tmp_iph;
+
+        ahp = x->data;
+        ahash = ahp->ahash;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
 
         skb_push(skb, -skb_network_offset(skb));
+        ah = ip_auth_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        err = -ENOMEM;
+        iph = ah_alloc_tmp(ahash, nfrags, ihl);
+        if (!iph)
+                goto out;
+
+        icv = ah_tmp_icv(ahash, iph, ihl);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         top_iph = ip_hdr(skb);
-        iph = &tmp_iph.iph;
 
         iph->tos = top_iph->tos;
         iph->ttl = top_iph->ttl;
@@ -78,10 +189,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
                 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
                 if (err)
-                        goto error;
+                        goto out_free;
         }
 
-        ah = ip_auth_hdr(skb);
         ah->nexthdr = *skb_mac_header(skb);
         *skb_mac_header(skb) = IPPROTO_AH;
 
@@ -91,20 +201,31 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->ttl = 0;
         top_iph->check = 0;
 
-        ahp = x->data;
         ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
 
-        spin_lock_bh(&x->lock);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-        if (err)
-                goto error;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_output_done, skb);
+
+        AH_SKB_CB(skb)->tmp = iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
 
         top_iph->tos = iph->tos;
         top_iph->ttl = iph->ttl;
@@ -114,28 +235,67 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
         }
 
-        err = 0;
-
-error:
+out_free:
+        kfree(iph);
+out:
         return err;
 }
 
+static void ah_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        struct iphdr *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, ihl);
+        __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
+
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
+
 static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ah_hlen;
         int ihl;
         int nexthdr;
-        int err = -EINVAL;
-        struct iphdr *iph;
+        int nfrags;
+        u8 *auth_data;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
+        struct iphdr *iph, *work_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        char work_buf[60];
+        int err = -ENOMEM;
 
         if (!pskb_may_pull(skb, sizeof(*ah)))
                 goto out;
 
         ah = (struct ip_auth_hdr *)skb->data;
         ahp = x->data;
+        ahash = ahp->ahash;
+
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
@@ -156,9 +316,24 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         ah = (struct ip_auth_hdr *)skb->data;
         iph = ip_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
+        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
 
-        ihl = skb->data - skb_network_header(skb);
-        memcpy(work_buf, iph, ihl);
+        memcpy(work_iph, iph, ihl);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
         iph->ttl = 0;
         iph->tos = 0;
@@ -166,35 +341,44 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         iph->check = 0;
         if (ihl > sizeof(*iph)) {
                 __be32 dummy;
-                if (ip_clear_mutable_options(iph, &dummy))
-                        goto out;
+                err = ip_clear_mutable_options(iph, &dummy);
+                if (err)
+                        goto out_free;
         }
 
-        spin_lock(&x->lock);
-        {
-                u8 auth_data[MAX_AH_AUTH_LEN];
+        skb_push(skb, ihl);
 
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
-                skb_push(skb, ihl);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (err)
-                        goto unlock;
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
-                        err = -EBADMSG;
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
+
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_input_done, skb);
+
+        AH_SKB_CB(skb)->tmp = work_iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
         }
-unlock:
-        spin_unlock(&x->lock);
 
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
         if (err)
-                goto out;
+                goto out_free;
 
         skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), work_buf, ihl);
-        skb->transport_header = skb->network_header;
+        memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
 
-        return nexthdr;
+        err = nexthdr;
 
+out_free:
+        kfree (work_iph);
 out:
         return err;
 }
@@ -210,7 +394,7 @@ static void ah4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
         if (!x)
                 return;
         printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
@@ -222,7 +406,7 @@ static int ah_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
 
         if (!x->aalg)
                 goto error;
@@ -231,44 +415,40 @@ static int ah_init_state(struct xfrm_state *x)
                 goto error;
 
         ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
-        if (ahp == NULL)
+        if (!ahp)
                 return -ENOMEM;
 
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
+        if (IS_ERR(ahash))
                 goto error;
 
-        ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
-                               (x->aalg->alg_key_len + 7) / 8))
+        ahp->ahash = ahash;
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
+                                (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
         /*
          * Lookup the algorithm description maintained by xfrm_algo,
          * verify crypto transform properties, and store information
          * we need for AH processing.  This lookup cannot fail here
-         * after a successful crypto_alloc_hash().
+         * after a successful crypto_alloc_ahash().
          */
         aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
         BUG_ON(!aalg_desc);
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
 
         ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-        ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
+        ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
 
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
 
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
-
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                           ahp->icv_trunc_len);
         if (x->props.mode == XFRM_MODE_TUNNEL)
@@ -279,8 +459,7 @@ static int ah_init_state(struct xfrm_state *x)
 
 error:
         if (ahp) {
-                kfree(ahp->work_icv);
-                crypto_free_hash(ahp->tfm);
+                crypto_free_ahash(ahp->ahash);
                 kfree(ahp);
         }
         return -EINVAL;
@@ -293,8 +472,7 @@ static void ah_destroy(struct xfrm_state *x)
         if (!ahp)
                 return;
 
-        kfree(ahp->work_icv);
-        crypto_free_hash(ahp->tfm);
+        crypto_free_ahash(ahp->ahash);
         kfree(ahp);
 }
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 4e80f336c0cf..80769f1f9fab 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -70,6 +70,7 @@
  *                                      bonding can change the skb before
  *                                      sending (e.g. insert 8021q tag).
  *              Harald Welte    :       convert to make use of jenkins hash
+ *              Jesper D. Brouer:       Proxy ARP PVLAN RFC 3069 support.
  */
 
 #include <linux/module.h>
@@ -97,6 +98,7 @@
 #include <linux/net.h>
 #include <linux/rcupdate.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -524,12 +526,15 @@ int arp_bind_neighbour(struct dst_entry *dst)
 /*
  * Check if we can use proxy ARP for this path
  */
-
-static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
+static inline int arp_fwd_proxy(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt)
 {
         struct in_device *out_dev;
         int imi, omi = -1;
 
+        if (rt->u.dst.dev == dev)
+                return 0;
+
         if (!IN_DEV_PROXY_ARP(in_dev))
                 return 0;
 
@@ -548,6 +553,43 @@ static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
 }
 
 /*
+ * Check for RFC3069 proxy arp private VLAN (allow to send back to same dev)
+ *
+ * RFC3069 supports proxy arp replies back to the same interface.  This
+ * is done to support (ethernet) switch features, like RFC 3069, where
+ * the individual ports are not allowed to communicate with each
+ * other, BUT they are allowed to talk to the upstream router.  As
+ * described in RFC 3069, it is possible to allow these hosts to
+ * communicate through the upstream router, by proxy_arp'ing.
+ *
+ * RFC 3069: "VLAN Aggregation for Efficient IP Address Allocation"
+ *
+ *  This technology is known by different names:
+ *    In RFC 3069 it is called VLAN Aggregation.
+ *    Cisco and Allied Telesyn call it Private VLAN.
+ *    Hewlett-Packard call it Source-Port filtering or port-isolation.
+ *    Ericsson call it MAC-Forced Forwarding (RFC Draft).
+ *
+ */
+static inline int arp_fwd_pvlan(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt,
+                                __be32 sip, __be32 tip)
+{
+        /* Private VLAN is only concerned about the same ethernet segment */
+        if (rt->u.dst.dev != dev)
+                return 0;
+
+        /* Don't reply on self probes (often done by windowz boxes)*/
+        if (sip == tip)
+                return 0;
+
+        if (IN_DEV_PROXY_ARP_PVLAN(in_dev))
+                return 1;
+        else
+                return 0;
+}
+
+/*
  *      Interface to link layer: send routine and receive handler.
  */
 
@@ -619,13 +661,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 #endif
 #endif
 
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 arp->ar_hrd = htons(ARPHRD_ETHER);
                 arp->ar_pro = htons(ETH_P_IP);
                 break;
 #endif
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 arp->ar_hrd = htons(ARPHRD_IEEE802);
                 arp->ar_pro = htons(ETH_P_IP);
@@ -833,8 +875,11 @@ static int arp_process(struct sk_buff *skb)
                         }
                         goto out;
                 } else if (IN_DEV_FORWARD(in_dev)) {
-                            if (addr_type == RTN_UNICAST  && rt->u.dst.dev != dev &&
-                             (arp_fwd_proxy(in_dev, rt) || pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
+                        if (addr_type == RTN_UNICAST  &&
+                            (arp_fwd_proxy(in_dev, dev, rt) ||
+                             arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
+                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0)))
+                        {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n)
                                         neigh_release(n);
@@ -863,7 +908,8 @@ static int arp_process(struct sk_buff *skb)
                    devices (strip is candidate)
                  */
                 if (n == NULL &&
-                    arp->ar_op == htons(ARPOP_REPLY) &&
+                    (arp->ar_op == htons(ARPOP_REPLY) ||
+                     (arp->ar_op == htons(ARPOP_REQUEST) && tip == sip)) &&
                     inet_addr_type(net, sip) == RTN_UNICAST)
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
@@ -1005,7 +1051,7 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                         return -EINVAL;
         }
         switch (dev->type) {
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 /*
                  * According to RFC 1390, FDDI devices should accept ARP
@@ -1239,8 +1285,7 @@ void __init arp_init(void)
         dev_add_pack(&arp_packet_type);
         arp_proc_init();
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &arp_tbl.parms, NET_IPV4,
-                              NET_IPV4_NEIGH, "ipv4", NULL, NULL);
+        neigh_sysctl_register(NULL, &arp_tbl.parms, "ipv4", NULL);
 #endif
         register_netdevice_notifier(&arp_netdev_notifier);
 }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 039cc1ffe977..c97cd9ff697e 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -44,6 +44,7 @@
 #include <linux/string.h>
 #include <linux/jhash.h>
 #include <linux/audit.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/icmp.h>
 #include <net/tcp.h>
@@ -2017,7 +2018,7 @@ req_setattr_failure:
  * values on failure.
  *
  */
-int cipso_v4_delopt(struct ip_options **opt_ptr)
+static int cipso_v4_delopt(struct ip_options **opt_ptr)
 {
         int hdr_delta = 0;
         struct ip_options *opt = *opt_ptr;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 5e6c5a0f3fde..fb2465811b48 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -39,7 +39,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_dst_reset(sk);
 
         oif = sk->sk_bound_dev_if;
-        saddr = inet->saddr;
+        saddr = inet->inet_saddr;
         if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
                 if (!oif)
                         oif = inet->mc_index;
@@ -49,7 +49,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr,
                                RT_CONN_FLAGS(sk), oif,
                                sk->sk_protocol,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (err) {
                 if (err == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -60,14 +60,14 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 ip_rt_put(rt);
                 return -EACCES;
         }
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;       /* Update source address */
-        if (!inet->rcv_saddr)
-                inet->rcv_saddr = rt->rt_src;
-        inet->daddr = rt->rt_dst;
-        inet->dport = usin->sin_port;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;  /* Update source address */
+        if (!inet->inet_rcv_saddr)
+                inet->inet_rcv_saddr = rt->rt_src;
+        inet->inet_daddr = rt->rt_dst;
+        inet->inet_dport = usin->sin_port;
         sk->sk_state = TCP_ESTABLISHED;
-        inet->id = jiffies;
+        inet->inet_id = jiffies;
 
         sk_dst_set(sk, &rt->u.dst);
         return(0);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5df2f6a0b0f0..90e3d6379a42 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -50,6 +50,7 @@
 #include <linux/notifier.h>
 #include <linux/inetdevice.h>
 #include <linux/igmp.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -64,20 +65,20 @@
 
 static struct ipv4_devconf ipv4_devconf = {
         .data = {
-                [NET_IPV4_CONF_ACCEPT_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SEND_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SECURE_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SHARED_MEDIA - 1] = 1,
+                [IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SEND_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SECURE_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SHARED_MEDIA - 1] = 1,
         },
 };
 
 static struct ipv4_devconf ipv4_devconf_dflt = {
         .data = {
-                [NET_IPV4_CONF_ACCEPT_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SEND_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SECURE_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SHARED_MEDIA - 1] = 1,
-                [NET_IPV4_CONF_ACCEPT_SOURCE_ROUTE - 1] = 1,
+                [IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SEND_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SECURE_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SHARED_MEDIA - 1] = 1,
+                [IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE - 1] = 1,
         },
 };
 
@@ -140,11 +141,11 @@ void in_dev_finish_destroy(struct in_device *idev)
 #endif
         dev_put(dev);
         if (!idev->dead)
-                printk("Freeing alive in_device %p\n", idev);
-        else {
+                pr_err("Freeing alive in_device %p\n", idev);
+        else
                 kfree(idev);
-        }
 }
+EXPORT_SYMBOL(in_dev_finish_destroy);
 
 static struct in_device *inetdev_init(struct net_device *dev)
 {
@@ -159,7 +160,8 @@ static struct in_device *inetdev_init(struct net_device *dev)
                         sizeof(in_dev->cnf));
         in_dev->cnf.sysctl = NULL;
         in_dev->dev = dev;
-        if ((in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl)) == NULL)
+        in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl);
+        if (!in_dev->arp_parms)
                 goto out_kfree;
         if (IPV4_DEVCONF(in_dev->cnf, FORWARDING))
                 dev_disable_lro(dev);
@@ -405,13 +407,15 @@ struct in_device *inetdev_by_index(struct net *net, int ifindex)
 {
         struct net_device *dev;
         struct in_device *in_dev = NULL;
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifindex);
+
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
         if (dev)
                 in_dev = in_dev_get(dev);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return in_dev;
 }
+EXPORT_SYMBOL(inetdev_by_index);
 
 /* Called only from RTNL semaphored context. No locks. */
 
@@ -557,7 +561,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
  *      Determine a default network mask, based on the IP address.
  */
 
-static __inline__ int inet_abc_len(__be32 addr)
+static inline int inet_abc_len(__be32 addr)
 {
         int rc = -1;    /* Something else, probably a multicast. */
 
@@ -646,13 +650,15 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         rtnl_lock();
 
         ret = -ENODEV;
-        if ((dev = __dev_get_by_name(net, ifr.ifr_name)) == NULL)
+        dev = __dev_get_by_name(net, ifr.ifr_name);
+        if (!dev)
                 goto done;
 
         if (colon)
                 *colon = ':';
 
-        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
+        in_dev = __in_dev_get_rtnl(dev);
+        if (in_dev) {
                 if (tryaddrmatch) {
                         /* Matthias Andree */
                         /* compare label and address (4.4BSD style) */
@@ -720,7 +726,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 
                 if (!ifa) {
                         ret = -ENOBUFS;
-                        if ((ifa = inet_alloc_ifa()) == NULL)
+                        ifa = inet_alloc_ifa();
+                        if (!ifa)
                                 break;
                         if (colon)
                                 memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ);
@@ -822,10 +829,10 @@ static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
         struct ifreq ifr;
         int done = 0;
 
-        if (!in_dev || (ifa = in_dev->ifa_list) == NULL)
+        if (!in_dev)
                 goto out;
 
-        for (; ifa; ifa = ifa->ifa_next) {
+        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
                 if (!buf) {
                         done += sizeof(ifr);
                         continue;
@@ -875,36 +882,33 @@ __be32 inet_select_addr(const struct net_device *dev, __be32 dst, int scope)
                 if (!addr)
                         addr = ifa->ifa_local;
         } endfor_ifa(in_dev);
-no_in_dev:
-        rcu_read_unlock();
 
         if (addr)
-                goto out;
+                goto out_unlock;
+no_in_dev:
 
         /* Not loopback addresses on loopback should be preferred
            in this case. It is importnat that lo is the first interface
            in dev_base list.
          */
-        read_lock(&dev_base_lock);
-        rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (!in_dev)
                         continue;
 
                 for_primary_ifa(in_dev) {
                         if (ifa->ifa_scope != RT_SCOPE_LINK &&
                             ifa->ifa_scope <= scope) {
                                 addr = ifa->ifa_local;
-                                goto out_unlock_both;
+                                goto out_unlock;
                         }
                 } endfor_ifa(in_dev);
         }
-out_unlock_both:
-        read_unlock(&dev_base_lock);
+out_unlock:
         rcu_read_unlock();
-out:
         return addr;
 }
+EXPORT_SYMBOL(inet_select_addr);
 
 static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                               __be32 local, int scope)
@@ -940,7 +944,7 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                 }
         } endfor_ifa(in_dev);
 
-        return same? addr : 0;
+        return same ? addr : 0;
 }
 
 /*
@@ -961,17 +965,16 @@ __be32 inet_confirm_addr(struct in_device *in_dev,
                 return confirm_addr_indev(in_dev, dst, local, scope);
 
         net = dev_net(in_dev->dev);
-        read_lock(&dev_base_lock);
         rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev))) {
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (in_dev) {
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                         if (addr)
                                 break;
                 }
         }
         rcu_read_unlock();
-        read_unlock(&dev_base_lock);
 
         return addr;
 }
@@ -984,14 +987,16 @@ int register_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_register(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(register_inetaddr_notifier);
 
 int unregister_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_unregister(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(unregister_inetaddr_notifier);
 
-/* Rename ifa_labels for a device name change. Make some effort to preserve existing
- * alias numbering and to create unique labels if possible.
+/* Rename ifa_labels for a device name change. Make some effort to preserve
+ * existing alias numbering and to create unique labels if possible.
 */
 static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
 {
@@ -1010,11 +1015,10 @@ static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
                         sprintf(old, ":%d", named);
                         dot = old;
                 }
-                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ) {
+                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
                         strcat(ifa->ifa_label, dot);
-                } else {
+                else
                         strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
-                }
 skip:
                 rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
         }
@@ -1061,8 +1065,9 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 if (!inetdev_valid_mtu(dev->mtu))
                         break;
                 if (dev->flags & IFF_LOOPBACK) {
-                        struct in_ifaddr *ifa;
-                        if ((ifa = inet_alloc_ifa()) != NULL) {
+                        struct in_ifaddr *ifa = inet_alloc_ifa();
+
+                        if (ifa) {
                                 ifa->ifa_local =
                                   ifa->ifa_address = htonl(INADDR_LOOPBACK);
                                 ifa->ifa_prefixlen = 8;
@@ -1170,38 +1175,54 @@ nla_put_failure:
 static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        int idx, ip_idx;
+        int h, s_h;
+        int idx, s_idx;
+        int ip_idx, s_ip_idx;
         struct net_device *dev;
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
-        int s_ip_idx, s_idx = cb->args[0];
+        struct hlist_head *head;
+        struct hlist_node *node;
 
-        s_ip_idx = ip_idx = cb->args[1];
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if (idx > s_idx)
-                        s_ip_idx = 0;
-                if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
-                        goto cont;
-
-                for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
-                     ifa = ifa->ifa_next, ip_idx++) {
-                        if (ip_idx < s_ip_idx)
-                                continue;
-                        if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
+        s_h = cb->args[0];
+        s_idx = idx = cb->args[1];
+        s_ip_idx = ip_idx = cb->args[2];
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (h > s_h || idx > s_idx)
+                                s_ip_idx = 0;
+                        in_dev = __in_dev_get_rcu(dev);
+                        if (!in_dev)
+                                goto cont;
+
+                        for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
+                             ifa = ifa->ifa_next, ip_idx++) {
+                                if (ip_idx < s_ip_idx)
+                                        continue;
+                                if (inet_fill_ifaddr(skb, ifa,
+                                             NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq,
-                                             RTM_NEWADDR, NLM_F_MULTI) <= 0)
-                                goto done;
-                }
+                                             RTM_NEWADDR, NLM_F_MULTI) <= 0) {
+                                        rcu_read_unlock();
+                                        goto done;
+                                }
+                        }
 cont:
-                idx++;
+                        idx++;
+                }
+                rcu_read_unlock();
         }
 
 done:
-        cb->args[0] = idx;
-        cb->args[1] = ip_idx;
+        cb->args[0] = h;
+        cb->args[1] = idx;
+        cb->args[2] = ip_idx;
 
         return skb->len;
 }
@@ -1239,18 +1260,18 @@ static void devinet_copy_dflt_conf(struct net *net, int i)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 struct in_device *in_dev;
-                rcu_read_lock();
+
                 in_dev = __in_dev_get_rcu(dev);
                 if (in_dev && !test_bit(i, in_dev->cnf.state))
                         in_dev->cnf.data[i] = net->ipv4.devconf_dflt->data[i];
-                rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
+/* called with RTNL locked */
 static void inet_forward_change(struct net *net)
 {
         struct net_device *dev;
@@ -1259,7 +1280,6 @@ static void inet_forward_change(struct net *net)
         IPV4_DEVCONF_ALL(net, ACCEPT_REDIRECTS) = !on;
         IPV4_DEVCONF_DFLT(net, FORWARDING) = on;
 
-        read_lock(&dev_base_lock);
         for_each_netdev(net, dev) {
                 struct in_device *in_dev;
                 if (on)
@@ -1270,7 +1290,6 @@ static void inet_forward_change(struct net *net)
                         IN_DEV_CONF_SET(in_dev, FORWARDING, on);
                 rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
 }
 
 static int devinet_conf_proc(ctl_table *ctl, int write,
@@ -1293,72 +1312,25 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
         return ret;
 }
 
-static int devinet_conf_sysctl(ctl_table *table,
-                               void __user *oldval, size_t __user *oldlenp,
-                               void __user *newval, size_t newlen)
-{
-        struct ipv4_devconf *cnf;
-        struct net *net;
-        int *valp = table->data;
-        int new;
-        int i;
-
-        if (!newval || !newlen)
-                return 0;
-
-        if (newlen != sizeof(int))
-                return -EINVAL;
-
-        if (get_user(new, (int __user *)newval))
-                return -EFAULT;
-
-        if (new == *valp)
-                return 0;
-
-        if (oldval && oldlenp) {
-                size_t len;
-
-                if (get_user(len, oldlenp))
-                        return -EFAULT;
-
-                if (len) {
-                        if (len > table->maxlen)
-                                len = table->maxlen;
-                        if (copy_to_user(oldval, valp, len))
-                                return -EFAULT;
-                        if (put_user(len, oldlenp))
-                                return -EFAULT;
-                }
-        }
-
-        *valp = new;
-
-        cnf = table->extra1;
-        net = table->extra2;
-        i = (int *)table->data - cnf->data;
-
-        set_bit(i, cnf->state);
-
-        if (cnf == net->ipv4.devconf_dflt)
-                devinet_copy_dflt_conf(net, i);
-
-        return 1;
-}
-
 static int devinet_sysctl_forward(ctl_table *ctl, int write,
                                   void __user *buffer,
                                   size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
+        loff_t pos = *ppos;
         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write && *valp != val) {
                 struct net *net = ctl->extra2;
 
                 if (valp != &IPV4_DEVCONF_DFLT(net, FORWARDING)) {
-                        if (!rtnl_trylock())
+                        if (!rtnl_trylock()) {
+                                /* Restore the original values before restarting */
+                                *valp = val;
+                                *ppos = pos;
                                 return restart_syscall();
+                        }
                         if (valp == &IPV4_DEVCONF_ALL(net, FORWARDING)) {
                                 inet_forward_change(net);
                         } else if (*valp) {
@@ -1390,57 +1362,37 @@ int ipv4_doint_and_flush(ctl_table *ctl, int write,
         return ret;
 }
 
-int ipv4_doint_and_flush_strategy(ctl_table *table,
-                                  void __user *oldval, size_t __user *oldlenp,
-                                  void __user *newval, size_t newlen)
-{
-        int ret = devinet_conf_sysctl(table, oldval, oldlenp, newval, newlen);
-        struct net *net = table->extra2;
-
-        if (ret == 1)
-                rt_cache_flush(net, 0);
-
-        return ret;
-}
-
-
-#define DEVINET_SYSCTL_ENTRY(attr, name, mval, proc, sysctl) \
+#define DEVINET_SYSCTL_ENTRY(attr, name, mval, proc) \
         { \
-                .ctl_name       = NET_IPV4_CONF_ ## attr, \
                 .procname       = name, \
                 .data           = ipv4_devconf.data + \
-                                  NET_IPV4_CONF_ ## attr - 1, \
+                                  IPV4_DEVCONF_ ## attr - 1, \
                 .maxlen         = sizeof(int), \
                 .mode           = mval, \
                 .proc_handler   = proc, \
-                .strategy       = sysctl, \
                 .extra1         = &ipv4_devconf, \
         }
 
 #define DEVINET_SYSCTL_RW_ENTRY(attr, name) \
-        DEVINET_SYSCTL_ENTRY(attr, name, 0644, devinet_conf_proc, \
-                             devinet_conf_sysctl)
+        DEVINET_SYSCTL_ENTRY(attr, name, 0644, devinet_conf_proc)
 
 #define DEVINET_SYSCTL_RO_ENTRY(attr, name) \
-        DEVINET_SYSCTL_ENTRY(attr, name, 0444, devinet_conf_proc, \
-                             devinet_conf_sysctl)
+        DEVINET_SYSCTL_ENTRY(attr, name, 0444, devinet_conf_proc)
 
-#define DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, proc, sysctl) \
-        DEVINET_SYSCTL_ENTRY(attr, name, 0644, proc, sysctl)
+#define DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, proc) \
+        DEVINET_SYSCTL_ENTRY(attr, name, 0644, proc)
 
 #define DEVINET_SYSCTL_FLUSHING_ENTRY(attr, name) \
-        DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, ipv4_doint_and_flush, \
-                                     ipv4_doint_and_flush_strategy)
+        DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, ipv4_doint_and_flush)
 
 static struct devinet_sysctl_table {
         struct ctl_table_header *sysctl_header;
-        struct ctl_table devinet_vars[__NET_IPV4_CONF_MAX];
+        struct ctl_table devinet_vars[__IPV4_DEVCONF_MAX];
         char *dev_name;
 } devinet_sysctl = {
         .devinet_vars = {
                 DEVINET_SYSCTL_COMPLEX_ENTRY(FORWARDING, "forwarding",
-                                             devinet_sysctl_forward,
-                                             devinet_conf_sysctl),
+                                             devinet_sysctl_forward),
                 DEVINET_SYSCTL_RO_ENTRY(MC_FORWARDING, "mc_forwarding"),
 
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_REDIRECTS, "accept_redirects"),
@@ -1450,6 +1402,8 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(SEND_REDIRECTS, "send_redirects"),
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
                                         "accept_source_route"),
+                DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),
+                DEVINET_SYSCTL_RW_ENTRY(SRC_VMARK, "src_valid_mark"),
                 DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
                 DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
                 DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
@@ -1460,6 +1414,7 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(ARP_IGNORE, "arp_ignore"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_ACCEPT, "arp_accept"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_NOTIFY, "arp_notify"),
+                DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP_PVLAN, "proxy_arp_pvlan"),
 
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"),
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"),
@@ -1471,7 +1426,7 @@ static struct devinet_sysctl_table {
 };
 
 static int __devinet_sysctl_register(struct net *net, char *dev_name,
-                int ctl_name, struct ipv4_devconf *p)
+                                        struct ipv4_devconf *p)
 {
         int i;
         struct devinet_sysctl_table *t;
@@ -1479,9 +1434,9 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
 #define DEVINET_CTL_PATH_DEV    3
 
         struct ctl_path devinet_ctl_path[] = {
-                { .procname = "net", .ctl_name = CTL_NET, },
-                { .procname = "ipv4", .ctl_name = NET_IPV4, },
-                { .procname = "conf", .ctl_name = NET_IPV4_CONF, },
+                { .procname = "net",  },
+                { .procname = "ipv4", },
+                { .procname = "conf", },
                 { /* to be set */ },
                 { },
         };
@@ -1506,7 +1461,6 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
                 goto free;
 
         devinet_ctl_path[DEVINET_CTL_PATH_DEV].procname = t->dev_name;
-        devinet_ctl_path[DEVINET_CTL_PATH_DEV].ctl_name = ctl_name;
 
         t->sysctl_header = register_net_sysctl_table(net, devinet_ctl_path,
                         t->devinet_vars);
@@ -1539,10 +1493,9 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
 
 static void devinet_sysctl_register(struct in_device *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->arp_parms, NET_IPV4,
-                        NET_IPV4_NEIGH, "ipv4", NULL, NULL);
+        neigh_sysctl_register(idev->dev, idev->arp_parms, "ipv4", NULL);
         __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
-                        idev->dev->ifindex, &idev->cnf);
+                                        &idev->cnf);
 }
 
 static void devinet_sysctl_unregister(struct in_device *idev)
@@ -1553,14 +1506,12 @@ static void devinet_sysctl_unregister(struct in_device *idev)
 
 static struct ctl_table ctl_forward_entry[] = {
         {
-                .ctl_name       = NET_IPV4_FORWARD,
                 .procname       = "ip_forward",
                 .data           = &ipv4_devconf.data[
-                                        NET_IPV4_CONF_FORWARDING - 1],
+                                        IPV4_DEVCONF_FORWARDING - 1],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = devinet_sysctl_forward,
-                .strategy       = devinet_conf_sysctl,
                 .extra1         = &ipv4_devconf,
                 .extra2         = &init_net,
         },
@@ -1568,8 +1519,8 @@ static struct ctl_table ctl_forward_entry[] = {
 };
 
 static __net_initdata struct ctl_path net_ipv4_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
         { },
 };
 #endif
@@ -1587,7 +1538,7 @@ static __net_init int devinet_init_net(struct net *net)
         all = &ipv4_devconf;
         dflt = &ipv4_devconf_dflt;
 
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 all = kmemdup(all, sizeof(ipv4_devconf), GFP_KERNEL);
                 if (all == NULL)
                         goto err_alloc_all;
@@ -1601,20 +1552,18 @@ static __net_init int devinet_init_net(struct net *net)
                 if (tbl == NULL)
                         goto err_alloc_ctl;
 
-                tbl[0].data = &all->data[NET_IPV4_CONF_FORWARDING - 1];
+                tbl[0].data = &all->data[IPV4_DEVCONF_FORWARDING - 1];
                 tbl[0].extra1 = all;
                 tbl[0].extra2 = net;
 #endif
         }
 
 #ifdef CONFIG_SYSCTL
-        err = __devinet_sysctl_register(net, "all",
-                        NET_PROTO_CONF_ALL, all);
+        err = __devinet_sysctl_register(net, "all", all);
         if (err < 0)
                 goto err_reg_all;
 
-        err = __devinet_sysctl_register(net, "default",
-                        NET_PROTO_CONF_DEFAULT, dflt);
+        err = __devinet_sysctl_register(net, "default", dflt);
         if (err < 0)
                 goto err_reg_dflt;
 
@@ -1680,8 +1629,3 @@ void __init devinet_init(void)
         rtnl_register(PF_INET, RTM_GETADDR, NULL, inet_dump_ifaddr);
 }
 
-EXPORT_SYMBOL(in_dev_finish_destroy);
-EXPORT_SYMBOL(inet_select_addr);
-EXPORT_SYMBOL(inetdev_by_index);
-EXPORT_SYMBOL(register_inetaddr_notifier);
-EXPORT_SYMBOL(unregister_inetaddr_notifier);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 12f7287e902d..14ca1f1c3fb0 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -422,7 +422,7 @@ static void esp4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
         if (!x)
                 return;
         NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
@@ -530,7 +530,7 @@ static int esp_init_authenc(struct xfrm_state *x)
                 }
 
                 err = crypto_aead_setauthsize(
-                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                        aead, x->aalg->alg_trunc_len / 8);
                 if (err)
                         goto free_key;
         }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index aa00398be80e..4f0ed458c883 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -125,7 +126,7 @@ void fib_select_default(struct net *net,
 #endif
         tb = fib_get_table(net, table);
         if (FIB_RES_GW(*res) && FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
-                tb->tb_select_default(tb, flp, res);
+                fib_table_select_default(tb, flp, res);
 }
 
 static void fib_flush(struct net *net)
@@ -139,7 +140,7 @@ static void fib_flush(struct net *net)
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 head = &net->ipv4.fib_table_hash[h];
                 hlist_for_each_entry(tb, node, head, tb_hlist)
-                        flushed += tb->tb_flush(tb);
+                        flushed += fib_table_flush(tb);
         }
 
         if (flushed)
@@ -162,7 +163,7 @@ struct net_device * ip_dev_find(struct net *net, __be32 addr)
 #endif
 
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!local_table || local_table->tb_lookup(local_table, &fl, &res))
+        if (!local_table || fib_table_lookup(local_table, &fl, &res))
                 return NULL;
         if (res.type != RTN_LOCAL)
                 goto out;
@@ -200,7 +201,7 @@ static inline unsigned __inet_dev_addr_type(struct net *net,
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
         if (local_table) {
                 ret = RTN_UNICAST;
-                if (!local_table->tb_lookup(local_table, &fl, &res)) {
+                if (!fib_table_lookup(local_table, &fl, &res)) {
                         if (!dev || dev == res.fi->fib_dev)
                                 ret = res.type;
                         fib_res_put(&res);
@@ -241,16 +242,19 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
                             .iif = oif };
 
         struct fib_result res;
-        int no_addr, rpf;
+        int no_addr, rpf, accept_local;
         int ret;
         struct net *net;
 
-        no_addr = rpf = 0;
+        no_addr = rpf = accept_local = 0;
         rcu_read_lock();
         in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 no_addr = in_dev->ifa_list == NULL;
                 rpf = IN_DEV_RPFILTER(in_dev);
+                accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
+                if (mark && !IN_DEV_SRC_VMARK(in_dev))
+                        fl.mark = 0;
         }
         rcu_read_unlock();
 
@@ -260,8 +264,10 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
         net = dev_net(dev);
         if (fib_lookup(net, &fl, &res))
                 goto last_resort;
-        if (res.type != RTN_UNICAST)
-                goto e_inval_res;
+        if (res.type != RTN_UNICAST) {
+                if (res.type != RTN_LOCAL || !accept_local)
+                        goto e_inval_res;
+        }
         *spec_dst = FIB_RES_PREFSRC(res);
         fib_combine_itag(itag, &res);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
@@ -476,13 +482,13 @@ int ip_rt_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                         if (cmd == SIOCDELRT) {
                                 tb = fib_get_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_delete(tb, &cfg);
+                                        err = fib_table_delete(tb, &cfg);
                                 else
                                         err = -ESRCH;
                         } else {
                                 tb = fib_new_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_insert(tb, &cfg);
+                                        err = fib_table_insert(tb, &cfg);
                                 else
                                         err = -ENOBUFS;
                         }
@@ -597,7 +603,7 @@ static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_delete(tb, &cfg);
+        err = fib_table_delete(tb, &cfg);
 errout:
         return err;
 }
@@ -619,7 +625,7 @@ static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_insert(tb, &cfg);
+        err = fib_table_insert(tb, &cfg);
 errout:
         return err;
 }
@@ -650,7 +656,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                         if (dumped)
                                 memset(&cb->args[2], 0, sizeof(cb->args) -
                                                  2 * sizeof(cb->args[0]));
-                        if (tb->tb_dump(tb, skb, cb) < 0)
+                        if (fib_table_dump(tb, skb, cb) < 0)
                                 goto out;
                         dumped = 1;
 next:
@@ -704,9 +710,9 @@ static void fib_magic(int cmd, int type, __be32 dst, int dst_len, struct in_ifad
                 cfg.fc_scope = RT_SCOPE_HOST;
 
         if (cmd == RTM_NEWROUTE)
-                tb->tb_insert(tb, &cfg);
+                fib_table_insert(tb, &cfg);
         else
-                tb->tb_delete(tb, &cfg);
+                fib_table_delete(tb, &cfg);
 }
 
 void fib_add_ifaddr(struct in_ifaddr *ifa)
@@ -835,7 +841,7 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
                 local_bh_disable();
 
                 frn->tb_id = tb->tb_id;
-                frn->err = tb->tb_lookup(tb, &fl, &res);
+                frn->err = fib_table_lookup(tb, &fl, &res);
 
                 if (!frn->err) {
                         frn->prefixlen = res.prefixlen;
@@ -878,7 +884,7 @@ static void nl_fib_input(struct sk_buff *skb)
         netlink_unicast(net->ipv4.fibnl, skb, pid, MSG_DONTWAIT);
 }
 
-static int nl_fib_lookup_init(struct net *net)
+static int __net_init nl_fib_lookup_init(struct net *net)
 {
         struct sock *sk;
         sk = netlink_kernel_create(net, NETLINK_FIB_LOOKUP, 0,
@@ -895,11 +901,11 @@ static void nl_fib_lookup_exit(struct net *net)
         net->ipv4.fibnl = NULL;
 }
 
-static void fib_disable_ip(struct net_device *dev, int force)
+static void fib_disable_ip(struct net_device *dev, int force, int delay)
 {
         if (fib_sync_down_dev(dev, force))
                 fib_flush(dev_net(dev));
-        rt_cache_flush(dev_net(dev), 0);
+        rt_cache_flush(dev_net(dev), delay);
         arp_ifdown(dev);
 }
 
@@ -922,7 +928,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
                         /* Last address was deleted from this interface.
                            Disable IP.
                          */
-                        fib_disable_ip(dev, 1);
+                        fib_disable_ip(dev, 1, 0);
                 } else {
                         rt_cache_flush(dev_net(dev), -1);
                 }
@@ -937,7 +943,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
         struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         if (event == NETDEV_UNREGISTER) {
-                fib_disable_ip(dev, 2);
+                fib_disable_ip(dev, 2, -1);
                 return NOTIFY_DONE;
         }
 
@@ -955,12 +961,15 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
                 rt_cache_flush(dev_net(dev), -1);
                 break;
         case NETDEV_DOWN:
-                fib_disable_ip(dev, 0);
+                fib_disable_ip(dev, 0, 0);
                 break;
         case NETDEV_CHANGEMTU:
         case NETDEV_CHANGE:
                 rt_cache_flush(dev_net(dev), 0);
                 break;
+        case NETDEV_UNREGISTER_BATCH:
+                rt_cache_flush_batch();
+                break;
         }
         return NOTIFY_DONE;
 }
@@ -996,7 +1005,7 @@ fail:
         return err;
 }
 
-static void __net_exit ip_fib_net_exit(struct net *net)
+static void ip_fib_net_exit(struct net *net)
 {
         unsigned int i;
 
@@ -1012,7 +1021,7 @@ static void __net_exit ip_fib_net_exit(struct net *net)
                 head = &net->ipv4.fib_table_hash[i];
                 hlist_for_each_entry_safe(tb, node, tmp, head, tb_hlist) {
                         hlist_del(node);
-                        tb->tb_flush(tb);
+                        fib_table_flush(tb);
                         kfree(tb);
                 }
         }
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index ecd39454235c..4ed7e0dea1bc 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -32,6 +32,7 @@
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/ip.h>
@@ -242,8 +243,8 @@ fn_new_zone(struct fn_hash *table, int z)
         return fz;
 }
 
-static int
-fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb,
+                     const struct flowi *flp, struct fib_result *res)
 {
         int err;
         struct fn_zone *fz;
@@ -274,8 +275,8 @@ out:
         return err;
 }
 
-static void
-fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp, struct fib_result *res)
 {
         int order, last_idx;
         struct hlist_node *node;
@@ -366,7 +367,7 @@ static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
         return NULL;
 }
 
-static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fib_node *new_f = NULL;
@@ -544,8 +545,7 @@ out:
         return err;
 }
 
-
-static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *)tb->tb_data;
         struct fib_node *f;
@@ -662,7 +662,7 @@ static int fn_flush_list(struct fn_zone *fz, int idx)
         return found;
 }
 
-static int fn_hash_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fn_zone *fz;
@@ -743,7 +743,8 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
         return skb->len;
 }
 
-static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         int m, s_m;
         struct fn_zone *fz;
@@ -787,12 +788,7 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_hash_lookup;
-        tb->tb_insert = fn_hash_insert;
-        tb->tb_delete = fn_hash_delete;
-        tb->tb_flush = fn_hash_flush;
-        tb->tb_select_default = fn_hash_select_default;
-        tb->tb_dump = fn_hash_dump;
+
         memset(tb->tb_data, 0, sizeof(struct fn_hash));
         return tb;
 }
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 92d9d97ec5e3..ca2d07b1c706 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -94,7 +94,7 @@ static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
         if ((tbl = fib_get_table(rule->fr_net, rule->table)) == NULL)
                 goto errout;
 
-        err = tbl->tb_lookup(tbl, flp, (struct fib_result *) arg->result);
+        err = fib_table_lookup(tbl, flp, (struct fib_result *) arg->result);
         if (err > 0)
                 err = -EAGAIN;
 errout:
@@ -284,7 +284,7 @@ static int fib_default_rules_init(struct fib_rules_ops *ops)
 {
         int err;
 
-        err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, FIB_RULE_PERMANENT);
+        err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0);
         if (err < 0)
                 return err;
         err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0);
@@ -301,13 +301,9 @@ int __net_init fib4_rules_init(struct net *net)
         int err;
         struct fib_rules_ops *ops;
 
-        ops = kmemdup(&fib4_rules_ops_template, sizeof(*ops), GFP_KERNEL);
-        if (ops == NULL)
-                return -ENOMEM;
-        INIT_LIST_HEAD(&ops->rules_list);
-        ops->fro_net = net;
-
-        fib_rules_register(ops);
+        ops = fib_rules_register(&fib4_rules_ops_template, net);
+        if (IS_ERR(ops))
+                return PTR_ERR(ops);
 
         err = fib_default_rules_init(ops);
         if (err < 0)
@@ -318,12 +314,10 @@ int __net_init fib4_rules_init(struct net *net)
 fail:
         /* also cleans all rules already added */
         fib_rules_unregister(ops);
-        kfree(ops);
         return err;
 }
 
 void __net_exit fib4_rules_exit(struct net *net)
 {
         fib_rules_unregister(net->ipv4.rules_ops);
-        kfree(net->ipv4.rules_ops);
 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 9b096d6ff3f2..20f09c5b31e8 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -32,6 +32,7 @@
 #include <linux/proc_fs.h>
 #include <linux/skbuff.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 
 #include <net/arp.h>
 #include <net/ip.h>
@@ -62,8 +63,8 @@ static DEFINE_SPINLOCK(fib_multipath_lock);
 #define for_nexthops(fi) { int nhsel; const struct fib_nh * nh; \
 for (nhsel=0, nh = (fi)->fib_nh; nhsel < (fi)->fib_nhs; nh++, nhsel++)
 
-#define change_nexthops(fi) { int nhsel; struct fib_nh * nh; \
-for (nhsel=0, nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++, nhsel++)
+#define change_nexthops(fi) { int nhsel; struct fib_nh *nexthop_nh; \
+for (nhsel=0, nexthop_nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nexthop_nh++, nhsel++)
 
 #else /* CONFIG_IP_ROUTE_MULTIPATH */
 
@@ -72,7 +73,7 @@ for (nhsel=0, nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++,
 #define for_nexthops(fi) { int nhsel = 0; const struct fib_nh * nh = (fi)->fib_nh; \
 for (nhsel=0; nhsel < 1; nhsel++)
 
-#define change_nexthops(fi) { int nhsel = 0; struct fib_nh * nh = (struct fib_nh *)((fi)->fib_nh); \
+#define change_nexthops(fi) { int nhsel = 0; struct fib_nh *nexthop_nh = (struct fib_nh *)((fi)->fib_nh); \
 for (nhsel=0; nhsel < 1; nhsel++)
 
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
@@ -145,9 +146,9 @@ void free_fib_info(struct fib_info *fi)
                 return;
         }
         change_nexthops(fi) {
-                if (nh->nh_dev)
-                        dev_put(nh->nh_dev);
-                nh->nh_dev = NULL;
+                if (nexthop_nh->nh_dev)
+                        dev_put(nexthop_nh->nh_dev);
+                nexthop_nh->nh_dev = NULL;
         } endfor_nexthops(fi);
         fib_info_cnt--;
         release_net(fi->fib_net);
@@ -162,9 +163,9 @@ void fib_release_info(struct fib_info *fi)
                 if (fi->fib_prefsrc)
                         hlist_del(&fi->fib_lhash);
                 change_nexthops(fi) {
-                        if (!nh->nh_dev)
+                        if (!nexthop_nh->nh_dev)
                                 continue;
-                        hlist_del(&nh->nh_hash);
+                        hlist_del(&nexthop_nh->nh_hash);
                 } endfor_nexthops(fi)
                 fi->fib_dead = 1;
                 fib_info_put(fi);
@@ -228,7 +229,7 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
         head = &fib_info_hash[hash];
 
         hlist_for_each_entry(fi, node, head, fib_hash) {
-                if (fi->fib_net != nfi->fib_net)
+                if (!net_eq(fi->fib_net, nfi->fib_net))
                         continue;
                 if (fi->fib_nhs != nfi->fib_nhs)
                         continue;
@@ -395,19 +396,20 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
                 if (!rtnh_ok(rtnh, remaining))
                         return -EINVAL;
 
-                nh->nh_flags = (cfg->fc_flags & ~0xFF) | rtnh->rtnh_flags;
-                nh->nh_oif = rtnh->rtnh_ifindex;
-                nh->nh_weight = rtnh->rtnh_hops + 1;
+                nexthop_nh->nh_flags =
+                        (cfg->fc_flags & ~0xFF) | rtnh->rtnh_flags;
+                nexthop_nh->nh_oif = rtnh->rtnh_ifindex;
+                nexthop_nh->nh_weight = rtnh->rtnh_hops + 1;
 
                 attrlen = rtnh_attrlen(rtnh);
                 if (attrlen > 0) {
                         struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
 
                         nla = nla_find(attrs, attrlen, RTA_GATEWAY);
-                        nh->nh_gw = nla ? nla_get_be32(nla) : 0;
+                        nexthop_nh->nh_gw = nla ? nla_get_be32(nla) : 0;
 #ifdef CONFIG_NET_CLS_ROUTE
                         nla = nla_find(attrs, attrlen, RTA_FLOW);
-                        nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
+                        nexthop_nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
 #endif
                 }
 
@@ -527,10 +529,6 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
         if (nh->nh_gw) {
                 struct fib_result res;
 
-#ifdef CONFIG_IP_ROUTE_PERVASIVE
-                if (nh->nh_flags&RTNH_F_PERVASIVE)
-                        return 0;
-#endif
                 if (nh->nh_flags&RTNH_F_ONLINK) {
                         struct net_device *dev;
 
@@ -738,7 +736,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
 
         fi->fib_nhs = nhs;
         change_nexthops(fi) {
-                nh->nh_parent = fi;
+                nexthop_nh->nh_parent = fi;
         } endfor_nexthops(fi)
 
         if (cfg->fc_mx) {
@@ -808,7 +806,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                         goto failure;
         } else {
                 change_nexthops(fi) {
-                        if ((err = fib_check_nh(cfg, fi, nh)) != 0)
+                        if ((err = fib_check_nh(cfg, fi, nexthop_nh)) != 0)
                                 goto failure;
                 } endfor_nexthops(fi)
         }
@@ -843,11 +841,11 @@ link_it:
                 struct hlist_head *head;
                 unsigned int hash;
 
-                if (!nh->nh_dev)
+                if (!nexthop_nh->nh_dev)
                         continue;
-                hash = fib_devindex_hashfn(nh->nh_dev->ifindex);
+                hash = fib_devindex_hashfn(nexthop_nh->nh_dev->ifindex);
                 head = &fib_info_devhash[hash];
-                hlist_add_head(&nh->nh_hash, head);
+                hlist_add_head(&nexthop_nh->nh_hash, head);
         } endfor_nexthops(fi)
         spin_unlock_bh(&fib_info_lock);
         return fi;
@@ -1047,7 +1045,7 @@ int fib_sync_down_addr(struct net *net, __be32 local)
                 return 0;
 
         hlist_for_each_entry(fi, node, head, fib_lhash) {
-                if (fi->fib_net != net)
+                if (!net_eq(fi->fib_net, net))
                         continue;
                 if (fi->fib_prefsrc == local) {
                         fi->fib_flags |= RTNH_F_DEAD;
@@ -1080,21 +1078,21 @@ int fib_sync_down_dev(struct net_device *dev, int force)
                 prev_fi = fi;
                 dead = 0;
                 change_nexthops(fi) {
-                        if (nh->nh_flags&RTNH_F_DEAD)
+                        if (nexthop_nh->nh_flags&RTNH_F_DEAD)
                                 dead++;
-                        else if (nh->nh_dev == dev &&
-                                        nh->nh_scope != scope) {
-                                nh->nh_flags |= RTNH_F_DEAD;
+                        else if (nexthop_nh->nh_dev == dev &&
+                                 nexthop_nh->nh_scope != scope) {
+                                nexthop_nh->nh_flags |= RTNH_F_DEAD;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
                                 spin_lock_bh(&fib_multipath_lock);
-                                fi->fib_power -= nh->nh_power;
-                                nh->nh_power = 0;
+                                fi->fib_power -= nexthop_nh->nh_power;
+                                nexthop_nh->nh_power = 0;
                                 spin_unlock_bh(&fib_multipath_lock);
 #endif
                                 dead++;
                         }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-                        if (force > 1 && nh->nh_dev == dev) {
+                        if (force > 1 && nexthop_nh->nh_dev == dev) {
                                 dead = fi->fib_nhs;
                                 break;
                         }
@@ -1144,18 +1142,20 @@ int fib_sync_up(struct net_device *dev)
                 prev_fi = fi;
                 alive = 0;
                 change_nexthops(fi) {
-                        if (!(nh->nh_flags&RTNH_F_DEAD)) {
+                        if (!(nexthop_nh->nh_flags&RTNH_F_DEAD)) {
                                 alive++;
                                 continue;
                         }
-                        if (nh->nh_dev == NULL || !(nh->nh_dev->flags&IFF_UP))
+                        if (nexthop_nh->nh_dev == NULL ||
+                            !(nexthop_nh->nh_dev->flags&IFF_UP))
                                 continue;
-                        if (nh->nh_dev != dev || !__in_dev_get_rtnl(dev))
+                        if (nexthop_nh->nh_dev != dev ||
+                            !__in_dev_get_rtnl(dev))
                                 continue;
                         alive++;
                         spin_lock_bh(&fib_multipath_lock);
-                        nh->nh_power = 0;
-                        nh->nh_flags &= ~RTNH_F_DEAD;
+                        nexthop_nh->nh_power = 0;
+                        nexthop_nh->nh_flags &= ~RTNH_F_DEAD;
                         spin_unlock_bh(&fib_multipath_lock);
                 } endfor_nexthops(fi)
 
@@ -1182,9 +1182,9 @@ void fib_select_multipath(const struct flowi *flp, struct fib_result *res)
         if (fi->fib_power <= 0) {
                 int power = 0;
                 change_nexthops(fi) {
-                        if (!(nh->nh_flags&RTNH_F_DEAD)) {
-                                power += nh->nh_weight;
-                                nh->nh_power = nh->nh_weight;
+                        if (!(nexthop_nh->nh_flags&RTNH_F_DEAD)) {
+                                power += nexthop_nh->nh_weight;
+                                nexthop_nh->nh_power = nexthop_nh->nh_weight;
                         }
                 } endfor_nexthops(fi);
                 fi->fib_power = power;
@@ -1204,9 +1204,10 @@ void fib_select_multipath(const struct flowi *flp, struct fib_result *res)
         w = jiffies % fi->fib_power;
 
         change_nexthops(fi) {
-                if (!(nh->nh_flags&RTNH_F_DEAD) && nh->nh_power) {
-                        if ((w -= nh->nh_power) <= 0) {
-                                nh->nh_power--;
+                if (!(nexthop_nh->nh_flags&RTNH_F_DEAD) &&
+                    nexthop_nh->nh_power) {
+                        if ((w -= nexthop_nh->nh_power) <= 0) {
+                                nexthop_nh->nh_power--;
                                 fi->fib_power--;
                                 res->nh_sel = nhsel;
                                 spin_unlock_bh(&fib_multipath_lock);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 291bdf50a21f..c98f115fb0fd 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -71,6 +71,7 @@
 #include <linux/netlink.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -208,7 +209,9 @@ static inline struct node *tnode_get_child_rcu(struct tnode *tn, unsigned int i)
 {
         struct node *ret = tnode_get_child(tn, i);
 
-        return rcu_dereference(ret);
+        return rcu_dereference_check(ret,
+                                     rcu_read_lock_held() ||
+                                     lockdep_rtnl_is_held());
 }
 
 static inline int tnode_child_length(const struct tnode *tn)
@@ -961,7 +964,9 @@ fib_find_node(struct trie *t, u32 key)
         struct node *n;
 
         pos = 0;
-        n = rcu_dereference(t->trie);
+        n = rcu_dereference_check(t->trie,
+                                  rcu_read_lock_held() ||
+                                  lockdep_rtnl_is_held());
 
         while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                 tn = (struct tnode *) n;
@@ -1174,7 +1179,7 @@ done:
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct fib_alias *fa, *new_fa;
@@ -1373,8 +1378,8 @@ static int check_leaf(struct trie *t, struct leaf *l,
         return 1;
 }
 
-static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
-                          struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb, const struct flowi *flp,
+                     struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int ret;
@@ -1595,7 +1600,7 @@ static void trie_leaf_remove(struct trie *t, struct leaf *l)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         u32 key, mask;
@@ -1786,7 +1791,7 @@ static struct leaf *trie_leafindex(struct trie *t, int index)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct leaf *l, *ll = NULL;
@@ -1807,9 +1812,9 @@ static int fn_trie_flush(struct fib_table *tb)
         return found;
 }
 
-static void fn_trie_select_default(struct fib_table *tb,
-                                   const struct flowi *flp,
-                                   struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp,
+                              struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int order, last_idx;
@@ -1952,8 +1957,8 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
         return skb->len;
 }
 
-static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb,
-                        struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         struct leaf *l;
         struct trie *t = (struct trie *) tb->tb_data;
@@ -2020,12 +2025,6 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_trie_lookup;
-        tb->tb_insert = fn_trie_insert;
-        tb->tb_delete = fn_trie_delete;
-        tb->tb_flush = fn_trie_flush;
-        tb->tb_select_default = fn_trie_select_default;
-        tb->tb_dump = fn_trie_dump;
 
         t = (struct trie *) tb->tb_data;
         memset(t, 0, sizeof(*t));
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5bc13fe816d1..ac4dec132735 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -74,6 +74,7 @@
 #include <linux/netdevice.h>
 #include <linux/string.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/slab.h>
 #include <net/snmp.h>
 #include <net/ip.h>
 #include <net/route.h>
@@ -114,7 +115,7 @@ struct icmp_bxm {
 /* An array of errno for error messages from dest unreach. */
 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
 
-struct icmp_err icmp_err_convert[] = {
+const struct icmp_err icmp_err_convert[] = {
         {
                 .errno = ENETUNREACH,   /* ICMP_NET_UNREACH */
                 .fatal = 0,
@@ -501,15 +502,16 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         if (!(rt->rt_flags & RTCF_LOCAL)) {
                 struct net_device *dev = NULL;
 
+                rcu_read_lock();
                 if (rt->fl.iif &&
                         net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
-                        dev = dev_get_by_index(net, rt->fl.iif);
+                        dev = dev_get_by_index_rcu(net, rt->fl.iif);
 
-                if (dev) {
+                if (dev)
                         saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
-                        dev_put(dev);
-                } else
+                else
                         saddr = 0;
+                rcu_read_unlock();
         }
 
         tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
@@ -1165,6 +1167,10 @@ static int __net_init icmp_sk_init(struct net *net)
                 sk->sk_sndbuf =
                         (2 * ((64 * 1024) + sizeof(struct sk_buff)));
 
+                /*
+                 * Speedup sock_wfree()
+                 */
+                sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
                 inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
         }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d41e5de79a82..15d3eeda92f5 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -71,6 +71,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/types.h>
@@ -946,7 +947,6 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
-        case IGMPV3_HOST_MEMBERSHIP_REPORT:
                 /* Is it our report looped back? */
                 if (skb_rtable(skb)->fl.iif == 0)
                         break;
@@ -960,6 +960,7 @@ int igmp_rcv(struct sk_buff *skb)
                 in_dev_put(in_dev);
                 return pim_rcv_v1(skb);
 #endif
+        case IGMPV3_HOST_MEMBERSHIP_REPORT:
         case IGMP_DVMRP:
         case IGMP_TRACE:
         case IGMP_HOST_LEAVE_MESSAGE:
@@ -1799,7 +1800,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
         iml->next = inet->mc_list;
         iml->sflist = NULL;
         iml->sfmode = MCAST_EXCLUDE;
-        inet->mc_list = iml;
+        rcu_assign_pointer(inet->mc_list, iml);
         ip_mc_inc_group(in_dev, addr);
         err = 0;
 done:
@@ -1807,24 +1808,46 @@ done:
         return err;
 }
 
+static void ip_sf_socklist_reclaim(struct rcu_head *rp)
+{
+        struct ip_sf_socklist *psf;
+
+        psf = container_of(rp, struct ip_sf_socklist, rcu);
+        /* sk_omem_alloc should have been decreased by the caller*/
+        kfree(psf);
+}
+
 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
                            struct in_device *in_dev)
 {
+        struct ip_sf_socklist *psf = iml->sflist;
         int err;
 
-        if (iml->sflist == NULL) {
+        if (psf == NULL) {
                 /* any-source empty exclude case */
                 return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
                         iml->sfmode, 0, NULL, 0);
         }
         err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
-                        iml->sfmode, iml->sflist->sl_count,
-                        iml->sflist->sl_addr, 0);
-        sock_kfree_s(sk, iml->sflist, IP_SFLSIZE(iml->sflist->sl_max));
-        iml->sflist = NULL;
+                        iml->sfmode, psf->sl_count, psf->sl_addr, 0);
+        rcu_assign_pointer(iml->sflist, NULL);
+        /* decrease mem now to avoid the memleak warning */
+        atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
+        call_rcu(&psf->rcu, ip_sf_socklist_reclaim);
         return err;
 }
 
+
+static void ip_mc_socklist_reclaim(struct rcu_head *rp)
+{
+        struct ip_mc_socklist *iml;
+
+        iml = container_of(rp, struct ip_mc_socklist, rcu);
+        /* sk_omem_alloc should have been decreased by the caller*/
+        kfree(iml);
+}
+
+
 /*
  *      Ask a socket to leave a group.
  */
@@ -1854,12 +1877,14 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 
                 (void) ip_mc_leave_src(sk, iml, in_dev);
 
-                *imlp = iml->next;
+                rcu_assign_pointer(*imlp, iml->next);
 
                 if (in_dev)
                         ip_mc_dec_group(in_dev, group);
                 rtnl_unlock();
-                sock_kfree_s(sk, iml, sizeof(*iml));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
                 return 0;
         }
         if (!in_dev)
@@ -1899,8 +1924,9 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         err = -EADDRNOTAVAIL;
 
         for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
-                if (pmc->multi.imr_multiaddr.s_addr == imr.imr_multiaddr.s_addr
-                    && pmc->multi.imr_ifindex == imr.imr_ifindex)
+                if ((pmc->multi.imr_multiaddr.s_addr ==
+                     imr.imr_multiaddr.s_addr) &&
+                    (pmc->multi.imr_ifindex == imr.imr_ifindex))
                         break;
         }
         if (!pmc) {             /* must have a prior join */
@@ -1973,9 +1999,12 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 if (psl) {
                         for (i=0; i<psl->sl_count; i++)
                                 newpsl->sl_addr[i] = psl->sl_addr[i];
-                        sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
+                        /* decrease mem now to avoid the memleak warning */
+                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+                        call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
                 }
-                pmc->sflist = psl = newpsl;
+                rcu_assign_pointer(pmc->sflist, newpsl);
+                psl = newpsl;
         }
         rv = 1; /* > 0 for insert logic below if sl_count is 0 */
         for (i=0; i<psl->sl_count; i++) {
@@ -2071,11 +2100,13 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
         if (psl) {
                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                         psl->sl_count, psl->sl_addr, 0);
-                sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+                call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
         } else
                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                         0, NULL, 0);
-        pmc->sflist = newpsl;
+        rcu_assign_pointer(pmc->sflist, newpsl);
         pmc->sfmode = msf->imsf_fmode;
         err = 0;
 done:
@@ -2208,30 +2239,40 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
         struct ip_mc_socklist *pmc;
         struct ip_sf_socklist *psl;
         int i;
+        int ret;
 
+        ret = 1;
         if (!ipv4_is_multicast(loc_addr))
-                return 1;
+                goto out;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for (pmc=rcu_dereference(inet->mc_list); pmc; pmc=rcu_dereference(pmc->next)) {
                 if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
                     pmc->multi.imr_ifindex == dif)
                         break;
         }
+        ret = inet->mc_all;
         if (!pmc)
-                return inet->mc_all;
+                goto unlock;
         psl = pmc->sflist;
+        ret = (pmc->sfmode == MCAST_EXCLUDE);
         if (!psl)
-                return pmc->sfmode == MCAST_EXCLUDE;
+                goto unlock;
 
         for (i=0; i<psl->sl_count; i++) {
                 if (psl->sl_addr[i] == rmt_addr)
                         break;
         }
+        ret = 0;
         if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
-                return 0;
+                goto unlock;
         if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
-                return 0;
-        return 1;
+                goto unlock;
+        ret = 1;
+unlock:
+        rcu_read_unlock();
+out:
+        return ret;
 }
 
 /*
@@ -2250,7 +2291,7 @@ void ip_mc_drop_socket(struct sock *sk)
         rtnl_lock();
         while ((iml = inet->mc_list) != NULL) {
                 struct in_device *in_dev;
-                inet->mc_list = iml->next;
+                rcu_assign_pointer(inet->mc_list, iml->next);
 
                 in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
                 (void) ip_mc_leave_src(sk, iml, in_dev);
@@ -2258,7 +2299,9 @@ void ip_mc_drop_socket(struct sock *sk)
                         ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
                         in_dev_put(in_dev);
                 }
-                sock_kfree_s(sk, iml, sizeof(*iml));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
         }
         rtnl_unlock();
 }
@@ -2311,9 +2354,10 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
 
         state->in_dev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *in_dev;
-                in_dev = in_dev_get(state->dev);
+
+                in_dev = __in_dev_get_rcu(state->dev);
                 if (!in_dev)
                         continue;
                 read_lock(&in_dev->mc_list_lock);
@@ -2323,7 +2367,6 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
                         break;
                 }
                 read_unlock(&in_dev->mc_list_lock);
-                in_dev_put(in_dev);
         }
         return im;
 }
@@ -2333,16 +2376,15 @@ static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_li
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
         im = im->next;
         while (!im) {
-                if (likely(state->in_dev != NULL)) {
+                if (likely(state->in_dev != NULL))
                         read_unlock(&state->in_dev->mc_list_lock);
-                        in_dev_put(state->in_dev);
-                }
-                state->dev = next_net_device(state->dev);
+
+                state->dev = next_net_device_rcu(state->dev);
                 if (!state->dev) {
                         state->in_dev = NULL;
                         break;
                 }
-                state->in_dev = in_dev_get(state->dev);
+                state->in_dev = __in_dev_get_rcu(state->dev);
                 if (!state->in_dev)
                         continue;
                 read_lock(&state->in_dev->mc_list_lock);
@@ -2361,9 +2403,9 @@ static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2379,16 +2421,15 @@ static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(rcu)
 {
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
         if (likely(state->in_dev != NULL)) {
                 read_unlock(&state->in_dev->mc_list_lock);
-                in_dev_put(state->in_dev);
                 state->in_dev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mc_seq_show(struct seq_file *seq, void *v)
@@ -2462,9 +2503,9 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
 
         state->idev = NULL;
         state->im = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *idev;
-                idev = in_dev_get(state->dev);
+                idev = __in_dev_get_rcu(state->dev);
                 if (unlikely(idev == NULL))
                         continue;
                 read_lock(&idev->mc_list_lock);
@@ -2480,7 +2521,6 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                         spin_unlock_bh(&im->lock);
                 }
                 read_unlock(&idev->mc_list_lock);
-                in_dev_put(idev);
         }
         return psf;
 }
@@ -2494,16 +2534,15 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                 spin_unlock_bh(&state->im->lock);
                 state->im = state->im->next;
                 while (!state->im) {
-                        if (likely(state->idev != NULL)) {
+                        if (likely(state->idev != NULL))
                                 read_unlock(&state->idev->mc_list_lock);
-                                in_dev_put(state->idev);
-                        }
-                        state->dev = next_net_device(state->dev);
+
+                        state->dev = next_net_device_rcu(state->dev);
                         if (!state->dev) {
                                 state->idev = NULL;
                                 goto out;
                         }
-                        state->idev = in_dev_get(state->dev);
+                        state->idev = __in_dev_get_rcu(state->dev);
                         if (!state->idev)
                                 continue;
                         read_lock(&state->idev->mc_list_lock);
@@ -2528,8 +2567,9 @@ static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2545,6 +2585,7 @@ static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
+        __releases(rcu)
 {
         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
         if (likely(state->im != NULL)) {
@@ -2553,11 +2594,10 @@ static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
         }
         if (likely(state->idev != NULL)) {
                 read_unlock(&state->idev->mc_list_lock);
-                in_dev_put(state->idev);
                 state->idev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
@@ -2605,7 +2645,7 @@ static const struct file_operations igmp_mcf_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int igmp_net_init(struct net *net)
+static int __net_init igmp_net_init(struct net *net)
 {
         struct proc_dir_entry *pde;
 
@@ -2623,7 +2663,7 @@ out_igmp:
         return -ENOMEM;
 }
 
-static void igmp_net_exit(struct net *net)
+static void __net_exit igmp_net_exit(struct net *net)
 {
         proc_net_remove(net, "mcfilter");
         proc_net_remove(net, "igmp");
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 537731b3bcb3..8da6429269dd 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -112,7 +112,7 @@ again:
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
-                                if (ib_net(tb) == net && tb->port == rover) {
+                                if (net_eq(ib_net(tb), net) && tb->port == rover) {
                                         if (tb->fastreuse > 0 &&
                                             sk->sk_reuse &&
                                             sk->sk_state != TCP_LISTEN &&
@@ -158,7 +158,7 @@ have_snum:
                                 hashinfo->bhash_size)];
                 spin_lock(&head->lock);
                 inet_bind_bucket_for_each(tb, node, &head->chain)
-                        if (ib_net(tb) == net && tb->port == snum)
+                        if (net_eq(ib_net(tb), net) && tb->port == snum)
                                 goto tb_found;
         }
         tb = NULL;
@@ -358,6 +358,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
+                            .mark = sk->sk_mark,
                             .nl_u = { .ip4_u =
                                       { .daddr = ((opt && opt->srr) ?
                                                   opt->faddr :
@@ -367,7 +368,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
                             .proto = sk->sk_protocol,
                             .flags = inet_sk_flowi_flags(sk),
                             .uli_u = { .ports =
-                                       { .sport = inet_sk(sk)->sport,
+                                       { .sport = inet_sk(sk)->inet_sport,
                                          .dport = ireq->rmt_port } } };
         struct net *net = sock_net(sk);
 
@@ -528,9 +529,11 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                                 syn_ack_recalc(req, thresh, max_retries,
                                                queue->rskq_defer_accept,
                                                &expire, &resend);
+                                if (req->rsk_ops->syn_ack_timeout)
+                                        req->rsk_ops->syn_ack_timeout(parent, req);
                                 if (!expire &&
                                     (!resend ||
-                                     !req->rsk_ops->rtx_syn_ack(parent, req) ||
+                                     !req->rsk_ops->rtx_syn_ack(parent, req, NULL) ||
                                      inet_rsk(req)->acked)) {
                                         unsigned long timeo;
 
@@ -574,9 +577,9 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
                 newsk->sk_state = TCP_SYN_RECV;
                 newicsk->icsk_bind_hash = NULL;
 
-                inet_sk(newsk)->dport = inet_rsk(req)->rmt_port;
-                inet_sk(newsk)->num = ntohs(inet_rsk(req)->loc_port);
-                inet_sk(newsk)->sport = inet_rsk(req)->loc_port;
+                inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port;
+                inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port);
+                inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
                 newsk->sk_write_space = sk_stream_write_space;
 
                 newicsk->icsk_retransmits = 0;
@@ -607,8 +610,8 @@ void inet_csk_destroy_sock(struct sock *sk)
         /* It cannot be in hash table! */
         WARN_ON(!sk_unhashed(sk));
 
-        /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
+        /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */
+        WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -643,8 +646,8 @@ int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
          * after validation is complete.
          */
         sk->sk_state = TCP_LISTEN;
-        if (!sk->sk_prot->get_port(sk, inet->num)) {
-                inet->sport = htons(inet->num);
+        if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
+                inet->inet_sport = htons(inet->inet_num);
 
                 sk_dst_reset(sk);
                 sk->sk_prot->hash(sk);
@@ -720,8 +723,8 @@ void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
         const struct inet_sock *inet = inet_sk(sk);
 
         sin->sin_family         = AF_INET;
-        sin->sin_addr.s_addr    = inet->daddr;
-        sin->sin_port           = inet->dport;
+        sin->sin_addr.s_addr    = inet->inet_daddr;
+        sin->sin_port           = inet->inet_dport;
 }
 
 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a706a47f4dbb..e5fa2ddce320 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <linux/cache.h>
 #include <linux/init.h>
 #include <linux/time.h>
@@ -116,10 +117,10 @@ static int inet_csk_diag_fill(struct sock *sk,
         r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
         r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
 
-        r->id.idiag_sport = inet->sport;
-        r->id.idiag_dport = inet->dport;
-        r->id.idiag_src[0] = inet->rcv_saddr;
-        r->id.idiag_dst[0] = inet->daddr;
+        r->id.idiag_sport = inet->inet_sport;
+        r->id.idiag_dport = inet->inet_dport;
+        r->id.idiag_src[0] = inet->inet_rcv_saddr;
+        r->id.idiag_dst[0] = inet->inet_daddr;
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         if (r->idiag_family == AF_INET6) {
@@ -368,7 +369,7 @@ static int inet_diag_bc_run(const void *bc, int len,
                         yes = entry->sport >= op[1].no;
                         break;
                 case INET_DIAG_BC_S_LE:
-                        yes = entry->dport <= op[1].no;
+                        yes = entry->sport <= op[1].no;
                         break;
                 case INET_DIAG_BC_D_GE:
                         yes = entry->dport >= op[1].no;
@@ -504,11 +505,11 @@ static int inet_csk_diag_dump(struct sock *sk,
                 } else
 #endif
                 {
-                        entry.saddr = &inet->rcv_saddr;
-                        entry.daddr = &inet->daddr;
+                        entry.saddr = &inet->inet_rcv_saddr;
+                        entry.daddr = &inet->inet_daddr;
                 }
-                entry.sport = inet->num;
-                entry.dport = ntohs(inet->dport);
+                entry.sport = inet->inet_num;
+                entry.dport = ntohs(inet->inet_dport);
                 entry.userlocks = sk->sk_userlocks;
 
                 if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
@@ -584,7 +585,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
         if (tmo < 0)
                 tmo = 0;
 
-        r->id.idiag_sport = inet->sport;
+        r->id.idiag_sport = inet->inet_sport;
         r->id.idiag_dport = ireq->rmt_port;
         r->id.idiag_src[0] = ireq->loc_addr;
         r->id.idiag_dst[0] = ireq->rmt_addr;
@@ -639,7 +640,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 
         if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
                 bc = (struct rtattr *)(r + 1);
-                entry.sport = inet->num;
+                entry.sport = inet->inet_num;
                 entry.userlocks = sk->sk_userlocks;
         }
 
@@ -732,7 +733,7 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                         continue;
                                 }
 
-                                if (r->id.idiag_sport != inet->sport &&
+                                if (r->id.idiag_sport != inet->inet_sport &&
                                     r->id.idiag_sport)
                                         goto next_listen;
 
@@ -774,7 +775,7 @@ skip_listen_ht:
         if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
                 goto unlock;
 
-        for (i = s_i; i < hashinfo->ehash_size; i++) {
+        for (i = s_i; i <= hashinfo->ehash_mask; i++) {
                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
                 struct sock *sk;
@@ -797,10 +798,10 @@ skip_listen_ht:
                                 goto next_normal;
                         if (!(r->idiag_states & (1 << sk->sk_state)))
                                 goto next_normal;
-                        if (r->id.idiag_sport != inet->sport &&
+                        if (r->id.idiag_sport != inet->inet_sport &&
                             r->id.idiag_sport)
                                 goto next_normal;
-                        if (r->id.idiag_dport != inet->dport &&
+                        if (r->id.idiag_dport != inet->inet_dport &&
                             r->id.idiag_dport)
                                 goto next_normal;
                         if (inet_csk_diag_dump(sk, skb, cb) < 0) {
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index eaf3e2c8646a..a2ca6aed763b 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -19,6 +19,7 @@
 #include <linux/random.h>
 #include <linux/skbuff.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 
 #include <net/inet_frag.h>
 
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 625cc5f64c94..2b79377b468d 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -64,7 +64,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 
         atomic_inc(&hashinfo->bsockets);
 
-        inet_sk(sk)->num = snum;
+        inet_sk(sk)->inet_num = snum;
         sk_add_bind_node(sk, &tb->owners);
         tb->num_owners++;
         inet_csk(sk)->icsk_bind_hash = tb;
@@ -76,7 +76,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 static void __inet_put_port(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->inet_num,
                         hashinfo->bhash_size);
         struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -88,7 +88,7 @@ static void __inet_put_port(struct sock *sk)
         __sk_del_bind_node(sk);
         tb->num_owners--;
         inet_csk(sk)->icsk_bind_hash = NULL;
-        inet_sk(sk)->num = 0;
+        inet_sk(sk)->inet_num = 0;
         inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
         spin_unlock(&head->lock);
 }
@@ -105,7 +105,7 @@ EXPORT_SYMBOL(inet_put_port);
 void __inet_inherit_port(struct sock *sk, struct sock *child)
 {
         struct inet_hashinfo *table = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->inet_num,
                         table->bhash_size);
         struct inet_bind_hashbucket *head = &table->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -126,9 +126,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
         int score = -1;
         struct inet_sock *inet = inet_sk(sk);
 
-        if (net_eq(sock_net(sk), net) && inet->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet->inet_num == hnum &&
                         !ipv6_only_sock(sk)) {
-                __be32 rcv_saddr = inet->rcv_saddr;
+                __be32 rcv_saddr = inet->inet_rcv_saddr;
                 score = sk->sk_family == PF_INET ? 1 : 0;
                 if (rcv_saddr) {
                         if (rcv_saddr != daddr)
@@ -209,7 +209,7 @@ struct sock * __inet_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
         rcu_read_lock();
@@ -273,18 +273,20 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         struct inet_sock *inet = inet_sk(sk);
-        __be32 daddr = inet->rcv_saddr;
-        __be32 saddr = inet->daddr;
+        __be32 daddr = inet->inet_rcv_saddr;
+        __be32 saddr = inet->inet_daddr;
         int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
-        unsigned int hash = inet_ehashfn(net, daddr, lport, saddr, inet->dport);
+        unsigned int hash = inet_ehashfn(net, daddr, lport,
+                                         saddr, inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
+        int twrefcnt = 0;
 
         spin_lock(lock);
 
@@ -312,25 +314,28 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
         sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
+        if (tw) {
+                twrefcnt = inet_twsk_unhash(tw);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        }
         spin_unlock(lock);
+        if (twrefcnt)
+                inet_twsk_put(tw);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
 
         if (twp) {
                 *twp = tw;
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
         } else if (tw) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
-
         return 0;
 
 not_unique:
@@ -341,16 +346,18 @@ not_unique:
 static inline u32 inet_sk_port_offset(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
-        return secure_ipv4_port_ephemeral(inet->rcv_saddr, inet->daddr,
-                                          inet->dport);
+        return secure_ipv4_port_ephemeral(inet->inet_rcv_saddr,
+                                          inet->inet_daddr,
+                                          inet->inet_dport);
 }
 
-void __inet_hash_nolisten(struct sock *sk)
+int __inet_hash_nolisten(struct sock *sk, struct inet_timewait_sock *tw)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
         struct hlist_nulls_head *list;
         spinlock_t *lock;
         struct inet_ehash_bucket *head;
+        int twrefcnt = 0;
 
         WARN_ON(!sk_unhashed(sk));
 
@@ -361,8 +368,13 @@ void __inet_hash_nolisten(struct sock *sk)
 
         spin_lock(lock);
         __sk_nulls_add_node_rcu(sk, list);
+        if (tw) {
+                WARN_ON(sk->sk_hash != tw->tw_hash);
+                twrefcnt = inet_twsk_unhash(tw);
+        }
         spin_unlock(lock);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        return twrefcnt;
 }
 EXPORT_SYMBOL_GPL(__inet_hash_nolisten);
 
@@ -372,7 +384,7 @@ static void __inet_hash(struct sock *sk)
         struct inet_listen_hashbucket *ilb;
 
         if (sk->sk_state != TCP_LISTEN) {
-                __inet_hash_nolisten(sk);
+                __inet_hash_nolisten(sk, NULL);
                 return;
         }
 
@@ -421,14 +433,15 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 struct sock *sk, u32 port_offset,
                 int (*check_established)(struct inet_timewait_death_row *,
                         struct sock *, __u16, struct inet_timewait_sock **),
-                void (*hash)(struct sock *sk))
+                int (*hash)(struct sock *sk, struct inet_timewait_sock *twp))
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const unsigned short snum = inet_sk(sk)->num;
+        const unsigned short snum = inet_sk(sk)->inet_num;
         struct inet_bind_hashbucket *head;
         struct inet_bind_bucket *tb;
         int ret;
         struct net *net = sock_net(sk);
+        int twrefcnt = 1;
 
         if (!snum) {
                 int i, remaining, low, high, port;
@@ -452,7 +465,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          * unique enough.
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
-                                if (ib_net(tb) == net && tb->port == port) {
+                                if (net_eq(ib_net(tb), net) &&
+                                    tb->port == port) {
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
                                         WARN_ON(hlist_empty(&tb->owners));
@@ -485,14 +499,19 @@ ok:
                 /* Head lock still held and bh's disabled */
                 inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
-                        inet_sk(sk)->sport = htons(port);
-                        hash(sk);
+                        inet_sk(sk)->inet_sport = htons(port);
+                        twrefcnt += hash(sk, tw);
                 }
+                if (tw)
+                        twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
                 spin_unlock(&head->lock);
 
                 if (tw) {
                         inet_twsk_deschedule(tw, death_row);
-                        inet_twsk_put(tw);
+                        while (twrefcnt) {
+                                twrefcnt--;
+                                inet_twsk_put(tw);
+                        }
                 }
 
                 ret = 0;
@@ -503,7 +522,7 @@ ok:
         tb  = inet_csk(sk)->icsk_bind_hash;
         spin_lock_bh(&head->lock);
         if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
-                hash(sk);
+                hash(sk, NULL);
                 spin_unlock_bh(&head->lock);
                 return 0;
         } else {
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 6a667dae315e..47038cb6c138 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -64,15 +64,15 @@ static int lro_tcp_ip_check(struct iphdr *iph, struct tcphdr *tcph,
         if (iph->ihl != IPH_LEN_WO_OPTIONS)
                 return -1;
 
-        if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack
-            || tcph->rst || tcph->syn || tcph->fin)
+        if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack ||
+            tcph->rst || tcph->syn || tcph->fin)
                 return -1;
 
         if (INET_ECN_is_ce(ipv4_get_dsfield(iph)))
                 return -1;
 
-        if (tcph->doff != TCPH_LEN_WO_OPTIONS
-            && tcph->doff != TCPH_LEN_W_TIMESTAMP)
+        if (tcph->doff != TCPH_LEN_WO_OPTIONS &&
+            tcph->doff != TCPH_LEN_W_TIMESTAMP)
                 return -1;
 
         /* check tcp options (only timestamp allowed) */
@@ -262,10 +262,10 @@ static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
                               struct iphdr *iph,
                               struct tcphdr *tcph)
 {
-        if ((lro_desc->iph->saddr != iph->saddr)
-            || (lro_desc->iph->daddr != iph->daddr)
-            || (lro_desc->tcph->source != tcph->source)
-            || (lro_desc->tcph->dest != tcph->dest))
+        if ((lro_desc->iph->saddr != iph->saddr) ||
+            (lro_desc->iph->daddr != iph->daddr) ||
+            (lro_desc->tcph->source != tcph->source) ||
+            (lro_desc->tcph->dest != tcph->dest))
                 return -1;
         return 0;
 }
@@ -339,9 +339,9 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
         u64 flags;
         int vlan_hdr_len = 0;
 
-        if (!lro_mgr->get_skb_header
-            || lro_mgr->get_skb_header(skb, (void *)&iph, (void *)&tcph,
-                                       &flags, priv))
+        if (!lro_mgr->get_skb_header ||
+            lro_mgr->get_skb_header(skb, (void *)&iph, (void *)&tcph,
+                                    &flags, priv))
                 goto out;
 
         if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
@@ -351,8 +351,8 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
         if (!lro_desc)
                 goto out;
 
-        if ((skb->protocol == htons(ETH_P_8021Q))
-            && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
+        if ((skb->protocol == htons(ETH_P_8021Q)) &&
+            !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                 vlan_hdr_len = VLAN_HLEN;
 
         if (!lro_desc->active) { /* start new lro session */
@@ -446,9 +446,9 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
         int hdr_len = LRO_MAX_PG_HLEN;
         int vlan_hdr_len = 0;
 
-        if (!lro_mgr->get_frag_header
-            || lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-                                        (void *)&tcph, &flags, priv)) {
+        if (!lro_mgr->get_frag_header ||
+            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
+                                     (void *)&tcph, &flags, priv)) {
                 mac_hdr = page_address(frags->page) + frags->page_offset;
                 goto out1;
         }
@@ -472,8 +472,8 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
                 if (!skb)
                         goto out;
 
-                if ((skb->protocol == htons(ETH_P_8021Q))
-                    && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
+                if ((skb->protocol == htons(ETH_P_8021Q)) &&
+                    !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                         vlan_hdr_len = VLAN_HLEN;
 
                 iph = (void *)(skb->data + vlan_hdr_len);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 13f0781f35cd..c5af909cf701 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -10,44 +10,92 @@
 
 #include <linux/kernel.h>
 #include <linux/kmemcheck.h>
+#include <linux/slab.h>
 #include <net/inet_hashtables.h>
 #include <net/inet_timewait_sock.h>
 #include <net/ip.h>
 
+
+/**
+ *      inet_twsk_unhash - unhash a timewait socket from established hash
+ *      @tw: timewait socket
+ *
+ *      unhash a timewait socket from established hash, if hashed.
+ *      ehash lock must be held by caller.
+ *      Returns 1 if caller should call inet_twsk_put() after lock release.
+ */
+int inet_twsk_unhash(struct inet_timewait_sock *tw)
+{
+        if (hlist_nulls_unhashed(&tw->tw_node))
+                return 0;
+
+        hlist_nulls_del_rcu(&tw->tw_node);
+        sk_nulls_node_init(&tw->tw_node);
+        /*
+         * We cannot call inet_twsk_put() ourself under lock,
+         * caller must call it for us.
+         */
+        return 1;
+}
+
+/**
+ *      inet_twsk_bind_unhash - unhash a timewait socket from bind hash
+ *      @tw: timewait socket
+ *      @hashinfo: hashinfo pointer
+ *
+ *      unhash a timewait socket from bind hash, if hashed.
+ *      bind hash lock must be held by caller.
+ *      Returns 1 if caller should call inet_twsk_put() after lock release.
+ */
+int inet_twsk_bind_unhash(struct inet_timewait_sock *tw,
+                          struct inet_hashinfo *hashinfo)
+{
+        struct inet_bind_bucket *tb = tw->tw_tb;
+
+        if (!tb)
+                return 0;
+
+        __hlist_del(&tw->tw_bind_node);
+        tw->tw_tb = NULL;
+        inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
+        /*
+         * We cannot call inet_twsk_put() ourself under lock,
+         * caller must call it for us.
+         */
+        return 1;
+}
+
 /* Must be called with locally disabled BHs. */
 static void __inet_twsk_kill(struct inet_timewait_sock *tw,
                              struct inet_hashinfo *hashinfo)
 {
         struct inet_bind_hashbucket *bhead;
-        struct inet_bind_bucket *tb;
+        int refcnt;
         /* Unlink from established hashes. */
         spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
 
         spin_lock(lock);
-        if (hlist_nulls_unhashed(&tw->tw_node)) {
-                spin_unlock(lock);
-                return;
-        }
-        hlist_nulls_del_rcu(&tw->tw_node);
-        sk_nulls_node_init(&tw->tw_node);
+        refcnt = inet_twsk_unhash(tw);
         spin_unlock(lock);
 
         /* Disassociate with bind bucket. */
         bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), tw->tw_num,
                         hashinfo->bhash_size)];
+
         spin_lock(&bhead->lock);
-        tb = tw->tw_tb;
-        __hlist_del(&tw->tw_bind_node);
-        tw->tw_tb = NULL;
-        inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
+        refcnt += inet_twsk_bind_unhash(tw, hashinfo);
         spin_unlock(&bhead->lock);
+
 #ifdef SOCK_REFCNT_DEBUG
         if (atomic_read(&tw->tw_refcnt) != 1) {
                 printk(KERN_DEBUG "%s timewait_sock %p refcnt=%d\n",
                        tw->tw_prot->name, tw, atomic_read(&tw->tw_refcnt));
         }
 #endif
-        inet_twsk_put(tw);
+        while (refcnt) {
+                inet_twsk_put(tw);
+                refcnt--;
+        }
 }
 
 static noinline void inet_twsk_free(struct inet_timewait_sock *tw)
@@ -86,7 +134,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
            Note, that any socket with inet->num != 0 MUST be bound in
            binding cache, even if it is closed.
          */
-        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->num,
+        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->inet_num,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
@@ -101,16 +149,24 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
          * Should be done before removing sk from established chain
          * because readers are lockless and search established first.
          */
-        atomic_inc(&tw->tw_refcnt);
         inet_twsk_add_node_rcu(tw, &ehead->twchain);
 
         /* Step 3: Remove SK from established hash. */
         if (__sk_nulls_del_node_init_rcu(sk))
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 
+        /*
+         * Notes :
+         * - We initially set tw_refcnt to 0 in inet_twsk_alloc()
+         * - We add one reference for the bhash link
+         * - We add one reference for the ehash link
+         * - We want this refcnt update done before allowing other
+         *   threads to find this tw in ehash chain.
+         */
+        atomic_add(1 + 1 + 1, &tw->tw_refcnt);
+
         spin_unlock(lock);
 }
-
 EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
 
 struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int state)
@@ -124,14 +180,14 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 kmemcheck_annotate_bitfield(tw, flags);
 
                 /* Give us an identity. */
-                tw->tw_daddr        = inet->daddr;
-                tw->tw_rcv_saddr    = inet->rcv_saddr;
+                tw->tw_daddr        = inet->inet_daddr;
+                tw->tw_rcv_saddr    = inet->inet_rcv_saddr;
                 tw->tw_bound_dev_if = sk->sk_bound_dev_if;
-                tw->tw_num          = inet->num;
+                tw->tw_num          = inet->inet_num;
                 tw->tw_state        = TCP_TIME_WAIT;
                 tw->tw_substate     = state;
-                tw->tw_sport        = inet->sport;
-                tw->tw_dport        = inet->dport;
+                tw->tw_sport        = inet->inet_sport;
+                tw->tw_dport        = inet->inet_dport;
                 tw->tw_family       = sk->sk_family;
                 tw->tw_reuse        = sk->sk_reuse;
                 tw->tw_hash         = sk->sk_hash;
@@ -139,14 +195,18 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 tw->tw_transparent  = inet->transparent;
                 tw->tw_prot         = sk->sk_prot_creator;
                 twsk_net_set(tw, hold_net(sock_net(sk)));
-                atomic_set(&tw->tw_refcnt, 1);
+                /*
+                 * Because we use RCU lookups, we should not set tw_refcnt
+                 * to a non null value before everything is setup for this
+                 * timewait socket.
+                 */
+                atomic_set(&tw->tw_refcnt, 0);
                 inet_twsk_dead_node_init(tw);
                 __module_get(tw->tw_prot->owner);
         }
 
         return tw;
 }
-
 EXPORT_SYMBOL_GPL(inet_twsk_alloc);
 
 /* Returns non-zero if quota exceeded.  */
@@ -225,7 +285,6 @@ void inet_twdr_hangman(unsigned long data)
 out:
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_hangman);
 
 void inet_twdr_twkill_work(struct work_struct *work)
@@ -256,7 +315,6 @@ void inet_twdr_twkill_work(struct work_struct *work)
                 spin_unlock_bh(&twdr->death_lock);
         }
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_twkill_work);
 
 /* These are always called from BH context.  See callers in
@@ -276,7 +334,6 @@ void inet_twsk_deschedule(struct inet_timewait_sock *tw,
         spin_unlock(&twdr->death_lock);
         __inet_twsk_kill(tw, twdr->hashinfo);
 }
-
 EXPORT_SYMBOL(inet_twsk_deschedule);
 
 void inet_twsk_schedule(struct inet_timewait_sock *tw,
@@ -357,7 +414,6 @@ void inet_twsk_schedule(struct inet_timewait_sock *tw,
                 mod_timer(&twdr->tw_timer, jiffies + twdr->period);
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twsk_schedule);
 
 void inet_twdr_twcal_tick(unsigned long data)
@@ -418,40 +474,48 @@ out:
 #endif
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_twcal_tick);
 
-void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
+void inet_twsk_purge(struct inet_hashinfo *hashinfo,
                      struct inet_timewait_death_row *twdr, int family)
 {
         struct inet_timewait_sock *tw;
         struct sock *sk;
         struct hlist_nulls_node *node;
-        int h;
+        unsigned int slot;
 
-        local_bh_disable();
-        for (h = 0; h < (hashinfo->ehash_size); h++) {
-                struct inet_ehash_bucket *head =
-                        inet_ehash_bucket(hashinfo, h);
-                spinlock_t *lock = inet_ehash_lockp(hashinfo, h);
+        for (slot = 0; slot <= hashinfo->ehash_mask; slot++) {
+                struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
+restart_rcu:
+                rcu_read_lock();
 restart:
-                spin_lock(lock);
-                sk_nulls_for_each(sk, node, &head->twchain) {
-
+                sk_nulls_for_each_rcu(sk, node, &head->twchain) {
                         tw = inet_twsk(sk);
-                        if (!net_eq(twsk_net(tw), net) ||
-                            tw->tw_family != family)
+                        if ((tw->tw_family != family) ||
+                                atomic_read(&twsk_net(tw)->count))
                                 continue;
 
-                        atomic_inc(&tw->tw_refcnt);
-                        spin_unlock(lock);
+                        if (unlikely(!atomic_inc_not_zero(&tw->tw_refcnt)))
+                                continue;
+
+                        if (unlikely((tw->tw_family != family) ||
+                                     atomic_read(&twsk_net(tw)->count))) {
+                                inet_twsk_put(tw);
+                                goto restart;
+                        }
+
+                        rcu_read_unlock();
                         inet_twsk_deschedule(tw, twdr);
                         inet_twsk_put(tw);
-
-                        goto restart;
+                        goto restart_rcu;
                 }
-                spin_unlock(lock);
+                /* If the nulls value we got at the end of this lookup is
+                 * not the expected one, we must restart lookup.
+                 * We probably met an item that was moved to another chain.
+                 */
+                if (get_nulls_value(node) != slot)
+                        goto restart;
+                rcu_read_unlock();
         }
-        local_bh_enable();
 }
 EXPORT_SYMBOL_GPL(inet_twsk_purge);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index b1fbe18feb5a..6bcfe52a9c87 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -67,9 +67,6 @@
  *              ip_id_count: idlock
  */
 
-/* Exported for inet_getid inline function.  */
-DEFINE_SPINLOCK(inet_peer_idlock);
-
 static struct kmem_cache *peer_cachep __read_mostly;
 
 #define node_height(x) x->avl_height
@@ -390,7 +387,7 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
         n->v4daddr = daddr;
         atomic_set(&n->refcnt, 1);
         atomic_set(&n->rid, 0);
-        n->ip_id_count = secure_ip_id(daddr);
+        atomic_set(&n->ip_id_count, secure_ip_id(daddr));
         n->tcp_ts_stamp = 0;
 
         write_lock_bh(&peer_pool_lock);
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index a2991bc8e32e..af10942b326c 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -25,6 +25,7 @@
 #include <linux/ip.h>
 #include <linux/icmp.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/ip.h>
 #include <net/tcp.h>
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index d3fe10be7219..75347ea70ea0 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -32,6 +32,9 @@
 #include <linux/netdevice.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <linux/slab.h>
+#include <net/route.h>
+#include <net/dst.h>
 #include <net/sock.h>
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -205,11 +208,35 @@ static void ip_expire(unsigned long arg)
         if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) {
                 struct sk_buff *head = qp->q.fragments;
 
-                /* Send an ICMP "Fragment Reassembly Timeout" message. */
-                if ((head->dev = dev_get_by_index(net, qp->iif)) != NULL) {
-                        icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-                        dev_put(head->dev);
+                rcu_read_lock();
+                head->dev = dev_get_by_index_rcu(net, qp->iif);
+                if (!head->dev)
+                        goto out_rcu_unlock;
+
+                /*
+                 * Only search router table for the head fragment,
+                 * when defraging timeout at PRE_ROUTING HOOK.
+                 */
+                if (qp->user == IP_DEFRAG_CONNTRACK_IN && !skb_dst(head)) {
+                        const struct iphdr *iph = ip_hdr(head);
+                        int err = ip_route_input(head, iph->daddr, iph->saddr,
+                                                 iph->tos, head->dev);
+                        if (unlikely(err))
+                                goto out_rcu_unlock;
+
+                        /*
+                         * Only an end host needs to send an ICMP
+                         * "Fragment Reassembly Timeout" message, per RFC792.
+                         */
+                        if (skb_rtable(head)->rt_type != RTN_LOCAL)
+                                goto out_rcu_unlock;
+
                 }
+
+                /* Send an ICMP "Fragment Reassembly Timeout" message. */
+                icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
+out_rcu_unlock:
+                rcu_read_unlock();
         }
 out:
         spin_unlock(&qp->q.lock);
@@ -603,7 +630,6 @@ static int zero;
 
 static struct ctl_table ip4_frags_ns_ctl_table[] = {
         {
-                .ctl_name       = NET_IPV4_IPFRAG_HIGH_THRESH,
                 .procname       = "ipfrag_high_thresh",
                 .data           = &init_net.ipv4.frags.high_thresh,
                 .maxlen         = sizeof(int),
@@ -611,7 +637,6 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_IPFRAG_LOW_THRESH,
                 .procname       = "ipfrag_low_thresh",
                 .data           = &init_net.ipv4.frags.low_thresh,
                 .maxlen         = sizeof(int),
@@ -619,26 +644,22 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_IPFRAG_TIME,
                 .procname       = "ipfrag_time",
                 .data           = &init_net.ipv4.frags.timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         { }
 };
 
 static struct ctl_table ip4_frags_ctl_table[] = {
         {
-                .ctl_name       = NET_IPV4_IPFRAG_SECRET_INTERVAL,
                 .procname       = "ipfrag_secret_interval",
                 .data           = &ip4_frags.secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
                 .procname       = "ipfrag_max_dist",
@@ -651,13 +672,13 @@ static struct ctl_table ip4_frags_ctl_table[] = {
         { }
 };
 
-static int ip4_frags_ns_ctl_register(struct net *net)
+static int __net_init ip4_frags_ns_ctl_register(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
 
         table = ip4_frags_ns_ctl_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
@@ -675,13 +696,13 @@ static int ip4_frags_ns_ctl_register(struct net *net)
         return 0;
 
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 kfree(table);
 err_alloc:
         return -ENOMEM;
 }
 
-static void ip4_frags_ns_ctl_unregister(struct net *net)
+static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net)
 {
         struct ctl_table *table;
 
@@ -709,7 +730,7 @@ static inline void ip4_frags_ctl_register(void)
 }
 #endif
 
-static int ipv4_frags_init_net(struct net *net)
+static int __net_init ipv4_frags_init_net(struct net *net)
 {
         /*
          * Fragment cache limits. We will commit 256K at one time. Should we
@@ -731,7 +752,7 @@ static int ipv4_frags_init_net(struct net *net)
         return ip4_frags_ns_ctl_register(net);
 }
 
-static void ipv4_frags_exit_net(struct net *net)
+static void __net_exit ipv4_frags_exit_net(struct net *net)
 {
         ip4_frags_ns_ctl_unregister(net);
         inet_frags_exit_net(&net->ipv4.frags, &ip4_frags);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 143333852624..fe381d12ecdd 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -125,7 +126,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev);
 
 #define HASH_SIZE  16
 
-static int ipgre_net_id;
+static int ipgre_net_id __read_mostly;
 struct ipgre_net {
         struct ip_tunnel *tunnels[4][HASH_SIZE];
 
@@ -156,8 +157,13 @@ struct ipgre_net {
 #define tunnels_r       tunnels[2]
 #define tunnels_l       tunnels[1]
 #define tunnels_wc      tunnels[0]
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipgre_lock);
 
-static DEFINE_RWLOCK(ipgre_lock);
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 /* Given src, dst and key, find appropriate for input tunnel. */
 
@@ -175,7 +181,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                        ARPHRD_ETHER : ARPHRD_IPGRE;
         int score, cand_score = 4;
 
-        for (t = ign->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r_l[h0 ^ h1]) {
                 if (local != t->parms.iph.saddr ||
                     remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
@@ -200,7 +206,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_r[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r[h0 ^ h1]) {
                 if (remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
                     !(t->dev->flags & IFF_UP))
@@ -224,7 +230,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_l[h1]) {
                 if ((local != t->parms.iph.saddr &&
                      (local != t->parms.iph.daddr ||
                       !ipv4_is_multicast(local))) ||
@@ -250,7 +256,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_wc[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_wc[h1]) {
                 if (t->parms.i_key != key ||
                     !(t->dev->flags & IFF_UP))
                         continue;
@@ -276,8 +282,9 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
         if (cand != NULL)
                 return cand;
 
-        if (ign->fb_tunnel_dev->flags & IFF_UP)
-                return netdev_priv(ign->fb_tunnel_dev);
+        dev = ign->fb_tunnel_dev;
+        if (dev->flags & IFF_UP)
+                return netdev_priv(dev);
 
         return NULL;
 }
@@ -311,10 +318,10 @@ static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipgre_bucket(ign, t);
 
+        spin_lock_bh(&ipgre_lock);
         t->next = *tp;
-        write_lock_bh(&ipgre_lock);
-        *tp = t;
-        write_unlock_bh(&ipgre_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipgre_lock);
 }
 
 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
@@ -323,9 +330,9 @@ static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
 
         for (tp = ipgre_bucket(ign, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipgre_lock);
+                        spin_lock_bh(&ipgre_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipgre_lock);
+                        spin_unlock_bh(&ipgre_lock);
                         break;
                 }
         }
@@ -476,7 +483,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 break;
         }
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
                                 flags & GRE_KEY ?
                                 *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
@@ -494,7 +501,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
         return;
 }
 
@@ -573,7 +580,7 @@ static int ipgre_rcv(struct sk_buff *skb)
 
         gre_proto = *(__be16 *)(h + 2);
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         if ((tunnel = ipgre_tunnel_lookup(skb->dev,
                                           iph->saddr, iph->daddr, key,
                                           gre_proto))) {
@@ -647,13 +654,13 @@ static int ipgre_rcv(struct sk_buff *skb)
                 ipgre_ecn_decapsulate(iph, skb);
 
                 netif_rx(skb);
-                read_unlock(&ipgre_lock);
+                rcu_read_unlock();
                 return(0);
         }
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 drop:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
 drop_nolock:
         kfree_skb(skb);
         return(0);
@@ -662,7 +669,8 @@ drop_nolock:
 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *tiph;
         u8     tos;
@@ -786,7 +794,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 }
 
                 if (mtu >= IPV6_MIN_MTU && mtu < skb->len - tunnel->hlen + gre_hlen) {
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                         ip_rt_put(rt);
                         goto tx_error;
                 }
@@ -803,14 +811,16 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         tunnel->err_count = 0;
         }
 
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen;
+        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->u.dst.header_len;
 
         if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
+                if (max_headroom > dev->needed_headroom)
+                        dev->needed_headroom = max_headroom;
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -1137,12 +1147,9 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
 
         if (saddr)
                 memcpy(&iph->saddr, saddr, 4);
-
-        if (daddr) {
+        if (daddr)
                 memcpy(&iph->daddr, daddr, 4);
-                return t->hlen;
-        }
-        if (iph->daddr && !ipv4_is_multicast(iph->daddr))
+        if (iph->daddr)
                 return t->hlen;
 
         return -t->hlen;
@@ -1283,33 +1290,27 @@ static const struct net_protocol ipgre_protocol = {
         .netns_ok       =       1,
 };
 
-static void ipgre_destroy_tunnels(struct ipgre_net *ign)
+static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
 {
         int prio;
 
         for (prio = 0; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ign->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ign->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
 
-static int ipgre_init_net(struct net *net)
+static int __net_init ipgre_init_net(struct net *net)
 {
+        struct ipgre_net *ign = net_generic(net, ipgre_net_id);
         int err;
-        struct ipgre_net *ign;
-
-        err = -ENOMEM;
-        ign = kzalloc(sizeof(struct ipgre_net), GFP_KERNEL);
-        if (ign == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, ipgre_net_id, ign);
-        if (err < 0)
-                goto err_assign;
 
         ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0",
                                            ipgre_tunnel_setup);
@@ -1330,27 +1331,26 @@ static int ipgre_init_net(struct net *net)
 err_reg_dev:
         free_netdev(ign->fb_tunnel_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(ign);
-err_alloc:
         return err;
 }
 
-static void ipgre_exit_net(struct net *net)
+static void __net_exit ipgre_exit_net(struct net *net)
 {
         struct ipgre_net *ign;
+        LIST_HEAD(list);
 
         ign = net_generic(net, ipgre_net_id);
         rtnl_lock();
-        ipgre_destroy_tunnels(ign);
+        ipgre_destroy_tunnels(ign, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(ign);
 }
 
 static struct pernet_operations ipgre_net_ops = {
         .init = ipgre_init_net,
         .exit = ipgre_exit_net,
+        .id   = &ipgre_net_id,
+        .size = sizeof(struct ipgre_net),
 };
 
 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -1471,7 +1471,7 @@ static void ipgre_tap_setup(struct net_device *dev)
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
-static int ipgre_newlink(struct net_device *dev, struct nlattr *tb[],
+static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
                          struct nlattr *data[])
 {
         struct ip_tunnel *nt;
@@ -1665,15 +1665,16 @@ static int __init ipgre_init(void)
 
         printk(KERN_INFO "GRE over IPv4 tunneling driver\n");
 
-        if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) {
+        err = register_pernet_device(&ipgre_net_ops);
+        if (err < 0)
+                return err;
+
+        err = inet_add_protocol(&ipgre_protocol, IPPROTO_GRE);
+        if (err < 0) {
                 printk(KERN_INFO "ipgre init: can't add protocol\n");
-                return -EAGAIN;
+                goto add_proto_failed;
         }
 
-        err = register_pernet_gen_device(&ipgre_net_id, &ipgre_net_ops);
-        if (err < 0)
-                goto gen_device_failed;
-
         err = rtnl_link_register(&ipgre_link_ops);
         if (err < 0)
                 goto rtnl_link_failed;
@@ -1688,9 +1689,9 @@ out:
 tap_ops_failed:
         rtnl_link_unregister(&ipgre_link_ops);
 rtnl_link_failed:
-        unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
-gen_device_failed:
         inet_del_protocol(&ipgre_protocol, IPPROTO_GRE);
+add_proto_failed:
+        unregister_pernet_device(&ipgre_net_ops);
         goto out;
 }
 
@@ -1698,9 +1699,9 @@ static void __exit ipgre_fini(void)
 {
         rtnl_link_unregister(&ipgre_tap_ops);
         rtnl_link_unregister(&ipgre_link_ops);
-        unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
         if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
                 printk(KERN_INFO "ipgre close: can't remove protocol\n");
+        unregister_pernet_device(&ipgre_net_ops);
 }
 
 module_init(ipgre_init);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 6c98b43badf4..f8ab7a380d4a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -119,6 +119,7 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 
 #include <linux/net.h>
 #include <linux/socket.h>
@@ -161,10 +162,10 @@ int ip_call_ra_chain(struct sk_buff *skb)
                 /* If socket is bound to an interface, only report
                  * the packet if it came  from that interface.
                  */
-                if (sk && inet_sk(sk)->num == protocol &&
+                if (sk && inet_sk(sk)->inet_num == protocol &&
                     (!sk->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == dev->ifindex) &&
-                    sock_net(sk) == dev_net(dev)) {
+                    net_eq(sock_net(sk), dev_net(dev))) {
                         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
                                 if (ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN)) {
                                         read_unlock(&ip_ra_lock);
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 94bf105ef3c9..4c09a31fd140 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -11,6 +11,7 @@
 
 #include <linux/capability.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <asm/uaccess.h>
 #include <linux/skbuff.h>
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f9895180f481..d1bcc9f21d4f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -51,6 +51,7 @@
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/highmem.h>
+#include <linux/slab.h>
 
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -119,7 +120,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
-        netif_rx(newskb);
+        netif_rx_ni(newskb);
         return 0;
 }
 
@@ -254,7 +255,7 @@ int ip_mc_output(struct sk_buff *skb)
          */
 
         if (rt->rt_flags&RTCF_MULTICAST) {
-                if ((!sk || inet_sk(sk)->mc_loop)
+                if (sk_mc_loop(sk)
 #ifdef CONFIG_IP_MROUTE
                 /* Small optimization: do not loopback not local frames,
                    which returned after forwarding; they will be  dropped
@@ -264,9 +265,11 @@ int ip_mc_output(struct sk_buff *skb)
 
                    This check is duplicated in ip_mr_input at the moment.
                  */
-                    && ((rt->rt_flags&RTCF_LOCAL) || !(IPCB(skb)->flags&IPSKB_FORWARDED))
+                    &&
+                    ((rt->rt_flags & RTCF_LOCAL) ||
+                     !(IPCB(skb)->flags & IPSKB_FORWARDED))
 #endif
-                ) {
+                   ) {
                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
                         if (newskb)
                                 NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb,
@@ -329,7 +332,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                 __be32 daddr;
 
                 /* Use correct destination address if we have options. */
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
                 if(opt && opt->srr)
                         daddr = opt->faddr;
 
@@ -338,13 +341,13 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                                             .mark = sk->sk_mark,
                                             .nl_u = { .ip4_u =
                                                       { .daddr = daddr,
-                                                        .saddr = inet->saddr,
+                                                        .saddr = inet->inet_saddr,
                                                         .tos = RT_CONN_FLAGS(sk) } },
                                             .proto = sk->sk_protocol,
                                             .flags = inet_sk_flowi_flags(sk),
                                             .uli_u = { .ports =
-                                                       { .sport = inet->sport,
-                                                         .dport = inet->dport } } };
+                                                       { .sport = inet->inet_sport,
+                                                         .dport = inet->inet_dport } } };
 
                         /* If this fails, retransmit mechanism of transport layer will
                          * keep trying until route appears or the connection times
@@ -379,7 +382,7 @@ packet_routed:
 
         if (opt && opt->optlen) {
                 iph->ihl += opt->optlen >> 2;
-                ip_options_build(skb, opt, inet->daddr, rt, 0);
+                ip_options_build(skb, opt, inet->inet_daddr, rt, 0);
         }
 
         ip_select_ident_more(iph, &rt->u.dst, sk,
@@ -501,8 +504,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                truesizes += frag->truesize;
                         }
+                        truesizes += frag->truesize;
                 }
 
                 /* Everything is OK. Generate! */
@@ -846,7 +849,8 @@ int ip_append_data(struct sock *sk,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + length > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu-exthdrlen);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
+                               mtu-exthdrlen);
                 return -EMSGSIZE;
         }
 
@@ -1100,7 +1104,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + size > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport, mtu);
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index e982b5c1ee17..1e64dabbd232 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -23,6 +23,7 @@
 #include <linux/icmp.h>
 #include <linux/inetdevice.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -245,7 +246,7 @@ int ip_ra_control(struct sock *sk, unsigned char on,
 {
         struct ip_ra_chain *ra, *new_ra, **rap;
 
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num == IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num == IPPROTO_RAW)
                 return -EINVAL;
 
         new_ra = on ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -451,7 +452,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                              (1<<IP_TTL) | (1<<IP_HDRINCL) |
                              (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
                              (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
-                             (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT))) ||
+                             (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
+                             (1<<IP_MINTTL))) ||
             optname == IP_MULTICAST_TTL ||
             optname == IP_MULTICAST_ALL ||
             optname == IP_MULTICAST_LOOP ||
@@ -480,7 +482,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         case IP_OPTIONS:
         {
                 struct ip_options *opt = NULL;
-                if (optlen > 40 || optlen < 0)
+                if (optlen > 40)
                         goto e_inval;
                 err = ip_options_get_from_user(sock_net(sk), &opt,
                                                optval, optlen);
@@ -492,7 +494,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         if (sk->sk_family == PF_INET ||
                             (!((1 << sk->sk_state) &
                                (TCPF_LISTEN | TCPF_CLOSE)) &&
-                             inet->daddr != LOOPBACK4_IPV6)) {
+                             inet->inet_daddr != LOOPBACK4_IPV6)) {
 #endif
                                 if (inet->opt)
                                         icsk->icsk_ext_hdr_len -= inet->opt->optlen;
@@ -575,7 +577,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 inet->hdrincl = val ? 1 : 0;
                 break;
         case IP_MTU_DISCOVER:
-                if (val < 0 || val > 3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                         goto e_inval;
                 inet->pmtudisc = val;
                 break;
@@ -936,6 +938,14 @@ mc_msf_out:
                 inet->transparent = !!val;
                 break;
 
+        case IP_MINTTL:
+                if (optlen < 1)
+                        goto e_inval;
+                if (val < 0 || val > 255)
+                        goto e_inval;
+                inet->min_ttl = val;
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -1180,8 +1190,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                 if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                         struct in_pktinfo info;
 
-                        info.ipi_addr.s_addr = inet->rcv_saddr;
-                        info.ipi_spec_dst.s_addr = inet->rcv_saddr;
+                        info.ipi_addr.s_addr = inet->inet_rcv_saddr;
+                        info.ipi_spec_dst.s_addr = inet->inet_rcv_saddr;
                         info.ipi_ifindex = inet->mc_index;
                         put_cmsg(&msg, SOL_IP, IP_PKTINFO, sizeof(info), &info);
                 }
@@ -1198,6 +1208,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_TRANSPARENT:
                 val = inet->transparent;
                 break;
+        case IP_MINTTL:
+                val = inet->min_ttl;
+                break;
         default:
                 release_sock(sk);
                 return -ENOPROTOOPT;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 38fbf04150ae..629067571f02 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -25,6 +25,7 @@
 
 static void ipcomp4_err(struct sk_buff *skb, u32 info)
 {
+        struct net *net = dev_net(skb->dev);
         __be32 spi;
         struct iphdr *iph = (struct iphdr *)skb->data;
         struct ip_comp_hdr *ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
@@ -35,7 +36,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
                 return;
 
         spi = htonl(ntohs(ipch->cpi));
-        x = xfrm_state_lookup(&init_net, (xfrm_address_t *)&iph->daddr,
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
                 return;
@@ -47,9 +48,10 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
 /* We always hold one tunnel user reference to indicate a tunnel */
 static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
         struct xfrm_state *t;
 
-        t = xfrm_state_alloc(&init_net);
+        t = xfrm_state_alloc(net);
         if (t == NULL)
                 goto out;
 
@@ -61,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
         t->props.mode = x->props.mode;
         t->props.saddr.a4 = x->props.saddr.a4;
         t->props.flags = x->props.flags;
+        memcpy(&t->mark, &x->mark, sizeof(t->mark));
 
         if (xfrm_init_state(t))
                 goto error;
@@ -82,10 +85,12 @@ error:
  */
 static int ipcomp_tunnel_attach(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
         int err = 0;
         struct xfrm_state *t;
+        u32 mark = x->mark.v & x->mark.m;
 
-        t = xfrm_state_lookup(&init_net, (xfrm_address_t *)&x->id.daddr.a4,
+        t = xfrm_state_lookup(net, mark, (xfrm_address_t *)&x->id.daddr.a4,
                               x->props.saddr.a4, IPPROTO_IPIP, AF_INET);
         if (!t) {
                 t = ipcomp_tunnel_create(x);
@@ -124,16 +129,12 @@ static int ipcomp4_init_state(struct xfrm_state *x)
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp_tunnel_attach(x);
                 if (err)
-                        goto error_tunnel;
+                        goto out;
         }
 
         err = 0;
 out:
         return err;
-
-error_tunnel:
-        ipcomp_destroy(x);
-        goto out;
 }
 
 static const struct xfrm_type ipcomp_type = {
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index f8d04c256454..067ce9e043dc 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -53,6 +53,7 @@
 #include <linux/root_dev.h>
 #include <linux/delay.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/arp.h>
 #include <net/ip.h>
@@ -187,6 +188,16 @@ struct ic_device {
 static struct ic_device *ic_first_dev __initdata = NULL;/* List of open device */
 static struct net_device *ic_dev __initdata = NULL;     /* Selected device */
 
+static bool __init ic_device_match(struct net_device *dev)
+{
+        if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
+            (!(dev->flags & IFF_LOOPBACK) &&
+             (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
+             strncmp(dev->name, "dummy", 5)))
+                return true;
+        return false;
+}
+
 static int __init ic_open_devs(void)
 {
         struct ic_device *d, **last;
@@ -207,10 +218,7 @@ static int __init ic_open_devs(void)
         for_each_netdev(&init_net, dev) {
                 if (dev->flags & IFF_LOOPBACK)
                         continue;
-                if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
-                    (!(dev->flags & IFF_LOOPBACK) &&
-                     (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
-                     strncmp(dev->name, "dummy", 5))) {
+                if (ic_device_match(dev)) {
                         int able = 0;
                         if (dev->mtu >= 364)
                                 able |= IC_BOOTP;
@@ -228,7 +236,7 @@ static int __init ic_open_devs(void)
                         }
                         if (!(d = kmalloc(sizeof(struct ic_device), GFP_KERNEL))) {
                                 rtnl_unlock();
-                                return -1;
+                                return -ENOMEM;
                         }
                         d->dev = dev;
                         *last = d;
@@ -253,7 +261,7 @@ static int __init ic_open_devs(void)
                         printk(KERN_ERR "IP-Config: Device `%s' not found.\n", user_dev_name);
                 else
                         printk(KERN_ERR "IP-Config: No network devices available.\n");
-                return -1;
+                return -ENODEV;
         }
         return 0;
 }
@@ -1172,10 +1180,9 @@ static int __init ic_dynamic(void)
                         schedule_timeout_uninterruptible(1);
 #ifdef IPCONFIG_DHCP
                 /* DHCP isn't done until we get a DHCPACK. */
-                if ((ic_got_reply & IC_BOOTP)
-                    && (ic_proto_enabled & IC_USE_DHCP)
-                    && ic_dhcp_msgtype != DHCPACK)
-                {
+                if ((ic_got_reply & IC_BOOTP) &&
+                    (ic_proto_enabled & IC_USE_DHCP) &&
+                    ic_dhcp_msgtype != DHCPACK) {
                         ic_got_reply = 0;
                         printk(",");
                         continue;
@@ -1304,6 +1311,32 @@ __be32 __init root_nfs_parse_addr(char *name)
         return addr;
 }
 
+#define DEVICE_WAIT_MAX         12 /* 12 seconds */
+
+static int __init wait_for_devices(void)
+{
+        int i;
+
+        msleep(CONF_PRE_OPEN);
+        for (i = 0; i < DEVICE_WAIT_MAX; i++) {
+                struct net_device *dev;
+                int found = 0;
+
+                rtnl_lock();
+                for_each_netdev(&init_net, dev) {
+                        if (ic_device_match(dev)) {
+                                found = 1;
+                                break;
+                        }
+                }
+                rtnl_unlock();
+                if (found)
+                        return 0;
+                ssleep(1);
+        }
+        return -ENODEV;
+}
+
 /*
  *      IP Autoconfig dispatcher.
  */
@@ -1314,6 +1347,7 @@ static int __init ip_auto_config(void)
 #ifdef IPCONFIG_DYNAMIC
         int retries = CONF_OPEN_RETRIES;
 #endif
+        int err;
 
 #ifdef CONFIG_PROC_FS
         proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
@@ -1326,12 +1360,15 @@ static int __init ip_auto_config(void)
 #ifdef IPCONFIG_DYNAMIC
  try_try_again:
 #endif
-        /* Give hardware a chance to settle */
-        msleep(CONF_PRE_OPEN);
+        /* Wait for devices to appear */
+        err = wait_for_devices();
+        if (err)
+                return err;
 
         /* Setup all network devices */
-        if (ic_open_devs() < 0)
-                return -1;
+        err = ic_open_devs();
+        if (err)
+                return err;
 
         /* Give drivers a chance to settle */
         ssleep(CONF_POST_OPEN);
@@ -1344,9 +1381,9 @@ static int __init ip_auto_config(void)
          */
         if (ic_myaddr == NONE ||
 #ifdef CONFIG_ROOT_NFS
-            (root_server_addr == NONE
-             && ic_servaddr == NONE
-             && ROOT_DEV == Root_NFS) ||
+            (root_server_addr == NONE &&
+             ic_servaddr == NONE &&
+             ROOT_DEV == Root_NFS) ||
 #endif
             ic_first_dev->next) {
 #ifdef IPCONFIG_DYNAMIC
@@ -1447,7 +1484,7 @@ late_initcall(ip_auto_config);
 
 /*
  *  Decode any IP configuration options in the "ip=" or "nfsaddrs=" kernel
- *  command line parameter.  See Documentation/filesystems/nfsroot.txt.
+ *  command line parameter.  See Documentation/filesystems/nfs/nfsroot.txt.
  */
 static int __init ic_proto_name(char *name)
 {
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index ae40ed1ba560..0b27b14dcc9d 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -95,6 +95,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -119,7 +120,7 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
-static int ipip_net_id;
+static int ipip_net_id __read_mostly;
 struct ipip_net {
         struct ip_tunnel *tunnels_r_l[HASH_SIZE];
         struct ip_tunnel *tunnels_r[HASH_SIZE];
@@ -130,11 +131,16 @@ struct ipip_net {
         struct net_device *fb_tunnel_dev;
 };
 
-static void ipip_fb_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_setup(struct net_device *dev);
 
-static DEFINE_RWLOCK(ipip_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip_lock);
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
                 __be32 remote, __be32 local)
@@ -144,20 +150,21 @@ static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ipn->tunnels_r_l[h0 ^ h1])
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_r[h0]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_r[h0])
                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_l[h1]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_l[h1])
                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
+
+        t = rcu_dereference(ipn->tunnels_wc[0]);
+        if (t && (t->dev->flags&IFF_UP))
                 return t;
         return NULL;
 }
@@ -193,9 +200,9 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 
         for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipip_lock);
+                        spin_lock_bh(&ipip_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipip_lock);
+                        spin_unlock_bh(&ipip_lock);
                         break;
                 }
         }
@@ -205,10 +212,10 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipip_bucket(ipn, t);
 
+        spin_lock_bh(&ipip_lock);
         t->next = *tp;
-        write_lock_bh(&ipip_lock);
-        *tp = t;
-        write_unlock_bh(&ipip_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipip_lock);
 }
 
 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
@@ -267,9 +274,9 @@ static void ipip_tunnel_uninit(struct net_device *dev)
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
         if (dev == ipn->fb_tunnel_dev) {
-                write_lock_bh(&ipip_lock);
+                spin_lock_bh(&ipip_lock);
                 ipn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip_lock);
+                spin_unlock_bh(&ipip_lock);
         } else
                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
         dev_put(dev);
@@ -318,7 +325,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
         if (t == NULL || t->parms.iph.daddr == 0)
                 goto out;
@@ -333,7 +340,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -351,11 +358,11 @@ static int ipip_rcv(struct sk_buff *skb)
         struct ip_tunnel *tunnel;
         const struct iphdr *iph = ip_hdr(skb);
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
                                         iph->saddr, iph->daddr)) != NULL) {
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ipip_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -374,10 +381,10 @@ static int ipip_rcv(struct sk_buff *skb)
                 nf_reset(skb);
                 ipip_ecn_decapsulate(iph, skb);
                 netif_rx(skb);
-                read_unlock(&ipip_lock);
+                rcu_read_unlock();
                 return 0;
         }
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
 
         return -1;
 }
@@ -390,7 +397,8 @@ static int ipip_rcv(struct sk_buff *skb)
 static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *tiph = &tunnel->parms.iph;
         u8     tos = tunnel->parms.iph.tos;
         __be16 df = tiph->frag_off;
@@ -480,7 +488,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -722,7 +730,7 @@ static void ipip_tunnel_init(struct net_device *dev)
         ipip_tunnel_bind_dev(dev);
 }
 
-static void ipip_fb_tunnel_init(struct net_device *dev)
+static void __net_init ipip_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
@@ -748,33 +756,27 @@ static struct xfrm_tunnel ipip_handler = {
 static const char banner[] __initconst =
         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 
-static void ipip_destroy_tunnels(struct ipip_net *ipn)
+static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 {
         int prio;
 
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ipn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ipn->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
 
-static int ipip_init_net(struct net *net)
+static int __net_init ipip_init_net(struct net *net)
 {
+        struct ipip_net *ipn = net_generic(net, ipip_net_id);
         int err;
-        struct ipip_net *ipn;
-
-        err = -ENOMEM;
-        ipn = kzalloc(sizeof(struct ipip_net), GFP_KERNEL);
-        if (ipn == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, ipip_net_id, ipn);
-        if (err < 0)
-                goto err_assign;
 
         ipn->tunnels[0] = ipn->tunnels_wc;
         ipn->tunnels[1] = ipn->tunnels_l;
@@ -801,27 +803,26 @@ err_reg_dev:
         free_netdev(ipn->fb_tunnel_dev);
 err_alloc_dev:
         /* nothing */
-err_assign:
-        kfree(ipn);
-err_alloc:
         return err;
 }
 
-static void ipip_exit_net(struct net *net)
+static void __net_exit ipip_exit_net(struct net *net)
 {
-        struct ipip_net *ipn;
+        struct ipip_net *ipn = net_generic(net, ipip_net_id);
+        LIST_HEAD(list);
 
-        ipn = net_generic(net, ipip_net_id);
         rtnl_lock();
-        ipip_destroy_tunnels(ipn);
-        unregister_netdevice(ipn->fb_tunnel_dev);
+        ipip_destroy_tunnels(ipn, &list);
+        unregister_netdevice_queue(ipn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(ipn);
 }
 
 static struct pernet_operations ipip_net_ops = {
         .init = ipip_init_net,
         .exit = ipip_exit_net,
+        .id   = &ipip_net_id,
+        .size = sizeof(struct ipip_net),
 };
 
 static int __init ipip_init(void)
@@ -830,15 +831,14 @@ static int __init ipip_init(void)
 
         printk(banner);
 
-        if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) {
+        err = register_pernet_device(&ipip_net_ops);
+        if (err < 0)
+                return err;
+        err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+        if (err < 0) {
+                unregister_pernet_device(&ipip_net_ops);
                 printk(KERN_INFO "ipip init: can't register tunnel\n");
-                return -EAGAIN;
         }
-
-        err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
-        if (err)
-                xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
-
         return err;
 }
 
@@ -847,7 +847,7 @@ static void __exit ipip_fini(void)
         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
 
-        unregister_pernet_gen_device(ipip_net_id, &ipip_net_ops);
+        unregister_pernet_device(&ipip_net_ops);
 }
 
 module_init(ipip_init);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 99508d66a642..ec19a890c9a0 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -47,6 +47,7 @@
 #include <linux/mroute.h>
 #include <linux/init.h>
 #include <linux/if_ether.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -275,7 +276,8 @@ failure:
  *      @notify: Set to 1, if the caller is a notifier_call
  */
 
-static int vif_delete(struct net *net, int vifi, int notify)
+static int vif_delete(struct net *net, int vifi, int notify,
+                      struct list_head *head)
 {
         struct vif_device *v;
         struct net_device *dev;
@@ -319,7 +321,7 @@ static int vif_delete(struct net *net, int vifi, int notify)
         }
 
         if (v->flags&(VIFF_TUNNEL|VIFF_REGISTER) && !notify)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
         return 0;
@@ -469,8 +471,18 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                         return err;
                 }
                 break;
+
+        case VIFF_USE_IFINDEX:
         case 0:
-                dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+                if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
+                        dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
+                        if (dev && dev->ip_ptr == NULL) {
+                                dev_put(dev);
+                                return -EADDRNOTAVAIL;
+                        }
+                } else
+                        dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+
                 if (!dev)
                         return -EADDRNOTAVAIL;
                 err = dev_set_allmulti(dev, 1);
@@ -742,7 +754,8 @@ ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
                 c->next = mfc_unres_queue;
                 mfc_unres_queue = c;
 
-                mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
+                if (atomic_read(&net->ipv4.cache_resolve_queue_len) == 1)
+                        mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
         }
 
         /*
@@ -791,6 +804,9 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
         int line;
         struct mfc_cache *uc, *c, **cp;
 
+        if (mfc->mfcc_parent >= MAXVIFS)
+                return -ENFILE;
+
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
         for (cp = &net->ipv4.mfc_cache_array[line];
@@ -862,14 +878,16 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
         int i;
+        LIST_HEAD(list);
 
         /*
          *      Shut down all active vif entries
          */
         for (i = 0; i < net->ipv4.maxvif; i++) {
                 if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
-                        vif_delete(net, i, 0);
+                        vif_delete(net, i, 0, &list);
         }
+        unregister_netdevice_many(&list);
 
         /*
          *      Wipe the cache
@@ -948,7 +966,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
         switch (optname) {
         case MRT_INIT:
                 if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_IGMP)
+                    inet_sk(sk)->inet_num != IPPROTO_IGMP)
                         return -EOPNOTSUPP;
                 if (optlen != sizeof(int))
                         return -ENOPROTOOPT;
@@ -985,7 +1003,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                 if (optname == MRT_ADD_VIF) {
                         ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
                 } else {
-                        ret = vif_delete(net, vif.vifc_vifi, 0);
+                        ret = vif_delete(net, vif.vifc_vifi, 0, NULL);
                 }
                 rtnl_unlock();
                 return ret;
@@ -1148,17 +1166,16 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         struct net *net = dev_net(dev);
         struct vif_device *v;
         int ct;
-
-        if (!net_eq(dev_net(dev), net))
-                return NOTIFY_DONE;
+        LIST_HEAD(list);
 
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
         v = &net->ipv4.vif_table[0];
         for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
                 if (v->dev == dev)
-                        vif_delete(net, ct, 1);
+                        vif_delete(net, ct, 1, &list);
         }
+        unregister_netdevice_many(&list);
         return NOTIFY_DONE;
 }
 
@@ -1601,17 +1618,20 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net *net = mfc_net(c);
-        struct net_device *dev = net->ipv4.vif_table[c->mfc_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mfc_parent > MAXVIFS)
+                return -ENOENT;
+
+        if (VIF_EXISTS(net, c->mfc_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv4.vif_table[c->mfc_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (VIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 1725dc0ef688..82fb43c5c59e 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -4,6 +4,7 @@
 #include <linux/netfilter_ipv4.h>
 #include <linux/ip.h>
 #include <linux/skbuff.h>
+#include <linux/gfp.h>
 #include <net/route.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
@@ -155,10 +156,10 @@ static int nf_ip_reroute(struct sk_buff *skb,
         if (entry->hook == NF_INET_LOCAL_OUT) {
                 const struct iphdr *iph = ip_hdr(skb);
 
-                if (!(iph->tos == rt_info->tos
-                      && skb->mark == rt_info->mark
-                      && iph->daddr == rt_info->daddr
-                      && iph->saddr == rt_info->saddr))
+                if (!(iph->tos == rt_info->tos &&
+                      skb->mark == rt_info->mark &&
+                      iph->daddr == rt_info->daddr &&
+                      iph->saddr == rt_info->saddr))
                         return ip_route_me_harder(skb, RTN_UNSPEC);
         }
         return 0;
@@ -248,9 +249,9 @@ module_exit(ipv4_netfilter_fini);
 
 #ifdef CONFIG_SYSCTL
 struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
-        { .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
+        { .procname = "netfilter", },
         { }
 };
 EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 27774c99d888..f07d77f65751 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -27,6 +27,7 @@
 
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp/arp_tables.h>
+#include "../../netfilter/xt_repldata.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
@@ -58,6 +59,12 @@ do {								\
 #define ARP_NF_ASSERT(x)
 #endif
 
+void *arpt_alloc_initial_table(const struct xt_table *info)
+{
+        return xt_alloc_initial_table(arpt, ARPT);
+}
+EXPORT_SYMBOL_GPL(arpt_alloc_initial_table);
+
 static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
                                       const char *hdr_addr, int len)
 {
@@ -226,7 +233,14 @@ arpt_error(struct sk_buff *skb, const struct xt_target_param *par)
         return NF_DROP;
 }
 
-static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
+static inline const struct arpt_entry_target *
+arpt_get_target_c(const struct arpt_entry *e)
+{
+        return arpt_get_target((struct arpt_entry *)e);
+}
+
+static inline struct arpt_entry *
+get_entry(const void *base, unsigned int offset)
 {
         return (struct arpt_entry *)(base + offset);
 }
@@ -273,7 +287,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 
         arp = arp_hdr(skb);
         do {
-                struct arpt_entry_target *t;
+                const struct arpt_entry_target *t;
                 int hdr_len;
 
                 if (!arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
@@ -285,7 +299,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                         (2 * skb->dev->addr_len);
                 ADD_COUNTER(e->counters, hdr_len, 1);
 
-                t = arpt_get_target(e);
+                t = arpt_get_target_c(e);
 
                 /* Standard target? */
                 if (!t->u.kernel.target->target) {
@@ -351,7 +365,7 @@ static inline bool unconditional(const struct arpt_arp *arp)
 /* Figures out from what hook each rule can be called: returns 0 if
  * there are loops.  Puts hook bitmask in comefrom.
  */
-static int mark_source_chains(struct xt_table_info *newinfo,
+static int mark_source_chains(const struct xt_table_info *newinfo,
                               unsigned int valid_hooks, void *entry0)
 {
         unsigned int hook;
@@ -372,7 +386,7 @@ static int mark_source_chains(struct xt_table_info *newinfo,
 
                 for (;;) {
                         const struct arpt_standard_target *t
-                                = (void *)arpt_get_target(e);
+                                = (void *)arpt_get_target_c(e);
                         int visited = e->comefrom & (1 << hook);
 
                         if (e->comefrom & (1 << NF_ARP_NUMHOOKS)) {
@@ -384,11 +398,11 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 |= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct arpt_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       ARPT_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->arp)) || visited) {
+                        if ((e->target_offset == sizeof(struct arpt_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     ARPT_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 && unconditional(&e->arp)) ||
+                            visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -427,8 +441,8 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           ARPT_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           ARPT_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct arpt_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -456,7 +470,7 @@ static int mark_source_chains(struct xt_table_info *newinfo,
         return 1;
 }
 
-static inline int check_entry(struct arpt_entry *e, const char *name)
+static inline int check_entry(const struct arpt_entry *e, const char *name)
 {
         const struct arpt_entry_target *t;
 
@@ -468,7 +482,7 @@ static inline int check_entry(struct arpt_entry *e, const char *name)
         if (e->target_offset + sizeof(struct arpt_entry_target) > e->next_offset)
                 return -EINVAL;
 
-        t = arpt_get_target(e);
+        t = arpt_get_target_c(e);
         if (e->target_offset + t->u.target_size > e->next_offset)
                 return -EINVAL;
 
@@ -498,8 +512,7 @@ static inline int check_target(struct arpt_entry *e, const char *name)
 }
 
 static inline int
-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
-                 unsigned int *i)
+find_check_entry(struct arpt_entry *e, const char *name, unsigned int size)
 {
         struct arpt_entry_target *t;
         struct xt_target *target;
@@ -524,8 +537,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
         ret = check_target(e, name);
         if (ret)
                 goto err;
-
-        (*i)++;
         return 0;
 err:
         module_put(t->u.kernel.target->me);
@@ -533,14 +544,14 @@ out:
         return ret;
 }
 
-static bool check_underflow(struct arpt_entry *e)
+static bool check_underflow(const struct arpt_entry *e)
 {
         const struct arpt_entry_target *t;
         unsigned int verdict;
 
         if (!unconditional(&e->arp))
                 return false;
-        t = arpt_get_target(e);
+        t = arpt_get_target_c(e);
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
                 return false;
         verdict = ((struct arpt_standard_target *)t)->verdict;
@@ -550,17 +561,16 @@ static bool check_underflow(struct arpt_entry *e)
 
 static inline int check_entry_size_and_hooks(struct arpt_entry *e,
                                              struct xt_table_info *newinfo,
-                                             unsigned char *base,
-                                             unsigned char *limit,
+                                             const unsigned char *base,
+                                             const unsigned char *limit,
                                              const unsigned int *hook_entries,
                                              const unsigned int *underflows,
-                                             unsigned int valid_hooks,
-                                             unsigned int *i)
+                                             unsigned int valid_hooks)
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct arpt_entry) != 0
-            || (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -592,19 +602,14 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 }
 
-static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
+static inline void cleanup_entry(struct arpt_entry *e)
 {
         struct xt_tgdtor_param par;
         struct arpt_entry_target *t;
 
-        if (i && (*i)-- == 0)
-                return 1;
-
         t = arpt_get_target(e);
         par.target   = t->u.kernel.target;
         par.targinfo = t->data;
@@ -612,26 +617,20 @@ static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
         if (par.target->destroy != NULL)
                 par.target->destroy(&par);
         module_put(par.target->me);
-        return 0;
 }
 
 /* Checks and translates the user-supplied table segment (held in
  * newinfo).
  */
-static int translate_table(const char *name,
-                           unsigned int valid_hooks,
-                           struct xt_table_info *newinfo,
-                           void *entry0,
-                           unsigned int size,
-                           unsigned int number,
-                           const unsigned int *hook_entries,
-                           const unsigned int *underflows)
+static int translate_table(struct xt_table_info *newinfo, void *entry0,
+                           const struct arpt_replace *repl)
 {
+        struct arpt_entry *iter;
         unsigned int i;
-        int ret;
+        int ret = 0;
 
-        newinfo->size = size;
-        newinfo->number = number;
+        newinfo->size = repl->size;
+        newinfo->number = repl->num_entries;
 
         /* Init all hooks to impossible value. */
         for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
@@ -643,52 +642,63 @@ static int translate_table(const char *name,
         i = 0;
 
         /* Walk through entries, checking offsets. */
-        ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                 check_entry_size_and_hooks,
-                                 newinfo,
-                                 entry0,
-                                 entry0 + size,
-                                 hook_entries, underflows, valid_hooks, &i);
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = check_entry_size_and_hooks(iter, newinfo, entry0,
+                                                 entry0 + repl->size,
+                                                 repl->hook_entry,
+                                                 repl->underflow,
+                                                 repl->valid_hooks);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
         duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
         if (ret != 0)
                 return ret;
 
-        if (i != number) {
+        if (i != repl->num_entries) {
                 duprintf("translate_table: %u not %u entries\n",
-                         i, number);
+                         i, repl->num_entries);
                 return -EINVAL;
         }
 
         /* Check hooks all assigned */
         for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
                 /* Only hooks which are valid */
-                if (!(valid_hooks & (1 << i)))
+                if (!(repl->valid_hooks & (1 << i)))
                         continue;
                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
                         duprintf("Invalid hook entry %u %u\n",
-                                 i, hook_entries[i]);
+                                 i, repl->hook_entry[i]);
                         return -EINVAL;
                 }
                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
                         duprintf("Invalid underflow %u %u\n",
-                                 i, underflows[i]);
+                                 i, repl->underflow[i]);
                         return -EINVAL;
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
+        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) {
                 duprintf("Looping hook\n");
                 return -ELOOP;
         }
 
         /* Finally, each sanity check must pass */
         i = 0;
-        ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                 find_check_entry, name, size, &i);
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = find_check_entry(iter, repl->name, repl->size);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
 
         if (ret != 0) {
-                ARPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                cleanup_entry, &i);
+                xt_entry_foreach(iter, entry0, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter);
+                }
                 return ret;
         }
 
@@ -701,30 +711,10 @@ static int translate_table(const char *name,
         return ret;
 }
 
-/* Gets counters. */
-static inline int add_entry_to_counter(const struct arpt_entry *e,
-                                       struct xt_counters total[],
-                                       unsigned int *i)
-{
-        ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static inline int set_entry_to_counter(const struct arpt_entry *e,
-                                       struct xt_counters total[],
-                                       unsigned int *i)
-{
-        SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
 static void get_counters(const struct xt_table_info *t,
                          struct xt_counters counters[])
 {
+        struct arpt_entry *iter;
         unsigned int cpu;
         unsigned int i;
         unsigned int curcpu;
@@ -740,32 +730,32 @@ static void get_counters(const struct xt_table_info *t,
         curcpu = smp_processor_id();
 
         i = 0;
-        ARPT_ENTRY_ITERATE(t->entries[curcpu],
-                           t->size,
-                           set_entry_to_counter,
-                           counters,
-                           &i);
+        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
+                SET_COUNTER(counters[i], iter->counters.bcnt,
+                            iter->counters.pcnt);
+                ++i;
+        }
 
         for_each_possible_cpu(cpu) {
                 if (cpu == curcpu)
                         continue;
                 i = 0;
                 xt_info_wrlock(cpu);
-                ARPT_ENTRY_ITERATE(t->entries[cpu],
-                                   t->size,
-                                   add_entry_to_counter,
-                                   counters,
-                                   &i);
+                xt_entry_foreach(iter, t->entries[cpu], t->size) {
+                        ADD_COUNTER(counters[i], iter->counters.bcnt,
+                                    iter->counters.pcnt);
+                        ++i;
+                }
                 xt_info_wrunlock(cpu);
         }
         local_bh_enable();
 }
 
-static struct xt_counters *alloc_counters(struct xt_table *table)
+static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
-        struct xt_table_info *private = table->private;
+        const struct xt_table_info *private = table->private;
 
         /* We need atomic snapshot of counters: rest doesn't change
          * (other than comefrom, which userspace doesn't care
@@ -783,11 +773,11 @@ static struct xt_counters *alloc_counters(struct xt_table *table)
 }
 
 static int copy_entries_to_user(unsigned int total_size,
-                                struct xt_table *table,
+                                const struct xt_table *table,
                                 void __user *userptr)
 {
         unsigned int off, num;
-        struct arpt_entry *e;
+        const struct arpt_entry *e;
         struct xt_counters *counters;
         struct xt_table_info *private = table->private;
         int ret = 0;
@@ -807,7 +797,7 @@ static int copy_entries_to_user(unsigned int total_size,
         /* FIXME: use iterator macros --RR */
         /* ... then go back and fix counters and names */
         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
-                struct arpt_entry_target *t;
+                const struct arpt_entry_target *t;
 
                 e = (struct arpt_entry *)(loc_cpu_entry + off);
                 if (copy_to_user(userptr + off
@@ -818,7 +808,7 @@ static int copy_entries_to_user(unsigned int total_size,
                         goto free_counters;
                 }
 
-                t = arpt_get_target(e);
+                t = arpt_get_target_c(e);
                 if (copy_to_user(userptr + off + e->target_offset
                                  + offsetof(struct arpt_entry_target,
                                             u.user.name),
@@ -835,7 +825,7 @@ static int copy_entries_to_user(unsigned int total_size,
 }
 
 #ifdef CONFIG_COMPAT
-static void compat_standard_from_user(void *dst, void *src)
+static void compat_standard_from_user(void *dst, const void *src)
 {
         int v = *(compat_int_t *)src;
 
@@ -844,7 +834,7 @@ static void compat_standard_from_user(void *dst, void *src)
         memcpy(dst, &v, sizeof(v));
 }
 
-static int compat_standard_to_user(void __user *dst, void *src)
+static int compat_standard_to_user(void __user *dst, const void *src)
 {
         compat_int_t cv = *(int *)src;
 
@@ -853,18 +843,18 @@ static int compat_standard_to_user(void __user *dst, void *src)
         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 
-static int compat_calc_entry(struct arpt_entry *e,
+static int compat_calc_entry(const struct arpt_entry *e,
                              const struct xt_table_info *info,
-                             void *base, struct xt_table_info *newinfo)
+                             const void *base, struct xt_table_info *newinfo)
 {
-        struct arpt_entry_target *t;
+        const struct arpt_entry_target *t;
         unsigned int entry_offset;
         int off, i, ret;
 
         off = sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
         entry_offset = (void *)e - base;
 
-        t = arpt_get_target(e);
+        t = arpt_get_target_c(e);
         off += xt_compat_target_offset(t->u.kernel.target);
         newinfo->size -= off;
         ret = xt_compat_add_offset(NFPROTO_ARP, entry_offset, off);
@@ -885,7 +875,9 @@ static int compat_calc_entry(struct arpt_entry *e,
 static int compat_table_info(const struct xt_table_info *info,
                              struct xt_table_info *newinfo)
 {
+        struct arpt_entry *iter;
         void *loc_cpu_entry;
+        int ret;
 
         if (!newinfo || !info)
                 return -EINVAL;
@@ -894,13 +886,17 @@ static int compat_table_info(const struct xt_table_info *info,
         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
         newinfo->initial_entries = 0;
         loc_cpu_entry = info->entries[raw_smp_processor_id()];
-        return ARPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
-                                  compat_calc_entry, info, loc_cpu_entry,
-                                  newinfo);
+        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
+                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
+                if (ret != 0)
+                        return ret;
+        }
+        return 0;
 }
 #endif
 
-static int get_info(struct net *net, void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user,
+                    const int *len, int compat)
 {
         char name[ARPT_TABLE_MAXNAMELEN];
         struct xt_table *t;
@@ -925,10 +921,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         if (t && !IS_ERR(t)) {
                 struct arpt_getinfo info;
                 const struct xt_table_info *private = t->private;
-
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
+
                 if (compat) {
-                        struct xt_table_info tmp;
                         ret = compat_table_info(private, &tmp);
                         xt_compat_flush_offsets(NFPROTO_ARP);
                         private = &tmp;
@@ -959,7 +955,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
 }
 
 static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
-                       int *len)
+                       const int *len)
 {
         int ret;
         struct arpt_get_entries get;
@@ -1010,6 +1006,7 @@ static int __do_replace(struct net *net, const char *name,
         struct xt_table_info *oldinfo;
         struct xt_counters *counters;
         void *loc_cpu_old_entry;
+        struct arpt_entry *iter;
 
         ret = 0;
         counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
@@ -1053,8 +1050,8 @@ static int __do_replace(struct net *net, const char *name,
 
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
-        ARPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
-                           NULL);
+        xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+                cleanup_entry(iter);
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
@@ -1073,12 +1070,14 @@ static int __do_replace(struct net *net, const char *name,
         return ret;
 }
 
-static int do_replace(struct net *net, void __user *user, unsigned int len)
+static int do_replace(struct net *net, const void __user *user,
+                      unsigned int len)
 {
         int ret;
         struct arpt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct arpt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1099,9 +1098,7 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_table(tmp.name, tmp.valid_hooks,
-                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                              tmp.hook_entry, tmp.underflow);
+        ret = translate_table(newinfo, loc_cpu_entry, &tmp);
         if (ret != 0)
                 goto free_newinfo;
 
@@ -1114,27 +1111,15 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
 }
 
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
-static int
-add_counter_to_entry(struct arpt_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static int do_add_counters(struct net *net, void __user *user, unsigned int len,
-                           int compat)
+static int do_add_counters(struct net *net, const void __user *user,
+                           unsigned int len, int compat)
 {
         unsigned int i, curcpu;
         struct xt_counters_info tmp;
@@ -1147,6 +1132,7 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
         const struct xt_table_info *private;
         int ret = 0;
         void *loc_cpu_entry;
+        struct arpt_entry *iter;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1204,11 +1190,10 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
         curcpu = smp_processor_id();
         loc_cpu_entry = private->entries[curcpu];
         xt_info_wrlock(curcpu);
-        ARPT_ENTRY_ITERATE(loc_cpu_entry,
-                           private->size,
-                           add_counter_to_entry,
-                           paddc,
-                           &i);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size) {
+                ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
+                ++i;
+        }
         xt_info_wrunlock(curcpu);
  unlock_up_free:
         local_bh_enable();
@@ -1221,28 +1206,22 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
 }
 
 #ifdef CONFIG_COMPAT
-static inline int
-compat_release_entry(struct compat_arpt_entry *e, unsigned int *i)
+static inline void compat_release_entry(struct compat_arpt_entry *e)
 {
         struct arpt_entry_target *t;
 
-        if (i && (*i)-- == 0)
-                return 1;
-
         t = compat_arpt_get_target(e);
         module_put(t->u.kernel.target->me);
-        return 0;
 }
 
 static inline int
 check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
                                   struct xt_table_info *newinfo,
                                   unsigned int *size,
-                                  unsigned char *base,
-                                  unsigned char *limit,
-                                  unsigned int *hook_entries,
-                                  unsigned int *underflows,
-                                  unsigned int *i,
+                                  const unsigned char *base,
+                                  const unsigned char *limit,
+                                  const unsigned int *hook_entries,
+                                  const unsigned int *underflows,
                                   const char *name)
 {
         struct arpt_entry_target *t;
@@ -1251,8 +1230,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1302,8 +1281,6 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
         /* Clear counters and comefrom */
         memset(&e->counters, 0, sizeof(e->counters));
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 
 release_target:
@@ -1347,19 +1324,6 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
         return ret;
 }
 
-static inline int compat_check_entry(struct arpt_entry *e, const char *name,
-                                     unsigned int *i)
-{
-        int ret;
-
-        ret = check_target(e, name);
-        if (ret)
-                return ret;
-
-        (*i)++;
-        return 0;
-}
-
 static int translate_compat_table(const char *name,
                                   unsigned int valid_hooks,
                                   struct xt_table_info **pinfo,
@@ -1372,8 +1336,10 @@ static int translate_compat_table(const char *name,
         unsigned int i, j;
         struct xt_table_info *newinfo, *info;
         void *pos, *entry0, *entry1;
+        struct compat_arpt_entry *iter0;
+        struct arpt_entry *iter1;
         unsigned int size;
-        int ret;
+        int ret = 0;
 
         info = *pinfo;
         entry0 = *pentry0;
@@ -1390,13 +1356,17 @@ static int translate_compat_table(const char *name,
         j = 0;
         xt_compat_lock(NFPROTO_ARP);
         /* Walk through entries, checking offsets. */
-        ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
-                                        check_compat_entry_size_and_hooks,
-                                        info, &size, entry0,
-                                        entry0 + total_size,
-                                        hook_entries, underflows, &j, name);
-        if (ret != 0)
-                goto out_unlock;
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+                                                        entry0,
+                                                        entry0 + total_size,
+                                                        hook_entries,
+                                                        underflows,
+                                                        name);
+                if (ret != 0)
+                        goto out_unlock;
+                ++j;
+        }
 
         ret = -EINVAL;
         if (j != number) {
@@ -1435,9 +1405,12 @@ static int translate_compat_table(const char *name,
         entry1 = newinfo->entries[raw_smp_processor_id()];
         pos = entry1;
         size = total_size;
-        ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
-                                        compat_copy_entry_from_user,
-                                        &pos, &size, name, newinfo, entry1);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = compat_copy_entry_from_user(iter0, &pos, &size,
+                                                  name, newinfo, entry1);
+                if (ret != 0)
+                        break;
+        }
         xt_compat_flush_offsets(NFPROTO_ARP);
         xt_compat_unlock(NFPROTO_ARP);
         if (ret)
@@ -1448,13 +1421,32 @@ static int translate_compat_table(const char *name,
                 goto free_newinfo;
 
         i = 0;
-        ret = ARPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                                 name, &i);
+        xt_entry_foreach(iter1, entry1, newinfo->size) {
+                ret = check_target(iter1, name);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
         if (ret) {
+                /*
+                 * The first i matches need cleanup_entry (calls ->destroy)
+                 * because they had called ->check already. The other j-i
+                 * entries need only release.
+                 */
+                int skip = i;
                 j -= i;
-                COMPAT_ARPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
-                                                   compat_release_entry, &j);
-                ARPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+                xt_entry_foreach(iter0, entry0, newinfo->size) {
+                        if (skip-- > 0)
+                                continue;
+                        if (j-- == 0)
+                                break;
+                        compat_release_entry(iter0);
+                }
+                xt_entry_foreach(iter1, entry1, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter1);
+                }
                 xt_free_table_info(newinfo);
                 return ret;
         }
@@ -1472,7 +1464,11 @@ static int translate_compat_table(const char *name,
 free_newinfo:
         xt_free_table_info(newinfo);
 out:
-        COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                if (j-- == 0)
+                        break;
+                compat_release_entry(iter0);
+        }
         return ret;
 out_unlock:
         xt_compat_flush_offsets(NFPROTO_ARP);
@@ -1499,6 +1495,7 @@ static int compat_do_replace(struct net *net, void __user *user,
         struct compat_arpt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct arpt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1536,7 +1533,8 @@ static int compat_do_replace(struct net *net, void __user *user,
         return 0;
 
  free_newinfo_untrans:
-        ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
@@ -1570,7 +1568,7 @@ static int compat_do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user,
 static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
                                      compat_uint_t *size,
                                      struct xt_counters *counters,
-                                     unsigned int *i)
+                                     unsigned int i)
 {
         struct arpt_entry_target *t;
         struct compat_arpt_entry __user *ce;
@@ -1578,14 +1576,12 @@ static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
         compat_uint_t origsize;
         int ret;
 
-        ret = -EFAULT;
         origsize = *size;
         ce = (struct compat_arpt_entry __user *)*dstptr;
-        if (copy_to_user(ce, e, sizeof(struct arpt_entry)))
-                goto out;
-
-        if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
-                goto out;
+        if (copy_to_user(ce, e, sizeof(struct arpt_entry)) != 0 ||
+            copy_to_user(&ce->counters, &counters[i],
+            sizeof(counters[i])) != 0)
+                return -EFAULT;
 
         *dstptr += sizeof(struct compat_arpt_entry);
         *size -= sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
@@ -1595,18 +1591,12 @@ static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
         t = arpt_get_target(e);
         ret = xt_compat_target_to_user(t, dstptr, size);
         if (ret)
-                goto out;
-        ret = -EFAULT;
+                return ret;
         next_offset = e->next_offset - (origsize - *size);
-        if (put_user(target_offset, &ce->target_offset))
-                goto out;
-        if (put_user(next_offset, &ce->next_offset))
-                goto out;
-
-        (*i)++;
+        if (put_user(target_offset, &ce->target_offset) != 0 ||
+            put_user(next_offset, &ce->next_offset) != 0)
+                return -EFAULT;
         return 0;
-out:
-        return ret;
 }
 
 static int compat_copy_entries_to_user(unsigned int total_size,
@@ -1620,6 +1610,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
         int ret = 0;
         void *loc_cpu_entry;
         unsigned int i = 0;
+        struct arpt_entry *iter;
 
         counters = alloc_counters(table);
         if (IS_ERR(counters))
@@ -1629,9 +1620,12 @@ static int compat_copy_entries_to_user(unsigned int total_size,
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         pos = userptr;
         size = total_size;
-        ret = ARPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
-                                 compat_copy_entry_to_user,
-                                 &pos, &size, counters, &i);
+        xt_entry_foreach(iter, loc_cpu_entry, total_size) {
+                ret = compat_copy_entry_to_user(iter, &pos,
+                                                &size, counters, i++);
+                if (ret != 0)
+                        break;
+        }
         vfree(counters);
         return ret;
 }
@@ -1799,12 +1793,7 @@ struct xt_table *arpt_register_table(struct net *net,
         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
         memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-        ret = translate_table(table->name, table->valid_hooks,
-                              newinfo, loc_cpu_entry, repl->size,
-                              repl->num_entries,
-                              repl->hook_entry,
-                              repl->underflow);
-
+        ret = translate_table(newinfo, loc_cpu_entry, repl);
         duprintf("arpt_register_table: translate table gives %d\n", ret);
         if (ret != 0)
                 goto out_free;
@@ -1827,13 +1816,14 @@ void arpt_unregister_table(struct xt_table *table)
         struct xt_table_info *private;
         void *loc_cpu_entry;
         struct module *table_owner = table->me;
+        struct arpt_entry *iter;
 
         private = xt_unregister_table(table);
 
         /* Decrease module usage counts and free resources */
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
-        ARPT_ENTRY_ITERATE(loc_cpu_entry, private->size,
-                           cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size)
+                cleanup_entry(iter);
         if (private->number > private->initial_entries)
                 module_put(table_owner);
         xt_free_table_info(private);
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 97337601827a..79ca5e70d497 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -6,7 +6,9 @@
  */
 
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp/arp_tables.h>
+#include <linux/slab.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
@@ -15,93 +17,37 @@ MODULE_DESCRIPTION("arptables filter table");
 #define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \
                            (1 << NF_ARP_FORWARD))
 
-static const struct
-{
-        struct arpt_replace repl;
-        struct arpt_standard entries[3];
-        struct arpt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "filter",
-                .valid_hooks = FILTER_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct arpt_standard) * 3 + sizeof(struct arpt_error),
-                .hook_entry = {
-                        [NF_ARP_IN] = 0,
-                        [NF_ARP_OUT] = sizeof(struct arpt_standard),
-                        [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-                },
-                .underflow = {
-                        [NF_ARP_IN] = 0,
-                        [NF_ARP_OUT] = sizeof(struct arpt_standard),
-                        [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-                },
-        },
-        .entries = {
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_IN */
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_OUT */
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_FORWARD */
-        },
-        .term = ARPT_ERROR_INIT,
-};
-
 static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_ARP,
+        .priority       = NF_IP_PRI_FILTER,
 };
 
 /* The work comes in here from netfilter.c */
-static unsigned int arpt_in_hook(unsigned int hook,
-                                 struct sk_buff *skb,
-                                 const struct net_device *in,
-                                 const struct net_device *out,
-                                 int (*okfn)(struct sk_buff *))
+static unsigned int
+arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
+                     const struct net_device *in, const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv4.arptable_filter);
-}
+        const struct net *net = dev_net((in != NULL) ? in : out);
 
-static unsigned int arpt_out_hook(unsigned int hook,
-                                  struct sk_buff *skb,
-                                  const struct net_device *in,
-                                  const struct net_device *out,
-                                  int (*okfn)(struct sk_buff *))
-{
-        return arpt_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv4.arptable_filter);
+        return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
 }
 
-static struct nf_hook_ops arpt_ops[] __read_mostly = {
-        {
-                .hook           = arpt_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_IN,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = arpt_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_OUT,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = arpt_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_FORWARD,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-};
+static struct nf_hook_ops *arpfilter_ops __read_mostly;
 
 static int __net_init arptable_filter_net_init(struct net *net)
 {
-        /* Register table */
+        struct arpt_replace *repl;
+        
+        repl = arpt_alloc_initial_table(&packet_filter);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv4.arptable_filter =
-                arpt_register_table(net, &packet_filter, &initial_table.repl);
+                arpt_register_table(net, &packet_filter, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.arptable_filter))
                 return PTR_ERR(net->ipv4.arptable_filter);
         return 0;
@@ -125,9 +71,11 @@ static int __init arptable_filter_init(void)
         if (ret < 0)
                 return ret;
 
-        ret = nf_register_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
-        if (ret < 0)
+        arpfilter_ops = xt_hook_link(&packet_filter, arptable_filter_hook);
+        if (IS_ERR(arpfilter_ops)) {
+                ret = PTR_ERR(arpfilter_ops);
                 goto cleanup_table;
+        }
         return ret;
 
 cleanup_table:
@@ -137,7 +85,7 @@ cleanup_table:
 
 static void __exit arptable_filter_fini(void)
 {
-        nf_unregister_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
+        xt_hook_unlink(&packet_filter, arpfilter_ops);
         unregister_pernet_subsys(&arptable_filter_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index c156db215987..e2787048aa0a 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -26,6 +26,7 @@
 #include <linux/security.h>
 #include <linux/net.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/route.h>
@@ -497,10 +498,9 @@ ipq_rcv_nl_event(struct notifier_block *this,
 {
         struct netlink_notify *n = ptr;
 
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_FIREWALL && n->pid) {
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_FIREWALL) {
                 write_lock_bh(&queue_lock);
-                if ((n->net == &init_net) && (n->pid == peer_pid))
+                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
                         __ipq_reset();
                 write_unlock_bh(&queue_lock);
         }
@@ -516,14 +516,13 @@ static struct ctl_table_header *ipq_sysctl_header;
 
 static ctl_table ipq_table[] = {
         {
-                .ctl_name       = NET_IPQ_QMAX,
                 .procname       = NET_IPQ_QMAX_NAME,
                 .data           = &queue_maxlen,
                 .maxlen         = sizeof(queue_maxlen),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 #endif
 
@@ -622,7 +621,7 @@ cleanup_netlink_notifier:
 static void __exit ip_queue_fini(void)
 {
         nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
+
         ipq_flush(NULL, 0);
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index cde755d5eeab..b29c66df8d1f 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -28,6 +28,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <net/netfilter/nf_log.h>
+#include "../../netfilter/xt_repldata.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -66,6 +67,12 @@ do {								\
 #define inline
 #endif
 
+void *ipt_alloc_initial_table(const struct xt_table *info)
+{
+        return xt_alloc_initial_table(ipt, IPT);
+}
+EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
+
 /*
    We keep a set of rules for each CPU, so we can avoid write-locking
    them in the softirq when updating the counters and therefore
@@ -89,9 +96,9 @@ ip_packet_match(const struct iphdr *ip,
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 
         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
-                  IPT_INV_SRCIP)
-            || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-                     IPT_INV_DSTIP)) {
+                  IPT_INV_SRCIP) ||
+            FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+                  IPT_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
 
                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
@@ -122,8 +129,8 @@ ip_packet_match(const struct iphdr *ip,
         }
 
         /* Check specific protocol */
-        if (ipinfo->proto
-            && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
+        if (ipinfo->proto &&
+            FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
                 dprintf("Packet protocol %hi does not match %hi.%s\n",
                         ip->protocol, ipinfo->proto,
                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
@@ -169,7 +176,7 @@ ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
 
 /* Performance critical - called for every packet */
 static inline bool
-do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
+do_match(const struct ipt_entry_match *m, const struct sk_buff *skb,
          struct xt_match_param *par)
 {
         par->match     = m->u.kernel.match;
@@ -184,7 +191,7 @@ do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
 
 /* Performance critical */
 static inline struct ipt_entry *
-get_entry(void *base, unsigned int offset)
+get_entry(const void *base, unsigned int offset)
 {
         return (struct ipt_entry *)(base + offset);
 }
@@ -199,6 +206,13 @@ static inline bool unconditional(const struct ipt_ip *ip)
 #undef FWINV
 }
 
+/* for const-correctness */
+static inline const struct ipt_entry_target *
+ipt_get_target_c(const struct ipt_entry *e)
+{
+        return ipt_get_target((struct ipt_entry *)e);
+}
+
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 static const char *const hooknames[] = {
@@ -233,11 +247,11 @@ static struct nf_loginfo trace_loginfo = {
 
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
-get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
+get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
                       const char *hookname, const char **chainname,
                       const char **comment, unsigned int *rulenum)
 {
-        struct ipt_standard_target *t = (void *)ipt_get_target(s);
+        const struct ipt_standard_target *t = (void *)ipt_get_target_c(s);
 
         if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
                 /* Head of user chain: ERROR target with chainname */
@@ -246,11 +260,11 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
         } else if (s == e) {
                 (*rulenum)++;
 
-                if (s->target_offset == sizeof(struct ipt_entry)
-                   && strcmp(t->target.u.kernel.target->name,
-                             IPT_STANDARD_TARGET) == 0
-                   && t->verdict < 0
-                   && unconditional(&s->ip)) {
+                if (s->target_offset == sizeof(struct ipt_entry) &&
+                    strcmp(t->target.u.kernel.target->name,
+                           IPT_STANDARD_TARGET) == 0 &&
+                   t->verdict < 0 &&
+                   unconditional(&s->ip)) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
@@ -263,17 +277,18 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
         return 0;
 }
 
-static void trace_packet(struct sk_buff *skb,
+static void trace_packet(const struct sk_buff *skb,
                          unsigned int hook,
                          const struct net_device *in,
                          const struct net_device *out,
                          const char *tablename,
-                         struct xt_table_info *private,
-                         struct ipt_entry *e)
+                         const struct xt_table_info *private,
+                         const struct ipt_entry *e)
 {
-        void *table_base;
+        const void *table_base;
         const struct ipt_entry *root;
         const char *hookname, *chainname, *comment;
+        const struct ipt_entry *iter;
         unsigned int rulenum = 0;
 
         table_base = private->entries[smp_processor_id()];
@@ -282,10 +297,10 @@ static void trace_packet(struct sk_buff *skb,
         hookname = chainname = hooknames[hook];
         comment = comments[NF_IP_TRACE_COMMENT_RULE];
 
-        IPT_ENTRY_ITERATE(root,
-                          private->size - private->hook_entry[hook],
-                          get_chainname_rulenum,
-                          e, hookname, &chainname, &comment, &rulenum);
+        xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
+                if (get_chainname_rulenum(iter, e, hookname,
+                    &chainname, &comment, &rulenum) != 0)
+                        break;
 
         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
                       "TRACE: %s:%s:%s:%u ",
@@ -315,9 +330,9 @@ ipt_do_table(struct sk_buff *skb,
         /* Initializing verdict to NF_DROP keeps gcc happy. */
         unsigned int verdict = NF_DROP;
         const char *indev, *outdev;
-        void *table_base;
+        const void *table_base;
         struct ipt_entry *e, *back;
-        struct xt_table_info *private;
+        const struct xt_table_info *private;
         struct xt_match_param mtpar;
         struct xt_target_param tgpar;
 
@@ -350,17 +365,22 @@ ipt_do_table(struct sk_buff *skb,
         back = get_entry(table_base, private->underflow[hook]);
 
         do {
-                struct ipt_entry_target *t;
+                const struct ipt_entry_target *t;
+                const struct xt_entry_match *ematch;
 
                 IP_NF_ASSERT(e);
                 IP_NF_ASSERT(back);
                 if (!ip_packet_match(ip, indev, outdev,
-                    &e->ip, mtpar.fragoff) ||
-                    IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
+                    &e->ip, mtpar.fragoff)) {
+ no_match:
                         e = ipt_next_entry(e);
                         continue;
                 }
 
+                xt_ematch_foreach(ematch, e)
+                        if (do_match(ematch, skb, &mtpar) != 0)
+                                goto no_match;
+
                 ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
 
                 t = ipt_get_target(e);
@@ -388,8 +408,8 @@ ipt_do_table(struct sk_buff *skb,
                                 back = get_entry(table_base, back->comefrom);
                                 continue;
                         }
-                        if (table_base + v != ipt_next_entry(e)
-                            && !(e->ip.flags & IPT_F_GOTO)) {
+                        if (table_base + v != ipt_next_entry(e) &&
+                            !(e->ip.flags & IPT_F_GOTO)) {
                                 /* Save old back ptr in next entry */
                                 struct ipt_entry *next = ipt_next_entry(e);
                                 next->comefrom = (void *)back - table_base;
@@ -443,7 +463,7 @@ ipt_do_table(struct sk_buff *skb,
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
-mark_source_chains(struct xt_table_info *newinfo,
+mark_source_chains(const struct xt_table_info *newinfo,
                    unsigned int valid_hooks, void *entry0)
 {
         unsigned int hook;
@@ -461,8 +481,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                 e->counters.pcnt = pos;
 
                 for (;;) {
-                        struct ipt_standard_target *t
-                                = (void *)ipt_get_target(e);
+                        const struct ipt_standard_target *t
+                                = (void *)ipt_get_target_c(e);
                         int visited = e->comefrom & (1 << hook);
 
                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
@@ -473,11 +493,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ipt_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       IPT_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->ip)) || visited) {
+                        if ((e->target_offset == sizeof(struct ipt_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     IPT_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 && unconditional(&e->ip)) ||
+                            visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -524,8 +544,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           IPT_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           IPT_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct ipt_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -552,27 +572,23 @@ mark_source_chains(struct xt_table_info *newinfo,
         return 1;
 }
 
-static int
-cleanup_match(struct ipt_entry_match *m, unsigned int *i)
+static void cleanup_match(struct ipt_entry_match *m, struct net *net)
 {
         struct xt_mtdtor_param par;
 
-        if (i && (*i)-- == 0)
-                return 1;
-
+        par.net       = net;
         par.match     = m->u.kernel.match;
         par.matchinfo = m->data;
         par.family    = NFPROTO_IPV4;
         if (par.match->destroy != NULL)
                 par.match->destroy(&par);
         module_put(par.match->me);
-        return 0;
 }
 
 static int
-check_entry(struct ipt_entry *e, const char *name)
+check_entry(const struct ipt_entry *e, const char *name)
 {
-        struct ipt_entry_target *t;
+        const struct ipt_entry_target *t;
 
         if (!ip_checkentry(&e->ip)) {
                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
@@ -583,7 +599,7 @@ check_entry(struct ipt_entry *e, const char *name)
             e->next_offset)
                 return -EINVAL;
 
-        t = ipt_get_target(e);
+        t = ipt_get_target_c(e);
         if (e->target_offset + t->u.target_size > e->next_offset)
                 return -EINVAL;
 
@@ -591,8 +607,7 @@ check_entry(struct ipt_entry *e, const char *name)
 }
 
 static int
-check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
-            unsigned int *i)
+check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 {
         const struct ipt_ip *ip = par->entryinfo;
         int ret;
@@ -607,13 +622,11 @@ check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
                          par.match->name);
                 return ret;
         }
-        ++*i;
         return 0;
 }
 
 static int
-find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
-                 unsigned int *i)
+find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 {
         struct xt_match *match;
         int ret;
@@ -627,7 +640,7 @@ find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
         }
         m->u.kernel.match = match;
 
-        ret = check_match(m, par, i);
+        ret = check_match(m, par);
         if (ret)
                 goto err;
 
@@ -637,10 +650,11 @@ err:
         return ret;
 }
 
-static int check_target(struct ipt_entry *e, const char *name)
+static int check_target(struct ipt_entry *e, struct net *net, const char *name)
 {
         struct ipt_entry_target *t = ipt_get_target(e);
         struct xt_tgchk_param par = {
+                .net       = net,
                 .table     = name,
                 .entryinfo = e,
                 .target    = t->u.kernel.target,
@@ -661,27 +675,32 @@ static int check_target(struct ipt_entry *e, const char *name)
 }
 
 static int
-find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
-                 unsigned int *i)
+find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
+                 unsigned int size)
 {
         struct ipt_entry_target *t;
         struct xt_target *target;
         int ret;
         unsigned int j;
         struct xt_mtchk_param mtpar;
+        struct xt_entry_match *ematch;
 
         ret = check_entry(e, name);
         if (ret)
                 return ret;
 
         j = 0;
+        mtpar.net       = net;
         mtpar.table     = name;
         mtpar.entryinfo = &e->ip;
         mtpar.hook_mask = e->comefrom;
         mtpar.family    = NFPROTO_IPV4;
-        ret = IPT_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
-        if (ret != 0)
-                goto cleanup_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = find_check_match(ematch, &mtpar);
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
 
         t = ipt_get_target(e);
         target = try_then_request_module(xt_find_target(AF_INET,
@@ -695,27 +714,29 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
         }
         t->u.kernel.target = target;
 
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
         if (ret)
                 goto err;
-
-        (*i)++;
         return 0;
  err:
         module_put(t->u.kernel.target->me);
  cleanup_matches:
-        IPT_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
         return ret;
 }
 
-static bool check_underflow(struct ipt_entry *e)
+static bool check_underflow(const struct ipt_entry *e)
 {
         const struct ipt_entry_target *t;
         unsigned int verdict;
 
         if (!unconditional(&e->ip))
                 return false;
-        t = ipt_get_target(e);
+        t = ipt_get_target_c(e);
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
                 return false;
         verdict = ((struct ipt_standard_target *)t)->verdict;
@@ -726,17 +747,16 @@ static bool check_underflow(struct ipt_entry *e)
 static int
 check_entry_size_and_hooks(struct ipt_entry *e,
                            struct xt_table_info *newinfo,
-                           unsigned char *base,
-                           unsigned char *limit,
+                           const unsigned char *base,
+                           const unsigned char *limit,
                            const unsigned int *hook_entries,
                            const unsigned int *underflows,
-                           unsigned int valid_hooks,
-                           unsigned int *i)
+                           unsigned int valid_hooks)
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
-            || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -768,50 +788,42 @@ check_entry_size_and_hooks(struct ipt_entry *e,
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 }
 
-static int
-cleanup_entry(struct ipt_entry *e, unsigned int *i)
+static void
+cleanup_entry(struct ipt_entry *e, struct net *net)
 {
         struct xt_tgdtor_param par;
         struct ipt_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_match *ematch;
 
         /* Cleanup all matches */
-        IPT_MATCH_ITERATE(e, cleanup_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                cleanup_match(ematch, net);
         t = ipt_get_target(e);
 
+        par.net      = net;
         par.target   = t->u.kernel.target;
         par.targinfo = t->data;
         par.family   = NFPROTO_IPV4;
         if (par.target->destroy != NULL)
                 par.target->destroy(&par);
         module_put(par.target->me);
-        return 0;
 }
 
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
-translate_table(const char *name,
-                unsigned int valid_hooks,
-                struct xt_table_info *newinfo,
-                void *entry0,
-                unsigned int size,
-                unsigned int number,
-                const unsigned int *hook_entries,
-                const unsigned int *underflows)
+translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+                const struct ipt_replace *repl)
 {
+        struct ipt_entry *iter;
         unsigned int i;
-        int ret;
+        int ret = 0;
 
-        newinfo->size = size;
-        newinfo->number = number;
+        newinfo->size = repl->size;
+        newinfo->number = repl->num_entries;
 
         /* Init all hooks to impossible value. */
         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
@@ -822,49 +834,58 @@ translate_table(const char *name,
         duprintf("translate_table: size %u\n", newinfo->size);
         i = 0;
         /* Walk through entries, checking offsets. */
-        ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                check_entry_size_and_hooks,
-                                newinfo,
-                                entry0,
-                                entry0 + size,
-                                hook_entries, underflows, valid_hooks, &i);
-        if (ret != 0)
-                return ret;
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = check_entry_size_and_hooks(iter, newinfo, entry0,
+                                                 entry0 + repl->size,
+                                                 repl->hook_entry,
+                                                 repl->underflow,
+                                                 repl->valid_hooks);
+                if (ret != 0)
+                        return ret;
+                ++i;
+        }
 
-        if (i != number) {
+        if (i != repl->num_entries) {
                 duprintf("translate_table: %u not %u entries\n",
-                         i, number);
+                         i, repl->num_entries);
                 return -EINVAL;
         }
 
         /* Check hooks all assigned */
         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
                 /* Only hooks which are valid */
-                if (!(valid_hooks & (1 << i)))
+                if (!(repl->valid_hooks & (1 << i)))
                         continue;
                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
                         duprintf("Invalid hook entry %u %u\n",
-                                 i, hook_entries[i]);
+                                 i, repl->hook_entry[i]);
                         return -EINVAL;
                 }
                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
                         duprintf("Invalid underflow %u %u\n",
-                                 i, underflows[i]);
+                                 i, repl->underflow[i]);
                         return -EINVAL;
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
                 return -ELOOP;
 
         /* Finally, each sanity check must pass */
         i = 0;
-        ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                find_check_entry, name, size, &i);
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = find_check_entry(iter, net, repl->name, repl->size);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
 
         if (ret != 0) {
-                IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                cleanup_entry, &i);
+                xt_entry_foreach(iter, entry0, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter, net);
+                }
                 return ret;
         }
 
@@ -877,33 +898,11 @@ translate_table(const char *name,
         return ret;
 }
 
-/* Gets counters. */
-static inline int
-add_entry_to_counter(const struct ipt_entry *e,
-                     struct xt_counters total[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static inline int
-set_entry_to_counter(const struct ipt_entry *e,
-                     struct ipt_counters total[],
-                     unsigned int *i)
-{
-        SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
 static void
 get_counters(const struct xt_table_info *t,
              struct xt_counters counters[])
 {
+        struct ipt_entry *iter;
         unsigned int cpu;
         unsigned int i;
         unsigned int curcpu;
@@ -919,32 +918,32 @@ get_counters(const struct xt_table_info *t,
         curcpu = smp_processor_id();
 
         i = 0;
-        IPT_ENTRY_ITERATE(t->entries[curcpu],
-                          t->size,
-                          set_entry_to_counter,
-                          counters,
-                          &i);
+        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
+                SET_COUNTER(counters[i], iter->counters.bcnt,
+                            iter->counters.pcnt);
+                ++i;
+        }
 
         for_each_possible_cpu(cpu) {
                 if (cpu == curcpu)
                         continue;
                 i = 0;
                 xt_info_wrlock(cpu);
-                IPT_ENTRY_ITERATE(t->entries[cpu],
-                                  t->size,
-                                  add_entry_to_counter,
-                                  counters,
-                                  &i);
+                xt_entry_foreach(iter, t->entries[cpu], t->size) {
+                        ADD_COUNTER(counters[i], iter->counters.bcnt,
+                                    iter->counters.pcnt);
+                        ++i; /* macro does multi eval of i */
+                }
                 xt_info_wrunlock(cpu);
         }
         local_bh_enable();
 }
 
-static struct xt_counters * alloc_counters(struct xt_table *table)
+static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
-        struct xt_table_info *private = table->private;
+        const struct xt_table_info *private = table->private;
 
         /* We need atomic snapshot of counters: rest doesn't change
            (other than comefrom, which userspace doesn't care
@@ -962,11 +961,11 @@ static struct xt_counters * alloc_counters(struct xt_table *table)
 
 static int
 copy_entries_to_user(unsigned int total_size,
-                     struct xt_table *table,
+                     const struct xt_table *table,
                      void __user *userptr)
 {
         unsigned int off, num;
-        struct ipt_entry *e;
+        const struct ipt_entry *e;
         struct xt_counters *counters;
         const struct xt_table_info *private = table->private;
         int ret = 0;
@@ -1018,7 +1017,7 @@ copy_entries_to_user(unsigned int total_size,
                         }
                 }
 
-                t = ipt_get_target(e);
+                t = ipt_get_target_c(e);
                 if (copy_to_user(userptr + off + e->target_offset
                                  + offsetof(struct ipt_entry_target,
                                             u.user.name),
@@ -1035,7 +1034,7 @@ copy_entries_to_user(unsigned int total_size,
 }
 
 #ifdef CONFIG_COMPAT
-static void compat_standard_from_user(void *dst, void *src)
+static void compat_standard_from_user(void *dst, const void *src)
 {
         int v = *(compat_int_t *)src;
 
@@ -1044,7 +1043,7 @@ static void compat_standard_from_user(void *dst, void *src)
         memcpy(dst, &v, sizeof(v));
 }
 
-static int compat_standard_to_user(void __user *dst, void *src)
+static int compat_standard_to_user(void __user *dst, const void *src)
 {
         compat_int_t cv = *(int *)src;
 
@@ -1053,25 +1052,20 @@ static int compat_standard_to_user(void __user *dst, void *src)
         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 
-static inline int
-compat_calc_match(struct ipt_entry_match *m, int *size)
-{
-        *size += xt_compat_match_offset(m->u.kernel.match);
-        return 0;
-}
-
-static int compat_calc_entry(struct ipt_entry *e,
+static int compat_calc_entry(const struct ipt_entry *e,
                              const struct xt_table_info *info,
-                             void *base, struct xt_table_info *newinfo)
+                             const void *base, struct xt_table_info *newinfo)
 {
-        struct ipt_entry_target *t;
+        const struct xt_entry_match *ematch;
+        const struct ipt_entry_target *t;
         unsigned int entry_offset;
         int off, i, ret;
 
         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
         entry_offset = (void *)e - base;
-        IPT_MATCH_ITERATE(e, compat_calc_match, &off);
-        t = ipt_get_target(e);
+        xt_ematch_foreach(ematch, e)
+                off += xt_compat_match_offset(ematch->u.kernel.match);
+        t = ipt_get_target_c(e);
         off += xt_compat_target_offset(t->u.kernel.target);
         newinfo->size -= off;
         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
@@ -1092,7 +1086,9 @@ static int compat_calc_entry(struct ipt_entry *e,
 static int compat_table_info(const struct xt_table_info *info,
                              struct xt_table_info *newinfo)
 {
+        struct ipt_entry *iter;
         void *loc_cpu_entry;
+        int ret;
 
         if (!newinfo || !info)
                 return -EINVAL;
@@ -1101,13 +1097,17 @@ static int compat_table_info(const struct xt_table_info *info,
         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
         newinfo->initial_entries = 0;
         loc_cpu_entry = info->entries[raw_smp_processor_id()];
-        return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
-                                 compat_calc_entry, info, loc_cpu_entry,
-                                 newinfo);
+        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
+                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
+                if (ret != 0)
+                        return ret;
+        }
+        return 0;
 }
 #endif
 
-static int get_info(struct net *net, void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user,
+                    const int *len, int compat)
 {
         char name[IPT_TABLE_MAXNAMELEN];
         struct xt_table *t;
@@ -1132,10 +1132,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         if (t && !IS_ERR(t)) {
                 struct ipt_getinfo info;
                 const struct xt_table_info *private = t->private;
-
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
+
                 if (compat) {
-                        struct xt_table_info tmp;
                         ret = compat_table_info(private, &tmp);
                         xt_compat_flush_offsets(AF_INET);
                         private = &tmp;
@@ -1167,7 +1167,8 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
 }
 
 static int
-get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ipt_get_entries __user *uptr,
+            const int *len)
 {
         int ret;
         struct ipt_get_entries get;
@@ -1215,6 +1216,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
         struct xt_table_info *oldinfo;
         struct xt_counters *counters;
         void *loc_cpu_old_entry;
+        struct ipt_entry *iter;
 
         ret = 0;
         counters = vmalloc(num_counters * sizeof(struct xt_counters));
@@ -1257,8 +1259,9 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
-        IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
-                          NULL);
+        xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+                cleanup_entry(iter, net);
+
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
                          sizeof(struct xt_counters) * num_counters) != 0)
@@ -1277,12 +1280,13 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(struct net *net, void __user *user, unsigned int len)
+do_replace(struct net *net, const void __user *user, unsigned int len)
 {
         int ret;
         struct ipt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct ipt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1303,9 +1307,7 @@ do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_table(tmp.name, tmp.valid_hooks,
-                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                              tmp.hook_entry, tmp.underflow);
+        ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
         if (ret != 0)
                 goto free_newinfo;
 
@@ -1318,27 +1320,16 @@ do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
 }
 
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
 static int
-add_counter_to_entry(struct ipt_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static int
-do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
+do_add_counters(struct net *net, const void __user *user,
+                unsigned int len, int compat)
 {
         unsigned int i, curcpu;
         struct xt_counters_info tmp;
@@ -1351,6 +1342,7 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
         const struct xt_table_info *private;
         int ret = 0;
         void *loc_cpu_entry;
+        struct ipt_entry *iter;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1408,11 +1400,10 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
         curcpu = smp_processor_id();
         loc_cpu_entry = private->entries[curcpu];
         xt_info_wrlock(curcpu);
-        IPT_ENTRY_ITERATE(loc_cpu_entry,
-                          private->size,
-                          add_counter_to_entry,
-                          paddc,
-                          &i);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size) {
+                ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
+                ++i;
+        }
         xt_info_wrunlock(curcpu);
  unlock_up_free:
         local_bh_enable();
@@ -1440,45 +1431,40 @@ struct compat_ipt_replace {
 static int
 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
                           unsigned int *size, struct xt_counters *counters,
-                          unsigned int *i)
+                          unsigned int i)
 {
         struct ipt_entry_target *t;
         struct compat_ipt_entry __user *ce;
         u_int16_t target_offset, next_offset;
         compat_uint_t origsize;
-        int ret;
+        const struct xt_entry_match *ematch;
+        int ret = 0;
 
-        ret = -EFAULT;
         origsize = *size;
         ce = (struct compat_ipt_entry __user *)*dstptr;
-        if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
-                goto out;
-
-        if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
-                goto out;
+        if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
+            copy_to_user(&ce->counters, &counters[i],
+            sizeof(counters[i])) != 0)
+                return -EFAULT;
 
         *dstptr += sizeof(struct compat_ipt_entry);
         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 
-        ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
+        xt_ematch_foreach(ematch, e) {
+                ret = xt_compat_match_to_user(ematch, dstptr, size);
+                if (ret != 0)
+                        return ret;
+        }
         target_offset = e->target_offset - (origsize - *size);
-        if (ret)
-                goto out;
         t = ipt_get_target(e);
         ret = xt_compat_target_to_user(t, dstptr, size);
         if (ret)
-                goto out;
-        ret = -EFAULT;
+                return ret;
         next_offset = e->next_offset - (origsize - *size);
-        if (put_user(target_offset, &ce->target_offset))
-                goto out;
-        if (put_user(next_offset, &ce->next_offset))
-                goto out;
-
-        (*i)++;
+        if (put_user(target_offset, &ce->target_offset) != 0 ||
+            put_user(next_offset, &ce->next_offset) != 0)
+                return -EFAULT;
         return 0;
-out:
-        return ret;
 }
 
 static int
@@ -1486,7 +1472,7 @@ compat_find_calc_match(struct ipt_entry_match *m,
                        const char *name,
                        const struct ipt_ip *ip,
                        unsigned int hookmask,
-                       int *size, unsigned int *i)
+                       int *size)
 {
         struct xt_match *match;
 
@@ -1500,47 +1486,32 @@ compat_find_calc_match(struct ipt_entry_match *m,
         }
         m->u.kernel.match = match;
         *size += xt_compat_match_offset(match);
-
-        (*i)++;
-        return 0;
-}
-
-static int
-compat_release_match(struct ipt_entry_match *m, unsigned int *i)
-{
-        if (i && (*i)-- == 0)
-                return 1;
-
-        module_put(m->u.kernel.match->me);
         return 0;
 }
 
-static int
-compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
+static void compat_release_entry(struct compat_ipt_entry *e)
 {
         struct ipt_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_match *ematch;
 
         /* Cleanup all matches */
-        COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                module_put(ematch->u.kernel.match->me);
         t = compat_ipt_get_target(e);
         module_put(t->u.kernel.target->me);
-        return 0;
 }
 
 static int
 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
                                   struct xt_table_info *newinfo,
                                   unsigned int *size,
-                                  unsigned char *base,
-                                  unsigned char *limit,
-                                  unsigned int *hook_entries,
-                                  unsigned int *underflows,
-                                  unsigned int *i,
+                                  const unsigned char *base,
+                                  const unsigned char *limit,
+                                  const unsigned int *hook_entries,
+                                  const unsigned int *underflows,
                                   const char *name)
 {
+        struct xt_entry_match *ematch;
         struct ipt_entry_target *t;
         struct xt_target *target;
         unsigned int entry_offset;
@@ -1548,8 +1519,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1569,10 +1540,13 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
         entry_offset = (void *)e - (void *)base;
         j = 0;
-        ret = COMPAT_IPT_MATCH_ITERATE(e, compat_find_calc_match, name,
-                                       &e->ip, e->comefrom, &off, &j);
-        if (ret != 0)
-                goto release_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = compat_find_calc_match(ematch, name,
+                                             &e->ip, e->comefrom, &off);
+                if (ret != 0)
+                        goto release_matches;
+                ++j;
+        }
 
         t = compat_ipt_get_target(e);
         target = try_then_request_module(xt_find_target(AF_INET,
@@ -1604,14 +1578,16 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         /* Clear counters and comefrom */
         memset(&e->counters, 0, sizeof(e->counters));
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 
 out:
         module_put(t->u.kernel.target->me);
 release_matches:
-        IPT_MATCH_ITERATE(e, compat_release_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                module_put(ematch->u.kernel.match->me);
+        }
         return ret;
 }
 
@@ -1625,6 +1601,7 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
         struct ipt_entry *de;
         unsigned int origsize;
         int ret, h;
+        struct xt_entry_match *ematch;
 
         ret = 0;
         origsize = *size;
@@ -1635,10 +1612,11 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
         *dstptr += sizeof(struct ipt_entry);
         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 
-        ret = COMPAT_IPT_MATCH_ITERATE(e, xt_compat_match_from_user,
-                                       dstptr, size);
-        if (ret)
-                return ret;
+        xt_ematch_foreach(ematch, e) {
+                ret = xt_compat_match_from_user(ematch, dstptr, size);
+                if (ret != 0)
+                        return ret;
+        }
         de->target_offset = e->target_offset - (origsize - *size);
         t = compat_ipt_get_target(e);
         target = t->u.kernel.target;
@@ -1655,36 +1633,43 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
 }
 
 static int
-compat_check_entry(struct ipt_entry *e, const char *name,
-                                     unsigned int *i)
+compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
 {
+        struct xt_entry_match *ematch;
         struct xt_mtchk_param mtpar;
         unsigned int j;
-        int ret;
+        int ret = 0;
 
         j = 0;
+        mtpar.net       = net;
         mtpar.table     = name;
         mtpar.entryinfo = &e->ip;
         mtpar.hook_mask = e->comefrom;
         mtpar.family    = NFPROTO_IPV4;
-        ret = IPT_MATCH_ITERATE(e, check_match, &mtpar, &j);
-        if (ret)
-                goto cleanup_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = check_match(ematch, &mtpar);
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
 
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
         if (ret)
                 goto cleanup_matches;
-
-        (*i)++;
         return 0;
 
  cleanup_matches:
-        IPT_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
         return ret;
 }
 
 static int
-translate_compat_table(const char *name,
+translate_compat_table(struct net *net,
+                       const char *name,
                        unsigned int valid_hooks,
                        struct xt_table_info **pinfo,
                        void **pentry0,
@@ -1696,6 +1681,8 @@ translate_compat_table(const char *name,
         unsigned int i, j;
         struct xt_table_info *newinfo, *info;
         void *pos, *entry0, *entry1;
+        struct compat_ipt_entry *iter0;
+        struct ipt_entry *iter1;
         unsigned int size;
         int ret;
 
@@ -1714,13 +1701,17 @@ translate_compat_table(const char *name,
         j = 0;
         xt_compat_lock(AF_INET);
         /* Walk through entries, checking offsets. */
-        ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
-                                       check_compat_entry_size_and_hooks,
-                                       info, &size, entry0,
-                                       entry0 + total_size,
-                                       hook_entries, underflows, &j, name);
-        if (ret != 0)
-                goto out_unlock;
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+                                                        entry0,
+                                                        entry0 + total_size,
+                                                        hook_entries,
+                                                        underflows,
+                                                        name);
+                if (ret != 0)
+                        goto out_unlock;
+                ++j;
+        }
 
         ret = -EINVAL;
         if (j != number) {
@@ -1759,9 +1750,12 @@ translate_compat_table(const char *name,
         entry1 = newinfo->entries[raw_smp_processor_id()];
         pos = entry1;
         size = total_size;
-        ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
-                                       compat_copy_entry_from_user,
-                                       &pos, &size, name, newinfo, entry1);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = compat_copy_entry_from_user(iter0, &pos, &size,
+                                                  name, newinfo, entry1);
+                if (ret != 0)
+                        break;
+        }
         xt_compat_flush_offsets(AF_INET);
         xt_compat_unlock(AF_INET);
         if (ret)
@@ -1772,13 +1766,32 @@ translate_compat_table(const char *name,
                 goto free_newinfo;
 
         i = 0;
-        ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                                name, &i);
+        xt_entry_foreach(iter1, entry1, newinfo->size) {
+                ret = compat_check_entry(iter1, net, name);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
         if (ret) {
+                /*
+                 * The first i matches need cleanup_entry (calls ->destroy)
+                 * because they had called ->check already. The other j-i
+                 * entries need only release.
+                 */
+                int skip = i;
                 j -= i;
-                COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
-                                                  compat_release_entry, &j);
-                IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+                xt_entry_foreach(iter0, entry0, newinfo->size) {
+                        if (skip-- > 0)
+                                continue;
+                        if (j-- == 0)
+                                break;
+                        compat_release_entry(iter0);
+                }
+                xt_entry_foreach(iter1, entry1, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter1, net);
+                }
                 xt_free_table_info(newinfo);
                 return ret;
         }
@@ -1796,7 +1809,11 @@ translate_compat_table(const char *name,
 free_newinfo:
         xt_free_table_info(newinfo);
 out:
-        COMPAT_IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                if (j-- == 0)
+                        break;
+                compat_release_entry(iter0);
+        }
         return ret;
 out_unlock:
         xt_compat_flush_offsets(AF_INET);
@@ -1811,6 +1828,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
         struct compat_ipt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct ipt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1833,7 +1851,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+        ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
                                      &newinfo, &loc_cpu_entry, tmp.size,
                                      tmp.num_entries, tmp.hook_entry,
                                      tmp.underflow);
@@ -1849,7 +1867,8 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
@@ -1898,6 +1917,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
         int ret = 0;
         const void *loc_cpu_entry;
         unsigned int i = 0;
+        struct ipt_entry *iter;
 
         counters = alloc_counters(table);
         if (IS_ERR(counters))
@@ -1910,9 +1930,12 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         pos = userptr;
         size = total_size;
-        ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
-                                compat_copy_entry_to_user,
-                                &pos, &size, counters, &i);
+        xt_entry_foreach(iter, loc_cpu_entry, total_size) {
+                ret = compat_copy_entry_to_user(iter, &pos,
+                                                &size, counters, i++);
+                if (ret != 0)
+                        break;
+        }
 
         vfree(counters);
         return ret;
@@ -2086,11 +2109,7 @@ struct xt_table *ipt_register_table(struct net *net,
         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
         memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-        ret = translate_table(table->name, table->valid_hooks,
-                              newinfo, loc_cpu_entry, repl->size,
-                              repl->num_entries,
-                              repl->hook_entry,
-                              repl->underflow);
+        ret = translate_table(net, newinfo, loc_cpu_entry, repl);
         if (ret != 0)
                 goto out_free;
 
@@ -2108,17 +2127,19 @@ out:
         return ERR_PTR(ret);
 }
 
-void ipt_unregister_table(struct xt_table *table)
+void ipt_unregister_table(struct net *net, struct xt_table *table)
 {
         struct xt_table_info *private;
         void *loc_cpu_entry;
         struct module *table_owner = table->me;
+        struct ipt_entry *iter;
 
         private = xt_unregister_table(table);
 
         /* Decrease module usage counts and free resources */
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
-        IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size)
+                cleanup_entry(iter, net);
         if (private->number > private->initial_entries)
                 module_put(table_owner);
         xt_free_table_info(private);
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 2e4f98b85524..ab828400ed71 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -14,6 +14,7 @@
 #include <linux/jhash.h>
 #include <linux/bitops.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
@@ -303,9 +304,9 @@ clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
 
         /* special case: ICMP error handling. conntrack distinguishes between
          * error messages (RELATED) and information requests (see below) */
-        if (ip_hdr(skb)->protocol == IPPROTO_ICMP
-            && (ctinfo == IP_CT_RELATED
-                || ctinfo == IP_CT_RELATED+IP_CT_IS_REPLY))
+        if (ip_hdr(skb)->protocol == IPPROTO_ICMP &&
+            (ctinfo == IP_CT_RELATED ||
+             ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY))
                 return XT_CONTINUE;
 
         /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO,
@@ -362,8 +363,8 @@ static bool clusterip_tg_check(const struct xt_tgchk_param *par)
                 return false;
 
         }
-        if (e->ip.dmsk.s_addr != htonl(0xffffffff)
-            || e->ip.dst.s_addr == 0) {
+        if (e->ip.dmsk.s_addr != htonl(0xffffffff) ||
+            e->ip.dst.s_addr == 0) {
                 printk(KERN_ERR "CLUSTERIP: Please specify destination IP\n");
                 return false;
         }
@@ -495,14 +496,14 @@ arp_mangle(unsigned int hook,
         struct clusterip_config *c;
 
         /* we don't care about non-ethernet and non-ipv4 ARP */
-        if (arp->ar_hrd != htons(ARPHRD_ETHER)
-            || arp->ar_pro != htons(ETH_P_IP)
-            || arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
+        if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
+            arp->ar_pro != htons(ETH_P_IP) ||
+            arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
                 return NF_ACCEPT;
 
         /* we only want to mangle arp requests and replies */
-        if (arp->ar_op != htons(ARPOP_REPLY)
-            && arp->ar_op != htons(ARPOP_REQUEST))
+        if (arp->ar_op != htons(ARPOP_REPLY) &&
+            arp->ar_op != htons(ARPOP_REQUEST))
                 return NF_ACCEPT;
 
         payload = (void *)(arp+1);
@@ -560,8 +561,7 @@ struct clusterip_seq_position {
 
 static void *clusterip_seq_start(struct seq_file *s, loff_t *pos)
 {
-        const struct proc_dir_entry *pde = s->private;
-        struct clusterip_config *c = pde->data;
+        struct clusterip_config *c = s->private;
         unsigned int weight;
         u_int32_t local_nodes;
         struct clusterip_seq_position *idx;
@@ -632,10 +632,9 @@ static int clusterip_proc_open(struct inode *inode, struct file *file)
 
         if (!ret) {
                 struct seq_file *sf = file->private_data;
-                struct proc_dir_entry *pde = PDE(inode);
-                struct clusterip_config *c = pde->data;
+                struct clusterip_config *c = PDE(inode)->data;
 
-                sf->private = pde;
+                sf->private = c;
 
                 clusterip_config_get(c);
         }
@@ -645,8 +644,7 @@ static int clusterip_proc_open(struct inode *inode, struct file *file)
 
 static int clusterip_proc_release(struct inode *inode, struct file *file)
 {
-        struct proc_dir_entry *pde = PDE(inode);
-        struct clusterip_config *c = pde->data;
+        struct clusterip_config *c = PDE(inode)->data;
         int ret;
 
         ret = seq_release(inode, file);
@@ -660,10 +658,9 @@ static int clusterip_proc_release(struct inode *inode, struct file *file)
 static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
                                 size_t size, loff_t *ofs)
 {
+        struct clusterip_config *c = PDE(file->f_path.dentry->d_inode)->data;
 #define PROC_WRITELEN   10
         char buffer[PROC_WRITELEN+1];
-        const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
-        struct clusterip_config *c = pde->data;
         unsigned long nodenum;
 
         if (copy_from_user(buffer, input, PROC_WRITELEN))
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index f7e2fa0974dc..ea5cea2415c1 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -50,7 +50,7 @@ set_ect_tcp(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
         struct tcphdr _tcph, *tcph;
         __be16 oldval;
 
-        /* Not enought header? */
+        /* Not enough header? */
         tcph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
         if (!tcph)
                 return false;
@@ -85,8 +85,8 @@ ecn_tg(struct sk_buff *skb, const struct xt_target_param *par)
                 if (!set_ect_ip(skb, einfo))
                         return NF_DROP;
 
-        if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR)
-            && ip_hdr(skb)->protocol == IPPROTO_TCP)
+        if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR) &&
+            ip_hdr(skb)->protocol == IPPROTO_TCP)
                 if (!set_ect_tcp(skb, einfo))
                         return NF_DROP;
 
@@ -108,8 +108,8 @@ static bool ecn_tg_check(const struct xt_tgchk_param *par)
                         einfo->ip_ect);
                 return false;
         }
-        if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR))
-            && (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
+        if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
+            (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
                 printk(KERN_WARNING "ECN: cannot use TCP operations on a "
                        "non-tcp rule\n");
                 return false;
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index acc44c69eb68..ee128efa1c8d 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -74,8 +74,8 @@ static void dump_packet(const struct nf_loginfo *info,
         if (ntohs(ih->frag_off) & IP_OFFSET)
                 printk("FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
 
-        if ((logflags & IPT_LOG_IPOPT)
-            && ih->ihl * 4 > sizeof(struct iphdr)) {
+        if ((logflags & IPT_LOG_IPOPT) &&
+            ih->ihl * 4 > sizeof(struct iphdr)) {
                 const unsigned char *op;
                 unsigned char _opt[4 * 15 - sizeof(struct iphdr)];
                 unsigned int i, optsize;
@@ -146,8 +146,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 /* Max length: 11 "URGP=65535 " */
                 printk("URGP=%u ", ntohs(th->urg_ptr));
 
-                if ((logflags & IPT_LOG_TCPOPT)
-                    && th->doff * 4 > sizeof(struct tcphdr)) {
+                if ((logflags & IPT_LOG_TCPOPT) &&
+                    th->doff * 4 > sizeof(struct tcphdr)) {
                         unsigned char _opt[4 * 15 - sizeof(struct tcphdr)];
                         const unsigned char *op;
                         unsigned int i, optsize;
@@ -238,9 +238,9 @@ static void dump_packet(const struct nf_loginfo *info,
                 printk("TYPE=%u CODE=%u ", ich->type, ich->code);
 
                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                if (ich->type <= NR_ICMP_TYPES
-                    && required_len[ich->type]
-                    && skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
+                if (ich->type <= NR_ICMP_TYPES &&
+                    required_len[ich->type] &&
+                    skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
                         printk("INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
@@ -276,8 +276,8 @@ static void dump_packet(const struct nf_loginfo *info,
                         }
 
                         /* Max length: 10 "MTU=65535 " */
-                        if (ich->type == ICMP_DEST_UNREACH
-                            && ich->code == ICMP_FRAG_NEEDED)
+                        if (ich->type == ICMP_DEST_UNREACH &&
+                            ich->code == ICMP_FRAG_NEEDED)
                                 printk("MTU=%u ", ntohs(ich->un.frag.mtu));
                 }
                 break;
@@ -407,8 +407,8 @@ ipt_log_packet(u_int8_t pf,
         if (in && !out) {
                 /* MAC logging for input chain only. */
                 printk("MAC=");
-                if (skb->dev && skb->dev->hard_header_len
-                    && skb->mac_header != skb->network_header) {
+                if (skb->dev && skb->dev->hard_header_len &&
+                    skb->mac_header != skb->network_header) {
                         int i;
                         const unsigned char *p = skb_mac_header(skb);
                         for (i = 0; i < skb->dev->hard_header_len; i++,p++)
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index dada0863946d..650b54042b01 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -59,8 +59,8 @@ masquerade_tg(struct sk_buff *skb, const struct xt_target_param *par)
         ct = nf_ct_get(skb, &ctinfo);
         nat = nfct_nat(ct);
 
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
-                            || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
+        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                            ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
 
         /* Source address is 0.0.0.0 - locally generated packet that is
          * probably not supposed to be masqueraded.
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index c93ae44bff2a..a0e8bcf04159 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -12,6 +12,7 @@
 
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
 #include <linux/icmp.h>
@@ -184,8 +185,8 @@ static bool reject_tg_check(const struct xt_tgchk_param *par)
                 return false;
         } else if (rejinfo->with == IPT_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
-                if (e->ip.proto != IPPROTO_TCP
-                    || (e->ip.invflags & XT_INV_PROTO)) {
+                if (e->ip.proto != IPPROTO_TCP ||
+                    (e->ip.invflags & XT_INV_PROTO)) {
                         printk("ipt_REJECT: TCP_RESET invalid for non-tcp\n");
                         return false;
                 }
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index d32cc4bb328a..0dbe697f164f 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -33,6 +33,7 @@
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/kernel.h>
 #include <linux/timer.h>
@@ -226,9 +227,9 @@ static void ipt_ulog_packet(unsigned int hooknum,
         else
                 *(pm->prefix) = '\0';
 
-        if (in && in->hard_header_len > 0
-            && skb->mac_header != skb->network_header
-            && in->hard_header_len <= ULOG_MAC_LEN) {
+        if (in && in->hard_header_len > 0 &&
+            skb->mac_header != skb->network_header &&
+            in->hard_header_len <= ULOG_MAC_LEN) {
                 memcpy(pm->mac, skb_mac_header(skb), in->hard_header_len);
                 pm->mac_len = in->hard_header_len;
         } else
@@ -338,7 +339,7 @@ struct compat_ipt_ulog_info {
         char            prefix[ULOG_PREFIX_LEN];
 };
 
-static void ulog_tg_compat_from_user(void *dst, void *src)
+static void ulog_tg_compat_from_user(void *dst, const void *src)
 {
         const struct compat_ipt_ulog_info *cl = src;
         struct ipt_ulog_info l = {
@@ -351,7 +352,7 @@ static void ulog_tg_compat_from_user(void *dst, void *src)
         memcpy(dst, &l, sizeof(l));
 }
 
-static int ulog_tg_compat_to_user(void __user *dst, void *src)
+static int ulog_tg_compat_to_user(void __user *dst, const void *src)
 {
         const struct ipt_ulog_info *l = src;
         struct compat_ipt_ulog_info cl = {
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c
index 6289b64144c6..2a1e56b71908 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/ipv4/netfilter/ipt_ecn.c
@@ -96,8 +96,8 @@ static bool ecn_mt_check(const struct xt_mtchk_param *par)
         if (info->invert & IPT_ECN_OP_MATCH_MASK)
                 return false;
 
-        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)
-            && ip->proto != IPPROTO_TCP) {
+        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) &&
+            ip->proto != IPPROTO_TCP) {
                 printk(KERN_WARNING "ipt_ecn: can't match TCP bits in rule for"
                        " non-tcp packets\n");
                 return false;
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index df566cbd68e5..55392466daa4 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 
 MODULE_LICENSE("GPL");
@@ -23,104 +24,32 @@ MODULE_DESCRIPTION("iptables filter table");
                             (1 << NF_INET_FORWARD) | \
                             (1 << NF_INET_LOCAL_OUT))
 
-static struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[3];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "filter",
-                .valid_hooks = FILTER_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_IPV4,
+        .priority       = NF_IP_PRI_FILTER,
 };
 
-/* The work comes in here from netfilter.c. */
-static unsigned int
-ipt_local_in_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_filter);
-}
-
 static unsigned int
-ipt_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
+iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
+                    const struct net_device *in, const struct net_device *out,
+                    int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_filter);
-}
+        const struct net *net;
 
-static unsigned int
-ipt_local_out_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
-{
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (hook == NF_INET_LOCAL_OUT &&
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* root is playing with raw sockets. */
                 return NF_ACCEPT;
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_filter);
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
 }
 
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook           = ipt_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = ipt_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = ipt_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-};
+static struct nf_hook_ops *filter_ops __read_mostly;
 
 /* Default to forward because I got too much mail already. */
 static int forward = NF_ACCEPT;
@@ -128,9 +57,18 @@ module_param(forward, bool, 0000);
 
 static int __net_init iptable_filter_net_init(struct net *net)
 {
-        /* Register table */
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&packet_filter);
+        if (repl == NULL)
+                return -ENOMEM;
+        /* Entry 1 is the FORWARD hook */
+        ((struct ipt_standard *)repl->entries)[1].target.verdict =
+                -forward - 1;
+
         net->ipv4.iptable_filter =
-                ipt_register_table(net, &packet_filter, &initial_table.repl);
+                ipt_register_table(net, &packet_filter, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_filter))
                 return PTR_ERR(net->ipv4.iptable_filter);
         return 0;
@@ -138,7 +76,7 @@ static int __net_init iptable_filter_net_init(struct net *net)
 
 static void __net_exit iptable_filter_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_filter);
+        ipt_unregister_table(net, net->ipv4.iptable_filter);
 }
 
 static struct pernet_operations iptable_filter_net_ops = {
@@ -155,17 +93,16 @@ static int __init iptable_filter_init(void)
                 return -EINVAL;
         }
 
-        /* Entry 1 is the FORWARD hook */
-        initial_table.entries[1].target.verdict = -forward - 1;
-
         ret = register_pernet_subsys(&iptable_filter_net_ops);
         if (ret < 0)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);
+        if (IS_ERR(filter_ops)) {
+                ret = PTR_ERR(filter_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -176,7 +113,7 @@ static int __init iptable_filter_init(void)
 
 static void __exit iptable_filter_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&packet_filter, filter_ops);
         unregister_pernet_subsys(&iptable_filter_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 036047f9b0f2..294a2a32f293 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -12,6 +12,7 @@
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/route.h>
 #include <linux/ip.h>
@@ -27,101 +28,16 @@ MODULE_DESCRIPTION("iptables mangle table");
                             (1 << NF_INET_LOCAL_OUT) | \
                             (1 << NF_INET_POST_ROUTING))
 
-/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
-static const struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[5];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "mangle",
-                .valid_hooks = MANGLE_VALID_HOOKS,
-                .num_entries = 6,
-                .size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table packet_mangler = {
         .name           = "mangle",
         .valid_hooks    = MANGLE_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_IPV4,
+        .priority       = NF_IP_PRI_MANGLE,
 };
 
-/* The work comes in here from netfilter.c. */
-static unsigned int
-ipt_pre_routing_hook(unsigned int hook,
-                     struct sk_buff *skb,
-                     const struct net_device *in,
-                     const struct net_device *out,
-                     int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_mangle);
-}
-
-static unsigned int
-ipt_post_routing_hook(unsigned int hook,
-                      struct sk_buff *skb,
-                      const struct net_device *in,
-                      const struct net_device *out,
-                      int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_mangle);
-}
-
-static unsigned int
-ipt_local_in_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_mangle);
-}
-
-static unsigned int
-ipt_forward_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_mangle);
-}
-
 static unsigned int
-ipt_local_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
+ipt_mangle_out(struct sk_buff *skb, const struct net_device *out)
 {
         unsigned int ret;
         const struct iphdr *iph;
@@ -130,8 +46,8 @@ ipt_local_hook(unsigned int hook,
         u_int32_t mark;
 
         /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
 
         /* Save things which could affect route */
@@ -141,7 +57,7 @@ ipt_local_hook(unsigned int hook,
         daddr = iph->daddr;
         tos = iph->tos;
 
-        ret = ipt_do_table(skb, hook, in, out,
+        ret = ipt_do_table(skb, NF_INET_LOCAL_OUT, NULL, out,
                            dev_net(out)->ipv4.iptable_mangle);
         /* Reroute for ANY change. */
         if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
@@ -158,49 +74,36 @@ ipt_local_hook(unsigned int hook,
         return ret;
 }
 
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook           = ipt_pre_routing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_forward_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_local_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_post_routing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_POST_ROUTING,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-};
+/* The work comes in here from netfilter.c. */
+static unsigned int
+iptable_mangle_hook(unsigned int hook,
+                     struct sk_buff *skb,
+                     const struct net_device *in,
+                     const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
+{
+        if (hook == NF_INET_LOCAL_OUT)
+                return ipt_mangle_out(skb, out);
+        if (hook == NF_INET_POST_ROUTING)
+                return ipt_do_table(skb, hook, in, out,
+                                    dev_net(out)->ipv4.iptable_mangle);
+        /* PREROUTING/INPUT/FORWARD: */
+        return ipt_do_table(skb, hook, in, out,
+                            dev_net(in)->ipv4.iptable_mangle);
+}
+
+static struct nf_hook_ops *mangle_ops __read_mostly;
 
 static int __net_init iptable_mangle_net_init(struct net *net)
 {
-        /* Register table */
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&packet_mangler);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv4.iptable_mangle =
-                ipt_register_table(net, &packet_mangler, &initial_table.repl);
+                ipt_register_table(net, &packet_mangler, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_mangle))
                 return PTR_ERR(net->ipv4.iptable_mangle);
         return 0;
@@ -208,7 +111,7 @@ static int __net_init iptable_mangle_net_init(struct net *net)
 
 static void __net_exit iptable_mangle_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_mangle);
+        ipt_unregister_table(net, net->ipv4.iptable_mangle);
 }
 
 static struct pernet_operations iptable_mangle_net_ops = {
@@ -225,9 +128,11 @@ static int __init iptable_mangle_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        mangle_ops = xt_hook_link(&packet_mangler, iptable_mangle_hook);
+        if (IS_ERR(mangle_ops)) {
+                ret = PTR_ERR(mangle_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -238,7 +143,7 @@ static int __init iptable_mangle_init(void)
 
 static void __exit iptable_mangle_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&packet_mangler, mangle_ops);
         unregister_pernet_subsys(&iptable_mangle_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 993edc23be09..07fb710cd722 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -5,94 +5,49 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 
 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
 
-static const struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[2];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "raw",
-                .valid_hooks = RAW_VALID_HOOKS,
-                .num_entries = 3,
-                .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard)
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT]  = sizeof(struct ipt_standard)
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table packet_raw = {
         .name = "raw",
         .valid_hooks =  RAW_VALID_HOOKS,
         .me = THIS_MODULE,
         .af = NFPROTO_IPV4,
+        .priority = NF_IP_PRI_RAW,
 };
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ipt_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
+iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
+                 const struct net_device *in, const struct net_device *out,
+                 int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_raw);
-}
+        const struct net *net;
 
-static unsigned int
-ipt_local_hook(unsigned int hook,
-               struct sk_buff *skb,
-               const struct net_device *in,
-               const struct net_device *out,
-               int (*okfn)(struct sk_buff *))
-{
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (hook == NF_INET_LOCAL_OUT && 
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* root is playing with raw sockets. */
                 return NF_ACCEPT;
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_raw);
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
 }
 
-/* 'raw' is the very first table. */
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook = ipt_hook,
-                .pf = NFPROTO_IPV4,
-                .hooknum = NF_INET_PRE_ROUTING,
-                .priority = NF_IP_PRI_RAW,
-                .owner = THIS_MODULE,
-        },
-        {
-                .hook = ipt_local_hook,
-                .pf = NFPROTO_IPV4,
-                .hooknum = NF_INET_LOCAL_OUT,
-                .priority = NF_IP_PRI_RAW,
-                .owner = THIS_MODULE,
-        },
-};
+static struct nf_hook_ops *rawtable_ops __read_mostly;
 
 static int __net_init iptable_raw_net_init(struct net *net)
 {
-        /* Register table */
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&packet_raw);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv4.iptable_raw =
-                ipt_register_table(net, &packet_raw, &initial_table.repl);
+                ipt_register_table(net, &packet_raw, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_raw))
                 return PTR_ERR(net->ipv4.iptable_raw);
         return 0;
@@ -100,7 +55,7 @@ static int __net_init iptable_raw_net_init(struct net *net)
 
 static void __net_exit iptable_raw_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_raw);
+        ipt_unregister_table(net, net->ipv4.iptable_raw);
 }
 
 static struct pernet_operations iptable_raw_net_ops = {
@@ -117,9 +72,11 @@ static int __init iptable_raw_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook);
+        if (IS_ERR(rawtable_ops)) {
+                ret = PTR_ERR(rawtable_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -130,7 +87,7 @@ static int __init iptable_raw_init(void)
 
 static void __exit iptable_raw_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&packet_raw, rawtable_ops);
         unregister_pernet_subsys(&iptable_raw_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 99eb76c65d25..be45bdc4c602 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -17,6 +17,7 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 
 MODULE_LICENSE("GPL");
@@ -27,109 +28,44 @@ MODULE_DESCRIPTION("iptables security table, for MAC rules");
                                 (1 << NF_INET_FORWARD) | \
                                 (1 << NF_INET_LOCAL_OUT)
 
-static const struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[3];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "security",
-                .valid_hooks = SECURITY_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table security_table = {
         .name           = "security",
         .valid_hooks    = SECURITY_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_IPV4,
+        .priority       = NF_IP_PRI_SECURITY,
 };
 
 static unsigned int
-ipt_local_in_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_security);
-}
-
-static unsigned int
-ipt_forward_hook(unsigned int hook,
-                 struct sk_buff *skb,
-                 const struct net_device *in,
-                 const struct net_device *out,
-                 int (*okfn)(struct sk_buff *))
+iptable_security_hook(unsigned int hook, struct sk_buff *skb,
+                      const struct net_device *in,
+                      const struct net_device *out,
+                      int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_security);
-}
+        const struct net *net;
 
-static unsigned int
-ipt_local_out_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
-{
-        /* Somebody is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (hook == NF_INET_LOCAL_OUT &&
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* Somebody is playing with raw sockets. */
                 return NF_ACCEPT;
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_security);
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
 }
 
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook           = ipt_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP_PRI_SECURITY,
-        },
-        {
-                .hook           = ipt_forward_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP_PRI_SECURITY,
-        },
-        {
-                .hook           = ipt_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV4,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP_PRI_SECURITY,
-        },
-};
+static struct nf_hook_ops *sectbl_ops __read_mostly;
 
 static int __net_init iptable_security_net_init(struct net *net)
 {
-        net->ipv4.iptable_security =
-                ipt_register_table(net, &security_table, &initial_table.repl);
+        struct ipt_replace *repl;
 
+        repl = ipt_alloc_initial_table(&security_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv4.iptable_security =
+                ipt_register_table(net, &security_table, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_security))
                 return PTR_ERR(net->ipv4.iptable_security);
 
@@ -138,7 +74,7 @@ static int __net_init iptable_security_net_init(struct net *net)
 
 static void __net_exit iptable_security_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_security);
+        ipt_unregister_table(net, net->ipv4.iptable_security);
 }
 
 static struct pernet_operations iptable_security_net_ops = {
@@ -154,9 +90,11 @@ static int __init iptable_security_init(void)
         if (ret < 0)
                 return ret;
 
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        sectbl_ops = xt_hook_link(&security_table, iptable_security_hook);
+        if (IS_ERR(sectbl_ops)) {
+                ret = PTR_ERR(sectbl_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -167,7 +105,7 @@ cleanup_table:
 
 static void __exit iptable_security_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&security_table, sectbl_ops);
         unregister_pernet_subsys(&iptable_security_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index aa95bb82ee6c..2bb1f87051c4 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -22,6 +22,7 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/nf_nat_helper.h>
@@ -195,7 +196,6 @@ static int log_invalid_proto_max = 255;
 
 static ctl_table ip_ct_sysctl_table[] = {
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_MAX,
                 .procname       = "ip_conntrack_max",
                 .data           = &nf_conntrack_max,
                 .maxlen         = sizeof(int),
@@ -203,7 +203,6 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_COUNT,
                 .procname       = "ip_conntrack_count",
                 .data           = &init_net.ct.count,
                 .maxlen         = sizeof(int),
@@ -211,15 +210,13 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_BUCKETS,
                 .procname       = "ip_conntrack_buckets",
-                .data           = &nf_conntrack_htable_size,
+                .data           = &init_net.ct.htable_size,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0444,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_CHECKSUM,
                 .procname       = "ip_conntrack_checksum",
                 .data           = &init_net.ct.sysctl_checksum,
                 .maxlen         = sizeof(int),
@@ -227,19 +224,15 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_LOG_INVALID,
                 .procname       = "ip_conntrack_log_invalid",
                 .data           = &init_net.ct.sysctl_log_invalid,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &log_invalid_proto_min,
                 .extra2         = &log_invalid_proto_max,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */
 
@@ -255,10 +248,10 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
         struct nf_conntrack_tuple tuple;
 
         memset(&tuple, 0, sizeof(tuple));
-        tuple.src.u3.ip = inet->rcv_saddr;
-        tuple.src.u.tcp.port = inet->sport;
-        tuple.dst.u3.ip = inet->daddr;
-        tuple.dst.u.tcp.port = inet->dport;
+        tuple.src.u3.ip = inet->inet_rcv_saddr;
+        tuple.src.u.tcp.port = inet->inet_sport;
+        tuple.dst.u3.ip = inet->inet_daddr;
+        tuple.dst.u.tcp.port = inet->inet_dport;
         tuple.src.l3num = PF_INET;
         tuple.dst.protonum = sk->sk_protocol;
 
@@ -274,7 +267,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                 return -EINVAL;
         }
 
-        h = nf_conntrack_find_get(sock_net(sk), &tuple);
+        h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
         if (h) {
                 struct sockaddr_in sin;
                 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 8668a3defda6..2fb7b76da94f 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -32,7 +32,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
         struct hlist_nulls_node *n;
 
         for (st->bucket = 0;
-             st->bucket < nf_conntrack_htable_size;
+             st->bucket < net->ct.htable_size;
              st->bucket++) {
                 n = rcu_dereference(net->ct.hash[st->bucket].first);
                 if (!is_a_nulls(n))
@@ -50,7 +50,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
         head = rcu_dereference(head->next);
         while (is_a_nulls(head)) {
                 if (likely(get_nulls_value(head) == st->bucket)) {
-                        if (++st->bucket >= nf_conntrack_htable_size)
+                        if (++st->bucket >= net->ct.htable_size)
                                 return NULL;
                 }
                 head = rcu_dereference(net->ct.hash[st->bucket].first);
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index d71ba7677344..7404bde95994 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -18,6 +18,7 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_log.h>
 
 static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
@@ -54,8 +55,8 @@ static const u_int8_t invmap[] = {
 static bool icmp_invert_tuple(struct nf_conntrack_tuple *tuple,
                               const struct nf_conntrack_tuple *orig)
 {
-        if (orig->dst.u.icmp.type >= sizeof(invmap)
-            || !invmap[orig->dst.u.icmp.type])
+        if (orig->dst.u.icmp.type >= sizeof(invmap) ||
+            !invmap[orig->dst.u.icmp.type])
                 return false;
 
         tuple->src.u.icmp.id = orig->src.u.icmp.id;
@@ -101,8 +102,8 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
                 [ICMP_ADDRESS] = 1
         };
 
-        if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
-            || !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
+        if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new) ||
+            !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
                 /* Can't create a new ICMP `conn' with this. */
                 pr_debug("icmp: can't create new conn with type %u\n",
                          ct->tuplehash[0].tuple.dst.u.icmp.type);
@@ -114,13 +115,14 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
 
 /* Returns conntrack if it dealt with ICMP, and filled in skb fields */
 static int
-icmp_error_message(struct net *net, struct sk_buff *skb,
+icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
                  enum ip_conntrack_info *ctinfo,
                  unsigned int hooknum)
 {
         struct nf_conntrack_tuple innertuple, origtuple;
         const struct nf_conntrack_l4proto *innerproto;
         const struct nf_conntrack_tuple_hash *h;
+        u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
 
         NF_CT_ASSERT(skb->nfct == NULL);
 
@@ -146,7 +148,7 @@ icmp_error_message(struct net *net, struct sk_buff *skb,
 
         *ctinfo = IP_CT_RELATED;
 
-        h = nf_conntrack_find_get(net, &innertuple);
+        h = nf_conntrack_find_get(net, zone, &innertuple);
         if (!h) {
                 pr_debug("icmp_error_message: no match\n");
                 return -NF_ACCEPT;
@@ -163,7 +165,8 @@ icmp_error_message(struct net *net, struct sk_buff *skb,
 
 /* Small and modified version of icmp_rcv */
 static int
-icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
+icmp_error(struct net *net, struct nf_conn *tmpl,
+           struct sk_buff *skb, unsigned int dataoff,
            enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
 {
         const struct icmphdr *icmph;
@@ -201,14 +204,14 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
         }
 
         /* Need to track icmp error message? */
-        if (icmph->type != ICMP_DEST_UNREACH
-            && icmph->type != ICMP_SOURCE_QUENCH
-            && icmph->type != ICMP_TIME_EXCEEDED
-            && icmph->type != ICMP_PARAMETERPROB
-            && icmph->type != ICMP_REDIRECT)
+        if (icmph->type != ICMP_DEST_UNREACH &&
+            icmph->type != ICMP_SOURCE_QUENCH &&
+            icmph->type != ICMP_TIME_EXCEEDED &&
+            icmph->type != ICMP_PARAMETERPROB &&
+            icmph->type != ICMP_REDIRECT)
                 return NF_ACCEPT;
 
-        return icmp_error_message(net, skb, ctinfo, hooknum);
+        return icmp_error_message(net, tmpl, skb, ctinfo, hooknum);
 }
 
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
@@ -238,17 +241,17 @@ static const struct nla_policy icmp_nla_policy[CTA_PROTO_MAX+1] = {
 static int icmp_nlattr_to_tuple(struct nlattr *tb[],
                                 struct nf_conntrack_tuple *tuple)
 {
-        if (!tb[CTA_PROTO_ICMP_TYPE]
-            || !tb[CTA_PROTO_ICMP_CODE]
-            || !tb[CTA_PROTO_ICMP_ID])
+        if (!tb[CTA_PROTO_ICMP_TYPE] ||
+            !tb[CTA_PROTO_ICMP_CODE] ||
+            !tb[CTA_PROTO_ICMP_ID])
                 return -EINVAL;
 
         tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
         tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
         tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMP_ID]);
 
-        if (tuple->dst.u.icmp.type >= sizeof(invmap)
-            || !invmap[tuple->dst.u.icmp.type])
+        if (tuple->dst.u.icmp.type >= sizeof(invmap) ||
+            !invmap[tuple->dst.u.icmp.type])
                 return -EINVAL;
 
         return 0;
@@ -270,9 +273,7 @@ static struct ctl_table icmp_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name = 0
-        }
+        { }
 };
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 static struct ctl_table icmp_compat_sysctl_table[] = {
@@ -283,9 +284,7 @@ static struct ctl_table icmp_compat_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name = 0
-        }
+        { }
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif /* CONFIG_SYSCTL */
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index fa2d6b6fc3e5..cb763ae9ed90 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -14,8 +14,13 @@
 #include <net/route.h>
 #include <net/ip.h>
 
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netfilter/nf_conntrack.h>
+#endif
+#include <net/netfilter/nf_conntrack_zones.h>
 
 /* Returns new sk_buff, or NULL */
 static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
@@ -34,6 +39,27 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
         return err;
 }
 
+static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
+                                              struct sk_buff *skb)
+{
+        u16 zone = NF_CT_DEFAULT_ZONE;
+
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        if (skb->nfct)
+                zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+#endif
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP_DEFRAG_CONNTRACK_IN + zone;
+        else
+                return IP_DEFRAG_CONNTRACK_OUT + zone;
+}
+
 static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                           struct sk_buff *skb,
                                           const struct net_device *in,
@@ -44,16 +70,14 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
         /* Previously seen (loopback)?  Ignore.  Do this before
            fragment check. */
-        if (skb->nfct)
+        if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
                 return NF_ACCEPT;
 #endif
 #endif
         /* Gather fragments. */
         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                if (nf_ct_ipv4_gather_frags(skb,
-                                            hooknum == NF_INET_PRE_ROUTING ?
-                                            IP_DEFRAG_CONNTRACK_IN :
-                                            IP_DEFRAG_CONNTRACK_OUT))
+                enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
+                if (nf_ct_ipv4_gather_frags(skb, user))
                         return NF_STOLEN;
         }
         return NF_ACCEPT;
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index fe1a64479dd0..4f8bddb760c9 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/skbuff.h>
+#include <linux/gfp.h>
 #include <net/checksum.h>
 #include <net/icmp.h>
 #include <net/ip.h>
@@ -30,14 +31,12 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 static DEFINE_SPINLOCK(nf_nat_lock);
 
 static struct nf_conntrack_l3proto *l3proto __read_mostly;
 
-/* Calculated at init based on memory size */
-static unsigned int nf_nat_htable_size __read_mostly;
-
 #define MAX_IP_NAT_PROTO 256
 static const struct nf_nat_protocol *nf_nat_protos[MAX_IP_NAT_PROTO]
                                                 __read_mostly;
@@ -72,15 +71,16 @@ EXPORT_SYMBOL_GPL(nf_nat_proto_put);
 
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
-hash_by_src(const struct nf_conntrack_tuple *tuple)
+hash_by_src(const struct net *net, u16 zone,
+            const struct nf_conntrack_tuple *tuple)
 {
         unsigned int hash;
 
         /* Original src, to ensure we map it consistently if poss. */
         hash = jhash_3words((__force u32)tuple->src.u3.ip,
-                            (__force u32)tuple->src.u.all,
+                            (__force u32)tuple->src.u.all ^ zone,
                             tuple->dst.protonum, 0);
-        return ((u64)hash * nf_nat_htable_size) >> 32;
+        return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
 }
 
 /* Is this tuple already taken? (not by us) */
@@ -142,12 +142,12 @@ same_src(const struct nf_conn *ct,
 
 /* Only called for SRC manip */
 static int
-find_appropriate_src(struct net *net,
+find_appropriate_src(struct net *net, u16 zone,
                      const struct nf_conntrack_tuple *tuple,
                      struct nf_conntrack_tuple *result,
                      const struct nf_nat_range *range)
 {
-        unsigned int h = hash_by_src(tuple);
+        unsigned int h = hash_by_src(net, zone, tuple);
         const struct nf_conn_nat *nat;
         const struct nf_conn *ct;
         const struct hlist_node *n;
@@ -155,7 +155,7 @@ find_appropriate_src(struct net *net,
         rcu_read_lock();
         hlist_for_each_entry_rcu(nat, n, &net->ipv4.nat_bysource[h], bysource) {
                 ct = nat->ct;
-                if (same_src(ct, tuple)) {
+                if (same_src(ct, tuple) && nf_ct_zone(ct) == zone) {
                         /* Copy source part from reply tuple. */
                         nf_ct_invert_tuplepr(result,
                                        &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
@@ -178,7 +178,7 @@ find_appropriate_src(struct net *net,
    the ip with the lowest src-ip/dst-ip/proto usage.
 */
 static void
-find_best_ips_proto(struct nf_conntrack_tuple *tuple,
+find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
                     const struct nf_nat_range *range,
                     const struct nf_conn *ct,
                     enum nf_nat_manip_type maniptype)
@@ -212,7 +212,7 @@ find_best_ips_proto(struct nf_conntrack_tuple *tuple,
         maxip = ntohl(range->max_ip);
         j = jhash_2words((__force u32)tuple->src.u3.ip,
                          range->flags & IP_NAT_RANGE_PERSISTENT ?
-                                0 : (__force u32)tuple->dst.u3.ip, 0);
+                                0 : (__force u32)tuple->dst.u3.ip ^ zone, 0);
         j = ((u64)j * (maxip - minip + 1)) >> 32;
         *var_ipp = htonl(minip + j);
 }
@@ -232,6 +232,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
 {
         struct net *net = nf_ct_net(ct);
         const struct nf_nat_protocol *proto;
+        u16 zone = nf_ct_zone(ct);
 
         /* 1) If this srcip/proto/src-proto-part is currently mapped,
            and that same mapping gives a unique tuple within the given
@@ -242,7 +243,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
            manips not an issue.  */
         if (maniptype == IP_NAT_MANIP_SRC &&
             !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
-                if (find_appropriate_src(net, orig_tuple, tuple, range)) {
+                if (find_appropriate_src(net, zone, orig_tuple, tuple, range)) {
                         pr_debug("get_unique_tuple: Found current src map\n");
                         if (!nf_nat_used_tuple(tuple, ct))
                                 return;
@@ -252,7 +253,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
         /* 2) Select the least-used IP/proto combination in the given
            range. */
         *tuple = *orig_tuple;
-        find_best_ips_proto(tuple, range, ct, maniptype);
+        find_best_ips_proto(zone, tuple, range, ct, maniptype);
 
         /* 3) The per-protocol part of the manip is made to map into
            the range to make a unique tuple. */
@@ -330,7 +331,8 @@ nf_nat_setup_info(struct nf_conn *ct,
         if (have_to_hash) {
                 unsigned int srchash;
 
-                srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+                srchash = hash_by_src(net, nf_ct_zone(ct),
+                                      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                 spin_lock_bh(&nf_nat_lock);
                 /* nf_conntrack_alter_reply might re-allocate exntension aera */
                 nat = nfct_nat(ct);
@@ -679,8 +681,10 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
 
 static int __net_init nf_nat_net_init(struct net *net)
 {
-        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size,
-                                                      &net->ipv4.nat_vmalloced, 0);
+        /* Leave them the same for the moment. */
+        net->ipv4.nat_htable_size = net->ct.htable_size;
+        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size,
+                                                       &net->ipv4.nat_vmalloced, 0);
         if (!net->ipv4.nat_bysource)
                 return -ENOMEM;
         return 0;
@@ -703,7 +707,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
         nf_ct_iterate_cleanup(net, &clean_nat, NULL);
         synchronize_rcu();
         nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_vmalloced,
-                             nf_nat_htable_size);
+                             net->ipv4.nat_htable_size);
 }
 
 static struct pernet_operations nf_nat_net_ops = {
@@ -724,9 +728,6 @@ static int __init nf_nat_init(void)
                 return ret;
         }
 
-        /* Leave them the same for the moment. */
-        nf_nat_htable_size = nf_conntrack_htable_size;
-
         ret = register_pernet_subsys(&nf_nat_net_ops);
         if (ret < 0)
                 goto cleanup_extend;
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c
index a1d5d58a58bf..86e0e84ff0a0 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/ipv4/netfilter/nf_nat_ftp.c
@@ -27,76 +27,29 @@ MODULE_ALIAS("ip_nat_ftp");
 
 /* FIXME: Time out? --RR */
 
-static int
-mangle_rfc959_packet(struct sk_buff *skb,
-                     __be32 newip,
-                     u_int16_t port,
-                     unsigned int matchoff,
-                     unsigned int matchlen,
-                     struct nf_conn *ct,
-                     enum ip_conntrack_info ctinfo)
+static int nf_nat_ftp_fmt_cmd(enum nf_ct_ftp_type type,
+                              char *buffer, size_t buflen,
+                              __be32 addr, u16 port)
 {
-        char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
-
-        sprintf(buffer, "%u,%u,%u,%u,%u,%u",
-                NIPQUAD(newip), port>>8, port&0xFF);
-
-        pr_debug("calling nf_nat_mangle_tcp_packet\n");
-
-        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
-                                        matchlen, buffer, strlen(buffer));
-}
-
-/* |1|132.235.1.2|6275| */
-static int
-mangle_eprt_packet(struct sk_buff *skb,
-                   __be32 newip,
-                   u_int16_t port,
-                   unsigned int matchoff,
-                   unsigned int matchlen,
-                   struct nf_conn *ct,
-                   enum ip_conntrack_info ctinfo)
-{
-        char buffer[sizeof("|1|255.255.255.255|65535|")];
-
-        sprintf(buffer, "|1|%u.%u.%u.%u|%u|", NIPQUAD(newip), port);
-
-        pr_debug("calling nf_nat_mangle_tcp_packet\n");
-
-        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
-                                        matchlen, buffer, strlen(buffer));
-}
-
-/* |1|132.235.1.2|6275| */
-static int
-mangle_epsv_packet(struct sk_buff *skb,
-                   __be32 newip,
-                   u_int16_t port,
-                   unsigned int matchoff,
-                   unsigned int matchlen,
-                   struct nf_conn *ct,
-                   enum ip_conntrack_info ctinfo)
-{
-        char buffer[sizeof("|||65535|")];
-
-        sprintf(buffer, "|||%u|", port);
-
-        pr_debug("calling nf_nat_mangle_tcp_packet\n");
+        switch (type) {
+        case NF_CT_FTP_PORT:
+        case NF_CT_FTP_PASV:
+                return snprintf(buffer, buflen, "%u,%u,%u,%u,%u,%u",
+                                ((unsigned char *)&addr)[0],
+                                ((unsigned char *)&addr)[1],
+                                ((unsigned char *)&addr)[2],
+                                ((unsigned char *)&addr)[3],
+                                port >> 8,
+                                port & 0xFF);
+        case NF_CT_FTP_EPRT:
+                return snprintf(buffer, buflen, "|1|%pI4|%u|", &addr, port);
+        case NF_CT_FTP_EPSV:
+                return snprintf(buffer, buflen, "|||%u|", port);
+        }
 
-        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
-                                        matchlen, buffer, strlen(buffer));
+        return 0;
 }
 
-static int (*mangle[])(struct sk_buff *, __be32, u_int16_t,
-                       unsigned int, unsigned int, struct nf_conn *,
-                       enum ip_conntrack_info)
-= {
-        [NF_CT_FTP_PORT] = mangle_rfc959_packet,
-        [NF_CT_FTP_PASV] = mangle_rfc959_packet,
-        [NF_CT_FTP_EPRT] = mangle_eprt_packet,
-        [NF_CT_FTP_EPSV] = mangle_epsv_packet
-};
-
 /* So, this packet has hit the connection tracking matching code.
    Mangle it, and change the expectation to match the new version. */
 static unsigned int nf_nat_ftp(struct sk_buff *skb,
@@ -110,6 +63,8 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
         u_int16_t port;
         int dir = CTINFO2DIR(ctinfo);
         struct nf_conn *ct = exp->master;
+        char buffer[sizeof("|1|255.255.255.255|65535|")];
+        unsigned int buflen;
 
         pr_debug("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen);
 
@@ -132,11 +87,21 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
         if (port == 0)
                 return NF_DROP;
 
-        if (!mangle[type](skb, newip, port, matchoff, matchlen, ct, ctinfo)) {
-                nf_ct_unexpect_related(exp);
-                return NF_DROP;
-        }
+        buflen = nf_nat_ftp_fmt_cmd(type, buffer, sizeof(buffer), newip, port);
+        if (!buflen)
+                goto out;
+
+        pr_debug("calling nf_nat_mangle_tcp_packet\n");
+
+        if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
+                                      matchlen, buffer, buflen))
+                goto out;
+
         return NF_ACCEPT;
+
+out:
+        nf_ct_unexpect_related(exp);
+        return NF_DROP;
 }
 
 static void __exit nf_nat_ftp_fini(void)
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index f9520fa3aba9..4a0c6b548eee 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -8,6 +8,7 @@
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
+#include <linux/gfp.h>
 #include <linux/kmod.h>
 #include <linux/types.h>
 #include <linux/timer.h>
@@ -41,18 +42,14 @@ adjust_tcp_sequence(u32 seq,
                     struct nf_conn *ct,
                     enum ip_conntrack_info ctinfo)
 {
-        int dir;
-        struct nf_nat_seq *this_way, *other_way;
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way = &nat->seq[dir];
 
-        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n", seq, seq);
-
-        dir = CTINFO2DIR(ctinfo);
-
-        this_way = &nat->seq[dir];
-        other_way = &nat->seq[!dir];
+        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n",
+                 seq, sizediff);
 
-        pr_debug("nf_nat_resize_packet: Seq_offset before: ");
+        pr_debug("adjust_tcp_sequence: Seq_offset before: ");
         DUMP_OFFSET(this_way);
 
         spin_lock_bh(&nf_nat_seqofs_lock);
@@ -63,13 +60,13 @@ adjust_tcp_sequence(u32 seq,
          * retransmit */
         if (this_way->offset_before == this_way->offset_after ||
             before(this_way->correction_pos, seq)) {
-                   this_way->correction_pos = seq;
-                   this_way->offset_before = this_way->offset_after;
-                   this_way->offset_after += sizediff;
+                this_way->correction_pos = seq;
+                this_way->offset_before = this_way->offset_after;
+                this_way->offset_after += sizediff;
         }
         spin_unlock_bh(&nf_nat_seqofs_lock);
 
-        pr_debug("nf_nat_resize_packet: Seq_offset after: ");
+        pr_debug("adjust_tcp_sequence: Seq_offset after: ");
         DUMP_OFFSET(this_way);
 }
 
@@ -145,6 +142,17 @@ static int enlarge_skb(struct sk_buff *skb, unsigned int extra)
         return 1;
 }
 
+void nf_nat_set_seq_adjust(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                           __be32 seq, s16 off)
+{
+        if (!off)
+                return;
+        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
+        adjust_tcp_sequence(ntohl(seq), off, ct, ctinfo);
+        nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
+}
+EXPORT_SYMBOL_GPL(nf_nat_set_seq_adjust);
+
 /* Generic function for mangling variable-length address changes inside
  * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
  * command in FTP).
@@ -153,14 +161,13 @@ static int enlarge_skb(struct sk_buff *skb, unsigned int extra)
  * skb enlargement, ...
  *
  * */
-int
-nf_nat_mangle_tcp_packet(struct sk_buff *skb,
-                         struct nf_conn *ct,
-                         enum ip_conntrack_info ctinfo,
-                         unsigned int match_offset,
-                         unsigned int match_len,
-                         const char *rep_buffer,
-                         unsigned int rep_len)
+int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
+                               struct nf_conn *ct,
+                               enum ip_conntrack_info ctinfo,
+                               unsigned int match_offset,
+                               unsigned int match_len,
+                               const char *rep_buffer,
+                               unsigned int rep_len, bool adjust)
 {
         struct rtable *rt = skb_rtable(skb);
         struct iphdr *iph;
@@ -206,16 +213,13 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                 inet_proto_csum_replace2(&tcph->check, skb,
                                          htons(oldlen), htons(datalen), 1);
 
-        if (rep_len != match_len) {
-                set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
-                adjust_tcp_sequence(ntohl(tcph->seq),
-                                    (int)rep_len - (int)match_len,
-                                    ct, ctinfo);
-                nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
-        }
+        if (adjust && rep_len != match_len)
+                nf_nat_set_seq_adjust(ct, ctinfo, tcph->seq,
+                                      (int)rep_len - (int)match_len);
+
         return 1;
 }
-EXPORT_SYMBOL(nf_nat_mangle_tcp_packet);
+EXPORT_SYMBOL(__nf_nat_mangle_tcp_packet);
 
 /* Generic function for mangling variable-length address changes inside
  * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 9eb171056c63..4c060038d29f 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -25,6 +25,7 @@
 #include <net/netfilter/nf_nat_rule.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 
@@ -74,7 +75,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
 
         pr_debug("trying to unexpect other dir: ");
         nf_ct_dump_tuple_ip(&t);
-        other_exp = nf_ct_expect_find_get(net, &t);
+        other_exp = nf_ct_expect_find_get(net, nf_ct_zone(ct), &t);
         if (other_exp) {
                 nf_ct_unexpect_related(other_exp);
                 nf_ct_expect_put(other_exp);
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 9e81e0dfb4ec..26de2c1f7fab 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -15,6 +15,7 @@
 #include <linux/kmod.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
+#include <linux/slab.h>
 #include <net/checksum.h>
 #include <net/route.h>
 #include <linux/bitops.h>
@@ -28,36 +29,6 @@
                          (1 << NF_INET_POST_ROUTING) | \
                          (1 << NF_INET_LOCAL_OUT))
 
-static const struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[3];
-        struct ipt_error term;
-} nat_initial_table __net_initdata = {
-        .repl = {
-                .name = "nat",
-                .valid_hooks = NAT_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
 static const struct xt_table nat_table = {
         .name           = "nat",
         .valid_hooks    = NAT_VALID_HOOKS,
@@ -186,8 +157,13 @@ static struct xt_target ipt_dnat_reg __read_mostly = {
 
 static int __net_init nf_nat_rule_net_init(struct net *net)
 {
-        net->ipv4.nat_table = ipt_register_table(net, &nat_table,
-                                                 &nat_initial_table.repl);
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&nat_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv4.nat_table = ipt_register_table(net, &nat_table, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.nat_table))
                 return PTR_ERR(net->ipv4.nat_table);
         return 0;
@@ -195,7 +171,7 @@ static int __net_init nf_nat_rule_net_init(struct net *net)
 
 static void __net_exit nf_nat_rule_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.nat_table);
+        ipt_unregister_table(net, net->ipv4.nat_table);
 }
 
 static struct pernet_operations nf_nat_rule_net_ops = {
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 07d61a57613c..11b538deaaec 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -1,4 +1,4 @@
-/* SIP extension for UDP NAT alteration.
+/* SIP extension for NAT alteration.
  *
  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  * based on RR's ip_nat_ftp.c and other modules.
@@ -15,6 +15,7 @@
 #include <linux/ip.h>
 #include <net/ip.h>
 #include <linux/udp.h>
+#include <linux/tcp.h>
 
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
@@ -29,25 +30,42 @@ MODULE_DESCRIPTION("SIP NAT helper");
 MODULE_ALIAS("ip_nat_sip");
 
 
-static unsigned int mangle_packet(struct sk_buff *skb,
+static unsigned int mangle_packet(struct sk_buff *skb, unsigned int dataoff,
                                   const char **dptr, unsigned int *datalen,
                                   unsigned int matchoff, unsigned int matchlen,
                                   const char *buffer, unsigned int buflen)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
-
-        if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, matchoff, matchlen,
-                                      buffer, buflen))
-                return 0;
+        struct tcphdr *th;
+        unsigned int baseoff;
+
+        if (nf_ct_protonum(ct) == IPPROTO_TCP) {
+                th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
+                baseoff = ip_hdrlen(skb) + th->doff * 4;
+                matchoff += dataoff - baseoff;
+
+                if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+                                                matchoff, matchlen,
+                                                buffer, buflen, false))
+                        return 0;
+        } else {
+                baseoff = ip_hdrlen(skb) + sizeof(struct udphdr);
+                matchoff += dataoff - baseoff;
+
+                if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
+                                              matchoff, matchlen,
+                                              buffer, buflen))
+                        return 0;
+        }
 
         /* Reload data pointer and adjust datalen value */
-        *dptr = skb->data + ip_hdrlen(skb) + sizeof(struct udphdr);
+        *dptr = skb->data + dataoff;
         *datalen += buflen - matchlen;
         return 1;
 }
 
-static int map_addr(struct sk_buff *skb,
+static int map_addr(struct sk_buff *skb, unsigned int dataoff,
                     const char **dptr, unsigned int *datalen,
                     unsigned int matchoff, unsigned int matchlen,
                     union nf_inet_addr *addr, __be16 port)
@@ -76,11 +94,11 @@ static int map_addr(struct sk_buff *skb,
 
         buflen = sprintf(buffer, "%pI4:%u", &newaddr, ntohs(newport));
 
-        return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                              buffer, buflen);
 }
 
-static int map_sip_addr(struct sk_buff *skb,
+static int map_sip_addr(struct sk_buff *skb, unsigned int dataoff,
                         const char **dptr, unsigned int *datalen,
                         enum sip_header_types type)
 {
@@ -93,16 +111,18 @@ static int map_sip_addr(struct sk_buff *skb,
         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
                                     &matchoff, &matchlen, &addr, &port) <= 0)
                 return 1;
-        return map_addr(skb, dptr, datalen, matchoff, matchlen, &addr, port);
+        return map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
+                        &addr, port);
 }
 
-static unsigned int ip_nat_sip(struct sk_buff *skb,
+static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
                                const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        unsigned int dataoff, matchoff, matchlen;
+        unsigned int coff, matchoff, matchlen;
+        enum sip_header_types hdr;
         union nf_inet_addr addr;
         __be16 port;
         int request, in_header;
@@ -112,16 +132,21 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                 if (ct_sip_parse_request(ct, *dptr, *datalen,
                                          &matchoff, &matchlen,
                                          &addr, &port) > 0 &&
-                    !map_addr(skb, dptr, datalen, matchoff, matchlen,
+                    !map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
                               &addr, port))
                         return NF_DROP;
                 request = 1;
         } else
                 request = 0;
 
+        if (nf_ct_protonum(ct) == IPPROTO_TCP)
+                hdr = SIP_HDR_VIA_TCP;
+        else
+                hdr = SIP_HDR_VIA_UDP;
+
         /* Translate topmost Via header and parameters */
         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
-                                    SIP_HDR_VIA, NULL, &matchoff, &matchlen,
+                                    hdr, NULL, &matchoff, &matchlen,
                                     &addr, &port) > 0) {
                 unsigned int matchend, poff, plen, buflen, n;
                 char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
@@ -138,7 +163,7 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                                 goto next;
                 }
 
-                if (!map_addr(skb, dptr, datalen, matchoff, matchlen,
+                if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
                               &addr, port))
                         return NF_DROP;
 
@@ -153,8 +178,8 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                     addr.ip != ct->tuplehash[!dir].tuple.dst.u3.ip) {
                         buflen = sprintf(buffer, "%pI4",
                                         &ct->tuplehash[!dir].tuple.dst.u3.ip);
-                        if (!mangle_packet(skb, dptr, datalen, poff, plen,
-                                           buffer, buflen))
+                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                           poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
 
@@ -167,8 +192,8 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                     addr.ip != ct->tuplehash[!dir].tuple.src.u3.ip) {
                         buflen = sprintf(buffer, "%pI4",
                                         &ct->tuplehash[!dir].tuple.src.u3.ip);
-                        if (!mangle_packet(skb, dptr, datalen, poff, plen,
-                                           buffer, buflen))
+                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                           poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
 
@@ -181,31 +206,45 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                     htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
                         __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
                         buflen = sprintf(buffer, "%u", ntohs(p));
-                        if (!mangle_packet(skb, dptr, datalen, poff, plen,
-                                           buffer, buflen))
+                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                           poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
         }
 
 next:
         /* Translate Contact headers */
-        dataoff = 0;
+        coff = 0;
         in_header = 0;
-        while (ct_sip_parse_header_uri(ct, *dptr, &dataoff, *datalen,
+        while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
                                        SIP_HDR_CONTACT, &in_header,
                                        &matchoff, &matchlen,
                                        &addr, &port) > 0) {
-                if (!map_addr(skb, dptr, datalen, matchoff, matchlen,
+                if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
                               &addr, port))
                         return NF_DROP;
         }
 
-        if (!map_sip_addr(skb, dptr, datalen, SIP_HDR_FROM) ||
-            !map_sip_addr(skb, dptr, datalen, SIP_HDR_TO))
+        if (!map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_FROM) ||
+            !map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_TO))
                 return NF_DROP;
+
         return NF_ACCEPT;
 }
 
+static void ip_nat_sip_seq_adjust(struct sk_buff *skb, s16 off)
+{
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+        const struct tcphdr *th;
+
+        if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
+                return;
+
+        th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
+        nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
+}
+
 /* Handles expected signalling connections and media streams */
 static void ip_nat_sip_expected(struct nf_conn *ct,
                                 struct nf_conntrack_expect *exp)
@@ -232,7 +271,7 @@ static void ip_nat_sip_expected(struct nf_conn *ct,
         }
 }
 
-static unsigned int ip_nat_sip_expect(struct sk_buff *skb,
+static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
                                       const char **dptr, unsigned int *datalen,
                                       struct nf_conntrack_expect *exp,
                                       unsigned int matchoff,
@@ -279,8 +318,8 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb,
         if (exp->tuple.dst.u3.ip != exp->saved_ip ||
             exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
                 buflen = sprintf(buffer, "%pI4:%u", &newip, port);
-                if (!mangle_packet(skb, dptr, datalen, matchoff, matchlen,
-                                   buffer, buflen))
+                if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                   matchoff, matchlen, buffer, buflen))
                         goto err;
         }
         return NF_ACCEPT;
@@ -290,7 +329,7 @@ err:
         return NF_DROP;
 }
 
-static int mangle_content_len(struct sk_buff *skb,
+static int mangle_content_len(struct sk_buff *skb, unsigned int dataoff,
                               const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
@@ -312,12 +351,13 @@ static int mangle_content_len(struct sk_buff *skb,
                 return 0;
 
         buflen = sprintf(buffer, "%u", c_len);
-        return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                              buffer, buflen);
 }
 
-static int mangle_sdp_packet(struct sk_buff *skb, const char **dptr,
-                             unsigned int dataoff, unsigned int *datalen,
+static int mangle_sdp_packet(struct sk_buff *skb, unsigned int dataoff,
+                             const char **dptr, unsigned int *datalen,
+                             unsigned int sdpoff,
                              enum sdp_header_types type,
                              enum sdp_header_types term,
                              char *buffer, int buflen)
@@ -326,16 +366,16 @@ static int mangle_sdp_packet(struct sk_buff *skb, const char **dptr,
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
         unsigned int matchlen, matchoff;
 
-        if (ct_sip_get_sdp_header(ct, *dptr, dataoff, *datalen, type, term,
+        if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
                                   &matchoff, &matchlen) <= 0)
                 return -ENOENT;
-        return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                              buffer, buflen) ? 0 : -EINVAL;
 }
 
-static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, const char **dptr,
-                                    unsigned int dataoff,
-                                    unsigned int *datalen,
+static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, unsigned int dataoff,
+                                    const char **dptr, unsigned int *datalen,
+                                    unsigned int sdpoff,
                                     enum sdp_header_types type,
                                     enum sdp_header_types term,
                                     const union nf_inet_addr *addr)
@@ -344,16 +384,15 @@ static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, const char **dptr,
         unsigned int buflen;
 
         buflen = sprintf(buffer, "%pI4", &addr->ip);
-        if (mangle_sdp_packet(skb, dptr, dataoff, datalen, type, term,
+        if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff, type, term,
                               buffer, buflen))
                 return 0;
 
-        return mangle_content_len(skb, dptr, datalen);
+        return mangle_content_len(skb, dataoff, dptr, datalen);
 }
 
-static unsigned int ip_nat_sdp_port(struct sk_buff *skb,
-                                    const char **dptr,
-                                    unsigned int *datalen,
+static unsigned int ip_nat_sdp_port(struct sk_buff *skb, unsigned int dataoff,
+                                    const char **dptr, unsigned int *datalen,
                                     unsigned int matchoff,
                                     unsigned int matchlen,
                                     u_int16_t port)
@@ -362,16 +401,16 @@ static unsigned int ip_nat_sdp_port(struct sk_buff *skb,
         unsigned int buflen;
 
         buflen = sprintf(buffer, "%u", port);
-        if (!mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        if (!mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                            buffer, buflen))
                 return 0;
 
-        return mangle_content_len(skb, dptr, datalen);
+        return mangle_content_len(skb, dataoff, dptr, datalen);
 }
 
-static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
-                                       unsigned int dataoff,
-                                       unsigned int *datalen,
+static unsigned int ip_nat_sdp_session(struct sk_buff *skb, unsigned int dataoff,
+                                       const char **dptr, unsigned int *datalen,
+                                       unsigned int sdpoff,
                                        const union nf_inet_addr *addr)
 {
         char buffer[sizeof("nnn.nnn.nnn.nnn")];
@@ -379,12 +418,12 @@ static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
 
         /* Mangle session description owner and contact addresses */
         buflen = sprintf(buffer, "%pI4", &addr->ip);
-        if (mangle_sdp_packet(skb, dptr, dataoff, datalen,
+        if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
                                SDP_HDR_OWNER_IP4, SDP_HDR_MEDIA,
                                buffer, buflen))
                 return 0;
 
-        switch (mangle_sdp_packet(skb, dptr, dataoff, datalen,
+        switch (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
                                   SDP_HDR_CONNECTION_IP4, SDP_HDR_MEDIA,
                                   buffer, buflen)) {
         case 0:
@@ -401,14 +440,13 @@ static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
                 return 0;
         }
 
-        return mangle_content_len(skb, dptr, datalen);
+        return mangle_content_len(skb, dataoff, dptr, datalen);
 }
 
 /* So, this packet has hit the connection tracking matching code.
    Mangle it, and change the expectation to match the new version. */
-static unsigned int ip_nat_sdp_media(struct sk_buff *skb,
-                                     const char **dptr,
-                                     unsigned int *datalen,
+static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
+                                     const char **dptr, unsigned int *datalen,
                                      struct nf_conntrack_expect *rtp_exp,
                                      struct nf_conntrack_expect *rtcp_exp,
                                      unsigned int mediaoff,
@@ -456,7 +494,8 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb,
 
         /* Update media port. */
         if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
-            !ip_nat_sdp_port(skb, dptr, datalen, mediaoff, medialen, port))
+            !ip_nat_sdp_port(skb, dataoff, dptr, datalen,
+                             mediaoff, medialen, port))
                 goto err2;
 
         return NF_ACCEPT;
@@ -471,6 +510,7 @@ err1:
 static void __exit nf_nat_sip_fini(void)
 {
         rcu_assign_pointer(nf_nat_sip_hook, NULL);
+        rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, NULL);
         rcu_assign_pointer(nf_nat_sip_expect_hook, NULL);
         rcu_assign_pointer(nf_nat_sdp_addr_hook, NULL);
         rcu_assign_pointer(nf_nat_sdp_port_hook, NULL);
@@ -482,12 +522,14 @@ static void __exit nf_nat_sip_fini(void)
 static int __init nf_nat_sip_init(void)
 {
         BUG_ON(nf_nat_sip_hook != NULL);
+        BUG_ON(nf_nat_sip_seq_adjust_hook != NULL);
         BUG_ON(nf_nat_sip_expect_hook != NULL);
         BUG_ON(nf_nat_sdp_addr_hook != NULL);
         BUG_ON(nf_nat_sdp_port_hook != NULL);
         BUG_ON(nf_nat_sdp_session_hook != NULL);
         BUG_ON(nf_nat_sdp_media_hook != NULL);
         rcu_assign_pointer(nf_nat_sip_hook, ip_nat_sip);
+        rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, ip_nat_sip_seq_adjust);
         rcu_assign_pointer(nf_nat_sip_expect_hook, ip_nat_sip_expect);
         rcu_assign_pointer(nf_nat_sdp_addr_hook, ip_nat_sdp_addr);
         rcu_assign_pointer(nf_nat_sdp_port_hook, ip_nat_sdp_port);
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index d9521f6f9ed0..4d85b6e55f29 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -43,6 +43,7 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
@@ -1038,7 +1039,7 @@ static int snmp_parse_mangle(unsigned char *msg,
         unsigned int cls, con, tag, vers, pdutype;
         struct asn1_ctx ctx;
         struct asn1_octstr comm;
-        struct snmp_object **obj;
+        struct snmp_object *obj;
 
         if (debug > 1)
                 hex_dump(msg, len);
@@ -1148,43 +1149,34 @@ static int snmp_parse_mangle(unsigned char *msg,
         if (cls != ASN1_UNI || con != ASN1_CON || tag != ASN1_SEQ)
                 return 0;
 
-        obj = kmalloc(sizeof(struct snmp_object), GFP_ATOMIC);
-        if (obj == NULL) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "OOM in bsalg(%d)\n", __LINE__);
-                return 0;
-        }
-
         while (!asn1_eoc_decode(&ctx, eoc)) {
                 unsigned int i;
 
-                if (!snmp_object_decode(&ctx, obj)) {
-                        if (*obj) {
-                                kfree((*obj)->id);
-                                kfree(*obj);
+                if (!snmp_object_decode(&ctx, &obj)) {
+                        if (obj) {
+                                kfree(obj->id);
+                                kfree(obj);
                         }
-                        kfree(obj);
                         return 0;
                 }
 
                 if (debug > 1) {
                         printk(KERN_DEBUG "bsalg: object: ");
-                        for (i = 0; i < (*obj)->id_len; i++) {
+                        for (i = 0; i < obj->id_len; i++) {
                                 if (i > 0)
                                         printk(".");
-                                printk("%lu", (*obj)->id[i]);
+                                printk("%lu", obj->id[i]);
                         }
-                        printk(": type=%u\n", (*obj)->type);
+                        printk(": type=%u\n", obj->type);
 
                 }
 
-                if ((*obj)->type == SNMP_IPADDR)
+                if (obj->type == SNMP_IPADDR)
                         mangle_address(ctx.begin, ctx.pointer - 4 , map, check);
 
-                kfree((*obj)->id);
-                kfree(*obj);
+                kfree(obj->id);
+                kfree(obj);
         }
-        kfree(obj);
 
         if (!asn1_eoc_decode(&ctx, eoc))
                 return 0;
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 5f41d017ddd8..c39c9cf6bee6 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -7,6 +7,7 @@
  */
 #include <linux/types.h>
 #include <linux/icmp.h>
+#include <linux/gfp.h>
 #include <linux/ip.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
@@ -197,11 +198,11 @@ nf_nat_out(unsigned int hooknum,
             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
-                if (ct->tuplehash[dir].tuple.src.u3.ip !=
-                    ct->tuplehash[!dir].tuple.dst.u3.ip
-                    || ct->tuplehash[dir].tuple.src.u.all !=
-                       ct->tuplehash[!dir].tuple.dst.u.all
-                    )
+                if ((ct->tuplehash[dir].tuple.src.u3.ip !=
+                     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
+                    (ct->tuplehash[dir].tuple.src.u.all !=
+                     ct->tuplehash[!dir].tuple.dst.u.all)
+                   )
                         return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
         }
 #endif
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index f25542c48b7d..4f1f337f4337 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -127,8 +127,8 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static struct {
-        char *name;
+static const struct {
+        const char *name;
         int index;
 } icmpmibmap[] = {
         { "DestUnreachs", ICMP_DEST_UNREACH },
@@ -249,6 +249,8 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPSackShifted", LINUX_MIB_SACKSHIFTED),
         SNMP_MIB_ITEM("TCPSackMerged", LINUX_MIB_SACKMERGED),
         SNMP_MIB_ITEM("TCPSackShiftFallback", LINUX_MIB_SACKSHIFTFALLBACK),
+        SNMP_MIB_ITEM("TCPBacklogDrop", LINUX_MIB_TCPBACKLOGDROP),
+        SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),
         SNMP_MIB_SENTINEL
 };
 
@@ -280,7 +282,7 @@ static void icmpmsg_put(struct seq_file *seq)
 
         count = 0;
         for (i = 0; i < ICMPMSG_MIB_MAX; i++) {
-                val = snmp_fold_field((void **) net->mib.icmpmsg_statistics, i);
+                val = snmp_fold_field((void __percpu **) net->mib.icmpmsg_statistics, i);
                 if (val) {
                         type[count] = i;
                         vals[count++] = val;
@@ -307,18 +309,18 @@ static void icmp_put(struct seq_file *seq)
         for (i=0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " Out%s", icmpmibmap[i].name);
         seq_printf(seq, "\nIcmp: %lu %lu",
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_INMSGS),
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_INERRORS));
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INMSGS),
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INERRORS));
         for (i=0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                        snmp_fold_field((void **) net->mib.icmpmsg_statistics,
+                        snmp_fold_field((void __percpu **) net->mib.icmpmsg_statistics,
                                 icmpmibmap[i].index));
         seq_printf(seq, " %lu %lu",
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_OUTMSGS),
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_OUTERRORS));
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTMSGS),
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTERRORS));
         for (i=0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                        snmp_fold_field((void **) net->mib.icmpmsg_statistics,
+                        snmp_fold_field((void __percpu **) net->mib.icmpmsg_statistics,
                                 icmpmibmap[i].index | 0x100));
 }
 
@@ -341,7 +343,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
 
         for (i = 0; snmp4_ipstats_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.ip_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.ip_statistics,
                                            snmp4_ipstats_list[i].entry));
 
         icmp_put(seq);  /* RFC 2011 compatibility */
@@ -356,11 +358,11 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
                 /* MaxConn field is signed, RFC 2012 */
                 if (snmp4_tcp_list[i].entry == TCP_MIB_MAXCONN)
                         seq_printf(seq, " %ld",
-                                   snmp_fold_field((void **)net->mib.tcp_statistics,
+                                   snmp_fold_field((void __percpu **)net->mib.tcp_statistics,
                                                    snmp4_tcp_list[i].entry));
                 else
                         seq_printf(seq, " %lu",
-                                   snmp_fold_field((void **)net->mib.tcp_statistics,
+                                   snmp_fold_field((void __percpu **)net->mib.tcp_statistics,
                                                    snmp4_tcp_list[i].entry));
         }
 
@@ -371,7 +373,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
         seq_puts(seq, "\nUdp:");
         for (i = 0; snmp4_udp_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.udp_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.udp_statistics,
                                            snmp4_udp_list[i].entry));
 
         /* the UDP and UDP-Lite MIBs are the same */
@@ -382,7 +384,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
         seq_puts(seq, "\nUdpLite:");
         for (i = 0; snmp4_udp_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.udplite_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.udplite_statistics,
                                            snmp4_udp_list[i].entry));
 
         seq_putc(seq, '\n');
@@ -419,7 +421,7 @@ static int netstat_seq_show(struct seq_file *seq, void *v)
         seq_puts(seq, "\nTcpExt:");
         for (i = 0; snmp4_net_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.net_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.net_statistics,
                                            snmp4_net_list[i].entry));
 
         seq_puts(seq, "\nIpExt:");
@@ -429,7 +431,7 @@ static int netstat_seq_show(struct seq_file *seq, void *v)
         seq_puts(seq, "\nIpExt:");
         for (i = 0; snmp4_ipextstats_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.ip_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.ip_statistics,
                                            snmp4_ipextstats_list[i].entry));
 
         seq_putc(seq, '\n');
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ab996f9c0fe0..cc6f097fbd5f 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -60,7 +60,6 @@
 #include <net/net_namespace.h>
 #include <net/dst.h>
 #include <net/sock.h>
-#include <linux/gfp.h>
 #include <linux/ip.h>
 #include <linux/net.h>
 #include <net/ip.h>
@@ -87,7 +86,7 @@ void raw_hash_sk(struct sock *sk)
         struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;
         struct hlist_head *head;
 
-        head = &h->ht[inet_sk(sk)->num & (RAW_HTABLE_SIZE - 1)];
+        head = &h->ht[inet_sk(sk)->inet_num & (RAW_HTABLE_SIZE - 1)];
 
         write_lock_bh(&h->lock);
         sk_add_node(sk, head);
@@ -115,9 +114,9 @@ static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
         sk_for_each_from(sk, node) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (net_eq(sock_net(sk), net) && inet->num == num       &&
-                    !(inet->daddr && inet->daddr != raddr)              &&
-                    !(inet->rcv_saddr && inet->rcv_saddr != laddr)      &&
+                if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
+                    !(inet->inet_daddr && inet->inet_daddr != raddr)    &&
+                    !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
                     !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
                         goto found; /* gotcha */
         }
@@ -292,7 +291,6 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
         /* Charge it to the socket. */
 
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -327,7 +325,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         int err;
 
         if (length > rt->u.dst.dev->mtu) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport,
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
                                rt->u.dst.dev->mtu);
                 return -EMSGSIZE;
         }
@@ -500,10 +498,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 err = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
                         goto out;
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
         }
 
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
         ipc.opt = NULL;
         ipc.shtx.flags = 0;
         ipc.oif = sk->sk_bound_dev_if;
@@ -645,9 +643,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                 goto out;
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
         sk_dst_reset(sk);
         ret = 0;
 out:    return ret;
@@ -692,7 +690,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -717,7 +715,7 @@ static int raw_init(struct sock *sk)
 {
         struct raw_sock *rp = raw_sk(sk);
 
-        if (inet_sk(sk)->num == IPPROTO_ICMP)
+        if (inet_sk(sk)->inet_num == IPPROTO_ICMP)
                 memset(&rp->filter, 0, sizeof(rp->filter));
         return 0;
 }
@@ -754,7 +752,7 @@ static int do_raw_setsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, unsigned int optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_seticmpfilter(sk, optval, optlen);
@@ -784,7 +782,7 @@ static int do_raw_getsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, int __user *optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_geticmpfilter(sk, optval, optlen);
@@ -943,10 +941,10 @@ EXPORT_SYMBOL_GPL(raw_seq_stop);
 static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr,
-               src = inet->rcv_saddr;
+        __be32 dest = inet->inet_daddr,
+               src = inet->inet_rcv_saddr;
         __u16 destp = 0,
-              srcp  = inet->num;
+              srcp  = inet->inet_num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 5b1050a5d874..cb562fdd9b9a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -90,6 +90,7 @@
 #include <linux/jhash.h>
 #include <linux/rcupdate.h>
 #include <linux/times.h>
+#include <linux/slab.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
@@ -146,7 +147,6 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
 static void              ipv4_link_failure(struct sk_buff *skb);
 static void              ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 static int rt_garbage_collect(struct dst_ops *ops);
-static void rt_emergency_hash_rebuild(struct net *net);
 
 
 static struct dst_ops ipv4_dst_ops = {
@@ -287,12 +287,12 @@ static struct rtable *rt_cache_get_first(struct seq_file *seq)
                 if (!rt_hash_table[st->bucket].chain)
                         continue;
                 rcu_read_lock_bh();
-                r = rcu_dereference(rt_hash_table[st->bucket].chain);
+                r = rcu_dereference_bh(rt_hash_table[st->bucket].chain);
                 while (r) {
                         if (dev_net(r->u.dst.dev) == seq_file_net(seq) &&
                             r->rt_genid == st->genid)
                                 return r;
-                        r = rcu_dereference(r->u.dst.rt_next);
+                        r = rcu_dereference_bh(r->u.dst.rt_next);
                 }
                 rcu_read_unlock_bh();
         }
@@ -314,7 +314,7 @@ static struct rtable *__rt_cache_get_next(struct seq_file *seq,
                 rcu_read_lock_bh();
                 r = rt_hash_table[st->bucket].chain;
         }
-        return rcu_dereference(r);
+        return rcu_dereference_bh(r);
 }
 
 static struct rtable *rt_cache_get_next(struct seq_file *seq,
@@ -513,43 +513,42 @@ static const struct file_operations rt_cpu_seq_fops = {
 };
 
 #ifdef CONFIG_NET_CLS_ROUTE
-static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
-                           int length, int *eof, void *data)
-{
-        unsigned int i;
-
-        if ((offset & 3) || (length & 3))
-                return -EIO;
-
-        if (offset >= sizeof(struct ip_rt_acct) * 256) {
-                *eof = 1;
-                return 0;
-        }
-
-        if (offset + length >= sizeof(struct ip_rt_acct) * 256) {
-                length = sizeof(struct ip_rt_acct) * 256 - offset;
-                *eof = 1;
+static int rt_acct_proc_show(struct seq_file *m, void *v)
+{
+        struct ip_rt_acct *dst, *src;
+        unsigned int i, j;
+
+        dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
+        if (!dst)
+                return -ENOMEM;
+
+        for_each_possible_cpu(i) {
+                src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
+                for (j = 0; j < 256; j++) {
+                        dst[j].o_bytes   += src[j].o_bytes;
+                        dst[j].o_packets += src[j].o_packets;
+                        dst[j].i_bytes   += src[j].i_bytes;
+                        dst[j].i_packets += src[j].i_packets;
+                }
         }
 
-        offset /= sizeof(u32);
-
-        if (length > 0) {
-                u32 *dst = (u32 *) buffer;
-
-                *start = buffer;
-                memset(dst, 0, length);
-
-                for_each_possible_cpu(i) {
-                        unsigned int j;
-                        u32 *src;
+        seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
+        kfree(dst);
+        return 0;
+}
 
-                        src = ((u32 *) per_cpu_ptr(ip_rt_acct, i)) + offset;
-                        for (j = 0; j < length/4; j++)
-                                dst[j] += src[j];
-                }
-        }
-        return length;
+static int rt_acct_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rt_acct_proc_show, NULL);
 }
+
+static const struct file_operations rt_acct_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = rt_acct_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 #endif
 
 static int __net_init ip_rt_do_proc_init(struct net *net)
@@ -567,8 +566,7 @@ static int __net_init ip_rt_do_proc_init(struct net *net)
                 goto err2;
 
 #ifdef CONFIG_NET_CLS_ROUTE
-        pde = create_proc_read_entry("rt_acct", 0, net->proc_net,
-                        ip_rt_acct_read, NULL);
+        pde = proc_create("rt_acct", 0, net->proc_net, &rt_acct_proc_fops);
         if (!pde)
                 goto err3;
 #endif
@@ -588,7 +586,9 @@ static void __net_exit ip_rt_do_proc_exit(struct net *net)
 {
         remove_proc_entry("rt_cache", net->proc_net_stat);
         remove_proc_entry("rt_cache", net->proc_net);
+#ifdef CONFIG_NET_CLS_ROUTE
         remove_proc_entry("rt_acct", net->proc_net);
+#endif
 }
 
 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
@@ -703,7 +703,7 @@ static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
 {
-        return dev_net(rt1->u.dst.dev) == dev_net(rt2->u.dst.dev);
+        return net_eq(dev_net(rt1->u.dst.dev), dev_net(rt2->u.dst.dev));
 }
 
 static inline int rt_is_expired(struct rtable *rth)
@@ -780,11 +780,30 @@ static void rt_do_flush(int process_context)
 #define FRACT_BITS 3
 #define ONE (1UL << FRACT_BITS)
 
+/*
+ * Given a hash chain and an item in this hash chain,
+ * find if a previous entry has the same hash_inputs
+ * (but differs on tos, mark or oif)
+ * Returns 0 if an alias is found.
+ * Returns ONE if rth has no alias before itself.
+ */
+static int has_noalias(const struct rtable *head, const struct rtable *rth)
+{
+        const struct rtable *aux = head;
+
+        while (aux != rth) {
+                if (compare_hash_inputs(&aux->fl, &rth->fl))
+                        return 0;
+                aux = aux->u.dst.rt_next;
+        }
+        return ONE;
+}
+
 static void rt_check_expire(void)
 {
         static unsigned int rover;
         unsigned int i = rover, goal;
-        struct rtable *rth, *aux, **rthp;
+        struct rtable *rth, **rthp;
         unsigned long samples = 0;
         unsigned long sum = 0, sum2 = 0;
         unsigned long delta;
@@ -835,15 +854,7 @@ nofree:
                                          * attributes don't unfairly skew
                                          * the length computation
                                          */
-                                        for (aux = rt_hash_table[i].chain;;) {
-                                                if (aux == rth) {
-                                                        length += ONE;
-                                                        break;
-                                                }
-                                                if (compare_hash_inputs(&aux->fl, &rth->fl))
-                                                        break;
-                                                aux = aux->u.dst.rt_next;
-                                        }
+                                        length += has_noalias(rt_hash_table[i].chain, rth);
                                         continue;
                                 }
                         } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
@@ -902,6 +913,12 @@ void rt_cache_flush(struct net *net, int delay)
                 rt_do_flush(!in_softirq());
 }
 
+/* Flush previous cache invalidated entries from the cache */
+void rt_cache_flush_batch(void)
+{
+        rt_do_flush(!in_softirq());
+}
+
 /*
  * We change rt_genid and let gc do the cleanup
  */
@@ -916,10 +933,8 @@ static void rt_secret_rebuild_oneshot(struct net *net)
 {
         del_timer_sync(&net->ipv4.rt_secret_timer);
         rt_cache_invalidate(net);
-        if (ip_rt_secret_interval) {
-                net->ipv4.rt_secret_timer.expires += ip_rt_secret_interval;
-                add_timer(&net->ipv4.rt_secret_timer);
-        }
+        if (ip_rt_secret_interval)
+                mod_timer(&net->ipv4.rt_secret_timer, jiffies + ip_rt_secret_interval);
 }
 
 static void rt_emergency_hash_rebuild(struct net *net)
@@ -1067,8 +1082,23 @@ work_done:
 out:    return 0;
 }
 
+/*
+ * Returns number of entries in a hash chain that have different hash_inputs
+ */
+static int slow_chain_length(const struct rtable *head)
+{
+        int length = 0;
+        const struct rtable *rth = head;
+
+        while (rth) {
+                length += has_noalias(head, rth);
+                rth = rth->u.dst.rt_next;
+        }
+        return length >> FRACT_BITS;
+}
+
 static int rt_intern_hash(unsigned hash, struct rtable *rt,
-                          struct rtable **rp, struct sk_buff *skb)
+                          struct rtable **rp, struct sk_buff *skb, int ifindex)
 {
         struct rtable   *rth, **rthp;
         unsigned long   now;
@@ -1179,14 +1209,20 @@ restart:
                         rt_free(cand);
                 }
         } else {
-                if (chain_length > rt_chain_length_max) {
+                if (chain_length > rt_chain_length_max &&
+                    slow_chain_length(rt_hash_table[hash].chain) > rt_chain_length_max) {
                         struct net *net = dev_net(rt->u.dst.dev);
                         int num = ++net->ipv4.current_rt_cache_rebuild_count;
-                        if (!rt_caching(dev_net(rt->u.dst.dev))) {
+                        if (!rt_caching(net)) {
                                 printk(KERN_WARNING "%s: %d rebuilds is over limit, route caching disabled\n",
                                         rt->u.dst.dev->name, num);
                         }
-                        rt_emergency_hash_rebuild(dev_net(rt->u.dst.dev));
+                        rt_emergency_hash_rebuild(net);
+                        spin_unlock_bh(rt_hash_lock_addr(hash));
+
+                        hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
+                                        ifindex, rt_genid(net));
+                        goto restart;
                 }
         }
 
@@ -1346,9 +1382,9 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                 return;
 
         net = dev_net(dev);
-        if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev)
-            || ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw)
-            || ipv4_is_zeronet(new_gw))
+        if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
+            ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
+            ipv4_is_zeronet(new_gw))
                 goto reject_redirect;
 
         if (!rt_caching(net))
@@ -1411,7 +1447,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                         dev_hold(rt->u.dst.dev);
                                 if (rt->idev)
                                         in_dev_hold(rt->idev);
-                                rt->u.dst.obsolete      = 0;
+                                rt->u.dst.obsolete      = -1;
                                 rt->u.dst.lastuse       = jiffies;
                                 rt->u.dst.path          = &rt->u.dst;
                                 rt->u.dst.neighbour     = NULL;
@@ -1447,7 +1483,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                                         &netevent);
 
                                 rt_del(hash, rth);
-                                if (!rt_intern_hash(hash, rt, &rt, NULL))
+                                if (!rt_intern_hash(hash, rt, &rt, NULL, rt->fl.oif))
                                         ip_rt_put(rt);
                                 goto do_next;
                         }
@@ -1476,11 +1512,12 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
         struct dst_entry *ret = dst;
 
         if (rt) {
-                if (dst->obsolete) {
+                if (dst->obsolete > 0) {
                         ip_rt_put(rt);
                         ret = NULL;
                 } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-                           rt->u.dst.expires) {
+                           (rt->u.dst.expires &&
+                            time_after_eq(jiffies, rt->u.dst.expires))) {
                         unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
                                                 rt->fl.oif,
                                                 rt_genid(dev_net(dst->dev)));
@@ -1628,9 +1665,6 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
         __be32  daddr = iph->daddr;
         unsigned short est_mtu = 0;
 
-        if (ipv4_config.no_pmtu_disc)
-                return 0;
-
         for (k = 0; k < 2; k++) {
                 for (i = 0; i < 2; i++) {
                         unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
@@ -1699,7 +1733,9 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        return NULL;
+        if (rt_is_expired((struct rtable *)dst))
+                return NULL;
+        return dst;
 }
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
@@ -1861,7 +1897,8 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         if (!rth)
                 goto e_nobufs;
 
-        rth->u.dst.output= ip_rt_bug;
+        rth->u.dst.output = ip_rt_bug;
+        rth->u.dst.obsolete = -1;
 
         atomic_set(&rth->u.dst.__refcnt, 1);
         rth->u.dst.flags= DST_HOST;
@@ -1900,7 +1937,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
         in_dev_put(in_dev);
         hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
-        return rt_intern_hash(hash, rth, NULL, skb);
+        return rt_intern_hash(hash, rth, NULL, skb, dev->ifindex);
 
 e_nobufs:
         in_dev_put(in_dev);
@@ -1987,8 +2024,13 @@ static int __mkroute_input(struct sk_buff *skb,
         if (skb->protocol != htons(ETH_P_IP)) {
                 /* Not IP (i.e. ARP). Do not create route, if it is
                  * invalid for proxy arp. DNAT routes are always valid.
+                 *
+                 * Proxy arp feature have been extended to allow, ARP
+                 * replies back to the same interface, to support
+                 * Private VLAN switch technologies. See arp.c.
                  */
-                if (out_dev == in_dev) {
+                if (out_dev == in_dev &&
+                    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
                         err = -EINVAL;
                         goto cleanup;
                 }
@@ -2022,6 +2064,7 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->fl.oif     = 0;
         rth->rt_spec_dst= spec_dst;
 
+        rth->u.dst.obsolete = -1;
         rth->u.dst.input = ip_forward;
         rth->u.dst.output = ip_output;
         rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
@@ -2061,7 +2104,7 @@ static int ip_mkroute_input(struct sk_buff *skb,
         /* put it into the cache */
         hash = rt_hash(daddr, saddr, fl->iif,
                        rt_genid(dev_net(rth->u.dst.dev)));
-        return rt_intern_hash(hash, rth, NULL, skb);
+        return rt_intern_hash(hash, rth, NULL, skb, fl->iif);
 }
 
 /*
@@ -2186,6 +2229,7 @@ local_input:
                 goto e_nobufs;
 
         rth->u.dst.output= ip_rt_bug;
+        rth->u.dst.obsolete = -1;
         rth->rt_genid = rt_genid(net);
 
         atomic_set(&rth->u.dst.__refcnt, 1);
@@ -2217,7 +2261,7 @@ local_input:
         }
         rth->rt_type    = res.type;
         hash = rt_hash(daddr, saddr, fl.iif, rt_genid(net));
-        err = rt_intern_hash(hash, rth, NULL, skb);
+        err = rt_intern_hash(hash, rth, NULL, skb, fl.iif);
         goto done;
 
 no_route:
@@ -2314,10 +2358,11 @@ skip_cache:
                                 ip_hdr(skb)->protocol);
                         if (our
 #ifdef CONFIG_IP_MROUTE
-                            || (!ipv4_is_local_multicast(daddr) &&
-                                IN_DEV_MFORWARD(in_dev))
+                                ||
+                            (!ipv4_is_local_multicast(daddr) &&
+                             IN_DEV_MFORWARD(in_dev))
 #endif
-                            ) {
+                           ) {
                                 rcu_read_unlock();
                                 return ip_route_input_mc(skb, daddr, saddr,
                                                          tos, dev, our);
@@ -2411,6 +2456,7 @@ static int __mkroute_output(struct rtable **result,
         rth->rt_spec_dst= fl->fl4_src;
 
         rth->u.dst.output=ip_output;
+        rth->u.dst.obsolete = -1;
         rth->rt_genid = rt_genid(dev_net(dev_out));
 
         RT_CACHE_STAT_INC(out_slow_tot);
@@ -2462,7 +2508,7 @@ static int ip_mkroute_output(struct rtable **rp,
         if (err == 0) {
                 hash = rt_hash(oldflp->fl4_dst, oldflp->fl4_src, oldflp->oif,
                                rt_genid(dev_net(dev_out)));
-                err = rt_intern_hash(hash, rth, rp, NULL);
+                err = rt_intern_hash(hash, rth, rp, NULL, oldflp->oif);
         }
 
         return err;
@@ -2514,9 +2560,9 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                       of another iface. --ANK
                  */
 
-                if (oldflp->oif == 0
-                    && (ipv4_is_multicast(oldflp->fl4_dst) ||
-                        oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
+                if (oldflp->oif == 0 &&
+                    (ipv4_is_multicast(oldflp->fl4_dst) ||
+                     oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
                         dev_out = ip_dev_find(net, oldflp->fl4_src);
                         if (dev_out == NULL)
@@ -2685,8 +2731,8 @@ int __ip_route_output_key(struct net *net, struct rtable **rp,
         hash = rt_hash(flp->fl4_dst, flp->fl4_src, flp->oif, rt_genid(net));
 
         rcu_read_lock_bh();
-        for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
-                rth = rcu_dereference(rth->u.dst.rt_next)) {
+        for (rth = rcu_dereference_bh(rt_hash_table[hash].chain); rth;
+                rth = rcu_dereference_bh(rth->u.dst.rt_next)) {
                 if (rth->fl.fl4_dst == flp->fl4_dst &&
                     rth->fl.fl4_src == flp->fl4_src &&
                     rth->fl.iif == 0 &&
@@ -2855,7 +2901,7 @@ static int rt_fill_info(struct net *net,
         error = rt->u.dst.error;
         expires = rt->u.dst.expires ? rt->u.dst.expires - jiffies : 0;
         if (rt->peer) {
-                id = rt->peer->ip_id_count;
+                id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
                 if (rt->peer->tcp_ts_stamp) {
                         ts = rt->peer->tcp_ts;
                         tsage = get_seconds() - rt->peer->tcp_ts_stamp;
@@ -3004,8 +3050,8 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                 if (!rt_hash_table[h].chain)
                         continue;
                 rcu_read_lock_bh();
-                for (rt = rcu_dereference(rt_hash_table[h].chain), idx = 0; rt;
-                     rt = rcu_dereference(rt->u.dst.rt_next), idx++) {
+                for (rt = rcu_dereference_bh(rt_hash_table[h].chain), idx = 0; rt;
+                     rt = rcu_dereference_bh(rt->u.dst.rt_next), idx++) {
                         if (!net_eq(dev_net(rt->u.dst.dev), net) || idx < s_idx)
                                 continue;
                         if (rt_is_expired(rt))
@@ -3056,23 +3102,6 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
         return -EINVAL;
 }
 
-static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
-                                                void __user *oldval,
-                                                size_t __user *oldlenp,
-                                                void __user *newval,
-                                                size_t newlen)
-{
-        int delay;
-        struct net *net;
-        if (newlen != sizeof(int))
-                return -EINVAL;
-        if (get_user(delay, (int __user *)newval))
-                return -EFAULT;
-        net = (struct net *)table->extra1;
-        rt_cache_flush(net, delay);
-        return 0;
-}
-
 static void rt_secret_reschedule(int old)
 {
         struct net *net;
@@ -3085,22 +3114,20 @@ static void rt_secret_reschedule(int old)
         rtnl_lock();
         for_each_net(net) {
                 int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
+                long time;
 
                 if (!new)
                         continue;
 
                 if (deleted) {
-                        long time = net->ipv4.rt_secret_timer.expires - jiffies;
+                        time = net->ipv4.rt_secret_timer.expires - jiffies;
 
                         if (time <= 0 || (time += diff) <= 0)
                                 time = 0;
-
-                        net->ipv4.rt_secret_timer.expires = time;
                 } else
-                        net->ipv4.rt_secret_timer.expires = new;
+                        time = new;
 
-                net->ipv4.rt_secret_timer.expires += jiffies;
-                add_timer(&net->ipv4.rt_secret_timer);
+                mod_timer(&net->ipv4.rt_secret_timer, jiffies + time);
         }
         rtnl_unlock();
 }
@@ -3117,23 +3144,8 @@ static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
         return ret;
 }
 
-static int ipv4_sysctl_rt_secret_interval_strategy(ctl_table *table,
-                                                   void __user *oldval,
-                                                   size_t __user *oldlenp,
-                                                   void __user *newval,
-                                                   size_t newlen)
-{
-        int old = ip_rt_secret_interval;
-        int ret = sysctl_jiffies(table, oldval, oldlenp, newval, newlen);
-
-        rt_secret_reschedule(old);
-
-        return ret;
-}
-
 static ctl_table ipv4_route_table[] = {
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_THRESH,
                 .procname       = "gc_thresh",
                 .data           = &ipv4_dst_ops.gc_thresh,
                 .maxlen         = sizeof(int),
@@ -3141,7 +3153,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MAX_SIZE,
                 .procname       = "max_size",
                 .data           = &ip_rt_max_size,
                 .maxlen         = sizeof(int),
@@ -3151,43 +3162,34 @@ static ctl_table ipv4_route_table[] = {
         {
                 /*  Deprecated. Use gc_min_interval_ms */
 
-                .ctl_name       = NET_IPV4_ROUTE_GC_MIN_INTERVAL,
                 .procname       = "gc_min_interval",
                 .data           = &ip_rt_gc_min_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_MIN_INTERVAL_MS,
                 .procname       = "gc_min_interval_ms",
                 .data           = &ip_rt_gc_min_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_ms_jiffies,
-                .strategy       = sysctl_ms_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_TIMEOUT,
                 .procname       = "gc_timeout",
                 .data           = &ip_rt_gc_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_INTERVAL,
                 .procname       = "gc_interval",
                 .data           = &ip_rt_gc_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_REDIRECT_LOAD,
                 .procname       = "redirect_load",
                 .data           = &ip_rt_redirect_load,
                 .maxlen         = sizeof(int),
@@ -3195,7 +3197,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_REDIRECT_NUMBER,
                 .procname       = "redirect_number",
                 .data           = &ip_rt_redirect_number,
                 .maxlen         = sizeof(int),
@@ -3203,7 +3204,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_REDIRECT_SILENCE,
                 .procname       = "redirect_silence",
                 .data           = &ip_rt_redirect_silence,
                 .maxlen         = sizeof(int),
@@ -3211,7 +3211,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_ERROR_COST,
                 .procname       = "error_cost",
                 .data           = &ip_rt_error_cost,
                 .maxlen         = sizeof(int),
@@ -3219,7 +3218,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_ERROR_BURST,
                 .procname       = "error_burst",
                 .data           = &ip_rt_error_burst,
                 .maxlen         = sizeof(int),
@@ -3227,7 +3225,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_ELASTICITY,
                 .procname       = "gc_elasticity",
                 .data           = &ip_rt_gc_elasticity,
                 .maxlen         = sizeof(int),
@@ -3235,16 +3232,13 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MTU_EXPIRES,
                 .procname       = "mtu_expires",
                 .data           = &ip_rt_mtu_expires,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MIN_PMTU,
                 .procname       = "min_pmtu",
                 .data           = &ip_rt_min_pmtu,
                 .maxlen         = sizeof(int),
@@ -3252,7 +3246,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MIN_ADVMSS,
                 .procname       = "min_adv_mss",
                 .data           = &ip_rt_min_advmss,
                 .maxlen         = sizeof(int),
@@ -3260,50 +3253,46 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_SECRET_INTERVAL,
                 .procname       = "secret_interval",
                 .data           = &ip_rt_secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = ipv4_sysctl_rt_secret_interval,
-                .strategy       = ipv4_sysctl_rt_secret_interval_strategy,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_table empty[1];
 
 static struct ctl_table ipv4_skeleton[] =
 {
-        { .procname = "route", .ctl_name = NET_IPV4_ROUTE,
+        { .procname = "route", 
           .mode = 0555, .child = ipv4_route_table},
-        { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH,
+        { .procname = "neigh", 
           .mode = 0555, .child = empty},
         { }
 };
 
 static __net_initdata struct ctl_path ipv4_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
         { },
 };
 
 static struct ctl_table ipv4_route_flush_table[] = {
         {
-                .ctl_name       = NET_IPV4_ROUTE_FLUSH,
                 .procname       = "flush",
                 .maxlen         = sizeof(int),
                 .mode           = 0200,
                 .proc_handler   = ipv4_sysctl_rtcache_flush,
-                .strategy       = ipv4_sysctl_rtcache_flush_strategy,
         },
-        { .ctl_name = 0 },
+        { },
 };
 
 static __net_initdata struct ctl_path ipv4_route_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
-        { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
+        { .procname = "route", },
         { },
 };
 
@@ -3312,7 +3301,7 @@ static __net_init int sysctl_route_net_init(struct net *net)
         struct ctl_table *tbl;
 
         tbl = ipv4_route_flush_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
                 if (tbl == NULL)
                         goto err_dup;
@@ -3380,7 +3369,7 @@ static __net_initdata struct pernet_operations rt_secret_timer_ops = {
 
 
 #ifdef CONFIG_NET_CLS_ROUTE
-struct ip_rt_acct *ip_rt_acct __read_mostly;
+struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 #endif /* CONFIG_NET_CLS_ROUTE */
 
 static __initdata unsigned long rhash_entries;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index a6e0e077ac33..5c24db4a3c91 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -253,6 +253,8 @@ EXPORT_SYMBOL(cookie_check_timestamp);
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt)
 {
+        struct tcp_options_received tcp_opt;
+        u8 *hash_location;
         struct inet_request_sock *ireq;
         struct tcp_request_sock *treq;
         struct tcp_sock *tp = tcp_sk(sk);
@@ -263,7 +265,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         int mss;
         struct rtable *rt;
         __u8 rcv_wscale;
-        struct tcp_options_received tcp_opt;
 
         if (!sysctl_tcp_syncookies || !th->ack)
                 goto out;
@@ -278,7 +279,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         /* check for timestamp cookie support */
         memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
 
         if (tcp_opt.saw_tstamp)
                 cookie_check_timestamp(&tcp_opt);
@@ -333,7 +334,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * no easy way to do this.
          */
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
+                struct flowi fl = { .mark = sk->sk_mark,
+                                    .nl_u = { .ip4_u =
                                               { .daddr = ((opt && opt->srr) ?
                                                           opt->faddr :
                                                           ireq->rmt_addr),
@@ -356,7 +358,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
-                                  ireq->wscale_ok, &rcv_wscale);
+                                  ireq->wscale_ok, &rcv_wscale,
+                                  dst_metric(&rt->u.dst, RTAX_INITRWND));
 
         ireq->rcv_wscale  = rcv_wscale;
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 2dcf04d9b005..1cd5c15174b8 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -12,6 +12,7 @@
 #include <linux/inetdevice.h>
 #include <linux/seqlock.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/snmp.h>
 #include <net/icmp.h>
 #include <net/ip.h>
@@ -63,34 +64,6 @@ static int ipv4_local_port_range(ctl_table *table, int write,
         return ret;
 }
 
-/* Validate changes from sysctl interface. */
-static int ipv4_sysctl_local_port_range(ctl_table *table,
-                                         void __user *oldval,
-                                         size_t __user *oldlenp,
-                                        void __user *newval, size_t newlen)
-{
-        int ret;
-        int range[2];
-        ctl_table tmp = {
-                .data = &range,
-                .maxlen = sizeof(range),
-                .mode = table->mode,
-                .extra1 = &ip_local_port_range_min,
-                .extra2 = &ip_local_port_range_max,
-        };
-
-        inet_get_local_port_range(range, range + 1);
-        ret = sysctl_intvec(&tmp, oldval, oldlenp, newval, newlen);
-        if (ret == 0 && newval && newlen) {
-                if (range[1] < range[0])
-                        ret = -EINVAL;
-                else
-                        set_local_port_range(range);
-        }
-        return ret;
-}
-
-
 static int proc_tcp_congestion_control(ctl_table *ctl, int write,
                                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -109,25 +82,6 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write,
         return ret;
 }
 
-static int sysctl_tcp_congestion_control(ctl_table *table,
-                                         void __user *oldval,
-                                         size_t __user *oldlenp,
-                                         void __user *newval, size_t newlen)
-{
-        char val[TCP_CA_NAME_MAX];
-        ctl_table tbl = {
-                .data = val,
-                .maxlen = TCP_CA_NAME_MAX,
-        };
-        int ret;
-
-        tcp_get_default_congestion_control(val);
-        ret = sysctl_string(&tbl, oldval, oldlenp, newval, newlen);
-        if (ret == 1 && newval && newlen)
-                ret = tcp_set_default_congestion_control(val);
-        return ret;
-}
-
 static int proc_tcp_available_congestion_control(ctl_table *ctl,
                                                  int write,
                                                  void __user *buffer, size_t *lenp,
@@ -165,32 +119,8 @@ static int proc_allowed_congestion_control(ctl_table *ctl,
         return ret;
 }
 
-static int strategy_allowed_congestion_control(ctl_table *table,
-                                               void __user *oldval,
-                                               size_t __user *oldlenp,
-                                               void __user *newval,
-                                               size_t newlen)
-{
-        ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
-        int ret;
-
-        tbl.data = kmalloc(tbl.maxlen, GFP_USER);
-        if (!tbl.data)
-                return -ENOMEM;
-
-        tcp_get_available_congestion_control(tbl.data, tbl.maxlen);
-        ret = sysctl_string(&tbl, oldval, oldlenp, newval, newlen);
-        if (ret == 1 && newval && newlen)
-                ret = tcp_set_allowed_congestion_control(tbl.data);
-        kfree(tbl.data);
-
-        return ret;
-
-}
-
 static struct ctl_table ipv4_table[] = {
         {
-                .ctl_name       = NET_IPV4_TCP_TIMESTAMPS,
                 .procname       = "tcp_timestamps",
                 .data           = &sysctl_tcp_timestamps,
                 .maxlen         = sizeof(int),
@@ -198,7 +128,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_WINDOW_SCALING,
                 .procname       = "tcp_window_scaling",
                 .data           = &sysctl_tcp_window_scaling,
                 .maxlen         = sizeof(int),
@@ -206,7 +135,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_SACK,
                 .procname       = "tcp_sack",
                 .data           = &sysctl_tcp_sack,
                 .maxlen         = sizeof(int),
@@ -214,7 +142,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_RETRANS_COLLAPSE,
                 .procname       = "tcp_retrans_collapse",
                 .data           = &sysctl_tcp_retrans_collapse,
                 .maxlen         = sizeof(int),
@@ -222,17 +149,14 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_DEFAULT_TTL,
                 .procname       = "ip_default_ttl",
                 .data           = &sysctl_ip_default_ttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = ipv4_doint_and_flush,
-                .strategy       = ipv4_doint_and_flush_strategy,
                 .extra2         = &init_net,
         },
         {
-                .ctl_name       = NET_IPV4_NO_PMTU_DISC,
                 .procname       = "ip_no_pmtu_disc",
                 .data           = &ipv4_config.no_pmtu_disc,
                 .maxlen         = sizeof(int),
@@ -240,7 +164,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_NONLOCAL_BIND,
                 .procname       = "ip_nonlocal_bind",
                 .data           = &sysctl_ip_nonlocal_bind,
                 .maxlen         = sizeof(int),
@@ -248,7 +171,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_SYN_RETRIES,
                 .procname       = "tcp_syn_retries",
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
@@ -256,7 +178,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_SYNACK_RETRIES,
                 .procname       = "tcp_synack_retries",
                 .data           = &sysctl_tcp_synack_retries,
                 .maxlen         = sizeof(int),
@@ -264,7 +185,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MAX_ORPHANS,
                 .procname       = "tcp_max_orphans",
                 .data           = &sysctl_tcp_max_orphans,
                 .maxlen         = sizeof(int),
@@ -272,7 +192,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MAX_TW_BUCKETS,
                 .procname       = "tcp_max_tw_buckets",
                 .data           = &tcp_death_row.sysctl_max_tw_buckets,
                 .maxlen         = sizeof(int),
@@ -280,7 +199,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_DYNADDR,
                 .procname       = "ip_dynaddr",
                 .data           = &sysctl_ip_dynaddr,
                 .maxlen         = sizeof(int),
@@ -288,16 +206,13 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_KEEPALIVE_TIME,
                 .procname       = "tcp_keepalive_time",
                 .data           = &sysctl_tcp_keepalive_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_TCP_KEEPALIVE_PROBES,
                 .procname       = "tcp_keepalive_probes",
                 .data           = &sysctl_tcp_keepalive_probes,
                 .maxlen         = sizeof(int),
@@ -305,26 +220,21 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_KEEPALIVE_INTVL,
                 .procname       = "tcp_keepalive_intvl",
                 .data           = &sysctl_tcp_keepalive_intvl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_TCP_RETRIES1,
                 .procname       = "tcp_retries1",
                 .data           = &sysctl_tcp_retries1,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra2         = &tcp_retr1_max
         },
         {
-                .ctl_name       = NET_IPV4_TCP_RETRIES2,
                 .procname       = "tcp_retries2",
                 .data           = &sysctl_tcp_retries2,
                 .maxlen         = sizeof(int),
@@ -332,17 +242,14 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_FIN_TIMEOUT,
                 .procname       = "tcp_fin_timeout",
                 .data           = &sysctl_tcp_fin_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
 #ifdef CONFIG_SYN_COOKIES
         {
-                .ctl_name       = NET_TCP_SYNCOOKIES,
                 .procname       = "tcp_syncookies",
                 .data           = &sysctl_tcp_syncookies,
                 .maxlen         = sizeof(int),
@@ -351,7 +258,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #endif
         {
-                .ctl_name       = NET_TCP_TW_RECYCLE,
                 .procname       = "tcp_tw_recycle",
                 .data           = &tcp_death_row.sysctl_tw_recycle,
                 .maxlen         = sizeof(int),
@@ -359,7 +265,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_ABORT_ON_OVERFLOW,
                 .procname       = "tcp_abort_on_overflow",
                 .data           = &sysctl_tcp_abort_on_overflow,
                 .maxlen         = sizeof(int),
@@ -367,7 +272,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_STDURG,
                 .procname       = "tcp_stdurg",
                 .data           = &sysctl_tcp_stdurg,
                 .maxlen         = sizeof(int),
@@ -375,7 +279,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_RFC1337,
                 .procname       = "tcp_rfc1337",
                 .data           = &sysctl_tcp_rfc1337,
                 .maxlen         = sizeof(int),
@@ -383,7 +286,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MAX_SYN_BACKLOG,
                 .procname       = "tcp_max_syn_backlog",
                 .data           = &sysctl_max_syn_backlog,
                 .maxlen         = sizeof(int),
@@ -391,17 +293,14 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_LOCAL_PORT_RANGE,
                 .procname       = "ip_local_port_range",
                 .data           = &sysctl_local_ports.range,
                 .maxlen         = sizeof(sysctl_local_ports.range),
                 .mode           = 0644,
                 .proc_handler   = ipv4_local_port_range,
-                .strategy       = ipv4_sysctl_local_port_range,
         },
 #ifdef CONFIG_IP_MULTICAST
         {
-                .ctl_name       = NET_IPV4_IGMP_MAX_MEMBERSHIPS,
                 .procname       = "igmp_max_memberships",
                 .data           = &sysctl_igmp_max_memberships,
                 .maxlen         = sizeof(int),
@@ -411,7 +310,6 @@ static struct ctl_table ipv4_table[] = {
 
 #endif
         {
-                .ctl_name       = NET_IPV4_IGMP_MAX_MSF,
                 .procname       = "igmp_max_msf",
                 .data           = &sysctl_igmp_max_msf,
                 .maxlen         = sizeof(int),
@@ -419,7 +317,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_THRESHOLD,
                 .procname       = "inet_peer_threshold",
                 .data           = &inet_peer_threshold,
                 .maxlen         = sizeof(int),
@@ -427,43 +324,34 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_MINTTL,
                 .procname       = "inet_peer_minttl",
                 .data           = &inet_peer_minttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_MAXTTL,
                 .procname       = "inet_peer_maxttl",
                 .data           = &inet_peer_maxttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_GC_MINTIME,
                 .procname       = "inet_peer_gc_mintime",
                 .data           = &inet_peer_gc_mintime,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_GC_MAXTIME,
                 .procname       = "inet_peer_gc_maxtime",
                 .data           = &inet_peer_gc_maxtime,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_TCP_ORPHAN_RETRIES,
                 .procname       = "tcp_orphan_retries",
                 .data           = &sysctl_tcp_orphan_retries,
                 .maxlen         = sizeof(int),
@@ -471,7 +359,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_FACK,
                 .procname       = "tcp_fack",
                 .data           = &sysctl_tcp_fack,
                 .maxlen         = sizeof(int),
@@ -479,7 +366,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_REORDERING,
                 .procname       = "tcp_reordering",
                 .data           = &sysctl_tcp_reordering,
                 .maxlen         = sizeof(int),
@@ -487,7 +373,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_ECN,
                 .procname       = "tcp_ecn",
                 .data           = &sysctl_tcp_ecn,
                 .maxlen         = sizeof(int),
@@ -495,7 +380,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_DSACK,
                 .procname       = "tcp_dsack",
                 .data           = &sysctl_tcp_dsack,
                 .maxlen         = sizeof(int),
@@ -503,7 +387,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MEM,
                 .procname       = "tcp_mem",
                 .data           = &sysctl_tcp_mem,
                 .maxlen         = sizeof(sysctl_tcp_mem),
@@ -511,7 +394,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_WMEM,
                 .procname       = "tcp_wmem",
                 .data           = &sysctl_tcp_wmem,
                 .maxlen         = sizeof(sysctl_tcp_wmem),
@@ -519,7 +401,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_RMEM,
                 .procname       = "tcp_rmem",
                 .data           = &sysctl_tcp_rmem,
                 .maxlen         = sizeof(sysctl_tcp_rmem),
@@ -527,7 +408,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_APP_WIN,
                 .procname       = "tcp_app_win",
                 .data           = &sysctl_tcp_app_win,
                 .maxlen         = sizeof(int),
@@ -535,7 +415,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_ADV_WIN_SCALE,
                 .procname       = "tcp_adv_win_scale",
                 .data           = &sysctl_tcp_adv_win_scale,
                 .maxlen         = sizeof(int),
@@ -543,7 +422,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_TW_REUSE,
                 .procname       = "tcp_tw_reuse",
                 .data           = &sysctl_tcp_tw_reuse,
                 .maxlen         = sizeof(int),
@@ -551,7 +429,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_FRTO,
                 .procname       = "tcp_frto",
                 .data           = &sysctl_tcp_frto,
                 .maxlen         = sizeof(int),
@@ -559,7 +436,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_FRTO_RESPONSE,
                 .procname       = "tcp_frto_response",
                 .data           = &sysctl_tcp_frto_response,
                 .maxlen         = sizeof(int),
@@ -567,7 +443,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_LOW_LATENCY,
                 .procname       = "tcp_low_latency",
                 .data           = &sysctl_tcp_low_latency,
                 .maxlen         = sizeof(int),
@@ -575,7 +450,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_NO_METRICS_SAVE,
                 .procname       = "tcp_no_metrics_save",
                 .data           = &sysctl_tcp_nometrics_save,
                 .maxlen         = sizeof(int),
@@ -583,7 +457,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_MODERATE_RCVBUF,
                 .procname       = "tcp_moderate_rcvbuf",
                 .data           = &sysctl_tcp_moderate_rcvbuf,
                 .maxlen         = sizeof(int),
@@ -591,7 +464,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_TSO_WIN_DIVISOR,
                 .procname       = "tcp_tso_win_divisor",
                 .data           = &sysctl_tcp_tso_win_divisor,
                 .maxlen         = sizeof(int),
@@ -599,15 +471,12 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_CONG_CONTROL,
                 .procname       = "tcp_congestion_control",
                 .mode           = 0644,
                 .maxlen         = TCP_CA_NAME_MAX,
                 .proc_handler   = proc_tcp_congestion_control,
-                .strategy       = sysctl_tcp_congestion_control,
         },
         {
-                .ctl_name       = NET_TCP_ABC,
                 .procname       = "tcp_abc",
                 .data           = &sysctl_tcp_abc,
                 .maxlen         = sizeof(int),
@@ -615,7 +484,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_MTU_PROBING,
                 .procname       = "tcp_mtu_probing",
                 .data           = &sysctl_tcp_mtu_probing,
                 .maxlen         = sizeof(int),
@@ -623,7 +491,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_BASE_MSS,
                 .procname       = "tcp_base_mss",
                 .data           = &sysctl_tcp_base_mss,
                 .maxlen         = sizeof(int),
@@ -631,7 +498,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_TCP_WORKAROUND_SIGNED_WINDOWS,
                 .procname       = "tcp_workaround_signed_windows",
                 .data           = &sysctl_tcp_workaround_signed_windows,
                 .maxlen         = sizeof(int),
@@ -640,7 +506,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #ifdef CONFIG_NET_DMA
         {
-                .ctl_name       = NET_TCP_DMA_COPYBREAK,
                 .procname       = "tcp_dma_copybreak",
                 .data           = &sysctl_tcp_dma_copybreak,
                 .maxlen         = sizeof(int),
@@ -649,7 +514,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #endif
         {
-                .ctl_name       = NET_TCP_SLOW_START_AFTER_IDLE,
                 .procname       = "tcp_slow_start_after_idle",
                 .data           = &sysctl_tcp_slow_start_after_idle,
                 .maxlen         = sizeof(int),
@@ -658,7 +522,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #ifdef CONFIG_NETLABEL
         {
-                .ctl_name       = NET_CIPSOV4_CACHE_ENABLE,
                 .procname       = "cipso_cache_enable",
                 .data           = &cipso_v4_cache_enabled,
                 .maxlen         = sizeof(int),
@@ -666,7 +529,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_CIPSOV4_CACHE_BUCKET_SIZE,
                 .procname       = "cipso_cache_bucket_size",
                 .data           = &cipso_v4_cache_bucketsize,
                 .maxlen         = sizeof(int),
@@ -674,7 +536,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_CIPSOV4_RBM_OPTFMT,
                 .procname       = "cipso_rbm_optfmt",
                 .data           = &cipso_v4_rbm_optfmt,
                 .maxlen         = sizeof(int),
@@ -682,7 +543,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_CIPSOV4_RBM_STRICTVALID,
                 .procname       = "cipso_rbm_strictvalid",
                 .data           = &cipso_v4_rbm_strictvalid,
                 .maxlen         = sizeof(int),
@@ -697,15 +557,12 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_tcp_available_congestion_control,
         },
         {
-                .ctl_name       = NET_TCP_ALLOWED_CONG_CONTROL,
                 .procname       = "tcp_allowed_congestion_control",
                 .maxlen         = TCP_CA_BUF_MAX,
                 .mode           = 0644,
                 .proc_handler   = proc_allowed_congestion_control,
-                .strategy       = strategy_allowed_congestion_control,
         },
         {
-                .ctl_name       = NET_TCP_MAX_SSTHRESH,
                 .procname       = "tcp_max_ssthresh",
                 .data           = &sysctl_tcp_max_ssthresh,
                 .maxlen         = sizeof(int),
@@ -713,41 +570,55 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "tcp_cookie_size",
+                .data           = &sysctl_tcp_cookie_size,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_thin_linear_timeouts",
+                .data           = &sysctl_tcp_thin_linear_timeouts,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_thin_dupack",
+                .data           = &sysctl_tcp_thin_dupack,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "udp_rmem_min",
                 .data           = &sysctl_udp_rmem_min,
                 .maxlen         = sizeof(sysctl_udp_rmem_min),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "udp_wmem_min",
                 .data           = &sysctl_udp_wmem_min,
                 .maxlen         = sizeof(sysctl_udp_wmem_min),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_table ipv4_net_table[] = {
         {
-                .ctl_name       = NET_IPV4_ICMP_ECHO_IGNORE_ALL,
                 .procname       = "icmp_echo_ignore_all",
                 .data           = &init_net.ipv4.sysctl_icmp_echo_ignore_all,
                 .maxlen         = sizeof(int),
@@ -755,7 +626,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_ECHO_IGNORE_BROADCASTS,
                 .procname       = "icmp_echo_ignore_broadcasts",
                 .data           = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
                 .maxlen         = sizeof(int),
@@ -763,7 +633,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_IGNORE_BOGUS_ERROR_RESPONSES,
                 .procname       = "icmp_ignore_bogus_error_responses",
                 .data           = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
                 .maxlen         = sizeof(int),
@@ -771,7 +640,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_ERRORS_USE_INBOUND_IFADDR,
                 .procname       = "icmp_errors_use_inbound_ifaddr",
                 .data           = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
                 .maxlen         = sizeof(int),
@@ -779,16 +647,13 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_RATELIMIT,
                 .procname       = "icmp_ratelimit",
                 .data           = &init_net.ipv4.sysctl_icmp_ratelimit,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_ms_jiffies,
-                .strategy       = sysctl_ms_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_RATEMASK,
                 .procname       = "icmp_ratemask",
                 .data           = &init_net.ipv4.sysctl_icmp_ratemask,
                 .maxlen         = sizeof(int),
@@ -796,7 +661,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rt_cache_rebuild_count",
                 .data           = &init_net.ipv4.sysctl_rt_cache_rebuild_count,
                 .maxlen         = sizeof(int),
@@ -807,8 +671,8 @@ static struct ctl_table ipv4_net_table[] = {
 };
 
 struct ctl_path net_ipv4_ctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
         { },
 };
 EXPORT_SYMBOL_GPL(net_ipv4_ctl_path);
@@ -818,7 +682,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
         struct ctl_table *table;
 
         table = ipv4_net_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
@@ -849,7 +713,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
         return 0;
 
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 kfree(table);
 err_alloc:
         return -ENOMEM;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f1813bc71088..296150b2a62f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -264,6 +264,8 @@
 #include <linux/cache.h>
 #include <linux/err.h>
 #include <linux/crypto.h>
+#include <linux/time.h>
+#include <linux/slab.h>
 
 #include <net/icmp.h>
 #include <net/tcp.h>
@@ -428,7 +430,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 if (tp->urg_seq == tp->copied_seq &&
                     !sock_flag(sk, SOCK_URGINLINE) &&
                     tp->urg_data)
-                        target--;
+                        target++;
 
                 /* Potential race condition. If read of tp below will
                  * escape above sk->sk_state, we can be illegally awaken
@@ -535,8 +537,7 @@ static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
                 tp->nonagle &= ~TCP_NAGLE_PUSH;
 }
 
-static inline void tcp_mark_urg(struct tcp_sock *tp, int flags,
-                                struct sk_buff *skb)
+static inline void tcp_mark_urg(struct tcp_sock *tp, int flags)
 {
         if (flags & MSG_OOB)
                 tp->snd_up = tp->write_seq;
@@ -545,13 +546,13 @@ static inline void tcp_mark_urg(struct tcp_sock *tp, int flags,
 static inline void tcp_push(struct sock *sk, int flags, int mss_now,
                             int nonagle)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
         if (tcp_send_head(sk)) {
-                struct sk_buff *skb = tcp_write_queue_tail(sk);
+                struct tcp_sock *tp = tcp_sk(sk);
+
                 if (!(flags & MSG_MORE) || forced_push(tp))
-                        tcp_mark_push(tp, skb);
-                tcp_mark_urg(tp, flags, skb);
+                        tcp_mark_push(tp, tcp_write_queue_tail(sk));
+
+                tcp_mark_urg(tp, flags);
                 __tcp_push_pending_frames(sk, mss_now,
                                           (flags & MSG_MORE) ? TCP_NAGLE_CORK : nonagle);
         }
@@ -876,12 +877,12 @@ ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset,
 #define TCP_PAGE(sk)    (sk->sk_sndmsg_page)
 #define TCP_OFF(sk)     (sk->sk_sndmsg_off)
 
-static inline int select_size(struct sock *sk)
+static inline int select_size(struct sock *sk, int sg)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int tmp = tp->mss_cache;
 
-        if (sk->sk_route_caps & NETIF_F_SG) {
+        if (sg) {
                 if (sk_can_gso(sk))
                         tmp = 0;
                 else {
@@ -905,7 +906,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sk_buff *skb;
         int iovlen, flags;
         int mss_now, size_goal;
-        int err, copied;
+        int sg, err, copied;
         long timeo;
 
         lock_sock(sk);
@@ -933,6 +934,8 @@ int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                 goto out_err;
 
+        sg = sk->sk_route_caps & NETIF_F_SG;
+
         while (--iovlen >= 0) {
                 int seglen = iov->iov_len;
                 unsigned char __user *from = iov->iov_base;
@@ -958,8 +961,9 @@ new_segment:
                                 if (!sk_stream_memory_free(sk))
                                         goto wait_for_sndbuf;
 
-                                skb = sk_stream_alloc_skb(sk, select_size(sk),
-                                                sk->sk_allocation);
+                                skb = sk_stream_alloc_skb(sk,
+                                                          select_size(sk, sg),
+                                                          sk->sk_allocation);
                                 if (!skb)
                                         goto wait_for_memory;
 
@@ -996,9 +1000,7 @@ new_segment:
                                         /* We can extend the last page
                                          * fragment. */
                                         merge = 1;
-                                } else if (i == MAX_SKB_FRAGS ||
-                                           (!i &&
-                                           !(sk->sk_route_caps & NETIF_F_SG))) {
+                                } else if (i == MAX_SKB_FRAGS || !sg) {
                                         /* Need to add new fragment and cannot
                                          * do this because interface is non-SG,
                                          * or because all the page slots are
@@ -1253,6 +1255,39 @@ static void tcp_prequeue_process(struct sock *sk)
         tp->ucopy.memory = 0;
 }
 
+#ifdef CONFIG_NET_DMA
+static void tcp_service_net_dma(struct sock *sk, bool wait)
+{
+        dma_cookie_t done, used;
+        dma_cookie_t last_issued;
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        if (!tp->ucopy.dma_chan)
+                return;
+
+        last_issued = tp->ucopy.dma_cookie;
+        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
+        do {
+                if (dma_async_memcpy_complete(tp->ucopy.dma_chan,
+                                              last_issued, &done,
+                                              &used) == DMA_SUCCESS) {
+                        /* Safe to free early-copied skbs now */
+                        __skb_queue_purge(&sk->sk_async_wait_queue);
+                        break;
+                } else {
+                        struct sk_buff *skb;
+                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
+                               (dma_async_is_complete(skb->dma_cookie, done,
+                                                      used) == DMA_SUCCESS)) {
+                                __skb_dequeue(&sk->sk_async_wait_queue);
+                                kfree_skb(skb);
+                        }
+                }
+        } while (wait);
+}
+#endif
+
 static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
 {
         struct sk_buff *skb;
@@ -1334,6 +1369,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                 sk_eat_skb(sk, skb, 0);
                 if (!desc->count)
                         break;
+                tp->copied_seq = seq;
         }
         tp->copied_seq = seq;
 
@@ -1545,6 +1581,10 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         /* __ Set realtime policy in scheduler __ */
                 }
 
+#ifdef CONFIG_NET_DMA
+                if (tp->ucopy.dma_chan)
+                        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+#endif
                 if (copied >= target) {
                         /* Do not sleep, just process backlog. */
                         release_sock(sk);
@@ -1553,6 +1593,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         sk_wait_data(sk, &timeo);
 
 #ifdef CONFIG_NET_DMA
+                tcp_service_net_dma(sk, false);  /* Don't block */
                 tp->ucopy.wakeup = 0;
 #endif
 
@@ -1632,6 +1673,9 @@ do_prequeue:
                                                 copied = -EFAULT;
                                         break;
                                 }
+
+                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
                                 if ((offset + used) == skb->len)
                                         copied_early = 1;
 
@@ -1701,27 +1745,9 @@ skip_copy:
         }
 
 #ifdef CONFIG_NET_DMA
-        if (tp->ucopy.dma_chan) {
-                dma_cookie_t done, used;
-
-                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
-
-                while (dma_async_memcpy_complete(tp->ucopy.dma_chan,
-                                                 tp->ucopy.dma_cookie, &done,
-                                                 &used) == DMA_IN_PROGRESS) {
-                        /* do partial cleanup of sk_async_wait_queue */
-                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
-                               (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
-                                __skb_dequeue(&sk->sk_async_wait_queue);
-                                kfree_skb(skb);
-                        }
-                }
+        tcp_service_net_dma(sk, true);  /* Wait for queue to drain */
+        tp->ucopy.dma_chan = NULL;
 
-                /* Safe to free early-copied skbs now */
-                __skb_queue_purge(&sk->sk_async_wait_queue);
-                tp->ucopy.dma_chan = NULL;
-        }
         if (tp->ucopy.pinned_list) {
                 dma_unpin_iovec_pages(tp->ucopy.pinned_list);
                 tp->ucopy.pinned_list = NULL;
@@ -2042,7 +2068,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         __skb_queue_purge(&sk->sk_async_wait_queue);
 #endif
 
-        inet->dport = 0;
+        inet->inet_dport = 0;
 
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -2059,6 +2085,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_cnt = 0;
         tp->bytes_acked = 0;
+        tp->window_clamp = 0;
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
@@ -2066,7 +2093,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        WARN_ON(inet->num && !icsk->icsk_bind_hash);
+        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -2083,8 +2110,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
         int val;
         int err = 0;
 
-        /* This is a string value all the others are int's */
-        if (optname == TCP_CONGESTION) {
+        /* These are data/string values, all the others are ints */
+        switch (optname) {
+        case TCP_CONGESTION: {
                 char name[TCP_CA_NAME_MAX];
 
                 if (optlen < 1)
@@ -2101,6 +2129,93 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 release_sock(sk);
                 return err;
         }
+        case TCP_COOKIE_TRANSACTIONS: {
+                struct tcp_cookie_transactions ctd;
+                struct tcp_cookie_values *cvp = NULL;
+
+                if (sizeof(ctd) > optlen)
+                        return -EINVAL;
+                if (copy_from_user(&ctd, optval, sizeof(ctd)))
+                        return -EFAULT;
+
+                if (ctd.tcpct_used > sizeof(ctd.tcpct_value) ||
+                    ctd.tcpct_s_data_desired > TCP_MSS_DESIRED)
+                        return -EINVAL;
+
+                if (ctd.tcpct_cookie_desired == 0) {
+                        /* default to global value */
+                } else if ((0x1 & ctd.tcpct_cookie_desired) ||
+                           ctd.tcpct_cookie_desired > TCP_COOKIE_MAX ||
+                           ctd.tcpct_cookie_desired < TCP_COOKIE_MIN) {
+                        return -EINVAL;
+                }
+
+                if (TCP_COOKIE_OUT_NEVER & ctd.tcpct_flags) {
+                        /* Supercedes all other values */
+                        lock_sock(sk);
+                        if (tp->cookie_values != NULL) {
+                                kref_put(&tp->cookie_values->kref,
+                                         tcp_cookie_values_release);
+                                tp->cookie_values = NULL;
+                        }
+                        tp->rx_opt.cookie_in_always = 0; /* false */
+                        tp->rx_opt.cookie_out_never = 1; /* true */
+                        release_sock(sk);
+                        return err;
+                }
+
+                /* Allocate ancillary memory before locking.
+                 */
+                if (ctd.tcpct_used > 0 ||
+                    (tp->cookie_values == NULL &&
+                     (sysctl_tcp_cookie_size > 0 ||
+                      ctd.tcpct_cookie_desired > 0 ||
+                      ctd.tcpct_s_data_desired > 0))) {
+                        cvp = kzalloc(sizeof(*cvp) + ctd.tcpct_used,
+                                      GFP_KERNEL);
+                        if (cvp == NULL)
+                                return -ENOMEM;
+                }
+                lock_sock(sk);
+                tp->rx_opt.cookie_in_always =
+                        (TCP_COOKIE_IN_ALWAYS & ctd.tcpct_flags);
+                tp->rx_opt.cookie_out_never = 0; /* false */
+
+                if (tp->cookie_values != NULL) {
+                        if (cvp != NULL) {
+                                /* Changed values are recorded by a changed
+                                 * pointer, ensuring the cookie will differ,
+                                 * without separately hashing each value later.
+                                 */
+                                kref_put(&tp->cookie_values->kref,
+                                         tcp_cookie_values_release);
+                                kref_init(&cvp->kref);
+                                tp->cookie_values = cvp;
+                        } else {
+                                cvp = tp->cookie_values;
+                        }
+                }
+                if (cvp != NULL) {
+                        cvp->cookie_desired = ctd.tcpct_cookie_desired;
+
+                        if (ctd.tcpct_used > 0) {
+                                memcpy(cvp->s_data_payload, ctd.tcpct_value,
+                                       ctd.tcpct_used);
+                                cvp->s_data_desired = ctd.tcpct_used;
+                                cvp->s_data_constant = 1; /* true */
+                        } else {
+                                /* No constant payload data. */
+                                cvp->s_data_desired = ctd.tcpct_s_data_desired;
+                                cvp->s_data_constant = 0; /* false */
+                        }
+                }
+                release_sock(sk);
+                return err;
+        }
+        default:
+                /* fallthru */
+                break;
+        };
 
         if (optlen < sizeof(int))
                 return -EINVAL;
@@ -2139,6 +2254,20 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 }
                 break;
 
+        case TCP_THIN_LINEAR_TIMEOUTS:
+                if (val < 0 || val > 1)
+                        err = -EINVAL;
+                else
+                        tp->thin_lto = val;
+                break;
+
+        case TCP_THIN_DUPACK:
+                if (val < 0 || val > 1)
+                        err = -EINVAL;
+                else
+                        tp->thin_dupack = val;
+                break;
+
         case TCP_CORK:
                 /* When set indicates to always queue non-full frames.
                  * Later the user clears this option and we transmit
@@ -2425,6 +2554,42 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 if (copy_to_user(optval, icsk->icsk_ca_ops->name, len))
                         return -EFAULT;
                 return 0;
+
+        case TCP_COOKIE_TRANSACTIONS: {
+                struct tcp_cookie_transactions ctd;
+                struct tcp_cookie_values *cvp = tp->cookie_values;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+                if (len < sizeof(ctd))
+                        return -EINVAL;
+
+                memset(&ctd, 0, sizeof(ctd));
+                ctd.tcpct_flags = (tp->rx_opt.cookie_in_always ?
+                                   TCP_COOKIE_IN_ALWAYS : 0)
+                                | (tp->rx_opt.cookie_out_never ?
+                                   TCP_COOKIE_OUT_NEVER : 0);
+
+                if (cvp != NULL) {
+                        ctd.tcpct_flags |= (cvp->s_data_in ?
+                                            TCP_S_DATA_IN : 0)
+                                         | (cvp->s_data_out ?
+                                            TCP_S_DATA_OUT : 0);
+
+                        ctd.tcpct_cookie_desired = cvp->cookie_desired;
+                        ctd.tcpct_s_data_desired = cvp->s_data_desired;
+
+                        memcpy(&ctd.tcpct_value[0], &cvp->cookie_pair[0],
+                               cvp->cookie_pair_size);
+                        ctd.tcpct_used = cvp->cookie_pair_size;
+                }
+
+                if (put_user(sizeof(ctd), optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, &ctd, sizeof(ctd)))
+                        return -EFAULT;
+                return 0;
+        }
         default:
                 return -ENOPROTOOPT;
         }
@@ -2662,10 +2827,10 @@ EXPORT_SYMBOL(tcp_gro_complete);
 
 #ifdef CONFIG_TCP_MD5SIG
 static unsigned long tcp_md5sig_users;
-static struct tcp_md5sig_pool **tcp_md5sig_pool;
+static struct tcp_md5sig_pool * __percpu *tcp_md5sig_pool;
 static DEFINE_SPINLOCK(tcp_md5sig_pool_lock);
 
-static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool **pool)
+static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool * __percpu *pool)
 {
         int cpu;
         for_each_possible_cpu(cpu) {
@@ -2674,7 +2839,6 @@ static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool **pool)
                         if (p->md5_desc.tfm)
                                 crypto_free_hash(p->md5_desc.tfm);
                         kfree(p);
-                        p = NULL;
                 }
         }
         free_percpu(pool);
@@ -2682,7 +2846,7 @@ static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool **pool)
 
 void tcp_free_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool **pool = NULL;
+        struct tcp_md5sig_pool * __percpu *pool = NULL;
 
         spin_lock_bh(&tcp_md5sig_pool_lock);
         if (--tcp_md5sig_users == 0) {
@@ -2696,10 +2860,11 @@ void tcp_free_md5sig_pool(void)
 
 EXPORT_SYMBOL(tcp_free_md5sig_pool);
 
-static struct tcp_md5sig_pool **__tcp_alloc_md5sig_pool(struct sock *sk)
+static struct tcp_md5sig_pool * __percpu *
+__tcp_alloc_md5sig_pool(struct sock *sk)
 {
         int cpu;
-        struct tcp_md5sig_pool **pool;
+        struct tcp_md5sig_pool * __percpu *pool;
 
         pool = alloc_percpu(struct tcp_md5sig_pool *);
         if (!pool)
@@ -2726,9 +2891,9 @@ out_free:
         return NULL;
 }
 
-struct tcp_md5sig_pool **tcp_alloc_md5sig_pool(struct sock *sk)
+struct tcp_md5sig_pool * __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
 {
-        struct tcp_md5sig_pool **pool;
+        struct tcp_md5sig_pool * __percpu *pool;
         int alloc = 0;
 
 retry:
@@ -2747,7 +2912,9 @@ retry:
 
         if (alloc) {
                 /* we cannot hold spinlock here because this may sleep. */
-                struct tcp_md5sig_pool **p = __tcp_alloc_md5sig_pool(sk);
+                struct tcp_md5sig_pool * __percpu *p;
+
+                p = __tcp_alloc_md5sig_pool(sk);
                 spin_lock_bh(&tcp_md5sig_pool_lock);
                 if (!p) {
                         tcp_md5sig_users--;
@@ -2769,25 +2936,40 @@ retry:
 
 EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
 
-struct tcp_md5sig_pool *__tcp_get_md5sig_pool(int cpu)
+
+/**
+ *      tcp_get_md5sig_pool - get md5sig_pool for this user
+ *
+ *      We use percpu structure, so if we succeed, we exit with preemption
+ *      and BH disabled, to make sure another thread or softirq handling
+ *      wont try to get same context.
+ */
+struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool **p;
-        spin_lock_bh(&tcp_md5sig_pool_lock);
+        struct tcp_md5sig_pool * __percpu *p;
+
+        local_bh_disable();
+
+        spin_lock(&tcp_md5sig_pool_lock);
         p = tcp_md5sig_pool;
         if (p)
                 tcp_md5sig_users++;
-        spin_unlock_bh(&tcp_md5sig_pool_lock);
-        return (p ? *per_cpu_ptr(p, cpu) : NULL);
-}
+        spin_unlock(&tcp_md5sig_pool_lock);
 
-EXPORT_SYMBOL(__tcp_get_md5sig_pool);
+        if (p)
+                return *per_cpu_ptr(p, smp_processor_id());
+
+        local_bh_enable();
+        return NULL;
+}
+EXPORT_SYMBOL(tcp_get_md5sig_pool);
 
-void __tcp_put_md5sig_pool(void)
+void tcp_put_md5sig_pool(void)
 {
+        local_bh_enable();
         tcp_free_md5sig_pool();
 }
-
-EXPORT_SYMBOL(__tcp_put_md5sig_pool);
+EXPORT_SYMBOL(tcp_put_md5sig_pool);
 
 int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
                         struct tcphdr *th)
@@ -2847,6 +3029,135 @@ EXPORT_SYMBOL(tcp_md5_hash_key);
 
 #endif
 
+/**
+ * Each Responder maintains up to two secret values concurrently for
+ * efficient secret rollover.  Each secret value has 4 states:
+ *
+ * Generating.  (tcp_secret_generating != tcp_secret_primary)
+ *    Generates new Responder-Cookies, but not yet used for primary
+ *    verification.  This is a short-term state, typically lasting only
+ *    one round trip time (RTT).
+ *
+ * Primary.  (tcp_secret_generating == tcp_secret_primary)
+ *    Used both for generation and primary verification.
+ *
+ * Retiring.  (tcp_secret_retiring != tcp_secret_secondary)
+ *    Used for verification, until the first failure that can be
+ *    verified by the newer Generating secret.  At that time, this
+ *    cookie's state is changed to Secondary, and the Generating
+ *    cookie's state is changed to Primary.  This is a short-term state,
+ *    typically lasting only one round trip time (RTT).
+ *
+ * Secondary.  (tcp_secret_retiring == tcp_secret_secondary)
+ *    Used for secondary verification, after primary verification
+ *    failures.  This state lasts no more than twice the Maximum Segment
+ *    Lifetime (2MSL).  Then, the secret is discarded.
+ */
+struct tcp_cookie_secret {
+        /* The secret is divided into two parts.  The digest part is the
+         * equivalent of previously hashing a secret and saving the state,
+         * and serves as an initialization vector (IV).  The message part
+         * serves as the trailing secret.
+         */
+        u32                             secrets[COOKIE_WORKSPACE_WORDS];
+        unsigned long                   expires;
+};
+
+#define TCP_SECRET_1MSL (HZ * TCP_PAWS_MSL)
+#define TCP_SECRET_2MSL (HZ * TCP_PAWS_MSL * 2)
+#define TCP_SECRET_LIFE (HZ * 600)
+
+static struct tcp_cookie_secret tcp_secret_one;
+static struct tcp_cookie_secret tcp_secret_two;
+
+/* Essentially a circular list, without dynamic allocation. */
+static struct tcp_cookie_secret *tcp_secret_generating;
+static struct tcp_cookie_secret *tcp_secret_primary;
+static struct tcp_cookie_secret *tcp_secret_retiring;
+static struct tcp_cookie_secret *tcp_secret_secondary;
+
+static DEFINE_SPINLOCK(tcp_secret_locker);
+
+/* Select a pseudo-random word in the cookie workspace.
+ */
+static inline u32 tcp_cookie_work(const u32 *ws, const int n)
+{
+        return ws[COOKIE_DIGEST_WORDS + ((COOKIE_MESSAGE_WORDS-1) & ws[n])];
+}
+
+/* Fill bakery[COOKIE_WORKSPACE_WORDS] with generator, updating as needed.
+ * Called in softirq context.
+ * Returns: 0 for success.
+ */
+int tcp_cookie_generator(u32 *bakery)
+{
+        unsigned long jiffy = jiffies;
+
+        if (unlikely(time_after_eq(jiffy, tcp_secret_generating->expires))) {
+                spin_lock_bh(&tcp_secret_locker);
+                if (!time_after_eq(jiffy, tcp_secret_generating->expires)) {
+                        /* refreshed by another */
+                        memcpy(bakery,
+                               &tcp_secret_generating->secrets[0],
+                               COOKIE_WORKSPACE_WORDS);
+                } else {
+                        /* still needs refreshing */
+                        get_random_bytes(bakery, COOKIE_WORKSPACE_WORDS);
+
+                        /* The first time, paranoia assumes that the
+                         * randomization function isn't as strong.  But,
+                         * this secret initialization is delayed until
+                         * the last possible moment (packet arrival).
+                         * Although that time is observable, it is
+                         * unpredictably variable.  Mash in the most
+                         * volatile clock bits available, and expire the
+                         * secret extra quickly.
+                         */
+                        if (unlikely(tcp_secret_primary->expires ==
+                                     tcp_secret_secondary->expires)) {
+                                struct timespec tv;
+
+                                getnstimeofday(&tv);
+                                bakery[COOKIE_DIGEST_WORDS+0] ^=
+                                        (u32)tv.tv_nsec;
+
+                                tcp_secret_secondary->expires = jiffy
+                                        + TCP_SECRET_1MSL
+                                        + (0x0f & tcp_cookie_work(bakery, 0));
+                        } else {
+                                tcp_secret_secondary->expires = jiffy
+                                        + TCP_SECRET_LIFE
+                                        + (0xff & tcp_cookie_work(bakery, 1));
+                                tcp_secret_primary->expires = jiffy
+                                        + TCP_SECRET_2MSL
+                                        + (0x1f & tcp_cookie_work(bakery, 2));
+                        }
+                        memcpy(&tcp_secret_secondary->secrets[0],
+                               bakery, COOKIE_WORKSPACE_WORDS);
+
+                        rcu_assign_pointer(tcp_secret_generating,
+                                           tcp_secret_secondary);
+                        rcu_assign_pointer(tcp_secret_retiring,
+                                           tcp_secret_primary);
+                        /*
+                         * Neither call_rcu() nor synchronize_rcu() needed.
+                         * Retiring data is not freed.  It is replaced after
+                         * further (locked) pointer updates, and a quiet time
+                         * (minimum 1MSL, maximum LIFE - 2MSL).
+                         */
+                }
+                spin_unlock_bh(&tcp_secret_locker);
+        } else {
+                rcu_read_lock_bh();
+                memcpy(bakery,
+                       &rcu_dereference(tcp_secret_generating)->secrets[0],
+                       COOKIE_WORKSPACE_WORDS);
+                rcu_read_unlock_bh();
+        }
+        return 0;
+}
+EXPORT_SYMBOL(tcp_cookie_generator);
+
 void tcp_done(struct sock *sk)
 {
         if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
@@ -2881,6 +3192,7 @@ void __init tcp_init(void)
         struct sk_buff *skb = NULL;
         unsigned long nr_pages, limit;
         int order, i, max_share;
+        unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
 
@@ -2903,11 +3215,10 @@ void __init tcp_init(void)
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
-                                        &tcp_hashinfo.ehash_size,
                                         NULL,
+                                        &tcp_hashinfo.ehash_mask,
                                         thash_entries ? 0 : 512 * 1024);
-        tcp_hashinfo.ehash_size = 1 << tcp_hashinfo.ehash_size;
-        for (i = 0; i < tcp_hashinfo.ehash_size; i++) {
+        for (i = 0; i <= tcp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].twchain, i);
         }
@@ -2916,7 +3227,7 @@ void __init tcp_init(void)
         tcp_hashinfo.bhash =
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
-                                        tcp_hashinfo.ehash_size,
+                                        tcp_hashinfo.ehash_mask + 1,
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
@@ -2971,10 +3282,19 @@ void __init tcp_init(void)
         sysctl_tcp_rmem[2] = max(87380, max_share);
 
         printk(KERN_INFO "TCP: Hash tables configured "
-               "(established %d bind %d)\n",
-               tcp_hashinfo.ehash_size, tcp_hashinfo.bhash_size);
+               "(established %u bind %u)\n",
+               tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_register_congestion_control(&tcp_reno);
+
+        memset(&tcp_secret_one.secrets[0], 0, sizeof(tcp_secret_one.secrets));
+        memset(&tcp_secret_two.secrets[0], 0, sizeof(tcp_secret_two.secrets));
+        tcp_secret_one.expires = jiffy; /* past due */
+        tcp_secret_two.expires = jiffy; /* past due */
+        tcp_secret_generating = &tcp_secret_one;
+        tcp_secret_primary = &tcp_secret_one;
+        tcp_secret_retiring = &tcp_secret_two;
+        tcp_secret_secondary = &tcp_secret_two;
 }
 
 EXPORT_SYMBOL(tcp_close);
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 6428b342b164..0ec9bd0ae94f 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -10,6 +10,7 @@
 #include <linux/mm.h>
 #include <linux/types.h>
 #include <linux/list.h>
+#include <linux/gfp.h>
 #include <net/tcp.h>
 
 int sysctl_tcp_max_ssthresh = 0;
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index fcbcd4ff6c5f..939edb3b8e4d 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -27,7 +27,7 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                 r->idiag_rqueue = sk->sk_ack_backlog;
                 r->idiag_wqueue = sk->sk_max_ack_backlog;
         } else {
-                r->idiag_rqueue = tp->rcv_nxt - tp->copied_seq;
+                r->idiag_rqueue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
                 r->idiag_wqueue = tp->write_seq - tp->snd_una;
         }
         if (info != NULL)
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
index 26d5c7fc7de5..7c94a4955416 100644
--- a/net/ipv4/tcp_htcp.c
+++ b/net/ipv4/tcp_htcp.c
@@ -92,8 +92,8 @@ static inline void measure_rtt(struct sock *sk, u32 srtt)
         if (icsk->icsk_ca_state == TCP_CA_Open) {
                 if (ca->maxRTT < ca->minRTT)
                         ca->maxRTT = ca->minRTT;
-                if (ca->maxRTT < srtt
-                    && srtt <= ca->maxRTT + msecs_to_jiffies(20))
+                if (ca->maxRTT < srtt &&
+                    srtt <= ca->maxRTT + msecs_to_jiffies(20))
                         ca->maxRTT = srtt;
         }
 }
@@ -123,9 +123,9 @@ static void measure_achieved_throughput(struct sock *sk, u32 pkts_acked, s32 rtt
 
         ca->packetcount += pkts_acked;
 
-        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha >> 7 ? : 1)
-            && now - ca->lasttime >= ca->minRTT
-            && ca->minRTT > 0) {
+        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha >> 7 ? : 1) &&
+            now - ca->lasttime >= ca->minRTT &&
+            ca->minRTT > 0) {
                 __u32 cur_Bi = ca->packetcount * HZ / (now - ca->lasttime);
 
                 if (htcp_ccount(ca) <= 3) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d86784be7ab3..f240f57b2199 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -62,6 +62,7 @@
  */
 
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/sysctl.h>
 #include <linux/kernel.h>
@@ -89,6 +90,8 @@ int sysctl_tcp_frto __read_mostly = 2;
 int sysctl_tcp_frto_response __read_mostly;
 int sysctl_tcp_nometrics_save __read_mostly;
 
+int sysctl_tcp_thin_dupack __read_mostly;
+
 int sysctl_tcp_moderate_rcvbuf __read_mostly = 1;
 int sysctl_tcp_abc __read_mostly;
 
@@ -140,7 +143,7 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
                  * "len" is invariant segment length, including TCP header.
                  */
                 len += skb->data - skb_transport_header(skb);
-                if (len >= TCP_MIN_RCVMSS + sizeof(struct tcphdr) ||
+                if (len >= TCP_MSS_DEFAULT + sizeof(struct tcphdr) ||
                     /* If PSH is not set, packet should be
                      * full sized, provided peer TCP is not badly broken.
                      * This observation (if it is correct 8)) allows
@@ -411,7 +414,7 @@ void tcp_initialize_rcv_mss(struct sock *sk)
         unsigned int hint = min_t(unsigned int, tp->advmss, tp->mss_cache);
 
         hint = min(hint, tp->rcv_wnd / 2);
-        hint = min(hint, TCP_MIN_RCVMSS);
+        hint = min(hint, TCP_MSS_DEFAULT);
         hint = max(hint, TCP_MIN_MSS);
 
         inet_csk(sk)->icsk_ack.rcv_mss = hint;
@@ -2300,7 +2303,7 @@ static inline int tcp_fackets_out(struct tcp_sock *tp)
  * they differ. Since neither occurs due to loss, TCP should really
  * ignore them.
  */
-static inline int tcp_dupack_heurestics(struct tcp_sock *tp)
+static inline int tcp_dupack_heuristics(struct tcp_sock *tp)
 {
         return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
 }
@@ -2425,7 +2428,7 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
 
         /* Not-A-Trick#2 : Classic rule... */
-        if (tcp_dupack_heurestics(tp) > tp->reordering)
+        if (tcp_dupack_heuristics(tp) > tp->reordering)
                 return 1;
 
         /* Trick#3 : when we use RFC2988 timer restart, fast
@@ -2447,6 +2450,16 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
         }
 
+        /* If a thin stream is detected, retransmit after first
+         * received dupack. Employ only if SACK is supported in order
+         * to avoid possible corner-case series of spurious retransmissions
+         * Use only if there are no unsent data.
+         */
+        if ((tp->thin_dupack || sysctl_tcp_thin_dupack) &&
+            tcp_stream_is_thin(tp) && tcp_dupack_heuristics(tp) > 1 &&
+            tcp_is_sack(tp) && !tcp_send_head(sk))
+                return 1;
+
         return 0;
 }
 
@@ -2499,6 +2512,9 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
         int err;
         unsigned int mss;
 
+        if (packets == 0)
+                return;
+
         WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
                 skb = tp->lost_skb_hint;
@@ -2717,6 +2733,35 @@ static void tcp_try_undo_dsack(struct sock *sk)
         }
 }
 
+/* We can clear retrans_stamp when there are no retransmissions in the
+ * window. It would seem that it is trivially available for us in
+ * tp->retrans_out, however, that kind of assumptions doesn't consider
+ * what will happen if errors occur when sending retransmission for the
+ * second time. ...It could the that such segment has only
+ * TCPCB_EVER_RETRANS set at the present time. It seems that checking
+ * the head skb is enough except for some reneging corner cases that
+ * are not worth the effort.
+ *
+ * Main reason for all this complexity is the fact that connection dying
+ * time now depends on the validity of the retrans_stamp, in particular,
+ * that successive retransmissions of a segment must not advance
+ * retrans_stamp under any conditions.
+ */
+static int tcp_any_retrans_done(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
+
+        if (tp->retrans_out)
+                return 1;
+
+        skb = tcp_write_queue_head(sk);
+        if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
+                return 1;
+
+        return 0;
+}
+
 /* Undo during fast recovery after partial ACK. */
 
 static int tcp_try_undo_partial(struct sock *sk, int acked)
@@ -2729,7 +2774,7 @@ static int tcp_try_undo_partial(struct sock *sk, int acked)
                 /* Plain luck! Hole if filled with delayed
                  * packet, rather than with a retransmit.
                  */
-                if (tp->retrans_out == 0)
+                if (!tcp_any_retrans_done(sk))
                         tp->retrans_stamp = 0;
 
                 tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
@@ -2788,7 +2833,7 @@ static void tcp_try_keep_open(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         int state = TCP_CA_Open;
 
-        if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
+        if (tcp_left_out(tp) || tcp_any_retrans_done(sk) || tp->undo_marker)
                 state = TCP_CA_Disorder;
 
         if (inet_csk(sk)->icsk_ca_state != state) {
@@ -2803,7 +2848,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
 
         tcp_verify_left_out(tp);
 
-        if (!tp->frto_counter && tp->retrans_out == 0)
+        if (!tp->frto_counter && !tcp_any_retrans_done(sk))
                 tp->retrans_stamp = 0;
 
         if (flag & FLAG_ECE)
@@ -3698,7 +3743,7 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       int estab)
+                       u8 **hvpp, int estab)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
@@ -3782,7 +3827,30 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                  */
                                 break;
 #endif
-                        }
+                        case TCPOPT_COOKIE:
+                                /* This option is variable length.
+                                 */
+                                switch (opsize) {
+                                case TCPOLEN_COOKIE_BASE:
+                                        /* not yet implemented */
+                                        break;
+                                case TCPOLEN_COOKIE_PAIR:
+                                        /* not yet implemented */
+                                        break;
+                                case TCPOLEN_COOKIE_MIN+0:
+                                case TCPOLEN_COOKIE_MIN+2:
+                                case TCPOLEN_COOKIE_MIN+4:
+                                case TCPOLEN_COOKIE_MIN+6:
+                                case TCPOLEN_COOKIE_MAX:
+                                        /* 16-bit multiple */
+                                        opt_rx->cookie_plus = opsize;
+                                        *hvpp = ptr;
+                                default:
+                                        /* ignore option */
+                                        break;
+                                };
+                                break;
+                        };
 
                         ptr += opsize-2;
                         length -= opsize;
@@ -3810,17 +3878,20 @@ static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
  * If it is wrong it falls back on tcp_parse_options().
  */
 static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
-                                  struct tcp_sock *tp)
+                                  struct tcp_sock *tp, u8 **hvpp)
 {
-        if (th->doff == sizeof(struct tcphdr) >> 2) {
+        /* In the spirit of fast parsing, compare doff directly to constant
+         * values.  Because equality is used, short doff can be ignored here.
+         */
+        if (th->doff == (sizeof(*th) / 4)) {
                 tp->rx_opt.saw_tstamp = 0;
                 return 0;
         } else if (tp->rx_opt.tstamp_ok &&
-                   th->doff == (sizeof(struct tcphdr)>>2)+(TCPOLEN_TSTAMP_ALIGNED>>2)) {
+                   th->doff == ((sizeof(*th) + TCPOLEN_TSTAMP_ALIGNED) / 4)) {
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, 1);
+        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1);
         return 1;
 }
 
@@ -4845,11 +4916,11 @@ static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible)
         struct tcp_sock *tp = tcp_sk(sk);
 
             /* More than one full frame received... */
-        if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss
+        if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss &&
              /* ... and right edge of window advances far enough.
               * (tcp_recvmsg() will send ACK otherwise). Or...
               */
-             && __tcp_select_window(sk) >= tp->rcv_wnd) ||
+             __tcp_select_window(sk) >= tp->rcv_wnd) ||
             /* We ACK each frame or... */
             tcp_in_quickack_mode(sk) ||
             /* We have out of order data. */
@@ -5070,10 +5141,12 @@ out:
 static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                               struct tcphdr *th, int syn_inerr)
 {
+        u8 *hash_location;
         struct tcp_sock *tp = tcp_sk(sk);
 
         /* RFC1323: H1. Apply PAWS check first. */
-        if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
+        if (tcp_fast_parse_options(skb, th, tp, &hash_location) &&
+            tp->rx_opt.saw_tstamp &&
             tcp_paws_discard(sk, skb)) {
                 if (!th->rst) {
                         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
@@ -5361,11 +5434,13 @@ discard:
 static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                                          struct tcphdr *th, unsigned len)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        u8 *hash_location;
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_cookie_values *cvp = tp->cookie_values;
         int saved_clamp = tp->rx_opt.mss_clamp;
 
-        tcp_parse_options(skb, &tp->rx_opt, 0);
+        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0);
 
         if (th->ack) {
                 /* rfc793:
@@ -5462,6 +5537,31 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  * Change state from SYN-SENT only after copied_seq
                  * is initialized. */
                 tp->copied_seq = tp->rcv_nxt;
+
+                if (cvp != NULL &&
+                    cvp->cookie_pair_size > 0 &&
+                    tp->rx_opt.cookie_plus > 0) {
+                        int cookie_size = tp->rx_opt.cookie_plus
+                                        - TCPOLEN_COOKIE_BASE;
+                        int cookie_pair_size = cookie_size
+                                             + cvp->cookie_desired;
+
+                        /* A cookie extension option was sent and returned.
+                         * Note that each incoming SYNACK replaces the
+                         * Responder cookie.  The initial exchange is most
+                         * fragile, as protection against spoofing relies
+                         * entirely upon the sequence and timestamp (above).
+                         * This replacement strategy allows the correct pair to
+                         * pass through, while any others will be filtered via
+                         * Responder verification later.
+                         */
+                        if (sizeof(cvp->cookie_pair) >= cookie_pair_size) {
+                                memcpy(&cvp->cookie_pair[cvp->cookie_desired],
+                                       hash_location, cookie_size);
+                                cvp->cookie_pair_size = cookie_pair_size;
+                        }
+                }
+
                 smp_mb();
                 tcp_set_state(sk, TCP_ESTABLISHED);
 
@@ -5699,11 +5799,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
                                 /* tcp_ack considers this ACK as duplicate
                                  * and does not calculate rtt.
-                                 * Fix it at least with timestamps.
+                                 * Force it here.
                                  */
-                                if (tp->rx_opt.saw_tstamp &&
-                                    tp->rx_opt.rcv_tsecr && !tp->srtt)
-                                        tcp_ack_saw_tstamp(sk, 0);
+                                tcp_ack_update_rtt(sk, 0, 0);
 
                                 if (tp->rx_opt.tstamp_ok)
                                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 7cda24b53f61..3c23e70885f4 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -60,6 +60,7 @@
 #include <linux/jhash.h>
 #include <linux/init.h>
 #include <linux/times.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/icmp.h>
@@ -165,10 +166,10 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 nexthop = inet->opt->faddr;
         }
 
-        tmp = ip_route_connect(&rt, nexthop, inet->saddr,
+        tmp = ip_route_connect(&rt, nexthop, inet->inet_saddr,
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_TCP,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (tmp < 0) {
                 if (tmp == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -183,11 +184,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (!inet->opt || !inet->opt->srr)
                 daddr = rt->rt_dst;
 
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;
-        inet->rcv_saddr = inet->saddr;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;
+        inet->inet_rcv_saddr = inet->inet_saddr;
 
-        if (tp->rx_opt.ts_recent_stamp && inet->daddr != daddr) {
+        if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
                 /* Reset inherited state */
                 tp->rx_opt.ts_recent       = 0;
                 tp->rx_opt.ts_recent_stamp = 0;
@@ -204,20 +205,20 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                  * when trying new connection.
                  */
                 if (peer != NULL &&
-                    peer->tcp_ts_stamp + TCP_PAWS_MSL >= get_seconds()) {
+                    (u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
                         tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
                         tp->rx_opt.ts_recent = peer->tcp_ts;
                 }
         }
 
-        inet->dport = usin->sin_port;
-        inet->daddr = daddr;
+        inet->inet_dport = usin->sin_port;
+        inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet->opt)
                 inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
 
-        tp->rx_opt.mss_clamp = 536;
+        tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;
 
         /* Socket identity is still unknown (sport may be zero).
          * However we set state to SYN-SENT and not releasing socket
@@ -230,7 +231,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 goto failure;
 
         err = ip_route_newports(&rt, IPPROTO_TCP,
-                                inet->sport, inet->dport, sk);
+                                inet->inet_sport, inet->inet_dport, sk);
         if (err)
                 goto failure;
 
@@ -239,12 +240,12 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_setup_caps(sk, &rt->u.dst);
 
         if (!tp->write_seq)
-                tp->write_seq = secure_tcp_sequence_number(inet->saddr,
-                                                           inet->daddr,
-                                                           inet->sport,
+                tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr,
+                                                           inet->inet_daddr,
+                                                           inet->inet_sport,
                                                            usin->sin_port);
 
-        inet->id = tp->write_seq ^ jiffies;
+        inet->inet_id = tp->write_seq ^ jiffies;
 
         err = tcp_connect(sk);
         rt = NULL;
@@ -261,7 +262,7 @@ failure:
         tcp_set_state(sk, TCP_CLOSE);
         ip_rt_put(rt);
         sk->sk_route_caps = 0;
-        inet->dport = 0;
+        inet->inet_dport = 0;
         return err;
 }
 
@@ -370,6 +371,11 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto out;
+        }
+
         icsk = inet_csk(sk);
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
@@ -520,12 +526,13 @@ void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb)
         struct tcphdr *th = tcp_hdr(skb);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                th->check = ~tcp_v4_check(len, inet->saddr,
-                                          inet->daddr, 0);
+                th->check = ~tcp_v4_check(len, inet->inet_saddr,
+                                          inet->inet_daddr, 0);
                 skb->csum_start = skb_transport_header(skb) - skb->head;
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
-                th->check = tcp_v4_check(len, inet->saddr, inet->daddr,
+                th->check = tcp_v4_check(len, inet->inet_saddr,
+                                         inet->inet_daddr,
                                          csum_partial(th,
                                                       th->doff << 2,
                                                       skb->csum));
@@ -741,8 +748,9 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  *      This still operates on a request_sock only, not on a big
  *      socket.
  */
-static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
-                                struct dst_entry *dst)
+static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
+                              struct request_sock *req,
+                              struct request_values *rvp)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         int err = -1;
@@ -752,7 +760,7 @@ static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
         if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
                 return -1;
 
-        skb = tcp_make_synack(sk, dst, req);
+        skb = tcp_make_synack(sk, dst, req, rvp);
 
         if (skb) {
                 struct tcphdr *th = tcp_hdr(skb);
@@ -773,9 +781,11 @@ static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
         return err;
 }
 
-static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req)
+static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req,
+                              struct request_values *rvp)
 {
-        return __tcp_v4_send_synack(sk, req, NULL);
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+        return tcp_v4_send_synack(sk, NULL, req, rvp);
 }
 
 /*
@@ -848,7 +858,7 @@ static struct tcp_md5sig_key *
 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
                                          struct sock *addr_sk)
 {
-        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->daddr);
+        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->inet_daddr);
 }
 
 EXPORT_SYMBOL(tcp_v4_md5_lookup);
@@ -923,7 +933,7 @@ EXPORT_SYMBOL(tcp_v4_md5_do_add);
 static int tcp_v4_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                u8 *newkey, u8 newkeylen)
 {
-        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->daddr,
+        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->inet_daddr,
                                  newkey, newkeylen);
 }
 
@@ -1089,8 +1099,8 @@ int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
         __be32 saddr, daddr;
 
         if (sk) {
-                saddr = inet_sk(sk)->saddr;
-                daddr = inet_sk(sk)->daddr;
+                saddr = inet_sk(sk)->inet_saddr;
+                daddr = inet_sk(sk)->inet_daddr;
         } else if (req) {
                 saddr = inet_rsk(req)->loc_addr;
                 daddr = inet_rsk(req)->rmt_addr;
@@ -1189,10 +1199,11 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
 struct request_sock_ops tcp_request_sock_ops __read_mostly = {
         .family         =       PF_INET,
         .obj_size       =       sizeof(struct tcp_request_sock),
-        .rtx_syn_ack    =       tcp_v4_send_synack,
+        .rtx_syn_ack    =       tcp_v4_rtx_synack,
         .send_ack       =       tcp_v4_reqsk_send_ack,
         .destructor     =       tcp_v4_reqsk_destructor,
         .send_reset     =       tcp_v4_send_reset,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1210,13 +1221,16 @@ static struct timewait_sock_ops tcp_timewait_sock_ops = {
 
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
-        struct inet_request_sock *ireq;
+        struct tcp_extend_values tmp_ext;
         struct tcp_options_received tmp_opt;
+        u8 *hash_location;
         struct request_sock *req;
+        struct inet_request_sock *ireq;
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = NULL;
         __be32 saddr = ip_hdr(skb)->saddr;
         __be32 daddr = ip_hdr(skb)->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
-        struct dst_entry *dst = NULL;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
 #else
@@ -1257,16 +1271,50 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 #endif
 
         tcp_clear_options(&tmp_opt);
-        tmp_opt.mss_clamp = 536;
-        tmp_opt.user_mss  = tcp_sk(sk)->rx_opt.user_mss;
+        tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
+        tmp_opt.user_mss  = tp->rx_opt.user_mss;
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
+
+        if (tmp_opt.cookie_plus > 0 &&
+            tmp_opt.saw_tstamp &&
+            !tp->rx_opt.cookie_out_never &&
+            (sysctl_tcp_cookie_size > 0 ||
+             (tp->cookie_values != NULL &&
+              tp->cookie_values->cookie_desired > 0))) {
+                u8 *c;
+                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
+                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
+
+                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
+                        goto drop_and_release;
+
+                /* Secret recipe starts with IP addresses */
+                *mess++ ^= daddr;
+                *mess++ ^= saddr;
 
-        tcp_parse_options(skb, &tmp_opt, 0);
+                /* plus variable length Initiator Cookie */
+                c = (u8 *)mess;
+                while (l-- > 0)
+                        *c++ ^= *hash_location++;
+
+#ifdef CONFIG_SYN_COOKIES
+                want_cookie = 0;        /* not our kind of cookie */
+#endif
+                tmp_ext.cookie_out_never = 0; /* false */
+                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
+        } else if (!tp->rx_opt.cookie_in_always) {
+                /* redundant indications, but ensure initialization. */
+                tmp_ext.cookie_out_never = 1; /* true */
+                tmp_ext.cookie_plus = 0;
+        } else {
+                goto drop_and_release;
+        }
+        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
 
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
-
         tcp_openreq_init(req, &tmp_opt, skb);
 
         ireq = inet_rsk(req);
@@ -1304,7 +1352,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                     (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
                     peer->v4daddr == saddr) {
-                        if (get_seconds() < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
                             (s32)(peer->tcp_ts - req->ts_recent) >
                                                         TCP_PAWS_WINDOW) {
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
@@ -1333,7 +1381,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         }
         tcp_rsk(req)->snt_isn = isn;
 
-        if (__tcp_v4_send_synack(sk, req, dst) || want_cookie)
+        if (tcp_v4_send_synack(sk, dst, req,
+                               (struct request_values *)&tmp_ext) ||
+            want_cookie)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
@@ -1380,9 +1430,9 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
         ireq                  = inet_rsk(req);
-        newinet->daddr        = ireq->rmt_addr;
-        newinet->rcv_saddr    = ireq->loc_addr;
-        newinet->saddr        = ireq->loc_addr;
+        newinet->inet_daddr   = ireq->rmt_addr;
+        newinet->inet_rcv_saddr = ireq->loc_addr;
+        newinet->inet_saddr           = ireq->loc_addr;
         newinet->opt          = ireq->opt;
         ireq->opt             = NULL;
         newinet->mc_index     = inet_iif(skb);
@@ -1390,7 +1440,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (newinet->opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
-        newinet->id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = newtp->write_seq ^ jiffies;
 
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
@@ -1403,7 +1453,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
-        if ((key = tcp_v4_md5_do_lookup(sk, newinet->daddr)) != NULL) {
+        key = tcp_v4_md5_do_lookup(sk, newinet->inet_daddr);
+        if (key != NULL) {
                 /*
                  * We're using one, so create a matching key
                  * on the newsk structure. If we fail to get
@@ -1412,13 +1463,13 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, newinet->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->inet_daddr,
                                           newkey, key->keylen);
                 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
 #endif
 
-        __inet_hash_nolisten(newsk);
+        __inet_hash_nolisten(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
@@ -1610,6 +1661,11 @@ process:
         if (sk->sk_state == TCP_TIME_WAIT)
                 goto do_time_wait;
 
+        if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto discard_and_relse;
+        }
+
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
         nf_reset(skb);
@@ -1634,8 +1690,11 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v4_do_rcv(sk, skb);
                 }
-        } else
-                sk_add_backlog(sk, skb);
+        } else if (unlikely(sk_add_backlog(sk, skb))) {
+                bh_unlock_sock(sk);
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
+                goto discard_and_relse;
+        }
         bh_unlock_sock(sk);
 
         sock_put(sk);
@@ -1711,8 +1770,8 @@ int tcp_v4_remember_stamp(struct sock *sk)
         struct inet_peer *peer = NULL;
         int release_it = 0;
 
-        if (!rt || rt->rt_dst != inet->daddr) {
-                peer = inet_getpeer(inet->daddr, 1);
+        if (!rt || rt->rt_dst != inet->inet_daddr) {
+                peer = inet_getpeer(inet->inet_daddr, 1);
                 release_it = 1;
         } else {
                 if (!rt->peer)
@@ -1722,9 +1781,9 @@ int tcp_v4_remember_stamp(struct sock *sk)
 
         if (peer) {
                 if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tp->rx_opt.ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tp->rx_opt.ts_recent_stamp;
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tp->rx_opt.ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tp->rx_opt.ts_recent_stamp;
                         peer->tcp_ts = tp->rx_opt.ts_recent;
                 }
                 if (release_it)
@@ -1743,9 +1802,9 @@ int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
                 const struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 
                 if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tcptw->tw_ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tcptw->tw_ts_recent_stamp;
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tcptw->tw_ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tcptw->tw_ts_recent_stamp;
                         peer->tcp_ts       = tcptw->tw_ts_recent;
                 }
                 inet_putpeer(peer);
@@ -1810,7 +1869,7 @@ static int tcp_v4_init_sock(struct sock *sk)
          */
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = 536;
+        tp->mss_cache = TCP_MSS_DEFAULT;
 
         tp->reordering = sysctl_tcp_reordering;
         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
@@ -1826,6 +1885,19 @@ static int tcp_v4_init_sock(struct sock *sk)
         tp->af_specific = &tcp_sock_ipv4_specific;
 #endif
 
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
         sk->sk_sndbuf = sysctl_tcp_wmem[1];
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
@@ -1879,6 +1951,13 @@ void tcp_v4_destroy_sock(struct sock *sk)
                 sk->sk_sndmsg_page = NULL;
         }
 
+        /* TCP Cookie Transactions */
+        if (tp->cookie_values != NULL) {
+                kref_put(&tp->cookie_values->kref,
+                         tcp_cookie_values_release);
+                tp->cookie_values = NULL;
+        }
+
         percpu_counter_dec(&tcp_sockets_allocated);
 }
 
@@ -2000,7 +2079,7 @@ static void *established_get_first(struct seq_file *seq)
         struct net *net = seq_file_net(seq);
         void *rc = NULL;
 
-        for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
+        for (st->bucket = 0; st->bucket <= tcp_hashinfo.ehash_mask; ++st->bucket) {
                 struct sock *sk;
                 struct hlist_nulls_node *node;
                 struct inet_timewait_sock *tw;
@@ -2061,10 +2140,10 @@ get_tw:
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
 
                 /* Look for next non empty bucket */
-                while (++st->bucket < tcp_hashinfo.ehash_size &&
+                while (++st->bucket <= tcp_hashinfo.ehash_mask &&
                                 empty_bucket(st))
                         ;
-                if (st->bucket >= tcp_hashinfo.ehash_size)
+                if (st->bucket > tcp_hashinfo.ehash_mask)
                         return NULL;
 
                 spin_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
@@ -2225,7 +2304,7 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
                 i,
                 ireq->loc_addr,
-                ntohs(inet_sk(sk)->sport),
+                ntohs(inet_sk(sk)->inet_sport),
                 ireq->rmt_addr,
                 ntohs(ireq->rmt_port),
                 TCP_SYN_RECV,
@@ -2248,10 +2327,11 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        __be32 dest = inet->daddr;
-        __be32 src = inet->rcv_saddr;
-        __u16 destp = ntohs(inet->dport);
-        __u16 srcp = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src = inet->inet_rcv_saddr;
+        __u16 destp = ntohs(inet->inet_dport);
+        __u16 srcp = ntohs(inet->inet_sport);
+        int rx_queue;
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                 timer_active    = 1;
@@ -2267,12 +2347,19 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 timer_expires = jiffies;
         }
 
+        if (sk->sk_state == TCP_LISTEN)
+                rx_queue = sk->sk_ack_backlog;
+        else
+                /*
+                 * because we dont lock socket, we might find a transient negative value
+                 */
+                rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
+
         seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
                         "%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
                 i, src, srcp, dest, destp, sk->sk_state,
                 tp->write_seq - tp->snd_una,
-                sk->sk_state == TCP_LISTEN ? sk->sk_ack_backlog :
-                                             (tp->rcv_nxt - tp->copied_seq),
+                rx_queue,
                 timer_active,
                 jiffies_to_clock_t(timer_expires - jiffies),
                 icsk->icsk_retransmits,
@@ -2354,12 +2441,12 @@ static struct tcp_seq_afinfo tcp4_seq_afinfo = {
         },
 };
 
-static int tcp4_proc_init_net(struct net *net)
+static int __net_init tcp4_proc_init_net(struct net *net)
 {
         return tcp_proc_register(net, &tcp4_seq_afinfo);
 }
 
-static void tcp4_proc_exit_net(struct net *net)
+static void __net_exit tcp4_proc_exit_net(struct net *net)
 {
         tcp_proc_unregister(net, &tcp4_seq_afinfo);
 }
@@ -2463,12 +2550,17 @@ static int __net_init tcp_sk_init(struct net *net)
 static void __net_exit tcp_sk_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv4.tcp_sock);
-        inet_twsk_purge(net, &tcp_hashinfo, &tcp_death_row, AF_INET);
+}
+
+static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
+{
+        inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET);
 }
 
 static struct pernet_operations __net_initdata tcp_sk_ops = {
-       .init = tcp_sk_init,
-       .exit = tcp_sk_exit,
+       .init       = tcp_sk_init,
+       .exit       = tcp_sk_exit,
+       .exit_batch = tcp_sk_exit_batch,
 };
 
 void __init tcp_v4_init(void)
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index ce3c41ff50b2..de870377fbba 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -143,8 +143,8 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
                 goto out;
 
         /* we can't calc remote HZ with no different!! */
-        if (tp->rx_opt.rcv_tsval == lp->remote_ref_time
-            || tp->rx_opt.rcv_tsecr == lp->local_ref_time)
+        if (tp->rx_opt.rcv_tsval == lp->remote_ref_time ||
+            tp->rx_opt.rcv_tsecr == lp->local_ref_time)
                 goto out;
 
         m = HZ * (tp->rx_opt.rcv_tsval -
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 4c03598ed924..5fabff9ac6d6 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -20,19 +20,14 @@
 
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/workqueue.h>
 #include <net/tcp.h>
 #include <net/inet_common.h>
 #include <net/xfrm.h>
 
-#ifdef CONFIG_SYSCTL
-#define SYNC_INIT 0 /* let the user enable it */
-#else
-#define SYNC_INIT 1
-#endif
-
-int sysctl_tcp_syncookies __read_mostly = SYNC_INIT;
+int sysctl_tcp_syncookies __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_syncookies);
 
 int sysctl_tcp_abort_on_overflow __read_mostly;
@@ -96,13 +91,14 @@ enum tcp_tw_status
 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                            const struct tcphdr *th)
 {
-        struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         int paws_reject = 0;
 
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -389,14 +385,43 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 const struct inet_request_sock *ireq = inet_rsk(req);
                 struct tcp_request_sock *treq = tcp_rsk(req);
                 struct inet_connection_sock *newicsk = inet_csk(newsk);
-                struct tcp_sock *newtp;
+                struct tcp_sock *newtp = tcp_sk(newsk);
+                struct tcp_sock *oldtp = tcp_sk(sk);
+                struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
+
+                /* TCP Cookie Transactions require space for the cookie pair,
+                 * as it differs for each connection.  There is no need to
+                 * copy any s_data_payload stored at the original socket.
+                 * Failure will prevent resuming the connection.
+                 *
+                 * Presumed copied, in order of appearance:
+                 *      cookie_in_always, cookie_out_never
+                 */
+                if (oldcvp != NULL) {
+                        struct tcp_cookie_values *newcvp =
+                                kzalloc(sizeof(*newtp->cookie_values),
+                                        GFP_ATOMIC);
+
+                        if (newcvp != NULL) {
+                                kref_init(&newcvp->kref);
+                                newcvp->cookie_desired =
+                                                oldcvp->cookie_desired;
+                                newtp->cookie_values = newcvp;
+                        } else {
+                                /* Not Yet Implemented */
+                                newtp->cookie_values = NULL;
+                        }
+                }
 
                 /* Now setup tcp_sock */
-                newtp = tcp_sk(newsk);
                 newtp->pred_flags = 0;
-                newtp->rcv_wup = newtp->copied_seq = newtp->rcv_nxt = treq->rcv_isn + 1;
-                newtp->snd_sml = newtp->snd_una = newtp->snd_nxt = treq->snt_isn + 1;
-                newtp->snd_up = treq->snt_isn + 1;
+
+                newtp->rcv_wup = newtp->copied_seq =
+                newtp->rcv_nxt = treq->rcv_isn + 1;
+
+                newtp->snd_sml = newtp->snd_una =
+                newtp->snd_nxt = newtp->snd_up =
+                        treq->snt_isn + 1 + tcp_s_data_size(oldtp);
 
                 tcp_prequeue_init(newtp);
 
@@ -429,8 +454,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 tcp_set_ca_state(newsk, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
                 skb_queue_head_init(&newtp->out_of_order_queue);
-                newtp->write_seq = treq->snt_isn + 1;
-                newtp->pushed_seq = newtp->write_seq;
+                newtp->write_seq = newtp->pushed_seq =
+                        treq->snt_isn + 1 + tcp_s_data_size(oldtp);
 
                 newtp->rx_opt.saw_tstamp = 0;
 
@@ -476,7 +501,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 if (newtp->af_specific->md5_lookup(sk, newsk))
                         newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
 #endif
-                if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)
+                if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                 newtp->rx_opt.mss_clamp = req->mss;
                 TCP_ECN_openreq_child(newtp, req);
@@ -495,15 +520,16 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                            struct request_sock *req,
                            struct request_sock **prev)
 {
+        struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct sock *child;
         const struct tcphdr *th = tcp_hdr(skb);
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
         int paws_reject = 0;
-        struct tcp_options_received tmp_opt;
-        struct sock *child;
 
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(struct tcphdr)>>2)) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
@@ -537,7 +563,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                  * Enforce "SYN-ACK" according to figure 8, figure 6
                  * of RFC793, fixed by RFC1122.
                  */
-                req->rsk_ops->rtx_syn_ack(sk, req);
+                req->rsk_ops->rtx_syn_ack(sk, req, NULL);
                 return NULL;
         }
 
@@ -596,7 +622,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
          * Invalid ACK: reset will be sent by listening socket
          */
         if ((flg & TCP_FLAG_ACK) &&
-            (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))
+            (TCP_SKB_CB(skb)->ack_seq !=
+             tcp_rsk(req)->snt_isn + 1 + tcp_s_data_size(tcp_sk(sk))))
                 return sk;
 
         /* Also, it would be not so bad idea to check rcv_tsecr, which
@@ -702,7 +729,7 @@ int tcp_child_process(struct sock *parent, struct sock *child,
                  * in main socket hash table and lock on listening
                  * socket does not protect us more.
                  */
-                sk_add_backlog(child, skb);
+                __sk_add_backlog(child, skb);
         }
 
         bh_unlock_sock(child);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index fcd278a7080e..0dda86e72ad8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -37,6 +37,7 @@
 #include <net/tcp.h>
 
 #include <linux/compiler.h>
+#include <linux/gfp.h>
 #include <linux/module.h>
 
 /* People can turn this off for buggy TCP's found in printers etc. */
@@ -59,6 +60,10 @@ int sysctl_tcp_base_mss __read_mostly = 512;
 /* By default, RFC2861 behavior.  */
 int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
 
+int sysctl_tcp_cookie_size __read_mostly = 0; /* TCP_COOKIE_MAX */
+EXPORT_SYMBOL_GPL(sysctl_tcp_cookie_size);
+
+
 /* Account for new data that has been sent to the network. */
 static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
 {
@@ -179,7 +184,8 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
  */
 void tcp_select_initial_window(int __space, __u32 mss,
                                __u32 *rcv_wnd, __u32 *window_clamp,
-                               int wscale_ok, __u8 *rcv_wscale)
+                               int wscale_ok, __u8 *rcv_wscale,
+                               __u32 init_rcv_wnd)
 {
         unsigned int space = (__space < 0 ? 0 : __space);
 
@@ -228,7 +234,13 @@ void tcp_select_initial_window(int __space, __u32 mss,
                         init_cwnd = 2;
                 else if (mss > 1460)
                         init_cwnd = 3;
-                if (*rcv_wnd > init_cwnd * mss)
+                /* when initializing use the value from init_rcv_wnd
+                 * rather than the default from above
+                 */
+                if (init_rcv_wnd &&
+                    (*rcv_wnd > init_rcv_wnd * mss))
+                        *rcv_wnd = init_rcv_wnd * mss;
+                else if (*rcv_wnd > init_cwnd * mss)
                         *rcv_wnd = init_cwnd * mss;
         }
 
@@ -362,15 +374,45 @@ static inline int tcp_urg_mode(const struct tcp_sock *tp)
 #define OPTION_TS               (1 << 1)
 #define OPTION_MD5              (1 << 2)
 #define OPTION_WSCALE           (1 << 3)
+#define OPTION_COOKIE_EXTENSION (1 << 4)
 
 struct tcp_out_options {
         u8 options;             /* bit field of OPTION_* */
         u8 ws;                  /* window scale, 0 to disable */
         u8 num_sack_blocks;     /* number of SACK blocks to include */
+        u8 hash_size;           /* bytes in hash_location */
         u16 mss;                /* 0 to disable */
         __u32 tsval, tsecr;     /* need to include OPTION_TS */
+        __u8 *hash_location;    /* temporary pointer, overloaded */
 };
 
+/* The sysctl int routines are generic, so check consistency here.
+ */
+static u8 tcp_cookie_size_check(u8 desired)
+{
+        if (desired > 0) {
+                /* previously specified */
+                return desired;
+        }
+        if (sysctl_tcp_cookie_size <= 0) {
+                /* no default specified */
+                return 0;
+        }
+        if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+                /* value too small, specify minimum */
+                return TCP_COOKIE_MIN;
+        }
+        if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+                /* value too large, specify maximum */
+                return TCP_COOKIE_MAX;
+        }
+        if (0x1 & sysctl_tcp_cookie_size) {
+                /* 8-bit multiple, illegal, fix it */
+                return (u8)(sysctl_tcp_cookie_size + 0x1);
+        }
+        return (u8)sysctl_tcp_cookie_size;
+}
+
 /* Write previously computed TCP options to the packet.
  *
  * Beware: Something in the Internet is very sensitive to the ordering of
@@ -385,17 +427,34 @@ struct tcp_out_options {
  * (but it may well be that other scenarios fail similarly).
  */
 static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
-                              const struct tcp_out_options *opts,
-                              __u8 **md5_hash) {
-        if (unlikely(OPTION_MD5 & opts->options)) {
-                *ptr++ = htonl((TCPOPT_NOP << 24) |
-                               (TCPOPT_NOP << 16) |
-                               (TCPOPT_MD5SIG << 8) |
-                               TCPOLEN_MD5SIG);
-                *md5_hash = (__u8 *)ptr;
+                              struct tcp_out_options *opts)
+{
+        u8 options = opts->options;     /* mungable copy */
+
+        /* Having both authentication and cookies for security is redundant,
+         * and there's certainly not enough room.  Instead, the cookie-less
+         * extension variant is proposed.
+         *
+         * Consider the pessimal case with authentication.  The options
+         * could look like:
+         *   COOKIE|MD5(20) + MSS(4) + SACK|TS(12) + WSCALE(4) == 40
+         */
+        if (unlikely(OPTION_MD5 & options)) {
+                if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
+                        *ptr++ = htonl((TCPOPT_COOKIE << 24) |
+                                       (TCPOLEN_COOKIE_BASE << 16) |
+                                       (TCPOPT_MD5SIG << 8) |
+                                       TCPOLEN_MD5SIG);
+                } else {
+                        *ptr++ = htonl((TCPOPT_NOP << 24) |
+                                       (TCPOPT_NOP << 16) |
+                                       (TCPOPT_MD5SIG << 8) |
+                                       TCPOLEN_MD5SIG);
+                }
+                options &= ~OPTION_COOKIE_EXTENSION;
+                /* overload cookie hash location */
+                opts->hash_location = (__u8 *)ptr;
                 ptr += 4;
-        } else {
-                *md5_hash = NULL;
         }
 
         if (unlikely(opts->mss)) {
@@ -404,12 +463,13 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                                opts->mss);
         }
 
-        if (likely(OPTION_TS & opts->options)) {
-                if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
+        if (likely(OPTION_TS & options)) {
+                if (unlikely(OPTION_SACK_ADVERTISE & options)) {
                         *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
                                        (TCPOLEN_SACK_PERM << 16) |
                                        (TCPOPT_TIMESTAMP << 8) |
                                        TCPOLEN_TIMESTAMP);
+                        options &= ~OPTION_SACK_ADVERTISE;
                 } else {
                         *ptr++ = htonl((TCPOPT_NOP << 24) |
                                        (TCPOPT_NOP << 16) |
@@ -420,15 +480,52 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                 *ptr++ = htonl(opts->tsecr);
         }
 
-        if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
-                     !(OPTION_TS & opts->options))) {
+        /* Specification requires after timestamp, so do it now.
+         *
+         * Consider the pessimal case without authentication.  The options
+         * could look like:
+         *   MSS(4) + SACK|TS(12) + COOKIE(20) + WSCALE(4) == 40
+         */
+        if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
+                __u8 *cookie_copy = opts->hash_location;
+                u8 cookie_size = opts->hash_size;
+
+                /* 8-bit multiple handled in tcp_cookie_size_check() above,
+                 * and elsewhere.
+                 */
+                if (0x2 & cookie_size) {
+                        __u8 *p = (__u8 *)ptr;
+
+                        /* 16-bit multiple */
+                        *p++ = TCPOPT_COOKIE;
+                        *p++ = TCPOLEN_COOKIE_BASE + cookie_size;
+                        *p++ = *cookie_copy++;
+                        *p++ = *cookie_copy++;
+                        ptr++;
+                        cookie_size -= 2;
+                } else {
+                        /* 32-bit multiple */
+                        *ptr++ = htonl(((TCPOPT_NOP << 24) |
+                                        (TCPOPT_NOP << 16) |
+                                        (TCPOPT_COOKIE << 8) |
+                                        TCPOLEN_COOKIE_BASE) +
+                                       cookie_size);
+                }
+
+                if (cookie_size > 0) {
+                        memcpy(ptr, cookie_copy, cookie_size);
+                        ptr += (cookie_size / 4);
+                }
+        }
+
+        if (unlikely(OPTION_SACK_ADVERTISE & options)) {
                 *ptr++ = htonl((TCPOPT_NOP << 24) |
                                (TCPOPT_NOP << 16) |
                                (TCPOPT_SACK_PERM << 8) |
                                TCPOLEN_SACK_PERM);
         }
 
-        if (unlikely(OPTION_WSCALE & opts->options)) {
+        if (unlikely(OPTION_WSCALE & options)) {
                 *ptr++ = htonl((TCPOPT_NOP << 24) |
                                (TCPOPT_WINDOW << 16) |
                                (TCPOLEN_WINDOW << 8) |
@@ -463,13 +560,17 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_out_options *opts,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
-        unsigned size = 0;
+        struct tcp_cookie_values *cvp = tp->cookie_values;
+        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
+                         tcp_cookie_size_check(cvp->cookie_desired) :
+                         0;
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tp->af_specific->md5_lookup(sk, sk);
         if (*md5) {
                 opts->options |= OPTION_MD5;
-                size += TCPOLEN_MD5SIG_ALIGNED;
+                remaining -= TCPOLEN_MD5SIG_ALIGNED;
         }
 #else
         *md5 = NULL;
@@ -485,26 +586,72 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
          * SACKs don't matter, we never delay an ACK when we have any of those
          * going out.  */
         opts->mss = tcp_advertise_mss(sk);
-        size += TCPOLEN_MSS_ALIGNED;
+        remaining -= TCPOLEN_MSS_ALIGNED;
 
         if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
-                size += TCPOLEN_TSTAMP_ALIGNED;
+                remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
         if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
                 opts->options |= OPTION_WSCALE;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
-                        size += TCPOLEN_SACKPERM_ALIGNED;
+                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
         }
 
-        return size;
+        /* Note that timestamps are required by the specification.
+         *
+         * Odd numbers of bytes are prohibited by the specification, ensuring
+         * that the cookie is 16-bit aligned, and the resulting cookie pair is
+         * 32-bit aligned.
+         */
+        if (*md5 == NULL &&
+            (OPTION_TS & opts->options) &&
+            cookie_size > 0) {
+                int need = TCPOLEN_COOKIE_BASE + cookie_size;
+
+                if (0x2 & need) {
+                        /* 32-bit multiple */
+                        need += 2; /* NOPs */
+
+                        if (need > remaining) {
+                                /* try shrinking cookie to fit */
+                                cookie_size -= 2;
+                                need -= 4;
+                        }
+                }
+                while (need > remaining && TCP_COOKIE_MIN <= cookie_size) {
+                        cookie_size -= 4;
+                        need -= 4;
+                }
+                if (TCP_COOKIE_MIN <= cookie_size) {
+                        opts->options |= OPTION_COOKIE_EXTENSION;
+                        opts->hash_location = (__u8 *)&cvp->cookie_pair[0];
+                        opts->hash_size = cookie_size;
+
+                        /* Remember for future incarnations. */
+                        cvp->cookie_desired = cookie_size;
+
+                        if (cvp->cookie_desired != cvp->cookie_pair_size) {
+                                /* Currently use random bytes as a nonce,
+                                 * assuming these are completely unpredictable
+                                 * by hostile users of the same system.
+                                 */
+                                get_random_bytes(&cvp->cookie_pair[0],
+                                                 cookie_size);
+                                cvp->cookie_pair_size = cookie_size;
+                        }
+
+                        remaining -= need;
+                }
+        }
+        return MAX_TCP_OPTION_SPACE - remaining;
 }
 
 /* Set up TCP options for SYN-ACKs. */
@@ -512,48 +659,77 @@ static unsigned tcp_synack_options(struct sock *sk,
                                    struct request_sock *req,
                                    unsigned mss, struct sk_buff *skb,
                                    struct tcp_out_options *opts,
-                                   struct tcp_md5sig_key **md5) {
-        unsigned size = 0;
+                                   struct tcp_md5sig_key **md5,
+                                   struct tcp_extend_values *xvp)
+{
         struct inet_request_sock *ireq = inet_rsk(req);
-        char doing_ts;
+        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        u8 cookie_plus = (xvp != NULL && !xvp->cookie_out_never) ?
+                         xvp->cookie_plus :
+                         0;
+        bool doing_ts = ireq->tstamp_ok;
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tcp_rsk(req)->af_specific->md5_lookup(sk, req);
         if (*md5) {
                 opts->options |= OPTION_MD5;
-                size += TCPOLEN_MD5SIG_ALIGNED;
+                remaining -= TCPOLEN_MD5SIG_ALIGNED;
+
+                /* We can't fit any SACK blocks in a packet with MD5 + TS
+                 * options. There was discussion about disabling SACK
+                 * rather than TS in order to fit in better with old,
+                 * buggy kernels, but that was deemed to be unnecessary.
+                 */
+                doing_ts &= !ireq->sack_ok;
         }
 #else
         *md5 = NULL;
 #endif
 
-        /* we can't fit any SACK blocks in a packet with MD5 + TS
-           options. There was discussion about disabling SACK rather than TS in
-           order to fit in better with old, buggy kernels, but that was deemed
-           to be unnecessary. */
-        doing_ts = ireq->tstamp_ok && !(*md5 && ireq->sack_ok);
-
+        /* We always send an MSS option. */
         opts->mss = mss;
-        size += TCPOLEN_MSS_ALIGNED;
+        remaining -= TCPOLEN_MSS_ALIGNED;
 
         if (likely(ireq->wscale_ok)) {
                 opts->ws = ireq->rcv_wscale;
                 opts->options |= OPTION_WSCALE;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(doing_ts)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = req->ts_recent;
-                size += TCPOLEN_TSTAMP_ALIGNED;
+                remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
         if (likely(ireq->sack_ok)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!doing_ts))
-                        size += TCPOLEN_SACKPERM_ALIGNED;
+                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
         }
 
-        return size;
+        /* Similar rationale to tcp_syn_options() applies here, too.
+         * If the <SYN> options fit, the same options should fit now!
+         */
+        if (*md5 == NULL &&
+            doing_ts &&
+            cookie_plus > TCPOLEN_COOKIE_BASE) {
+                int need = cookie_plus; /* has TCPOLEN_COOKIE_BASE */
+
+                if (0x2 & need) {
+                        /* 32-bit multiple */
+                        need += 2; /* NOPs */
+                }
+                if (need <= remaining) {
+                        opts->options |= OPTION_COOKIE_EXTENSION;
+                        opts->hash_size = cookie_plus - TCPOLEN_COOKIE_BASE;
+                        remaining -= need;
+                } else {
+                        /* There's no error return, so flag it. */
+                        xvp->cookie_out_never = 1; /* true */
+                        opts->hash_size = 0;
+                }
+        }
+        return MAX_TCP_OPTION_SPACE - remaining;
 }
 
 /* Compute TCP options for ESTABLISHED sockets. This is not the
@@ -619,7 +795,6 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         struct tcp_out_options opts;
         unsigned tcp_options_size, tcp_header_size;
         struct tcp_md5sig_key *md5;
-        __u8 *md5_hash_location;
         struct tcphdr *th;
         int err;
 
@@ -661,8 +836,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         /* Build TCP header and checksum it. */
         th = tcp_hdr(skb);
-        th->source              = inet->sport;
-        th->dest                = inet->dport;
+        th->source              = inet->inet_sport;
+        th->dest                = inet->inet_dport;
         th->seq                 = htonl(tcb->seq);
         th->ack_seq             = htonl(tp->rcv_nxt);
         *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
@@ -690,7 +865,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                 }
         }
 
-        tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
+        tcp_options_write((__be32 *)(th + 1), tp, &opts);
         if (likely((tcb->flags & TCPCB_FLAG_SYN) == 0))
                 TCP_ECN_send(sk, skb, tcp_header_size);
 
@@ -698,7 +873,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         /* Calculate the MD5 hash, as we have all we need now */
         if (md5) {
                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
-                tp->af_specific->calc_md5_hash(md5_hash_location,
+                tp->af_specific->calc_md5_hash(opts.hash_location,
                                                md5, sk, NULL, skb);
         }
 #endif
@@ -1627,11 +1802,6 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
                                int nonagle)
 {
-        struct sk_buff *skb = tcp_send_head(sk);
-
-        if (!skb)
-                return;
-
         /* If we are closed, the bytes will have to remain here.
          * In time closedown will finish, we empty the write queue and
          * all will be happy.
@@ -1918,8 +2088,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          * case, when window is shrunk to zero. In this case
          * our retransmit serves as a zero window probe.
          */
-        if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp))
-            && TCP_SKB_CB(skb)->seq != tp->snd_una)
+        if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) &&
+            TCP_SKB_CB(skb)->seq != tp->snd_una)
                 return -EAGAIN;
 
         if (skb->len > cur_mss) {
@@ -2219,19 +2389,24 @@ int tcp_send_synack(struct sock *sk)
 
 /* Prepare a SYN-ACK. */
 struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
-                                struct request_sock *req)
+                                struct request_sock *req,
+                                struct request_values *rvp)
 {
+        struct tcp_out_options opts;
+        struct tcp_extend_values *xvp = tcp_xv(rvp);
         struct inet_request_sock *ireq = inet_rsk(req);
         struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_cookie_values *cvp = tp->cookie_values;
         struct tcphdr *th;
-        int tcp_header_size;
-        struct tcp_out_options opts;
         struct sk_buff *skb;
         struct tcp_md5sig_key *md5;
-        __u8 *md5_hash_location;
+        int tcp_header_size;
         int mss;
+        int s_data_desired = 0;
 
-        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
+        if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
+                s_data_desired = cvp->s_data_desired;
+        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
         if (skb == NULL)
                 return NULL;
 
@@ -2254,7 +2429,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                         &req->rcv_wnd,
                         &req->window_clamp,
                         ireq->wscale_ok,
-                        &rcv_wscale);
+                        &rcv_wscale,
+                        dst_metric(dst, RTAX_INITRWND));
                 ireq->rcv_wscale = rcv_wscale;
         }
 
@@ -2266,8 +2442,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 #endif
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         tcp_header_size = tcp_synack_options(sk, req, mss,
-                                             skb, &opts, &md5) +
-                          sizeof(struct tcphdr);
+                                             skb, &opts, &md5, xvp)
+                        + sizeof(*th);
 
         skb_push(skb, tcp_header_size);
         skb_reset_transport_header(skb);
@@ -2284,19 +2460,54 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
          */
         tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn,
                              TCPCB_FLAG_SYN | TCPCB_FLAG_ACK);
+
+        if (OPTION_COOKIE_EXTENSION & opts.options) {
+                if (s_data_desired) {
+                        u8 *buf = skb_put(skb, s_data_desired);
+
+                        /* copy data directly from the listening socket. */
+                        memcpy(buf, cvp->s_data_payload, s_data_desired);
+                        TCP_SKB_CB(skb)->end_seq += s_data_desired;
+                }
+
+                if (opts.hash_size > 0) {
+                        __u32 workspace[SHA_WORKSPACE_WORDS];
+                        u32 *mess = &xvp->cookie_bakery[COOKIE_DIGEST_WORDS];
+                        u32 *tail = &mess[COOKIE_MESSAGE_WORDS-1];
+
+                        /* Secret recipe depends on the Timestamp, (future)
+                         * Sequence and Acknowledgment Numbers, Initiator
+                         * Cookie, and others handled by IP variant caller.
+                         */
+                        *tail-- ^= opts.tsval;
+                        *tail-- ^= tcp_rsk(req)->rcv_isn + 1;
+                        *tail-- ^= TCP_SKB_CB(skb)->seq + 1;
+
+                        /* recommended */
+                        *tail-- ^= ((th->dest << 16) | th->source);
+                        *tail-- ^= (u32)(unsigned long)cvp; /* per sockopt */
+
+                        sha_transform((__u32 *)&xvp->cookie_bakery[0],
+                                      (char *)mess,
+                                      &workspace[0]);
+                        opts.hash_location =
+                                (__u8 *)&xvp->cookie_bakery[0];
+                }
+        }
+
         th->seq = htonl(TCP_SKB_CB(skb)->seq);
         th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
 
         /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
         th->window = htons(min(req->rcv_wnd, 65535U));
-        tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
+        tcp_options_write((__be32 *)(th + 1), tp, &opts);
         th->doff = (tcp_header_size >> 2);
         TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
         if (md5) {
-                tcp_rsk(req)->af_specific->calc_md5_hash(md5_hash_location,
+                tcp_rsk(req)->af_specific->calc_md5_hash(opts.hash_location,
                                                md5, NULL, req, skb);
         }
 #endif
@@ -2342,7 +2553,8 @@ static void tcp_connect_init(struct sock *sk)
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
                                   sysctl_tcp_window_scaling,
-                                  &rcv_wscale);
+                                  &rcv_wscale,
+                                  dst_metric(dst, RTAX_INITRWND));
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
         tp->rcv_ssthresh = tp->rcv_wnd;
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 59f5b5e7c566..f8efada580e8 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -22,6 +22,7 @@
 #include <linux/kprobes.h>
 #include <linux/socket.h>
 #include <linux/tcp.h>
+#include <linux/slab.h>
 #include <linux/proc_fs.h>
 #include <linux/module.h>
 #include <linux/ktime.h>
@@ -39,9 +40,9 @@ static int port __read_mostly = 0;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
 
-static int bufsize __read_mostly = 4096;
+static unsigned int bufsize __read_mostly = 4096;
 MODULE_PARM_DESC(bufsize, "Log buffer size in packets (4096)");
-module_param(bufsize, int, 0);
+module_param(bufsize, uint, 0);
 
 static int full __read_mostly;
 MODULE_PARM_DESC(full, "Full log (1=every ack packet received,  0=only cwnd changes)");
@@ -75,12 +76,12 @@ static struct {
 
 static inline int tcp_probe_used(void)
 {
-        return (tcp_probe.head - tcp_probe.tail) % bufsize;
+        return (tcp_probe.head - tcp_probe.tail) & (bufsize - 1);
 }
 
 static inline int tcp_probe_avail(void)
 {
-        return bufsize - tcp_probe_used();
+        return bufsize - tcp_probe_used() - 1;
 }
 
 /*
@@ -94,8 +95,9 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         const struct inet_sock *inet = inet_sk(sk);
 
         /* Only update if port matches */
-        if ((port == 0 || ntohs(inet->dport) == port || ntohs(inet->sport) == port)
-            && (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
+        if ((port == 0 || ntohs(inet->inet_dport) == port ||
+             ntohs(inet->inet_sport) == port) &&
+            (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
 
                 spin_lock(&tcp_probe.lock);
                 /* If log fills, just silently drop */
@@ -103,10 +105,10 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         struct tcp_log *p = tcp_probe.log + tcp_probe.head;
 
                         p->tstamp = ktime_get();
-                        p->saddr = inet->saddr;
-                        p->sport = inet->sport;
-                        p->daddr = inet->daddr;
-                        p->dport = inet->dport;
+                        p->saddr = inet->inet_saddr;
+                        p->sport = inet->inet_sport;
+                        p->daddr = inet->inet_daddr;
+                        p->dport = inet->inet_dport;
                         p->length = skb->len;
                         p->snd_nxt = tp->snd_nxt;
                         p->snd_una = tp->snd_una;
@@ -115,7 +117,7 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         p->ssthresh = tcp_current_ssthresh(sk);
                         p->srtt = tp->srtt >> 3;
 
-                        tcp_probe.head = (tcp_probe.head + 1) % bufsize;
+                        tcp_probe.head = (tcp_probe.head + 1) & (bufsize - 1);
                 }
                 tcp_probe.lastcwnd = tp->snd_cwnd;
                 spin_unlock(&tcp_probe.lock);
@@ -148,7 +150,7 @@ static int tcpprobe_open(struct inode * inode, struct file * file)
 static int tcpprobe_sprint(char *tbuf, int n)
 {
         const struct tcp_log *p
-                = tcp_probe.log + tcp_probe.tail % bufsize;
+                = tcp_probe.log + tcp_probe.tail;
         struct timespec tv
                 = ktime_to_timespec(ktime_sub(p->tstamp, tcp_probe.start));
 
@@ -191,7 +193,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
                 width = tcpprobe_sprint(tbuf, sizeof(tbuf));
 
                 if (cnt + width < len)
-                        tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
+                        tcp_probe.tail = (tcp_probe.tail + 1) & (bufsize - 1);
 
                 spin_unlock_bh(&tcp_probe.lock);
 
@@ -221,9 +223,10 @@ static __init int tcpprobe_init(void)
         init_waitqueue_head(&tcp_probe.wait);
         spin_lock_init(&tcp_probe.lock);
 
-        if (bufsize < 0)
+        if (bufsize == 0)
                 return -EINVAL;
 
+        bufsize = roundup_pow_of_two(bufsize);
         tcp_probe.log = kcalloc(bufsize, sizeof(struct tcp_log), GFP_KERNEL);
         if (!tcp_probe.log)
                 goto err0;
@@ -235,7 +238,7 @@ static __init int tcpprobe_init(void)
         if (ret)
                 goto err1;
 
-        pr_info("TCP probe registered (port=%d)\n", port);
+        pr_info("TCP probe registered (port=%d) bufsize=%u\n", port, bufsize);
         return 0;
  err1:
         proc_net_remove(&init_net, procname);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index cdb2ca7684d4..8a0ab2977f1f 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/gfp.h>
 #include <net/tcp.h>
 
 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
@@ -29,6 +30,7 @@ int sysctl_tcp_keepalive_intvl __read_mostly = TCP_KEEPALIVE_INTVL;
 int sysctl_tcp_retries1 __read_mostly = TCP_RETR1;
 int sysctl_tcp_retries2 __read_mostly = TCP_RETR2;
 int sysctl_tcp_orphan_retries __read_mostly;
+int sysctl_tcp_thin_linear_timeouts __read_mostly;
 
 static void tcp_write_timer(unsigned long);
 static void tcp_delack_timer(unsigned long);
@@ -132,6 +134,35 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
         }
 }
 
+/* This function calculates a "timeout" which is equivalent to the timeout of a
+ * TCP connection after "boundary" unsuccessful, exponentially backed-off
+ * retransmissions with an initial RTO of TCP_RTO_MIN.
+ */
+static bool retransmits_timed_out(struct sock *sk,
+                                  unsigned int boundary)
+{
+        unsigned int timeout, linear_backoff_thresh;
+        unsigned int start_ts;
+
+        if (!inet_csk(sk)->icsk_retransmits)
+                return false;
+
+        if (unlikely(!tcp_sk(sk)->retrans_stamp))
+                start_ts = TCP_SKB_CB(tcp_write_queue_head(sk))->when;
+        else
+                start_ts = tcp_sk(sk)->retrans_stamp;
+
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+
+        if (boundary <= linear_backoff_thresh)
+                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+        else
+                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                          (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+
+        return (tcp_time_stamp - start_ts) >= timeout;
+}
+
 /* A write timeout has occurred. Process the after effects. */
 static int tcp_write_timeout(struct sock *sk)
 {
@@ -141,14 +172,14 @@ static int tcp_write_timeout(struct sock *sk)
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
         } else {
                 if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 }
 
                 retry_until = sysctl_tcp_retries2;
@@ -303,15 +334,15 @@ void tcp_retransmit_timer(struct sock *sk)
                 struct inet_sock *inet = inet_sk(sk);
                 if (sk->sk_family == AF_INET) {
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &inet->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &inet->inet_daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (sk->sk_family == AF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &np->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &np->daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #endif
 #endif
@@ -386,7 +417,25 @@ void tcp_retransmit_timer(struct sock *sk)
         icsk->icsk_retransmits++;
 
 out_reset_timer:
-        icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
+        /* If stream is thin, use linear timeouts. Since 'icsk_backoff' is
+         * used to reset timer, set to 0. Recalculate 'icsk_rto' as this
+         * might be increased if the stream oscillates between thin and thick,
+         * thus the old value might already be too high compared to the value
+         * set by 'tcp_set_rto' in tcp_input.c which resets the rto without
+         * backoff. Limit to TCP_THIN_LINEAR_RETRIES before initiating
+         * exponential backoff behaviour to avoid continue hammering
+         * linear-timeout retransmissions into a black hole
+         */
+        if (sk->sk_state == TCP_ESTABLISHED &&
+            (tp->thin_lto || sysctl_tcp_thin_linear_timeouts) &&
+            tcp_stream_is_thin(tp) &&
+            icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
+                icsk->icsk_backoff = 0;
+                icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX);
+        } else {
+                /* Use normal (exponential) backoff */
+                icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
+        }
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
         if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
                 __sk_dst_reset(sk);
@@ -445,6 +494,12 @@ static void tcp_synack_timer(struct sock *sk)
                                    TCP_TIMEOUT_INIT, TCP_RTO_MAX);
 }
 
+void tcp_syn_ack_timeout(struct sock *sk, struct request_sock *req)
+{
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
+}
+EXPORT_SYMBOL(tcp_syn_ack_timeout);
+
 void tcp_set_keepalive(struct sock *sk, int val)
 {
         if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index e9bbff746488..b612acf76183 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -165,9 +165,8 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                  * every other rtt.
                                  */
                                 if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
-                                        if (veno->inc
-                                            && tp->snd_cwnd <
-                                            tp->snd_cwnd_clamp) {
+                                        if (veno->inc &&
+                                            tp->snd_cwnd < tp->snd_cwnd_clamp) {
                                                 tp->snd_cwnd++;
                                                 veno->inc = 0;
                                         } else
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 66b6821b984e..a0f240358892 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -157,8 +157,8 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 
                         if (queue > TCP_YEAH_ALPHA ||
                             rtt - yeah->vegas.baseRTT > (yeah->vegas.baseRTT / TCP_YEAH_PHY)) {
-                                if (queue > TCP_YEAH_ALPHA
-                                    && tp->snd_cwnd > yeah->reno_count) {
+                                if (queue > TCP_YEAH_ALPHA &&
+                                    tp->snd_cwnd > yeah->reno_count) {
                                         u32 reduction = min(queue / TCP_YEAH_GAMMA ,
                                                             tp->snd_cwnd >> TCP_YEAH_EPSILON);
 
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index 3959e0ca456a..3b3813cc80b9 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -8,6 +8,7 @@
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/icmp.h>
 #include <net/ip.h>
 #include <net/protocol.h>
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0fa9f70e4b19..c36522a0f113 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -95,6 +95,7 @@
 #include <linux/mm.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/tcp_states.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
@@ -106,7 +107,7 @@
 #include <net/xfrm.h>
 #include "udp_impl.h"
 
-struct udp_table udp_table;
+struct udp_table udp_table __read_mostly;
 EXPORT_SYMBOL(udp_table);
 
 int sysctl_udp_mem[3] __read_mostly;
@@ -121,28 +122,30 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
-#define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
+#define MAX_UDP_PORTS 65536
+#define PORTS_PER_CHAIN (MAX_UDP_PORTS / UDP_HTABLE_SIZE_MIN)
 
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
                                const struct udp_hslot *hslot,
                                unsigned long *bitmap,
                                struct sock *sk,
                                int (*saddr_comp)(const struct sock *sk1,
-                                                 const struct sock *sk2))
+                                                 const struct sock *sk2),
+                               unsigned int log)
 {
         struct sock *sk2;
         struct hlist_nulls_node *node;
 
         sk_nulls_for_each(sk2, node, &hslot->head)
-                if (net_eq(sock_net(sk2), net)                  &&
-                    sk2 != sk                                   &&
-                    (bitmap || sk2->sk_hash == num)             &&
-                    (!sk2->sk_reuse || !sk->sk_reuse)           &&
-                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
-                        || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                if (net_eq(sock_net(sk2), net) &&
+                    sk2 != sk &&
+                    (bitmap || udp_sk(sk2)->udp_port_hash == num) &&
+                    (!sk2->sk_reuse || !sk->sk_reuse) &&
+                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
+                     sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
                     (*saddr_comp)(sk, sk2)) {
                         if (bitmap)
-                                __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
+                                __set_bit(udp_sk(sk2)->udp_port_hash >> log,
                                           bitmap);
                         else
                                 return 1;
@@ -150,18 +153,51 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
         return 0;
 }
 
+/*
+ * Note: we still hold spinlock of primary hash chain, so no other writer
+ * can insert/delete a socket with local_port == num
+ */
+static int udp_lib_lport_inuse2(struct net *net, __u16 num,
+                               struct udp_hslot *hslot2,
+                               struct sock *sk,
+                               int (*saddr_comp)(const struct sock *sk1,
+                                                 const struct sock *sk2))
+{
+        struct sock *sk2;
+        struct hlist_nulls_node *node;
+        int res = 0;
+
+        spin_lock(&hslot2->lock);
+        udp_portaddr_for_each_entry(sk2, node, &hslot2->head)
+                if (net_eq(sock_net(sk2), net) &&
+                    sk2 != sk &&
+                    (udp_sk(sk2)->udp_port_hash == num) &&
+                    (!sk2->sk_reuse || !sk->sk_reuse) &&
+                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
+                     sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                    (*saddr_comp)(sk, sk2)) {
+                        res = 1;
+                        break;
+                }
+        spin_unlock(&hslot2->lock);
+        return res;
+}
+
 /**
  *  udp_lib_get_port  -  UDP/-Lite port lookup for IPv4 and IPv6
  *
  *  @sk:          socket struct in question
  *  @snum:        port number to look up
  *  @saddr_comp:  AF-dependent comparison of bound local IP addresses
+ *  @hash2_nulladdr: AF-dependant hash value in secondary hash chains,
+ *                   with NULL address
  */
 int udp_lib_get_port(struct sock *sk, unsigned short snum,
                        int (*saddr_comp)(const struct sock *sk1,
-                                         const struct sock *sk2))
+                                         const struct sock *sk2),
+                     unsigned int hash2_nulladdr)
 {
-        struct udp_hslot *hslot;
+        struct udp_hslot *hslot, *hslot2;
         struct udp_table *udptable = sk->sk_prot->h.udp_table;
         int    error = 1;
         struct net *net = sock_net(sk);
@@ -180,13 +216,14 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 /*
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
-                rand = (rand | 1) * UDP_HTABLE_SIZE;
-                for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
-                        hslot = &udptable->hash[udp_hashfn(net, first)];
+                rand = (rand | 1) * (udptable->mask + 1);
+                last = first + udptable->mask + 1;
+                do {
+                        hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
                         udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
-                                            saddr_comp);
+                                            saddr_comp, udptable->log);
 
                         snum = first;
                         /*
@@ -196,25 +233,59 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                          */
                         do {
                                 if (low <= snum && snum <= high &&
-                                    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
+                                    !test_bit(snum >> udptable->log, bitmap))
                                         goto found;
                                 snum += rand;
                         } while (snum != first);
                         spin_unlock_bh(&hslot->lock);
-                }
+                } while (++first != last);
                 goto fail;
         } else {
-                hslot = &udptable->hash[udp_hashfn(net, snum)];
+                hslot = udp_hashslot(udptable, net, snum);
                 spin_lock_bh(&hslot->lock);
-                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
+                if (hslot->count > 10) {
+                        int exist;
+                        unsigned int slot2 = udp_sk(sk)->udp_portaddr_hash ^ snum;
+
+                        slot2          &= udptable->mask;
+                        hash2_nulladdr &= udptable->mask;
+
+                        hslot2 = udp_hashslot2(udptable, slot2);
+                        if (hslot->count < hslot2->count)
+                                goto scan_primary_hash;
+
+                        exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                     sk, saddr_comp);
+                        if (!exist && (hash2_nulladdr != slot2)) {
+                                hslot2 = udp_hashslot2(udptable, hash2_nulladdr);
+                                exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                             sk, saddr_comp);
+                        }
+                        if (exist)
+                                goto fail_unlock;
+                        else
+                                goto found;
+                }
+scan_primary_hash:
+                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk,
+                                        saddr_comp, 0))
                         goto fail_unlock;
         }
 found:
-        inet_sk(sk)->num = snum;
-        sk->sk_hash = snum;
+        inet_sk(sk)->inet_num = snum;
+        udp_sk(sk)->udp_port_hash = snum;
+        udp_sk(sk)->udp_portaddr_hash ^= snum;
         if (sk_unhashed(sk)) {
                 sk_nulls_add_node_rcu(sk, &hslot->head);
+                hslot->count++;
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
+                spin_lock(&hslot2->lock);
+                hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                         &hslot2->head);
+                hslot2->count++;
+                spin_unlock(&hslot2->lock);
         }
         error = 0;
 fail_unlock:
@@ -229,13 +300,26 @@ static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
         return  (!ipv6_only_sock(sk2)  &&
-                 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr));
+                 (!inet1->inet_rcv_saddr || !inet2->inet_rcv_saddr ||
+                   inet1->inet_rcv_saddr == inet2->inet_rcv_saddr));
+}
+
+static unsigned int udp4_portaddr_hash(struct net *net, __be32 saddr,
+                                       unsigned int port)
+{
+        return jhash_1word(saddr, net_hash_mix(net)) ^ port;
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal);
+        unsigned int hash2_nulladdr =
+                udp4_portaddr_hash(sock_net(sk), INADDR_ANY, snum);
+        unsigned int hash2_partial =
+                udp4_portaddr_hash(sock_net(sk), inet_sk(sk)->inet_rcv_saddr, 0);
+
+        /* precompute partial secondary hash */
+        udp_sk(sk)->udp_portaddr_hash = hash2_partial;
+        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal, hash2_nulladdr);
 }
 
 static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
@@ -244,23 +328,23 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
                         !ipv6_only_sock(sk)) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 score = (sk->sk_family == PF_INET ? 1 : 0);
-                if (inet->rcv_saddr) {
-                        if (inet->rcv_saddr != daddr)
+                if (inet->inet_rcv_saddr) {
+                        if (inet->inet_rcv_saddr != daddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->daddr) {
-                        if (inet->daddr != saddr)
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->dport) {
-                        if (inet->dport != sport)
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
                                 return -1;
                         score += 2;
                 }
@@ -273,6 +357,89 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
         return score;
 }
 
+/*
+ * In this second variant, we check (daddr, dport) matches (inet_rcv_sadd, inet_num)
+ */
+#define SCORE2_MAX (1 + 2 + 2 + 2)
+static inline int compute_score2(struct sock *sk, struct net *net,
+                                 __be32 saddr, __be16 sport,
+                                 __be32 daddr, unsigned int hnum, int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && !ipv6_only_sock(sk)) {
+                struct inet_sock *inet = inet_sk(sk);
+
+                if (inet->inet_rcv_saddr != daddr)
+                        return -1;
+                if (inet->inet_num != hnum)
+                        return -1;
+
+                score = (sk->sk_family == PF_INET ? 1 : 0);
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
+                                return -1;
+                        score += 2;
+                }
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
+                                return -1;
+                        score += 2;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score += 2;
+                }
+        }
+        return score;
+}
+
+
+/* called with read_rcu_lock() */
+static struct sock *udp4_lib_lookup2(struct net *net,
+                __be32 saddr, __be16 sport,
+                __be32 daddr, unsigned int hnum, int dif,
+                struct udp_hslot *hslot2, unsigned int slot2)
+{
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
+        int score, badness;
+
+begin:
+        result = NULL;
+        badness = -1;
+        udp_portaddr_for_each_entry_rcu(sk, node, &hslot2->head) {
+                score = compute_score2(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                        if (score == SCORE2_MAX)
+                                goto exact_match;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot2)
+                goto begin;
+
+        if (result) {
+exact_match:
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score2(result, net, saddr, sport,
+                                  daddr, hnum, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        return result;
+}
+
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
@@ -283,11 +450,35 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
-        struct udp_hslot *hslot = &udptable->hash[hash];
+        unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
+        struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness;
 
         rcu_read_lock();
+        if (hslot->count > 10) {
+                hash2 = udp4_portaddr_hash(net, daddr, hnum);
+                slot2 = hash2 & udptable->mask;
+                hslot2 = &udptable->hash2[slot2];
+                if (hslot->count < hslot2->count)
+                        goto begin;
+
+                result = udp4_lib_lookup2(net, saddr, sport,
+                                          daddr, hnum, dif,
+                                          hslot2, slot2);
+                if (!result) {
+                        hash2 = udp4_portaddr_hash(net, INADDR_ANY, hnum);
+                        slot2 = hash2 & udptable->mask;
+                        hslot2 = &udptable->hash2[slot2];
+                        if (hslot->count < hslot2->count)
+                                goto begin;
+
+                        result = udp4_lib_lookup2(net, saddr, sport,
+                                                  INADDR_ANY, hnum, dif,
+                                                  hslot2, slot2);
+                }
+                rcu_read_unlock();
+                return result;
+        }
 begin:
         result = NULL;
         badness = -1;
@@ -304,7 +495,7 @@ begin:
          * not the expected one, we must restart lookup.
          * We probably met an item that was moved to another chain.
          */
-        if (get_nulls_value(node) != hash)
+        if (get_nulls_value(node) != slot)
                 goto begin;
 
         if (result) {
@@ -354,12 +545,13 @@ static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
         sk_nulls_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
-                if (!net_eq(sock_net(s), net)                           ||
-                    s->sk_hash != hnum                                  ||
-                    (inet->daddr && inet->daddr != rmt_addr)            ||
-                    (inet->dport != rmt_port && inet->dport)            ||
-                    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
-                    ipv6_only_sock(s)                                   ||
+                if (!net_eq(sock_net(s), net) ||
+                    udp_sk(s)->udp_port_hash != hnum ||
+                    (inet->inet_daddr && inet->inet_daddr != rmt_addr) ||
+                    (inet->inet_dport != rmt_port && inet->inet_dport) ||
+                    (inet->inet_rcv_saddr &&
+                     inet->inet_rcv_saddr != loc_addr) ||
+                    ipv6_only_sock(s) ||
                     (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
                         continue;
                 if (!ip_mc_sf_allow(s, loc_addr, rmt_addr, dif))
@@ -642,14 +834,14 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
-                daddr = inet->daddr;
-                dport = inet->dport;
+                daddr = inet->inet_daddr;
+                dport = inet->inet_dport;
                 /* Open fast path for connected socket.
                    Route will not be used, if at least one option is set.
                  */
                 connected = 1;
         }
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
 
         ipc.oif = sk->sk_bound_dev_if;
         err = sock_tx_timestamp(msg, sk, &ipc.shtx);
@@ -704,7 +896,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                     .proto = sk->sk_protocol,
                                     .flags = inet_sk_flowi_flags(sk),
                                     .uli_u = { .ports =
-                                               { .sport = inet->sport,
+                                               { .sport = inet->inet_sport,
                                                  .dport = dport } } };
                 struct net *net = sock_net(sk);
 
@@ -748,7 +940,7 @@ back_from_confirm:
         inet->cork.fl.fl4_dst = daddr;
         inet->cork.fl.fl_ip_dport = dport;
         inet->cork.fl.fl4_src = saddr;
-        inet->cork.fl.fl_ip_sport = inet->sport;
+        inet->cork.fl.fl_ip_sport = inet->inet_sport;
         up->pending = AF_INET;
 
 do_append_data:
@@ -862,6 +1054,7 @@ static unsigned int first_packet_length(struct sock *sk)
                 udp_lib_checksum_complete(skb)) {
                 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
                                  IS_UDPLITE(sk));
+                atomic_inc(&sk->sk_drops);
                 __skb_unlink(skb, rcvq);
                 __skb_queue_tail(&list_kill, skb);
         }
@@ -925,7 +1118,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
         struct sk_buff *skb;
-        unsigned int ulen, copied;
+        unsigned int ulen;
         int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
@@ -946,10 +1139,9 @@ try_again:
                 goto out;
 
         ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
-        if (copied > ulen)
-                copied = ulen;
-        else if (copied < ulen)
+        if (len > ulen)
+                len = ulen;
+        else if (len < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
         /*
@@ -958,14 +1150,14 @@ try_again:
          * coverage checksum (UDP-Lite), do it before the copy.
          */
 
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
                 if (udp_lib_checksum_complete(skb))
                         goto csum_copy_err;
         }
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied);
+                                              msg->msg_iov, len);
         else {
                 err = skb_copy_and_csum_datagram_iovec(skb,
                                                        sizeof(struct udphdr),
@@ -982,7 +1174,7 @@ try_again:
                 UDP_INC_STATS_USER(sock_net(sk),
                                 UDP_MIB_INDATAGRAMS, is_udplite);
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -994,7 +1186,7 @@ try_again:
         if (inet->cmsg_flags)
                 ip_cmsg_recv(msg, skb);
 
-        err = copied;
+        err = len;
         if (flags & MSG_TRUNC)
                 err = ulen;
 
@@ -1023,15 +1215,15 @@ int udp_disconnect(struct sock *sk, int flags)
          */
 
         sk->sk_state = TCP_CLOSE;
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk->sk_bound_dev_if = 0;
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
 
         if (!(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) {
                 sk->sk_prot->unhash(sk);
-                inet->sport = 0;
+                inet->inet_sport = 0;
         }
         sk_dst_reset(sk);
         return 0;
@@ -1042,13 +1234,22 @@ void udp_lib_unhash(struct sock *sk)
 {
         if (sk_hashed(sk)) {
                 struct udp_table *udptable = sk->sk_prot->h.udp_table;
-                unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
-                struct udp_hslot *hslot = &udptable->hash[hash];
+                struct udp_hslot *hslot, *hslot2;
+
+                hslot  = udp_hashslot(udptable, sock_net(sk),
+                                      udp_sk(sk)->udp_port_hash);
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
 
                 spin_lock_bh(&hslot->lock);
                 if (sk_nulls_del_node_init_rcu(sk)) {
-                        inet_sk(sk)->num = 0;
+                        hslot->count--;
+                        inet_sk(sk)->inet_num = 0;
                         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+
+                        spin_lock(&hslot2->lock);
+                        hlist_nulls_del_init_rcu(&udp_sk(sk)->udp_portaddr_node);
+                        hslot2->count--;
+                        spin_unlock(&hslot2->lock);
                 }
                 spin_unlock_bh(&hslot->lock);
         }
@@ -1057,25 +1258,22 @@ EXPORT_SYMBOL(udp_lib_unhash);
 
 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int is_udplite = IS_UDPLITE(sk);
-        int rc;
+        int rc = sock_queue_rcv_skb(sk, skb);
+
+        if (rc < 0) {
+                int is_udplite = IS_UDPLITE(sk);
 
-        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                          is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
+                UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+                kfree_skb(skb);
+                return -1;
         }
 
         return 0;
 
-drop:
-        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-        kfree_skb(skb);
-        return -1;
 }
 
 /* returns:
@@ -1174,61 +1372,98 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 rc = __udp_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                bh_unlock_sock(sk);
+                goto drop;
+        }
         bh_unlock_sock(sk);
 
         return rc;
 
 drop:
         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        atomic_inc(&sk->sk_drops);
         kfree_skb(skb);
         return -1;
 }
 
+
+static void flush_stack(struct sock **stack, unsigned int count,
+                        struct sk_buff *skb, unsigned int final)
+{
+        unsigned int i;
+        struct sk_buff *skb1 = NULL;
+        struct sock *sk;
+
+        for (i = 0; i < count; i++) {
+                sk = stack[i];
+                if (likely(skb1 == NULL))
+                        skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+
+                if (!skb1) {
+                        atomic_inc(&sk->sk_drops);
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+                                         IS_UDPLITE(sk));
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+                                         IS_UDPLITE(sk));
+                }
+
+                if (skb1 && udp_queue_rcv_skb(sk, skb1) <= 0)
+                        skb1 = NULL;
+        }
+        if (unlikely(skb1))
+                kfree_skb(skb1);
+}
+
 /*
  *      Multicasts and broadcasts go to each listener.
  *
- *      Note: called only from the BH handler context,
- *      so we don't need to lock the hashes.
+ *      Note: called only from the BH handler context.
  */
 static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                     struct udphdr  *uh,
                                     __be32 saddr, __be32 daddr,
                                     struct udp_table *udptable)
 {
-        struct sock *sk;
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct sock *sk, *stack[256 / sizeof(struct sock *)];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
         int dif;
+        unsigned int i, count = 0;
 
         spin_lock(&hslot->lock);
         sk = sk_nulls_head(&hslot->head);
         dif = skb->dev->ifindex;
         sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (sk) {
-                struct sock *sknext = NULL;
+        while (sk) {
+                stack[count++] = sk;
+                sk = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
+                                       daddr, uh->source, saddr, dif);
+                if (unlikely(count == ARRAY_SIZE(stack))) {
+                        if (!sk)
+                                break;
+                        flush_stack(stack, count, skb, ~0);
+                        count = 0;
+                }
+        }
+        /*
+         * before releasing chain lock, we must take a reference on sockets
+         */
+        for (i = 0; i < count; i++)
+                sock_hold(stack[i]);
 
-                do {
-                        struct sk_buff *skb1 = skb;
-
-                        sknext = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
-                                                   daddr, uh->source, saddr,
-                                                   dif);
-                        if (sknext)
-                                skb1 = skb_clone(skb, GFP_ATOMIC);
-
-                        if (skb1) {
-                                int ret = udp_queue_rcv_skb(sk, skb1);
-                                if (ret > 0)
-                                        /* we should probably re-process instead
-                                         * of dropping packets here. */
-                                        kfree_skb(skb1);
-                        }
-                        sk = sknext;
-                } while (sknext);
-        } else
-                consume_skb(skb);
         spin_unlock(&hslot->lock);
+
+        /*
+         * do the slow work with no lock held
+         */
+        if (count) {
+                flush_stack(stack, count, skb, count - 1);
+
+                for (i = 0; i < count; i++)
+                        sock_put(stack[i]);
+        } else {
+                kfree_skb(skb);
+        }
         return 0;
 }
 
@@ -1292,6 +1527,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
         uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
+
         if (ulen > skb->len)
                 goto short_packet;
 
@@ -1305,9 +1543,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
-        saddr = ip_hdr(skb)->saddr;
-        daddr = ip_hdr(skb)->daddr;
-
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(net, skb, uh,
                                 saddr, daddr, udptable);
@@ -1620,9 +1855,14 @@ static struct sock *udp_get_first(struct seq_file *seq, int start)
         struct udp_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
 
-        for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
+        for (state->bucket = start; state->bucket <= state->udp_table->mask;
+             ++state->bucket) {
                 struct hlist_nulls_node *node;
                 struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
+
+                if (hlist_nulls_empty(&hslot->head))
+                        continue;
+
                 spin_lock_bh(&hslot->lock);
                 sk_nulls_for_each(sk, node, &hslot->head) {
                         if (!net_eq(sock_net(sk), net))
@@ -1647,7 +1887,7 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
         } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
 
         if (!sk) {
-                if (state->bucket < UDP_HTABLE_SIZE)
+                if (state->bucket <= state->udp_table->mask)
                         spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
                 return udp_get_first(seq, state->bucket + 1);
         }
@@ -1667,7 +1907,7 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct udp_iter_state *state = seq->private;
-        state->bucket = UDP_HTABLE_SIZE;
+        state->bucket = MAX_UDP_PORTS;
 
         return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
@@ -1689,7 +1929,7 @@ static void udp_seq_stop(struct seq_file *seq, void *v)
 {
         struct udp_iter_state *state = seq->private;
 
-        if (state->bucket < UDP_HTABLE_SIZE)
+        if (state->bucket <= state->udp_table->mask)
                 spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
 }
 
@@ -1744,12 +1984,12 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
                 int bucket, int *len)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr;
-        __be32 src  = inet->rcv_saddr;
-        __u16 destp       = ntohs(inet->dport);
-        __u16 srcp        = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src  = inet->inet_rcv_saddr;
+        __u16 destp       = ntohs(inet->inet_dport);
+        __u16 srcp        = ntohs(inet->inet_sport);
 
-        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+        seq_printf(f, "%5d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
@@ -1789,12 +2029,12 @@ static struct udp_seq_afinfo udp4_seq_afinfo = {
         },
 };
 
-static int udp4_proc_init_net(struct net *net)
+static int __net_init udp4_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udp4_seq_afinfo);
 }
 
-static void udp4_proc_exit_net(struct net *net)
+static void __net_exit udp4_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udp4_seq_afinfo);
 }
@@ -1815,21 +2055,60 @@ void udp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-void __init udp_table_init(struct udp_table *table)
+static __initdata unsigned long uhash_entries;
+static int __init set_uhash_entries(char *str)
 {
-        int i;
+        if (!str)
+                return 0;
+        uhash_entries = simple_strtoul(str, &str, 0);
+        if (uhash_entries && uhash_entries < UDP_HTABLE_SIZE_MIN)
+                uhash_entries = UDP_HTABLE_SIZE_MIN;
+        return 1;
+}
+__setup("uhash_entries=", set_uhash_entries);
 
-        for (i = 0; i < UDP_HTABLE_SIZE; i++) {
+void __init udp_table_init(struct udp_table *table, const char *name)
+{
+        unsigned int i;
+
+        if (!CONFIG_BASE_SMALL)
+                table->hash = alloc_large_system_hash(name,
+                        2 * sizeof(struct udp_hslot),
+                        uhash_entries,
+                        21, /* one slot per 2 MB */
+                        0,
+                        &table->log,
+                        &table->mask,
+                        64 * 1024);
+        /*
+         * Make sure hash table has the minimum size
+         */
+        if (CONFIG_BASE_SMALL || table->mask < UDP_HTABLE_SIZE_MIN - 1) {
+                table->hash = kmalloc(UDP_HTABLE_SIZE_MIN *
+                                      2 * sizeof(struct udp_hslot), GFP_KERNEL);
+                if (!table->hash)
+                        panic(name);
+                table->log = ilog2(UDP_HTABLE_SIZE_MIN);
+                table->mask = UDP_HTABLE_SIZE_MIN - 1;
+        }
+        table->hash2 = table->hash + (table->mask + 1);
+        for (i = 0; i <= table->mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
+                table->hash[i].count = 0;
                 spin_lock_init(&table->hash[i].lock);
         }
+        for (i = 0; i <= table->mask; i++) {
+                INIT_HLIST_NULLS_HEAD(&table->hash2[i].head, i);
+                table->hash2[i].count = 0;
+                spin_lock_init(&table->hash2[i].lock);
+        }
 }
 
 void __init udp_init(void)
 {
         unsigned long nr_pages, limit;
 
-        udp_table_init(&udp_table);
+        udp_table_init(&udp_table, "UDP");
         /* Set the pressure threshold up by the same strategy of TCP. It is a
          * fraction of global memory that is up to 1/2 at 256 MB, decreasing
          * toward zero with the amount of memory, with a floor of 128 pages.
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 95248d7f75ec..6610bf76369f 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -12,7 +12,7 @@
  */
 #include "udp_impl.h"
 
-struct udp_table        udplite_table;
+struct udp_table        udplite_table __read_mostly;
 EXPORT_SYMBOL(udplite_table);
 
 static int udplite_rcv(struct sk_buff *skb)
@@ -64,7 +64,6 @@ static struct inet_protosw udplite4_protosw = {
         .protocol       =  IPPROTO_UDPLITE,
         .prot           =  &udplite_prot,
         .ops            =  &inet_dgram_ops,
-        .capability     = -1,
         .no_check       =  0,           /* must checksum (RFC 3828) */
         .flags          =  INET_PROTOSW_PERMANENT,
 };
@@ -82,12 +81,12 @@ static struct udp_seq_afinfo udplite4_seq_afinfo = {
         },
 };
 
-static int udplite4_proc_init_net(struct net *net)
+static int __net_init udplite4_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udplite4_seq_afinfo);
 }
 
-static void udplite4_proc_exit_net(struct net *net)
+static void __net_exit udplite4_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udplite4_seq_afinfo);
 }
@@ -110,7 +109,7 @@ static inline int udplite4_proc_init(void)
 
 void __init udplite4_register(void)
 {
-        udp_table_init(&udplite_table);
+        udp_table_init(&udplite_table, "UDP-Lite");
         if (proto_register(&udplite_prot, 1))
                 goto out_register_err;
 
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index f9f922a0ba88..c791bb63203f 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -9,6 +9,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/netfilter.h>
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 3444f3b34eca..6f368413eb0e 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -4,6 +4,7 @@
  * Copyright (c) 2004-2006 Herbert Xu <herbert@gondor.apana.org.au>
  */
 
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 74fb2eb833ec..e4a1483fba77 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -15,7 +15,6 @@
 #include <net/xfrm.h>
 #include <net/ip.h>
 
-static struct dst_ops xfrm4_dst_ops;
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
 
 static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
@@ -92,11 +91,12 @@ static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
         return 0;
 }
 
-static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+                          struct flowi *fl)
 {
         struct rtable *rt = (struct rtable *)xdst->route;
 
-        xdst->u.rt.fl = rt->fl;
+        xdst->u.rt.fl = *fl;
 
         xdst->u.dst.dev = dev;
         dev_hold(dev);
@@ -190,8 +190,10 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 static inline int xfrm4_garbage_collect(struct dst_ops *ops)
 {
-        xfrm4_policy_afinfo.garbage_collect(&init_net);
-        return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
+        struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops);
+
+        xfrm4_policy_afinfo.garbage_collect(net);
+        return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
 }
 
 static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -267,9 +269,8 @@ static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
 #ifdef CONFIG_SYSCTL
 static struct ctl_table xfrm4_policy_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "xfrm4_gc_thresh",
-                .data           = &xfrm4_dst_ops.gc_thresh,
+                .data           = &init_net.xfrm.xfrm4_dst_ops.gc_thresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
@@ -296,8 +297,6 @@ static void __exit xfrm4_policy_fini(void)
 
 void __init xfrm4_init(int rt_max_size)
 {
-        xfrm4_state_init();
-        xfrm4_policy_init();
         /*
          * Select a default value for the gc_thresh based on the main route
          * table hash size.  It seems to me the worst case scenario is when
@@ -309,6 +308,9 @@ void __init xfrm4_init(int rt_max_size)
          * and start cleaning when were 1/2 full
          */
         xfrm4_dst_ops.gc_thresh = rt_max_size/2;
+
+        xfrm4_state_init();
+        xfrm4_policy_init();
 #ifdef CONFIG_SYSCTL
         sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path,
                                                 xfrm4_policy_table);
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index ead6c7a42f44..a578096152ab 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -170,6 +170,25 @@ config IPV6_SIT
 
           Saying M here will produce a module called sit. If unsure, say Y.
 
+config IPV6_SIT_6RD
+        bool "IPv6: IPv6 Rapid Deployment (6RD) (EXPERIMENTAL)"
+        depends on IPV6_SIT && EXPERIMENTAL
+        default n
+        ---help---
+          IPv6 Rapid Deployment (6rd; draft-ietf-softwire-ipv6-6rd) builds upon
+          mechanisms of 6to4 (RFC3056) to enable a service provider to rapidly
+          deploy IPv6 unicast service to IPv4 sites to which it provides
+          customer premise equipment.  Like 6to4, it utilizes stateless IPv6 in
+          IPv4 encapsulation in order to transit IPv4-only network
+          infrastructure.  Unlike 6to4, a 6rd service provider uses an IPv6
+          prefix of its own in place of the fixed 6to4 prefix.
+
+          With this option enabled, the SIT driver offers 6rd functionality by
+          providing additional ioctl API to configure the IPv6 Prefix for in
+          stead of static 2002::/16 for 6to4.
+
+          If unsure, say N.
+
 config IPV6_NDISC_NODETYPE
         bool
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1fd0a3d775d2..413054f02aab 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -53,6 +53,7 @@
 #include <linux/route.h>
 #include <linux/inetdevice.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -278,31 +279,31 @@ static void addrconf_mod_timer(struct inet6_ifaddr *ifp,
 
 static int snmp6_alloc_dev(struct inet6_dev *idev)
 {
-        if (snmp_mib_init((void **)idev->stats.ipv6,
+        if (snmp_mib_init((void __percpu **)idev->stats.ipv6,
                           sizeof(struct ipstats_mib)) < 0)
                 goto err_ip;
-        if (snmp_mib_init((void **)idev->stats.icmpv6,
+        if (snmp_mib_init((void __percpu **)idev->stats.icmpv6,
                           sizeof(struct icmpv6_mib)) < 0)
                 goto err_icmp;
-        if (snmp_mib_init((void **)idev->stats.icmpv6msg,
+        if (snmp_mib_init((void __percpu **)idev->stats.icmpv6msg,
                           sizeof(struct icmpv6msg_mib)) < 0)
                 goto err_icmpmsg;
 
         return 0;
 
 err_icmpmsg:
-        snmp_mib_free((void **)idev->stats.icmpv6);
+        snmp_mib_free((void __percpu **)idev->stats.icmpv6);
 err_icmp:
-        snmp_mib_free((void **)idev->stats.ipv6);
+        snmp_mib_free((void __percpu **)idev->stats.ipv6);
 err_ip:
         return -ENOMEM;
 }
 
 static void snmp6_free_dev(struct inet6_dev *idev)
 {
-        snmp_mib_free((void **)idev->stats.icmpv6msg);
-        snmp_mib_free((void **)idev->stats.icmpv6);
-        snmp_mib_free((void **)idev->stats.ipv6);
+        snmp_mib_free((void __percpu **)idev->stats.icmpv6msg);
+        snmp_mib_free((void __percpu **)idev->stats.icmpv6);
+        snmp_mib_free((void __percpu **)idev->stats.ipv6);
 }
 
 /* Nobody refers to this device, we may destroy it. */
@@ -481,9 +482,8 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         struct net_device *dev;
         struct inet6_dev *idev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
-                rcu_read_lock();
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 idev = __in6_dev_get(dev);
                 if (idev) {
                         int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -491,9 +491,8 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
                         if (changed)
                                 dev_forward_change(idev);
                 }
-                rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
@@ -504,8 +503,11 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
         if (p == &net->ipv6.devconf_dflt->forwarding)
                 return 0;
 
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                 return restart_syscall();
+        }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
                 __s32 newf = net->ipv6.devconf_all->forwarding;
@@ -991,8 +993,7 @@ struct ipv6_saddr_dst {
 
 static inline int ipv6_saddr_preferred(int type)
 {
-        if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
-                    IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
+        if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
                 return 1;
         return 0;
 }
@@ -1137,10 +1138,9 @@ int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
         hiscore->rule = -1;
         hiscore->ifa = NULL;
 
-        read_lock(&dev_base_lock);
         rcu_read_lock();
 
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
                 struct inet6_dev *idev;
 
                 /* Candidate Source Address (section 4)
@@ -1235,7 +1235,6 @@ try_nextdev:
                 read_unlock_bh(&idev->lock);
         }
         rcu_read_unlock();
-        read_unlock(&dev_base_lock);
 
         if (!hiscore->ifa)
                 return -EADDRNOTAVAIL;
@@ -1382,6 +1381,8 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
                 if (dad_failed)
                         ifp->flags |= IFA_F_DADFAILED;
                 spin_unlock_bh(&ifp->lock);
+                if (dad_failed)
+                        ipv6_ifa_notify(0, ifp);
                 in6_ifa_put(ifp);
 #ifdef CONFIG_IPV6_PRIVACY
         } else if (ifp->flags&IFA_F_TEMPORARY) {
@@ -2617,7 +2618,7 @@ static void addrconf_bonding_change(struct net_device *dev, unsigned long event)
 static int addrconf_ifdown(struct net_device *dev, int how)
 {
         struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa, **bifa;
+        struct inet6_ifaddr *ifa, *keep_list, **bifa;
         struct net *net = dev_net(dev);
         int i;
 
@@ -2650,11 +2651,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
                 write_lock_bh(&addrconf_hash_lock);
                 while ((ifa = *bifa) != NULL) {
-                        if (ifa->idev == idev) {
+                        if (ifa->idev == idev &&
+                            (how || !(ifa->flags&IFA_F_PERMANENT) ||
+                             ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
                                 *bifa = ifa->lst_next;
                                 ifa->lst_next = NULL;
-                                addrconf_del_timer(ifa);
-                                in6_ifa_put(ifa);
+                                __in6_ifa_put(ifa);
                                 continue;
                         }
                         bifa = &ifa->lst_next;
@@ -2690,11 +2692,40 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 write_lock_bh(&idev->lock);
         }
 #endif
+        keep_list = NULL;
+        bifa = &keep_list;
         while ((ifa = idev->addr_list) != NULL) {
                 idev->addr_list = ifa->if_next;
                 ifa->if_next = NULL;
-                ifa->dead = 1;
+
                 addrconf_del_timer(ifa);
+
+                /* If just doing link down, and address is permanent
+                   and not link-local, then retain it. */
+                if (how == 0 &&
+                    (ifa->flags&IFA_F_PERMANENT) &&
+                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
+
+                        /* Move to holding list */
+                        *bifa = ifa;
+                        bifa = &ifa->if_next;
+
+                        /* If not doing DAD on this address, just keep it. */
+                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
+                            idev->cnf.accept_dad <= 0 ||
+                            (ifa->flags & IFA_F_NODAD))
+                                continue;
+
+                        /* If it was tentative already, no need to notify */
+                        if (ifa->flags & IFA_F_TENTATIVE)
+                                continue;
+
+                        /* Flag it for later restoration when link comes up */
+                        ifa->flags |= IFA_F_TENTATIVE;
+                        in6_ifa_hold(ifa);
+                } else {
+                        ifa->dead = 1;
+                }
                 write_unlock_bh(&idev->lock);
 
                 __ipv6_ifa_notify(RTM_DELADDR, ifa);
@@ -2703,6 +2734,9 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
                 write_lock_bh(&idev->lock);
         }
+
+        idev->addr_list = keep_list;
+
         write_unlock_bh(&idev->lock);
 
         /* Step 5: Discard multicast list */
@@ -2728,28 +2762,29 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 static void addrconf_rs_timer(unsigned long data)
 {
         struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
+        struct inet6_dev *idev = ifp->idev;
 
-        if (ifp->idev->cnf.forwarding)
+        read_lock(&idev->lock);
+        if (idev->dead || !(idev->if_flags & IF_READY))
                 goto out;
 
-        if (ifp->idev->if_flags & IF_RA_RCVD) {
-                /*
-                 *      Announcement received after solicitation
-                 *      was sent
-                 */
+        if (idev->cnf.forwarding)
+                goto out;
+
+        /* Announcement received after solicitation was sent */
+        if (idev->if_flags & IF_RA_RCVD)
                 goto out;
-        }
 
         spin_lock(&ifp->lock);
-        if (ifp->probes++ < ifp->idev->cnf.rtr_solicits) {
+        if (ifp->probes++ < idev->cnf.rtr_solicits) {
                 /* The wait after the last probe can be shorter */
                 addrconf_mod_timer(ifp, AC_RS,
-                                   (ifp->probes == ifp->idev->cnf.rtr_solicits) ?
-                                   ifp->idev->cnf.rtr_solicit_delay :
-                                   ifp->idev->cnf.rtr_solicit_interval);
+                                   (ifp->probes == idev->cnf.rtr_solicits) ?
+                                   idev->cnf.rtr_solicit_delay :
+                                   idev->cnf.rtr_solicit_interval);
                 spin_unlock(&ifp->lock);
 
-                ndisc_send_rs(ifp->idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
+                ndisc_send_rs(idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
         } else {
                 spin_unlock(&ifp->lock);
                 /*
@@ -2757,10 +2792,11 @@ static void addrconf_rs_timer(unsigned long data)
                  * assumption any longer.
                  */
                 printk(KERN_DEBUG "%s: no IPv6 routers present\n",
-                       ifp->idev->dev->name);
+                       idev->dev->name);
         }
 
 out:
+        read_unlock(&idev->lock);
         in6_ifa_put(ifp);
 }
 
@@ -2793,14 +2829,14 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
         read_lock_bh(&idev->lock);
         if (ifp->dead)
                 goto out;
-        spin_lock_bh(&ifp->lock);
 
+        spin_lock(&ifp->lock);
         if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
             idev->cnf.accept_dad < 1 ||
             !(ifp->flags&IFA_F_TENTATIVE) ||
             ifp->flags & IFA_F_NODAD) {
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                 read_unlock_bh(&idev->lock);
 
                 addrconf_dad_completed(ifp);
@@ -2808,7 +2844,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
         }
 
         if (!(idev->if_flags & IF_READY)) {
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                 read_unlock_bh(&idev->lock);
                 /*
                  * If the device is not ready:
@@ -2828,7 +2864,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
                 ip6_ins_rt(ifp->rt);
 
         addrconf_dad_kick(ifp);
-        spin_unlock_bh(&ifp->lock);
+        spin_unlock(&ifp->lock);
 out:
         read_unlock_bh(&idev->lock);
 }
@@ -2839,20 +2875,21 @@ static void addrconf_dad_timer(unsigned long data)
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr mcaddr;
 
-        read_lock_bh(&idev->lock);
-        if (idev->dead) {
-                read_unlock_bh(&idev->lock);
+        read_lock(&idev->lock);
+        if (idev->dead || !(idev->if_flags & IF_READY)) {
+                read_unlock(&idev->lock);
                 goto out;
         }
-        spin_lock_bh(&ifp->lock);
+
+        spin_lock(&ifp->lock);
         if (ifp->probes == 0) {
                 /*
                  * DAD was successful
                  */
 
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
-                spin_unlock_bh(&ifp->lock);
-                read_unlock_bh(&idev->lock);
+                spin_unlock(&ifp->lock);
+                read_unlock(&idev->lock);
 
                 addrconf_dad_completed(ifp);
 
@@ -2861,8 +2898,8 @@ static void addrconf_dad_timer(unsigned long data)
 
         ifp->probes--;
         addrconf_mod_timer(ifp, AC_DAD, ifp->idev->nd_parms->retrans_time);
-        spin_unlock_bh(&ifp->lock);
-        read_unlock_bh(&idev->lock);
+        spin_unlock(&ifp->lock);
+        read_unlock(&idev->lock);
 
         /* send a neighbour solicitation for our addr */
         addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
@@ -2909,12 +2946,12 @@ static void addrconf_dad_run(struct inet6_dev *idev) {
 
         read_lock_bh(&idev->lock);
         for (ifp = idev->addr_list; ifp; ifp = ifp->if_next) {
-                spin_lock_bh(&ifp->lock);
+                spin_lock(&ifp->lock);
                 if (!(ifp->flags & IFA_F_TENTATIVE)) {
-                        spin_unlock_bh(&ifp->lock);
+                        spin_unlock(&ifp->lock);
                         continue;
                 }
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                 addrconf_dad_kick(ifp);
         }
         read_unlock_bh(&idev->lock);
@@ -3031,14 +3068,14 @@ static const struct file_operations if6_fops = {
         .release        = seq_release_net,
 };
 
-static int if6_proc_net_init(struct net *net)
+static int __net_init if6_proc_net_init(struct net *net)
 {
         if (!proc_net_fops_create(net, "if_inet6", S_IRUGO, &if6_fops))
                 return -ENOMEM;
         return 0;
 }
 
-static void if6_proc_net_exit(struct net *net)
+static void __net_exit if6_proc_net_exit(struct net *net)
 {
        proc_net_remove(net, "if_inet6");
 }
@@ -3485,85 +3522,114 @@ enum addr_type_t
         ANYCAST_ADDR,
 };
 
+/* called with rcu_read_lock() */
+static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
+                          struct netlink_callback *cb, enum addr_type_t type,
+                          int s_ip_idx, int *p_ip_idx)
+{
+        struct inet6_ifaddr *ifa;
+        struct ifmcaddr6 *ifmca;
+        struct ifacaddr6 *ifaca;
+        int err = 1;
+        int ip_idx = *p_ip_idx;
+
+        read_lock_bh(&idev->lock);
+        switch (type) {
+        case UNICAST_ADDR:
+                /* unicast address incl. temp addr */
+                for (ifa = idev->addr_list; ifa;
+                     ifa = ifa->if_next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifaddr(skb, ifa,
+                                                NETLINK_CB(cb->skb).pid,
+                                                cb->nlh->nlmsg_seq,
+                                                RTM_NEWADDR,
+                                                NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        case MULTICAST_ADDR:
+                /* multicast address */
+                for (ifmca = idev->mc_list; ifmca;
+                     ifmca = ifmca->next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifmcaddr(skb, ifmca,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_GETMULTICAST,
+                                                  NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        case ANYCAST_ADDR:
+                /* anycast address */
+                for (ifaca = idev->ac_list; ifaca;
+                     ifaca = ifaca->aca_next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifacaddr(skb, ifaca,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_GETANYCAST,
+                                                  NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        default:
+                break;
+        }
+        read_unlock_bh(&idev->lock);
+        *p_ip_idx = ip_idx;
+        return err;
+}
+
 static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                            enum addr_type_t type)
 {
+        struct net *net = sock_net(skb->sk);
+        int h, s_h;
         int idx, ip_idx;
         int s_idx, s_ip_idx;
-        int err = 1;
         struct net_device *dev;
-        struct inet6_dev *idev = NULL;
-        struct inet6_ifaddr *ifa;
-        struct ifmcaddr6 *ifmca;
-        struct ifacaddr6 *ifaca;
-        struct net *net = sock_net(skb->sk);
+        struct inet6_dev *idev;
+        struct hlist_head *head;
+        struct hlist_node *node;
 
-        s_idx = cb->args[0];
-        s_ip_idx = ip_idx = cb->args[1];
+        s_h = cb->args[0];
+        s_idx = idx = cb->args[1];
+        s_ip_idx = ip_idx = cb->args[2];
 
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if (idx > s_idx)
-                        s_ip_idx = 0;
-                ip_idx = 0;
-                if ((idev = in6_dev_get(dev)) == NULL)
-                        goto cont;
-                read_lock_bh(&idev->lock);
-                switch (type) {
-                case UNICAST_ADDR:
-                        /* unicast address incl. temp addr */
-                        for (ifa = idev->addr_list; ifa;
-                             ifa = ifa->if_next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifaddr(skb, ifa,
-                                                        NETLINK_CB(cb->skb).pid,
-                                                        cb->nlh->nlmsg_seq,
-                                                        RTM_NEWADDR,
-                                                        NLM_F_MULTI);
-                        }
-                        break;
-                case MULTICAST_ADDR:
-                        /* multicast address */
-                        for (ifmca = idev->mc_list; ifmca;
-                             ifmca = ifmca->next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifmcaddr(skb, ifmca,
-                                                          NETLINK_CB(cb->skb).pid,
-                                                          cb->nlh->nlmsg_seq,
-                                                          RTM_GETMULTICAST,
-                                                          NLM_F_MULTI);
-                        }
-                        break;
-                case ANYCAST_ADDR:
-                        /* anycast address */
-                        for (ifaca = idev->ac_list; ifaca;
-                             ifaca = ifaca->aca_next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifacaddr(skb, ifaca,
-                                                          NETLINK_CB(cb->skb).pid,
-                                                          cb->nlh->nlmsg_seq,
-                                                          RTM_GETANYCAST,
-                                                          NLM_F_MULTI);
-                        }
-                        break;
-                default:
-                        break;
-                }
-                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
-
-                if (err <= 0)
-                        break;
+        rcu_read_lock();
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (h > s_h || idx > s_idx)
+                                s_ip_idx = 0;
+                        ip_idx = 0;
+                        if ((idev = __in6_dev_get(dev)) == NULL)
+                                goto cont;
+
+                        if (in6_dump_addrs(idev, skb, cb, type,
+                                           s_ip_idx, &ip_idx) <= 0)
+                                goto done;
 cont:
-                idx++;
+                        idx++;
+                }
         }
-        cb->args[0] = idx;
-        cb->args[1] = ip_idx;
+done:
+        rcu_read_unlock();
+        cb->args[0] = h;
+        cb->args[1] = idx;
+        cb->args[2] = ip_idx;
+
         return skb->len;
 }
 
@@ -3708,6 +3774,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
         array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
         array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
+        array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
 }
 
 static inline size_t inet6_if_nlmsg_size(void)
@@ -3726,8 +3793,8 @@ static inline size_t inet6_if_nlmsg_size(void)
                  );
 }
 
-static inline void __snmp6_fill_stats(u64 *stats, void **mib, int items,
-                                      int bytes)
+static inline void __snmp6_fill_stats(u64 *stats, void __percpu **mib,
+                                      int items, int bytes)
 {
         int i;
         int pad = bytes - sizeof(u64) * items;
@@ -3746,10 +3813,10 @@ static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
 {
         switch(attrtype) {
         case IFLA_INET6_STATS:
-                __snmp6_fill_stats(stats, (void **)idev->stats.ipv6, IPSTATS_MIB_MAX, bytes);
+                __snmp6_fill_stats(stats, (void __percpu **)idev->stats.ipv6, IPSTATS_MIB_MAX, bytes);
                 break;
         case IFLA_INET6_ICMP6STATS:
-                __snmp6_fill_stats(stats, (void **)idev->stats.icmpv6, ICMP6_MIB_MAX, bytes);
+                __snmp6_fill_stats(stats, (void __percpu **)idev->stats.icmpv6, ICMP6_MIB_MAX, bytes);
                 break;
         }
 }
@@ -3826,28 +3893,39 @@ nla_put_failure:
 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        int idx, err;
-        int s_idx = cb->args[0];
+        int h, s_h;
+        int idx = 0, s_idx;
         struct net_device *dev;
         struct inet6_dev *idev;
+        struct hlist_head *head;
+        struct hlist_node *node;
 
-        read_lock(&dev_base_lock);
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if ((idev = in6_dev_get(dev)) == NULL)
-                        goto cont;
-                err = inet6_fill_ifinfo(skb, idev, NETLINK_CB(cb->skb).pid,
-                                cb->nlh->nlmsg_seq, RTM_NEWLINK, NLM_F_MULTI);
-                in6_dev_put(idev);
-                if (err <= 0)
-                        break;
+        s_h = cb->args[0];
+        s_idx = cb->args[1];
+
+        rcu_read_lock();
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        idev = __in6_dev_get(dev);
+                        if (!idev)
+                                goto cont;
+                        if (inet6_fill_ifinfo(skb, idev,
+                                              NETLINK_CB(cb->skb).pid,
+                                              cb->nlh->nlmsg_seq,
+                                              RTM_NEWLINK, NLM_F_MULTI) <= 0)
+                                goto out;
 cont:
-                idx++;
+                        idx++;
+                }
         }
-        read_unlock(&dev_base_lock);
-        cb->args[0] = idx;
+out:
+        rcu_read_unlock();
+        cb->args[1] = idx;
+        cb->args[0] = h;
 
         return skb->len;
 }
@@ -3991,50 +4069,18 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
 {
         int *valp = ctl->data;
         int val = *valp;
+        loff_t pos = *ppos;
         int ret;
 
         ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_fixup_forwarding(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
         return ret;
 }
 
-static int addrconf_sysctl_forward_strategy(ctl_table *table,
-                                            void __user *oldval,
-                                            size_t __user *oldlenp,
-                                            void __user *newval, size_t newlen)
-{
-        int *valp = table->data;
-        int val = *valp;
-        int new;
-
-        if (!newval || !newlen)
-                return 0;
-        if (newlen != sizeof(int))
-                return -EINVAL;
-        if (get_user(new, (int __user *)newval))
-                return -EFAULT;
-        if (new == *valp)
-                return 0;
-        if (oldval && oldlenp) {
-                size_t len;
-                if (get_user(len, oldlenp))
-                        return -EFAULT;
-                if (len) {
-                        if (len > table->maxlen)
-                                len = table->maxlen;
-                        if (copy_to_user(oldval, valp, len))
-                                return -EFAULT;
-                        if (put_user(len, oldlenp))
-                                return -EFAULT;
-                }
-        }
-
-        *valp = new;
-        return addrconf_fixup_forwarding(table, valp, val);
-}
-
 static void dev_disable_change(struct inet6_dev *idev)
 {
         if (!idev || !idev->dev)
@@ -4051,9 +4097,8 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
         struct net_device *dev;
         struct inet6_dev *idev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
-                rcu_read_lock();
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 idev = __in6_dev_get(dev);
                 if (idev) {
                         int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
@@ -4061,9 +4106,8 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
                         if (changed)
                                 dev_disable_change(idev);
                 }
-                rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
@@ -4075,8 +4119,11 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
         if (p == &net->ipv6.devconf_dflt->disable_ipv6)
                 return 0;
 
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                 return restart_syscall();
+        }
 
         if (p == &net->ipv6.devconf_all->disable_ipv6) {
                 __s32 newf = net->ipv6.devconf_all->disable_ipv6;
@@ -4095,12 +4142,15 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
 {
         int *valp = ctl->data;
         int val = *valp;
+        loff_t pos = *ppos;
         int ret;
 
         ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_disable_ipv6(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
         return ret;
 }
 
@@ -4113,16 +4163,13 @@ static struct addrconf_sysctl_table
         .sysctl_header = NULL,
         .addrconf_vars = {
                 {
-                        .ctl_name       =       NET_IPV6_FORWARDING,
                         .procname       =       "forwarding",
                         .data           =       &ipv6_devconf.forwarding,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
                         .proc_handler   =       addrconf_sysctl_forward,
-                        .strategy       =       addrconf_sysctl_forward_strategy,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_HOP_LIMIT,
                         .procname       =       "hop_limit",
                         .data           =       &ipv6_devconf.hop_limit,
                         .maxlen         =       sizeof(int),
@@ -4130,7 +4177,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_MTU,
                         .procname       =       "mtu",
                         .data           =       &ipv6_devconf.mtu6,
                         .maxlen         =       sizeof(int),
@@ -4138,7 +4184,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA,
                         .procname       =       "accept_ra",
                         .data           =       &ipv6_devconf.accept_ra,
                         .maxlen         =       sizeof(int),
@@ -4146,7 +4191,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_ACCEPT_REDIRECTS,
                         .procname       =       "accept_redirects",
                         .data           =       &ipv6_devconf.accept_redirects,
                         .maxlen         =       sizeof(int),
@@ -4154,7 +4198,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_AUTOCONF,
                         .procname       =       "autoconf",
                         .data           =       &ipv6_devconf.autoconf,
                         .maxlen         =       sizeof(int),
@@ -4162,7 +4205,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_DAD_TRANSMITS,
                         .procname       =       "dad_transmits",
                         .data           =       &ipv6_devconf.dad_transmits,
                         .maxlen         =       sizeof(int),
@@ -4170,7 +4212,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_RTR_SOLICITS,
                         .procname       =       "router_solicitations",
                         .data           =       &ipv6_devconf.rtr_solicits,
                         .maxlen         =       sizeof(int),
@@ -4178,25 +4219,20 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_RTR_SOLICIT_INTERVAL,
                         .procname       =       "router_solicitation_interval",
                         .data           =       &ipv6_devconf.rtr_solicit_interval,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
                         .proc_handler   =       proc_dointvec_jiffies,
-                        .strategy       =       sysctl_jiffies,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_RTR_SOLICIT_DELAY,
                         .procname       =       "router_solicitation_delay",
                         .data           =       &ipv6_devconf.rtr_solicit_delay,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
                         .proc_handler   =       proc_dointvec_jiffies,
-                        .strategy       =       sysctl_jiffies,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_FORCE_MLD_VERSION,
                         .procname       =       "force_mld_version",
                         .data           =       &ipv6_devconf.force_mld_version,
                         .maxlen         =       sizeof(int),
@@ -4205,7 +4241,6 @@ static struct addrconf_sysctl_table
                 },
 #ifdef CONFIG_IPV6_PRIVACY
                 {
-                        .ctl_name       =       NET_IPV6_USE_TEMPADDR,
                         .procname       =       "use_tempaddr",
                         .data           =       &ipv6_devconf.use_tempaddr,
                         .maxlen         =       sizeof(int),
@@ -4213,7 +4248,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_TEMP_VALID_LFT,
                         .procname       =       "temp_valid_lft",
                         .data           =       &ipv6_devconf.temp_valid_lft,
                         .maxlen         =       sizeof(int),
@@ -4221,7 +4255,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_TEMP_PREFERED_LFT,
                         .procname       =       "temp_prefered_lft",
                         .data           =       &ipv6_devconf.temp_prefered_lft,
                         .maxlen         =       sizeof(int),
@@ -4229,7 +4262,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_REGEN_MAX_RETRY,
                         .procname       =       "regen_max_retry",
                         .data           =       &ipv6_devconf.regen_max_retry,
                         .maxlen         =       sizeof(int),
@@ -4237,7 +4269,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_MAX_DESYNC_FACTOR,
                         .procname       =       "max_desync_factor",
                         .data           =       &ipv6_devconf.max_desync_factor,
                         .maxlen         =       sizeof(int),
@@ -4246,7 +4277,6 @@ static struct addrconf_sysctl_table
                 },
 #endif
                 {
-                        .ctl_name       =       NET_IPV6_MAX_ADDRESSES,
                         .procname       =       "max_addresses",
                         .data           =       &ipv6_devconf.max_addresses,
                         .maxlen         =       sizeof(int),
@@ -4254,7 +4284,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_DEFRTR,
                         .procname       =       "accept_ra_defrtr",
                         .data           =       &ipv6_devconf.accept_ra_defrtr,
                         .maxlen         =       sizeof(int),
@@ -4262,7 +4291,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_PINFO,
                         .procname       =       "accept_ra_pinfo",
                         .data           =       &ipv6_devconf.accept_ra_pinfo,
                         .maxlen         =       sizeof(int),
@@ -4271,7 +4299,6 @@ static struct addrconf_sysctl_table
                 },
 #ifdef CONFIG_IPV6_ROUTER_PREF
                 {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_RTR_PREF,
                         .procname       =       "accept_ra_rtr_pref",
                         .data           =       &ipv6_devconf.accept_ra_rtr_pref,
                         .maxlen         =       sizeof(int),
@@ -4279,17 +4306,14 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_RTR_PROBE_INTERVAL,
                         .procname       =       "router_probe_interval",
                         .data           =       &ipv6_devconf.rtr_probe_interval,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
                         .proc_handler   =       proc_dointvec_jiffies,
-                        .strategy       =       sysctl_jiffies,
                 },
 #ifdef CONFIG_IPV6_ROUTE_INFO
                 {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN,
                         .procname       =       "accept_ra_rt_info_max_plen",
                         .data           =       &ipv6_devconf.accept_ra_rt_info_max_plen,
                         .maxlen         =       sizeof(int),
@@ -4299,7 +4323,6 @@ static struct addrconf_sysctl_table
 #endif
 #endif
                 {
-                        .ctl_name       =       NET_IPV6_PROXY_NDP,
                         .procname       =       "proxy_ndp",
                         .data           =       &ipv6_devconf.proxy_ndp,
                         .maxlen         =       sizeof(int),
@@ -4307,7 +4330,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       NET_IPV6_ACCEPT_SOURCE_ROUTE,
                         .procname       =       "accept_source_route",
                         .data           =       &ipv6_devconf.accept_source_route,
                         .maxlen         =       sizeof(int),
@@ -4316,7 +4338,6 @@ static struct addrconf_sysctl_table
                 },
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
                 {
-                        .ctl_name       =       CTL_UNNUMBERED,
                         .procname       =       "optimistic_dad",
                         .data           =       &ipv6_devconf.optimistic_dad,
                         .maxlen         =       sizeof(int),
@@ -4327,7 +4348,6 @@ static struct addrconf_sysctl_table
 #endif
 #ifdef CONFIG_IPV6_MROUTE
                 {
-                        .ctl_name       =       CTL_UNNUMBERED,
                         .procname       =       "mc_forwarding",
                         .data           =       &ipv6_devconf.mc_forwarding,
                         .maxlen         =       sizeof(int),
@@ -4336,16 +4356,13 @@ static struct addrconf_sysctl_table
                 },
 #endif
                 {
-                        .ctl_name       =       CTL_UNNUMBERED,
                         .procname       =       "disable_ipv6",
                         .data           =       &ipv6_devconf.disable_ipv6,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
                         .proc_handler   =       addrconf_sysctl_disable,
-                        .strategy       =       sysctl_intvec,
                 },
                 {
-                        .ctl_name       =       CTL_UNNUMBERED,
                         .procname       =       "accept_dad",
                         .data           =       &ipv6_devconf.accept_dad,
                         .maxlen         =       sizeof(int),
@@ -4353,13 +4370,20 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
-                        .ctl_name       =       0,      /* sentinel */
+                        .procname       = "force_tllao",
+                        .data           = &ipv6_devconf.force_tllao,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec
+                },
+                {
+                        /* sentinel */
                 }
         },
 };
 
 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
-                int ctl_name, struct inet6_dev *idev, struct ipv6_devconf *p)
+                struct inet6_dev *idev, struct ipv6_devconf *p)
 {
         int i;
         struct addrconf_sysctl_table *t;
@@ -4367,9 +4391,9 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
 #define ADDRCONF_CTL_PATH_DEV   3
 
         struct ctl_path addrconf_ctl_path[] = {
-                { .procname = "net", .ctl_name = CTL_NET, },
-                { .procname = "ipv6", .ctl_name = NET_IPV6, },
-                { .procname = "conf", .ctl_name = NET_IPV6_CONF, },
+                { .procname = "net", },
+                { .procname = "ipv6", },
+                { .procname = "conf", },
                 { /* to be set */ },
                 { },
         };
@@ -4395,7 +4419,6 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
                 goto free;
 
         addrconf_ctl_path[ADDRCONF_CTL_PATH_DEV].procname = t->dev_name;
-        addrconf_ctl_path[ADDRCONF_CTL_PATH_DEV].ctl_name = ctl_name;
 
         t->sysctl_header = register_net_sysctl_table(net, addrconf_ctl_path,
                         t->addrconf_vars);
@@ -4429,12 +4452,10 @@ static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
 
 static void addrconf_sysctl_register(struct inet6_dev *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->nd_parms, NET_IPV6,
-                              NET_IPV6_NEIGH, "ipv6",
-                              &ndisc_ifinfo_sysctl_change,
-                              ndisc_ifinfo_sysctl_strategy);
+        neigh_sysctl_register(idev->dev, idev->nd_parms, "ipv6",
+                              &ndisc_ifinfo_sysctl_change);
         __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
-                        idev->dev->ifindex, idev, &idev->cnf);
+                                        idev, &idev->cnf);
 }
 
 static void addrconf_sysctl_unregister(struct inet6_dev *idev)
@@ -4446,7 +4467,7 @@ static void addrconf_sysctl_unregister(struct inet6_dev *idev)
 
 #endif
 
-static int addrconf_init_net(struct net *net)
+static int __net_init addrconf_init_net(struct net *net)
 {
         int err;
         struct ipv6_devconf *all, *dflt;
@@ -4455,7 +4476,7 @@ static int addrconf_init_net(struct net *net)
         all = &ipv6_devconf;
         dflt = &ipv6_devconf_dflt;
 
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
                 if (all == NULL)
                         goto err_alloc_all;
@@ -4473,13 +4494,11 @@ static int addrconf_init_net(struct net *net)
         net->ipv6.devconf_dflt = dflt;
 
 #ifdef CONFIG_SYSCTL
-        err = __addrconf_sysctl_register(net, "all", NET_PROTO_CONF_ALL,
-                        NULL, all);
+        err = __addrconf_sysctl_register(net, "all", NULL, all);
         if (err < 0)
                 goto err_reg_all;
 
-        err = __addrconf_sysctl_register(net, "default", NET_PROTO_CONF_DEFAULT,
-                        NULL, dflt);
+        err = __addrconf_sysctl_register(net, "default", NULL, dflt);
         if (err < 0)
                 goto err_reg_dflt;
 #endif
@@ -4497,13 +4516,13 @@ err_alloc_all:
         return err;
 }
 
-static void addrconf_exit_net(struct net *net)
+static void __net_exit addrconf_exit_net(struct net *net)
 {
 #ifdef CONFIG_SYSCTL
         __addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
         __addrconf_sysctl_unregister(net->ipv6.devconf_all);
 #endif
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 kfree(net->ipv6.devconf_dflt);
                 kfree(net->ipv6.devconf_all);
         }
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 3f82e9542eda..6b03826552e1 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -72,7 +72,7 @@ int __ipv6_addr_type(const struct in6_addr *addr)
                                 IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.3 */
         }
 
-        return (IPV6_ADDR_RESERVED |
+        return (IPV6_ADDR_UNICAST |
                 IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.4 */
 }
 EXPORT_SYMBOL(__ipv6_addr_type);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 6ff73c4c126a..ae404c9a746c 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -13,6 +13,7 @@
 #include <linux/list.h>
 #include <linux/rcupdate.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/addrconf.h>
 #include <linux/if_addrlabel.h>
 #include <linux/netlink.h>
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e127a32f9540..3f9e86b15e0d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -36,6 +36,7 @@
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -95,7 +96,8 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
         return (struct ipv6_pinfo *)(((u8 *)sk) + offset);
 }
 
-static int inet6_create(struct net *net, struct socket *sock, int protocol)
+static int inet6_create(struct net *net, struct socket *sock, int protocol,
+                        int kern)
 {
         struct inet_sock *inet;
         struct ipv6_pinfo *np;
@@ -158,7 +160,7 @@ lookup_protocol:
         }
 
         err = -EPERM;
-        if (answer->capability > 0 && !capable(answer->capability))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 goto out_rcu_unlock;
 
         sock->ops = answer->ops;
@@ -185,7 +187,7 @@ lookup_protocol:
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                 if (IPPROTO_RAW == protocol)
                         inet->hdrincl = 1;
         }
@@ -198,7 +200,7 @@ lookup_protocol:
 
         inet_sk(sk)->pinet6 = np = inet6_sk_generic(sk);
         np->hop_limit   = -1;
-        np->mcast_hops  = -1;
+        np->mcast_hops  = IPV6_DEFAULT_MCASTHOPS;
         np->mc_loop     = 1;
         np->pmtudisc    = IPV6_PMTUDISC_WANT;
         np->ipv6only    = net->ipv6.sysctl.bindv6only;
@@ -228,12 +230,12 @@ lookup_protocol:
          */
         sk_refcnt_debug_inc(sk);
 
-        if (inet->num) {
+        if (inet->inet_num) {
                 /* It assumes that any protocol which allows
                  * the user to assign a number at socket
                  * creation time automatically shares.
                  */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                 sk->sk_prot->hash(sk);
         }
         if (sk->sk_prot->init) {
@@ -281,7 +283,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         lock_sock(sk);
 
         /* Check these errors (active socket, double bind). */
-        if (sk->sk_state != TCP_CLOSE || inet->num) {
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num) {
                 err = -EINVAL;
                 goto out;
         }
@@ -314,6 +316,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 if (addr_type != IPV6_ADDR_ANY) {
                         struct net_device *dev = NULL;
 
+                        rcu_read_lock();
                         if (addr_type & IPV6_ADDR_LINKLOCAL) {
                                 if (addr_len >= sizeof(struct sockaddr_in6) &&
                                     addr->sin6_scope_id) {
@@ -326,12 +329,12 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                 /* Binding to link-local address requires an interface */
                                 if (!sk->sk_bound_dev_if) {
                                         err = -EINVAL;
-                                        goto out;
+                                        goto out_unlock;
                                 }
-                                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
+                                dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
                                 if (!dev) {
                                         err = -ENODEV;
-                                        goto out;
+                                        goto out_unlock;
                                 }
                         }
 
@@ -342,19 +345,16 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         if (!(addr_type & IPV6_ADDR_MULTICAST)) {
                                 if (!ipv6_chk_addr(net, &addr->sin6_addr,
                                                    dev, 0)) {
-                                        if (dev)
-                                                dev_put(dev);
                                         err = -EADDRNOTAVAIL;
-                                        goto out;
+                                        goto out_unlock;
                                 }
                         }
-                        if (dev)
-                                dev_put(dev);
+                        rcu_read_unlock();
                 }
         }
 
-        inet->rcv_saddr = v4addr;
-        inet->saddr = v4addr;
+        inet->inet_rcv_saddr = v4addr;
+        inet->inet_saddr = v4addr;
 
         ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
 
@@ -375,12 +375,15 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         }
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
-        inet->dport = 0;
-        inet->daddr = 0;
+        inet->inet_sport = htons(inet->inet_num);
+        inet->inet_dport = 0;
+        inet->inet_daddr = 0;
 out:
         release_sock(sk);
         return err;
+out_unlock:
+        rcu_read_unlock();
+        goto out;
 }
 
 EXPORT_SYMBOL(inet6_bind);
@@ -441,12 +444,12 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         sin->sin6_flowinfo = 0;
         sin->sin6_scope_id = 0;
         if (peer) {
-                if (!inet->dport)
+                if (!inet->inet_dport)
                         return -ENOTCONN;
                 if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                     peer == 1)
                         return -ENOTCONN;
-                sin->sin6_port = inet->dport;
+                sin->sin6_port = inet->inet_dport;
                 ipv6_addr_copy(&sin->sin6_addr, &np->daddr);
                 if (np->sndflow)
                         sin->sin6_flowinfo = np->flow_label;
@@ -456,7 +459,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                 else
                         ipv6_addr_copy(&sin->sin6_addr, &np->rcv_saddr);
 
-                sin->sin6_port = inet->sport;
+                sin->sin6_port = inet->inet_sport;
         }
         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                 sin->sin6_scope_id = sk->sk_bound_dev_if;
@@ -552,7 +555,7 @@ const struct proto_ops inet6_dgram_ops = {
 #endif
 };
 
-static struct net_proto_family inet6_family_ops = {
+static const struct net_proto_family inet6_family_ops = {
         .family = PF_INET6,
         .create = inet6_create,
         .owner  = THIS_MODULE,
@@ -654,8 +657,9 @@ int inet6_sk_rebuild_header(struct sock *sk)
                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                 fl.fl6_flowlabel = np->flow_label;
                 fl.oif = sk->sk_bound_dev_if;
-                fl.fl_ip_dport = inet->dport;
-                fl.fl_ip_sport = inet->sport;
+                fl.mark = sk->sk_mark;
+                fl.fl_ip_dport = inet->inet_dport;
+                fl.fl_ip_sport = inet->inet_sport;
                 security_sk_classify_flow(sk, &fl);
 
                 if (np->opt && np->opt->srcrt) {
@@ -968,41 +972,41 @@ static void ipv6_packet_cleanup(void)
 
 static int __net_init ipv6_init_mibs(struct net *net)
 {
-        if (snmp_mib_init((void **)net->mib.udp_stats_in6,
+        if (snmp_mib_init((void __percpu **)net->mib.udp_stats_in6,
                           sizeof (struct udp_mib)) < 0)
                 return -ENOMEM;
-        if (snmp_mib_init((void **)net->mib.udplite_stats_in6,
+        if (snmp_mib_init((void __percpu **)net->mib.udplite_stats_in6,
                           sizeof (struct udp_mib)) < 0)
                 goto err_udplite_mib;
-        if (snmp_mib_init((void **)net->mib.ipv6_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.ipv6_statistics,
                           sizeof(struct ipstats_mib)) < 0)
                 goto err_ip_mib;
-        if (snmp_mib_init((void **)net->mib.icmpv6_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.icmpv6_statistics,
                           sizeof(struct icmpv6_mib)) < 0)
                 goto err_icmp_mib;
-        if (snmp_mib_init((void **)net->mib.icmpv6msg_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.icmpv6msg_statistics,
                           sizeof(struct icmpv6msg_mib)) < 0)
                 goto err_icmpmsg_mib;
         return 0;
 
 err_icmpmsg_mib:
-        snmp_mib_free((void **)net->mib.icmpv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpv6_statistics);
 err_icmp_mib:
-        snmp_mib_free((void **)net->mib.ipv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.ipv6_statistics);
 err_ip_mib:
-        snmp_mib_free((void **)net->mib.udplite_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.udplite_stats_in6);
 err_udplite_mib:
-        snmp_mib_free((void **)net->mib.udp_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.udp_stats_in6);
         return -ENOMEM;
 }
 
-static void __net_exit ipv6_cleanup_mibs(struct net *net)
+static void ipv6_cleanup_mibs(struct net *net)
 {
-        snmp_mib_free((void **)net->mib.udp_stats_in6);
-        snmp_mib_free((void **)net->mib.udplite_stats_in6);
-        snmp_mib_free((void **)net->mib.ipv6_statistics);
-        snmp_mib_free((void **)net->mib.icmpv6_statistics);
-        snmp_mib_free((void **)net->mib.icmpv6msg_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udp_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.udplite_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.ipv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpv6msg_statistics);
 }
 
 static int __net_init inet6_net_init(struct net *net)
@@ -1039,7 +1043,7 @@ out:
 #endif
 }
 
-static void inet6_net_exit(struct net *net)
+static void __net_exit inet6_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
         udp6_proc_exit(net);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c1589e2f1dc9..ee82d4ef26ce 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -24,18 +24,93 @@
  *      This file is derived from net/ipv4/ah.c.
  */
 
+#include <crypto/hash.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
 #include <linux/string.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
+#define IPV6HDR_BASELEN 8
+
+struct tmp_ext {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                struct in6_addr saddr;
+#endif
+                struct in6_addr daddr;
+                char hdrs[0];
+};
+
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline struct tmp_ext *ah_tmp_ext(void *base)
+{
+        return base + IPV6HDR_BASELEN;
+}
+
+static inline u8 *ah_tmp_auth(u8 *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+
+        ahash_request_set_tfm(req, ahash);
+
+        return req;
+}
+
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
+
 static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 {
         u8 *opt = (u8 *)opthdr;
@@ -218,24 +293,85 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
         return 0;
 }
 
+static void ah6_output_done(struct crypto_async_request *base, int err)
+{
+        int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct ipv6hdr *top_iph = ipv6_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        struct tmp_ext *iph_ext;
+
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+
+        iph_base = AH_SKB_CB(skb)->tmp;
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahp->ahash, iph_ext, extlen);
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+
+        if (extlen) {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                memcpy(&top_iph->saddr, iph_ext, extlen);
+#else
+                memcpy(&top_iph->daddr, iph_ext, extlen);
+#endif
+        }
+
+        err = ah->nexthdr;
+
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        int nfrags;
         int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        u8 nexthdr;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct ipv6hdr *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        u8 nexthdr;
-        char tmp_base[8];
-        struct {
-#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                struct in6_addr saddr;
-#endif
-                struct in6_addr daddr;
-                char hdrs[0];
-        } *tmp_ext;
+        struct tmp_ext *iph_ext;
+
+        ahp = x->data;
+        ahash = ahp->ahash;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
 
         skb_push(skb, -skb_network_offset(skb));
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+
+        err = -ENOMEM;
+        iph_base = ah_alloc_tmp(ahash, nfrags, IPV6HDR_BASELEN + extlen);
+        if (!iph_base)
+                goto out;
+
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahash, iph_ext, extlen);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        ah = ip_auth_hdr(skb);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         top_iph = ipv6_hdr(skb);
         top_iph->payload_len = htons(skb->len - sizeof(*top_iph));
 
@@ -245,31 +381,22 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         /* When there are no extension headers, we only need to save the first
          * 8 bytes of the base IP header.
          */
-        memcpy(tmp_base, top_iph, sizeof(tmp_base));
+        memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
 
-        tmp_ext = NULL;
-        extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
         if (extlen) {
-                extlen += sizeof(*tmp_ext);
-                tmp_ext = kmalloc(extlen, GFP_ATOMIC);
-                if (!tmp_ext) {
-                        err = -ENOMEM;
-                        goto error;
-                }
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(tmp_ext, &top_iph->saddr, extlen);
+                memcpy(iph_ext, &top_iph->saddr, extlen);
 #else
-                memcpy(tmp_ext, &top_iph->daddr, extlen);
+                memcpy(iph_ext, &top_iph->daddr, extlen);
 #endif
                 err = ipv6_clear_mutable_options(top_iph,
-                                                 extlen - sizeof(*tmp_ext) +
+                                                 extlen - sizeof(*iph_ext) +
                                                  sizeof(*top_iph),
                                                  XFRM_POLICY_OUT);
                 if (err)
-                        goto error_free_iph;
+                        goto out_free;
         }
 
-        ah = ip_auth_hdr(skb);
         ah->nexthdr = nexthdr;
 
         top_iph->priority    = 0;
@@ -278,36 +405,80 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->flow_lbl[2] = 0;
         top_iph->hop_limit   = 0;
 
-        ahp = x->data;
         ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
 
-        spin_lock_bh(&x->lock);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-        if (err)
-                goto error_free_iph;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah6_output_done, skb);
+
+        AH_SKB_CB(skb)->tmp = iph_base;
 
-        memcpy(top_iph, tmp_base, sizeof(tmp_base));
-        if (tmp_ext) {
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+
+        if (extlen) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(&top_iph->saddr, tmp_ext, extlen);
+                memcpy(&top_iph->saddr, iph_ext, extlen);
 #else
-                memcpy(&top_iph->daddr, tmp_ext, extlen);
+                memcpy(&top_iph->daddr, iph_ext, extlen);
 #endif
-error_free_iph:
-                kfree(tmp_ext);
         }
 
-error:
+out_free:
+        kfree(iph_base);
+out:
         return err;
 }
 
+static void ah6_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int hdr_len = skb_network_header_len(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
+        __skb_pull(skb, ah_hlen + hdr_len);
+        skb_set_transport_header(skb, -hdr_len);
+
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
+
+
+
 static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         /*
@@ -325,14 +496,21 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
          * There is offset of AH before IPv6 header after the process.
          */
 
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct ip_auth_hdr *ah;
         struct ipv6hdr *ip6h;
         struct ah_data *ahp;
-        unsigned char *tmp_hdr = NULL;
         u16 hdr_len;
         u16 ah_hlen;
         int nexthdr;
-        int err = -EINVAL;
+        int nfrags;
+        int err = -ENOMEM;
 
         if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
                 goto out;
@@ -345,9 +523,11 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->ip_summed = CHECKSUM_NONE;
 
-        hdr_len = skb->data - skb_network_header(skb);
+        hdr_len = skb_network_header_len(skb);
         ah = (struct ip_auth_hdr *)skb->data;
         ahp = x->data;
+        ahash = ahp->ahash;
+
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
@@ -358,48 +538,67 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, ah_hlen))
                 goto out;
 
-        tmp_hdr = kmemdup(skb_network_header(skb), hdr_len, GFP_ATOMIC);
-        if (!tmp_hdr)
-                goto out;
         ip6h = ipv6_hdr(skb);
+
+        skb_push(skb, hdr_len);
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
+        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        memcpy(work_iph, ip6h, hdr_len);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
-                goto free_out;
+                goto out_free;
+
         ip6h->priority    = 0;
         ip6h->flow_lbl[0] = 0;
         ip6h->flow_lbl[1] = 0;
         ip6h->flow_lbl[2] = 0;
         ip6h->hop_limit   = 0;
 
-        spin_lock(&x->lock);
-        {
-                u8 auth_data[MAX_AH_AUTH_LEN];
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
-                memset(ah->auth_data, 0, ahp->icv_trunc_len);
-                skb_push(skb, hdr_len);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (err)
-                        goto unlock;
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
-                        err = -EBADMSG;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah6_input_done, skb);
+
+        AH_SKB_CB(skb)->tmp = work_iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
         }
-unlock:
-        spin_unlock(&x->lock);
 
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
         if (err)
-                goto free_out;
+                goto out_free;
 
         skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), tmp_hdr, hdr_len);
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
         skb->transport_header = skb->network_header;
         __skb_pull(skb, ah_hlen + hdr_len);
 
-        kfree(tmp_hdr);
+        err = nexthdr;
 
-        return nexthdr;
-
-free_out:
-        kfree(tmp_hdr);
+out_free:
+        kfree(work_iph);
 out:
         return err;
 }
@@ -416,7 +615,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
             type != ICMPV6_PKT_TOOBIG)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
         if (!x)
                 return;
 
@@ -430,7 +629,7 @@ static int ah6_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
 
         if (!x->aalg)
                 goto error;
@@ -442,12 +641,12 @@ static int ah6_init_state(struct xfrm_state *x)
         if (ahp == NULL)
                 return -ENOMEM;
 
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
+        if (IS_ERR(ahash))
                 goto error;
 
-        ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
+        ahp->ahash = ahash;
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
                                (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
@@ -461,22 +660,18 @@ static int ah6_init_state(struct xfrm_state *x)
         BUG_ON(!aalg_desc);
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
 
         ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-        ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
+        ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
 
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
 
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
-
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                           ahp->icv_trunc_len);
         switch (x->props.mode) {
@@ -495,8 +690,7 @@ static int ah6_init_state(struct xfrm_state *x)
 
 error:
         if (ahp) {
-                kfree(ahp->work_icv);
-                crypto_free_hash(ahp->tfm);
+                crypto_free_ahash(ahp->ahash);
                 kfree(ahp);
         }
         return -EINVAL;
@@ -509,8 +703,7 @@ static void ah6_destroy(struct xfrm_state *x)
         if (!ahp)
                 return;
 
-        kfree(ahp->work_icv);
-        crypto_free_hash(ahp->tfm);
+        crypto_free_ahash(ahp->ahash);
         kfree(ahp);
 }
 
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 1ae58bec1de0..b5b07054508a 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -29,6 +29,7 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -404,13 +405,13 @@ int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
 
         if (dev)
                 return ipv6_chk_acast_dev(dev, addr);
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev)
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev)
                 if (ipv6_chk_acast_dev(dev, addr)) {
                         found = 1;
                         break;
                 }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return found;
 }
 
@@ -431,9 +432,9 @@ static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)
         struct net *net = seq_file_net(seq);
 
         state->idev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                 if (!idev)
                         continue;
                 read_lock_bh(&idev->lock);
@@ -443,7 +444,6 @@ static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)
                         break;
                 }
                 read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
         }
         return im;
 }
@@ -454,16 +454,15 @@ static struct ifacaddr6 *ac6_get_next(struct seq_file *seq, struct ifacaddr6 *im
 
         im = im->aca_next;
         while (!im) {
-                if (likely(state->idev != NULL)) {
+                if (likely(state->idev != NULL))
                         read_unlock_bh(&state->idev->lock);
-                        in6_dev_put(state->idev);
-                }
-                state->dev = next_net_device(state->dev);
+
+                state->dev = next_net_device_rcu(state->dev);
                 if (!state->dev) {
                         state->idev = NULL;
                         break;
                 }
-                state->idev = in6_dev_get(state->dev);
+                state->idev = __in6_dev_get(state->dev);
                 if (!state->idev)
                         continue;
                 read_lock_bh(&state->idev->lock);
@@ -482,29 +481,30 @@ static struct ifacaddr6 *ac6_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *ac6_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return ac6_get_idx(seq, *pos);
 }
 
 static void *ac6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ifacaddr6 *im;
-        im = ac6_get_next(seq, v);
+        struct ifacaddr6 *im = ac6_get_next(seq, v);
+
         ++*pos;
         return im;
 }
 
 static void ac6_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
         struct ac6_iter_state *state = ac6_seq_private(seq);
+
         if (likely(state->idev != NULL)) {
                 read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
+                state->idev = NULL;
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int ac6_seq_show(struct seq_file *seq, void *v)
@@ -539,7 +539,7 @@ static const struct file_operations ac6_seq_fops = {
         .release        =       seq_release_net,
 };
 
-int ac6_proc_init(struct net *net)
+int __net_init ac6_proc_init(struct net *net)
 {
         if (!proc_net_fops_create(net, "anycast6", S_IRUGO, &ac6_seq_fops))
                 return -ENOMEM;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index e2bdc6d83a43..61573885e451 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -21,6 +21,7 @@
 #include <linux/in6.h>
 #include <linux/ipv6.h>
 #include <linux/route.h>
+#include <linux/slab.h>
 
 #include <net/ipv6.h>
 #include <net/ndisc.h>
@@ -98,17 +99,15 @@ ipv4_connected:
                 if (err)
                         goto out;
 
-                ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
+                ipv6_addr_set_v4mapped(inet->inet_daddr, &np->daddr);
 
-                if (ipv6_addr_any(&np->saddr)) {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000ffff),
-                                      inet->saddr);
-                }
+                if (ipv6_addr_any(&np->saddr))
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
+
+                if (ipv6_addr_any(&np->rcv_saddr))
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
+                                               &np->rcv_saddr);
 
-                if (ipv6_addr_any(&np->rcv_saddr)) {
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000ffff),
-                                      inet->rcv_saddr);
-                }
                 goto out;
         }
 
@@ -136,7 +135,7 @@ ipv4_connected:
         ipv6_addr_copy(&np->daddr, daddr);
         np->flow_label = fl.fl6_flowlabel;
 
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
 
         /*
          *      Check for a route to destination an obtain the
@@ -147,8 +146,9 @@ ipv4_connected:
         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
         fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_dport = inet->dport;
-        fl.fl_ip_sport = inet->sport;
+        fl.mark = sk->sk_mark;
+        fl.fl_ip_dport = inet->inet_dport;
+        fl.fl_ip_sport = inet->inet_sport;
 
         if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
                 fl.oif = np->mcast_oif;
@@ -190,7 +190,7 @@ ipv4_connected:
 
         if (ipv6_addr_any(&np->rcv_saddr)) {
                 ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
-                inet->rcv_saddr = LOOPBACK4_IPV6;
+                inet->inet_rcv_saddr = LOOPBACK4_IPV6;
         }
 
         ip6_dst_store(sk, dst,
@@ -222,6 +222,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
         if (!skb)
                 return;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         serr = SKB_EXT_ERR(skb);
         serr->ee.ee_errno = err;
         serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
@@ -255,6 +257,8 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         if (!skb)
                 return;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         skb_put(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         iph = ipv6_hdr(skb);
@@ -319,7 +323,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_flowinfo = 0;
                 sin->sin6_port = serr->port;
                 sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                         ipv6_addr_copy(&sin->sin6_addr,
                                   (struct in6_addr *)(nh + serr->addr_offset));
                         if (np->sndflow)
@@ -329,9 +333,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                 sin->sin6_scope_id = IP6CB(skb)->iif;
                 } else {
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
-                                      htonl(0xffff),
-                                      *(__be32 *)(nh + serr->addr_offset));
+                        ipv6_addr_set_v4mapped(*(__be32 *)(nh + serr->addr_offset),
+                                               &sin->sin6_addr);
                 }
         }
 
@@ -342,7 +345,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
                 sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                         ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr);
                         if (np->rxopt.all)
                                 datagram_recv_ctl(sk, msg, skb);
@@ -351,8 +354,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 } else {
                         struct inet_sock *inet = inet_sk(sk);
 
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
+                                               &sin->sin6_addr);
                         if (inet->cmsg_flags)
                                 ip_cmsg_recv(msg, skb);
                 }
@@ -539,12 +542,17 @@ int datagram_send_ctl(struct net *net,
 
                         addr_type = __ipv6_addr_type(&src_info->ipi6_addr);
 
+                        rcu_read_lock();
                         if (fl->oif) {
-                                dev = dev_get_by_index(net, fl->oif);
-                                if (!dev)
+                                dev = dev_get_by_index_rcu(net, fl->oif);
+                                if (!dev) {
+                                        rcu_read_unlock();
                                         return -ENODEV;
-                        } else if (addr_type & IPV6_ADDR_LINKLOCAL)
+                                }
+                        } else if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                                rcu_read_unlock();
                                 return -EINVAL;
+                        }
 
                         if (addr_type != IPV6_ADDR_ANY) {
                                 int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
@@ -555,8 +563,7 @@ int datagram_send_ctl(struct net *net,
                                         ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
                         }
 
-                        if (dev)
-                                dev_put(dev);
+                        rcu_read_unlock();
 
                         if (err)
                                 goto exit_f;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index af597c73ebe9..ee9b93bdd6a2 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -365,7 +365,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
             type != ICMPV6_PKT_TOOBIG)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
         printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
@@ -473,7 +473,7 @@ static int esp_init_authenc(struct xfrm_state *x)
                 }
 
                 err = crypto_aead_setauthsize(
-                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                        aead, x->aalg->alg_trunc_len / 8);
                 if (err)
                         goto free_key;
         }
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index df159fffe4bc..8a659f92d17a 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -29,6 +29,7 @@
 #include <linux/netdevice.h>
 #include <linux/in6.h>
 #include <linux/icmpv6.h>
+#include <linux/slab.h>
 
 #include <net/dst.h>
 #include <net/sock.h>
@@ -481,7 +482,7 @@ looped_back:
                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
                                          IPSTATS_MIB_INHDRERRORS);
                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
-                                    0, skb->dev);
+                                    0);
                         kfree_skb(skb);
                         return -1;
                 }
@@ -559,6 +560,11 @@ static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 }
 
+static inline struct net *ipv6_skb_net(struct sk_buff *skb)
+{
+        return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
+}
+
 /* Router Alert as of RFC 2711 */
 
 static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
@@ -580,8 +586,8 @@ static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 {
         const unsigned char *nh = skb_network_header(skb);
+        struct net *net = ipv6_skb_net(skb);
         u32 pkt_len;
-        struct net *net = dev_net(skb_dst(skb)->dev);
 
         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 00a7a5e4ac97..5e463c43fcc2 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -84,18 +84,11 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                 if ((rule->flags & FIB_RULE_FIND_SADDR) &&
                     r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
                         struct in6_addr saddr;
-                        unsigned int srcprefs = 0;
-
-                        if (flags & RT6_LOOKUP_F_SRCPREF_TMP)
-                                srcprefs |= IPV6_PREFER_SRC_TMP;
-                        if (flags & RT6_LOOKUP_F_SRCPREF_PUBLIC)
-                                srcprefs |= IPV6_PREFER_SRC_PUBLIC;
-                        if (flags & RT6_LOOKUP_F_SRCPREF_COA)
-                                srcprefs |= IPV6_PREFER_SRC_COA;
 
                         if (ipv6_dev_get_saddr(net,
                                                ip6_dst_idev(&rt->u.dst)->dev,
-                                               &flp->fl6_dst, srcprefs,
+                                               &flp->fl6_dst,
+                                               rt6_flags2srcprefs(flags),
                                                &saddr))
                                 goto again;
                         if (!ipv6_prefix_equal(&saddr, &r->src.addr,
@@ -262,46 +255,38 @@ static struct fib_rules_ops fib6_rules_ops_template = {
         .fro_net                = &init_net,
 };
 
-static int fib6_rules_net_init(struct net *net)
+static int __net_init fib6_rules_net_init(struct net *net)
 {
+        struct fib_rules_ops *ops;
         int err = -ENOMEM;
 
-        net->ipv6.fib6_rules_ops = kmemdup(&fib6_rules_ops_template,
-                                           sizeof(*net->ipv6.fib6_rules_ops),
-                                           GFP_KERNEL);
-        if (!net->ipv6.fib6_rules_ops)
-                goto out;
+        ops = fib_rules_register(&fib6_rules_ops_template, net);
+        if (IS_ERR(ops))
+                return PTR_ERR(ops);
+        net->ipv6.fib6_rules_ops = ops;
 
-        net->ipv6.fib6_rules_ops->fro_net = net;
-        INIT_LIST_HEAD(&net->ipv6.fib6_rules_ops->rules_list);
 
         err = fib_default_rule_add(net->ipv6.fib6_rules_ops, 0,
-                                   RT6_TABLE_LOCAL, FIB_RULE_PERMANENT);
+                                   RT6_TABLE_LOCAL, 0);
         if (err)
                 goto out_fib6_rules_ops;
 
         err = fib_default_rule_add(net->ipv6.fib6_rules_ops,
                                    0x7FFE, RT6_TABLE_MAIN, 0);
         if (err)
-                goto out_fib6_default_rule_add;
+                goto out_fib6_rules_ops;
 
-        err = fib_rules_register(net->ipv6.fib6_rules_ops);
-        if (err)
-                goto out_fib6_default_rule_add;
 out:
         return err;
 
-out_fib6_default_rule_add:
-        fib_rules_cleanup_ops(net->ipv6.fib6_rules_ops);
 out_fib6_rules_ops:
-        kfree(net->ipv6.fib6_rules_ops);
+        fib_rules_unregister(ops);
         goto out;
 }
 
-static void fib6_rules_net_exit(struct net *net)
+static void __net_exit fib6_rules_net_exit(struct net *net)
 {
         fib_rules_unregister(net->ipv6.fib6_rules_ops);
-        kfree(net->ipv6.fib6_rules_ops);
 }
 
 static struct pernet_operations fib6_rules_net_ops = {
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index f23ebbec0631..3330a4bd6157 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -40,6 +40,7 @@
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
@@ -67,11 +68,6 @@
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
-DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics) __read_mostly;
-EXPORT_SYMBOL(icmpv6_statistics);
-DEFINE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg_statistics) __read_mostly;
-EXPORT_SYMBOL(icmpv6msg_statistics);
-
 /*
  *      The ICMP socket(s). This is the most convenient way to flow control
  *      our ICMP output as well as maintain a clean interface throughout
@@ -119,7 +115,7 @@ static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
  */
 void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 {
-        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos, skb->dev);
+        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos);
         kfree_skb(skb);
 }
 
@@ -305,8 +301,7 @@ static inline void mip6_addr_swap(struct sk_buff *skb) {}
 /*
  *      Send an ICMP message in response to a packet in error
  */
-void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
-                 struct net_device *dev)
+void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 {
         struct net *net = dev_net(skb->dev);
         struct inet6_dev *idev = NULL;
@@ -942,18 +937,16 @@ EXPORT_SYMBOL(icmpv6_err_convert);
 #ifdef CONFIG_SYSCTL
 ctl_table ipv6_icmp_table_template[] = {
         {
-                .ctl_name       = NET_IPV6_ICMP_RATELIMIT,
                 .procname       = "ratelimit",
                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_ms_jiffies,
-                .strategy       = sysctl_ms_jiffies
         },
-        { .ctl_name = 0 },
+        { },
 };
 
-struct ctl_table *ipv6_icmp_sysctl_init(struct net *net)
+struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
 {
         struct ctl_table *table;
 
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index cc4797dd8325..628db24bcf22 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -17,6 +17,7 @@
 #include <linux/in6.h>
 #include <linux/ipv6.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 
 #include <net/addrconf.h>
 #include <net/inet_connection_sock.h>
@@ -132,7 +133,7 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
 
         sin6->sin6_family = AF_INET6;
         ipv6_addr_copy(&sin6->sin6_addr, &np->daddr);
-        sin6->sin6_port = inet_sk(sk)->dport;
+        sin6->sin6_port = inet_sk(sk)->inet_dport;
         /* We do not store received flowlabel for TCP */
         sin6->sin6_flowinfo = 0;
         sin6->sin6_scope_id = 0;
@@ -168,8 +169,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
         if (dst) {
                 struct rt6_info *rt = (struct rt6_info *)dst;
                 if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-                        sk->sk_dst_cache = NULL;
-                        dst_release(dst);
+                        __sk_dst_reset(sk);
                         dst = NULL;
                 }
         }
@@ -194,8 +194,9 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
         fl.fl6_flowlabel = np->flow_label;
         IP6_ECN_flow_xmit(sk, fl.fl6_flowlabel);
         fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_sport = inet->sport;
-        fl.fl_ip_dport = inet->dport;
+        fl.mark = sk->sk_mark;
+        fl.fl_ip_sport = inet->inet_sport;
+        fl.fl_ip_dport = inet->inet_dport;
         security_sk_classify_flow(sk, &fl);
 
         if (np->opt && np->opt->srcrt) {
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1bcc3431859e..633a6c266136 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -22,9 +22,10 @@
 #include <net/inet6_hashtables.h>
 #include <net/ip.h>
 
-void __inet6_hash(struct sock *sk)
+int __inet6_hash(struct sock *sk, struct inet_timewait_sock *tw)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
+        int twrefcnt = 0;
 
         WARN_ON(!sk_unhashed(sk));
 
@@ -45,10 +46,15 @@ void __inet6_hash(struct sock *sk)
                 lock = inet_ehash_lockp(hashinfo, hash);
                 spin_lock(lock);
                 __sk_nulls_add_node_rcu(sk, list);
+                if (tw) {
+                        WARN_ON(sk->sk_hash != tw->tw_hash);
+                        twrefcnt = inet_twsk_unhash(tw);
+                }
                 spin_unlock(lock);
         }
 
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        return twrefcnt;
 }
 EXPORT_SYMBOL(__inet6_hash);
 
@@ -73,7 +79,7 @@ struct sock *__inet6_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
 
@@ -125,7 +131,7 @@ static int inline compute_score(struct sock *sk, struct net *net,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet_sk(sk)->inet_num == hnum &&
             sk->sk_family == PF_INET6) {
                 const struct ipv6_pinfo *np = inet6_sk(sk);
 
@@ -214,15 +220,16 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
         const int dif = sk->sk_bound_dev_if;
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
         const unsigned int hash = inet6_ehashfn(net, daddr, lport, saddr,
-                                                inet->dport);
+                                                inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
+        int twrefcnt = 0;
 
         spin_lock(lock);
 
@@ -248,21 +255,25 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
+        sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
-        sk->sk_hash = hash;
+        if (tw) {
+                twrefcnt = inet_twsk_unhash(tw);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        }
         spin_unlock(lock);
+        if (twrefcnt)
+                inet_twsk_put(tw);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
 
-        if (twp != NULL) {
+        if (twp) {
                 *twp = tw;
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
-        } else if (tw != NULL) {
+        } else if (tw) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
@@ -279,7 +290,7 @@ static inline u32 inet6_sk_port_offset(const struct sock *sk)
         const struct ipv6_pinfo *np = inet6_sk(sk);
         return secure_ipv6_port_ephemeral(np->rcv_saddr.s6_addr32,
                                           np->daddr.s6_addr32,
-                                          inet->dport);
+                                          inet->inet_dport);
 }
 
 int inet6_hash_connect(struct inet_timewait_death_row *death_row,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 0e93ca56eb69..6b82e02158c6 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -26,6 +26,7 @@
 #include <linux/in6.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 
 #ifdef  CONFIG_PROC_FS
 #include <linux/proc_fs.h>
@@ -93,29 +94,20 @@ static __u32 rt_sernum;
 
 static void fib6_gc_timer_cb(unsigned long arg);
 
-static struct fib6_walker_t fib6_walker_list = {
-        .prev   = &fib6_walker_list,
-        .next   = &fib6_walker_list,
-};
-
-#define FOR_WALKERS(w) for ((w)=fib6_walker_list.next; (w) != &fib6_walker_list; (w)=(w)->next)
+static LIST_HEAD(fib6_walkers);
+#define FOR_WALKERS(w) list_for_each_entry(w, &fib6_walkers, lh)
 
 static inline void fib6_walker_link(struct fib6_walker_t *w)
 {
         write_lock_bh(&fib6_walker_lock);
-        w->next = fib6_walker_list.next;
-        w->prev = &fib6_walker_list;
-        w->next->prev = w;
-        w->prev->next = w;
+        list_add(&w->lh, &fib6_walkers);
         write_unlock_bh(&fib6_walker_lock);
 }
 
 static inline void fib6_walker_unlink(struct fib6_walker_t *w)
 {
         write_lock_bh(&fib6_walker_lock);
-        w->next->prev = w->prev;
-        w->prev->next = w->next;
-        w->prev = w->next = w;
+        list_del(&w->lh);
         write_unlock_bh(&fib6_walker_lock);
 }
 static __inline__ u32 fib6_new_sernum(void)
@@ -239,7 +231,7 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
         return NULL;
 }
 
-static void fib6_tables_init(struct net *net)
+static void __net_init fib6_tables_init(struct net *net)
 {
         fib6_link_table(net, net->ipv6.fib6_main_tbl);
         fib6_link_table(net, net->ipv6.fib6_local_tbl);
@@ -262,7 +254,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
         return (struct dst_entry *) lookup(net, net->ipv6.fib6_main_tbl, fl, flags);
 }
 
-static void fib6_tables_init(struct net *net)
+static void __net_init fib6_tables_init(struct net *net)
 {
         fib6_link_table(net, net->ipv6.fib6_main_tbl);
 }
@@ -319,12 +311,26 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
         w->root = &table->tb6_root;
 
         if (cb->args[4] == 0) {
+                w->count = 0;
+                w->skip = 0;
+
                 read_lock_bh(&table->tb6_lock);
                 res = fib6_walk(w);
                 read_unlock_bh(&table->tb6_lock);
-                if (res > 0)
+                if (res > 0) {
                         cb->args[4] = 1;
+                        cb->args[5] = w->root->fn_sernum;
+                }
         } else {
+                if (cb->args[5] != w->root->fn_sernum) {
+                        /* Begin at the root if the tree changed */
+                        cb->args[5] = w->root->fn_sernum;
+                        w->state = FWS_INIT;
+                        w->node = w->root;
+                        w->skip = w->count;
+                } else
+                        w->skip = 0;
+
                 read_lock_bh(&table->tb6_lock);
                 res = fib6_walk_continue(w);
                 read_unlock_bh(&table->tb6_lock);
@@ -1250,9 +1256,18 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                         w->leaf = fn->leaf;
                 case FWS_C:
                         if (w->leaf && fn->fn_flags&RTN_RTINFO) {
-                                int err = w->func(w);
+                                int err;
+
+                                if (w->count < w->skip) {
+                                        w->count++;
+                                        continue;
+                                }
+
+                                err = w->func(w);
                                 if (err)
                                         return err;
+
+                                w->count++;
                                 continue;
                         }
                         w->state = FWS_U;
@@ -1346,6 +1361,8 @@ static void fib6_clean_tree(struct net *net, struct fib6_node *root,
         c.w.root = root;
         c.w.func = fib6_clean_node;
         c.w.prune = prune;
+        c.w.count = 0;
+        c.w.skip = 0;
         c.func = func;
         c.arg = arg;
         c.net = net;
@@ -1469,7 +1486,7 @@ static void fib6_gc_timer_cb(unsigned long arg)
         fib6_run_gc(0, (struct net *)arg);
 }
 
-static int fib6_net_init(struct net *net)
+static int __net_init fib6_net_init(struct net *net)
 {
         setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
 
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 7712578bdc66..14e23216eb28 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -20,6 +20,7 @@
 #include <linux/route.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -67,7 +68,7 @@ static inline struct ip6_flowlabel *__fl_lookup(struct net *net, __be32 label)
         struct ip6_flowlabel *fl;
 
         for (fl=fl_ht[FL_HASH(label)]; fl; fl = fl->next) {
-                if (fl->label == label && fl->fl_net == net)
+                if (fl->label == label && net_eq(fl->fl_net, net))
                         return fl;
         }
         return NULL;
@@ -154,7 +155,7 @@ static void ip6_fl_gc(unsigned long dummy)
         write_unlock(&ip6_fl_lock);
 }
 
-static void ip6_fl_purge(struct net *net)
+static void __net_exit ip6_fl_purge(struct net *net)
 {
         int i;
 
@@ -163,7 +164,8 @@ static void ip6_fl_purge(struct net *net)
                 struct ip6_flowlabel *fl, **flp;
                 flp = &fl_ht[i];
                 while ((fl = *flp) != NULL) {
-                        if (fl->fl_net == net && atomic_read(&fl->users) == 0) {
+                        if (net_eq(fl->fl_net, net) &&
+                            atomic_read(&fl->users) == 0) {
                                 *flp = fl->next;
                                 fl_free(fl);
                                 atomic_dec(&fl_size);
@@ -377,8 +379,8 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                 goto done;
         fl->share = freq->flr_share;
         addr_type = ipv6_addr_type(&freq->flr_dst);
-        if ((addr_type&IPV6_ADDR_MAPPED)
-            || addr_type == IPV6_ADDR_ANY) {
+        if ((addr_type & IPV6_ADDR_MAPPED) ||
+            addr_type == IPV6_ADDR_ANY) {
                 err = -EINVAL;
                 goto done;
         }
@@ -421,8 +423,8 @@ static int mem_check(struct sock *sk)
 
         if (room <= 0 ||
             ((count >= FL_MAX_PER_SOCK ||
-             (count > 0 && room < FL_MAX_SIZE/2) || room < FL_MAX_SIZE/4)
-             && !capable(CAP_NET_ADMIN)))
+              (count > 0 && room < FL_MAX_SIZE/2) || room < FL_MAX_SIZE/4) &&
+             !capable(CAP_NET_ADMIN)))
                 return -ENOBUFS;
 
         return 0;
@@ -630,7 +632,7 @@ static struct ip6_flowlabel *ip6fl_get_first(struct seq_file *seq)
         for (state->bucket = 0; state->bucket <= FL_HASH_MASK; ++state->bucket) {
                 fl = fl_ht[state->bucket];
 
-                while (fl && fl->fl_net != net)
+                while (fl && !net_eq(fl->fl_net, net))
                         fl = fl->next;
                 if (fl)
                         break;
@@ -645,7 +647,7 @@ static struct ip6_flowlabel *ip6fl_get_next(struct seq_file *seq, struct ip6_flo
 
         fl = fl->next;
 try_again:
-        while (fl && fl->fl_net != net)
+        while (fl && !net_eq(fl->fl_net, net))
                 fl = fl->next;
 
         while (!fl) {
@@ -734,7 +736,7 @@ static const struct file_operations ip6fl_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int ip6_flowlabel_proc_init(struct net *net)
+static int __net_init ip6_flowlabel_proc_init(struct net *net)
 {
         if (!proc_net_fops_create(net, "ip6_flowlabel",
                                   S_IRUGO, &ip6fl_seq_fops))
@@ -742,7 +744,7 @@ static int ip6_flowlabel_proc_init(struct net *net)
         return 0;
 }
 
-static void ip6_flowlabel_proc_fini(struct net *net)
+static void __net_exit ip6_flowlabel_proc_fini(struct net *net)
 {
         proc_net_remove(net, "ip6_flowlabel");
 }
@@ -753,11 +755,10 @@ static inline int ip6_flowlabel_proc_init(struct net *net)
 }
 static inline void ip6_flowlabel_proc_fini(struct net *net)
 {
-        return ;
 }
 #endif
 
-static inline void ip6_flowlabel_net_exit(struct net *net)
+static void __net_exit ip6_flowlabel_net_exit(struct net *net)
 {
         ip6_fl_purge(net);
         ip6_flowlabel_proc_fini(net);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 237e2dba6e94..6aa7ee1295c2 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -28,6 +28,7 @@
 #include <linux/in6.h>
 #include <linux/icmpv6.h>
 #include <linux/mroute6.h>
+#include <linux/slab.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -216,8 +217,7 @@ resubmit:
                                 IP6_INC_STATS_BH(net, idev,
                                                  IPSTATS_MIB_INUNKNOWNPROTOS);
                                 icmpv6_send(skb, ICMPV6_PARAMPROB,
-                                            ICMPV6_UNK_NEXTHDR, nhoff,
-                                            skb->dev);
+                                            ICMPV6_UNK_NEXTHDR, nhoff);
                         }
                 } else
                         IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDELIVERS);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index cd48801a8d6f..75d5ef830097 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -37,6 +37,7 @@
 #include <linux/tcp.h>
 #include <linux/route.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -107,7 +108,7 @@ static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
 
-        netif_rx(newskb);
+        netif_rx_ni(newskb);
         return 0;
 }
 
@@ -121,10 +122,9 @@ static int ip6_output2(struct sk_buff *skb)
         skb->dev = dev;
 
         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
-                struct ipv6_pinfo* np = skb->sk ? inet6_sk(skb->sk) : NULL;
                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 
-                if (!(dev->flags & IFF_LOOPBACK) && (!np || np->mc_loop) &&
+                if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
                     ((mroute6_socket(dev_net(dev)) &&
                      !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
                      ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
@@ -268,7 +268,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         if (net_ratelimit())
                 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
         skb->dev = dst->dev;
-        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
         kfree_skb(skb);
         return -EMSGSIZE;
@@ -403,6 +403,7 @@ int ip6_forward(struct sk_buff *skb)
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct net *net = dev_net(dst->dev);
+        u32 mtu;
 
         if (net->ipv6.devconf_all->forwarding == 0)
                 goto error;
@@ -442,8 +443,7 @@ int ip6_forward(struct sk_buff *skb)
         if (hdr->hop_limit <= 1) {
                 /* Force OUTPUT device used as source address */
                 skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
-                            0, skb->dev);
+                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
                 IP6_INC_STATS_BH(net,
                                  ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 
@@ -505,15 +505,19 @@ int ip6_forward(struct sk_buff *skb)
                         goto error;
                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
-                                ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
+                                    ICMPV6_NOT_NEIGHBOUR, 0);
                         goto error;
                 }
         }
 
-        if (skb->len > dst_mtu(dst)) {
+        mtu = dst_mtu(dst);
+        if (mtu < IPV6_MIN_MTU)
+                mtu = IPV6_MIN_MTU;
+
+        if (skb->len > mtu) {
                 /* Again, force OUTPUT device used as source address */
                 skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, dst_mtu(dst), skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS_BH(net,
                                  ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
                 IP6_INC_STATS_BH(net,
@@ -623,12 +627,11 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         mtu = ip6_skb_dst_mtu(skb);
 
         /* We must not fragment if the socket is set to force MTU discovery
-         * or if the skb it not generated by a local socket.  (This last
-         * check should be redundant, but it's free.)
+         * or if the skb it not generated by a local socket.
          */
-        if (!skb->local_df) {
+        if (!skb->local_df && skb->len > mtu) {
                 skb->dev = skb_dst(skb)->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                               IPSTATS_MIB_FRAGFAILS);
                 kfree_skb(skb);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index c595bbe1ed99..2599870747ec 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -37,6 +37,7 @@
 #include <linux/route.h>
 #include <linux/rtnetlink.h>
 #include <linux/netfilter_ipv6.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/atomic.h>
@@ -74,11 +75,10 @@ MODULE_LICENSE("GPL");
                      (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
                     (HASH_SIZE - 1))
 
-static void ip6_fb_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_setup(struct net_device *dev);
 
-static int ip6_tnl_net_id;
+static int ip6_tnl_net_id __read_mostly;
 struct ip6_tnl_net {
         /* the IPv6 tunnel fallback device */
         struct net_device *fb_tnl_dev;
@@ -88,8 +88,10 @@ struct ip6_tnl_net {
         struct ip6_tnl **tnls[2];
 };
 
-/* lock for the tunnel lists */
-static DEFINE_RWLOCK(ip6_tnl_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ip6_tnl_lock);
 
 static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
@@ -130,6 +132,9 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
  *   else %NULL
  **/
 
+#define for_each_ip6_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
 {
@@ -138,13 +143,14 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        for (t = ip6n->tnls_r_l[h0 ^ h1]; t; t = t->next) {
+        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[h0 ^ h1]) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        if ((t = ip6n->tnls_wc[0]) != NULL && (t->dev->flags & IFF_UP))
+        t = rcu_dereference(ip6n->tnls_wc[0]);
+        if (t && (t->dev->flags & IFF_UP))
                 return t;
 
         return NULL;
@@ -186,10 +192,10 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
         struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
 
+        spin_lock_bh(&ip6_tnl_lock);
         t->next = *tp;
-        write_lock_bh(&ip6_tnl_lock);
-        *tp = t;
-        write_unlock_bh(&ip6_tnl_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ip6_tnl_lock);
 }
 
 /**
@@ -204,9 +210,9 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 
         for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ip6_tnl_lock);
+                        spin_lock_bh(&ip6_tnl_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ip6_tnl_lock);
+                        spin_unlock_bh(&ip6_tnl_lock);
                         break;
                 }
         }
@@ -313,9 +319,9 @@ ip6_tnl_dev_uninit(struct net_device *dev)
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         if (dev == ip6n->fb_tnl_dev) {
-                write_lock_bh(&ip6_tnl_lock);
+                spin_lock_bh(&ip6_tnl_lock);
                 ip6n->tnls_wc[0] = NULL;
-                write_unlock_bh(&ip6_tnl_lock);
+                spin_unlock_bh(&ip6_tnl_lock);
         } else {
                 ip6_tnl_unlink(ip6n, t);
         }
@@ -409,7 +415,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
            in trouble since we might need the source address for further
            processing of the error. */
 
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
         if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
                                         &ipv6h->saddr)) == NULL)
                 goto out;
@@ -482,7 +488,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
         *msg = rel_msg;
 
 out:
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -617,7 +623,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (rt && rt->rt6i_dev)
                         skb2->dev = rt->rt6i_dev;
 
-                icmpv6_send(skb2, rel_type, rel_code, rel_info, skb2->dev);
+                icmpv6_send(skb2, rel_type, rel_code, rel_info);
 
                 if (rt)
                         dst_release(&rt->u.dst);
@@ -652,6 +658,7 @@ static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
                 IP6_ECN_set_ce(ipv6_hdr(skb));
 }
 
+/* called with rcu_read_lock() */
 static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
 {
         struct ip6_tnl_parm *p = &t->parms;
@@ -662,15 +669,13 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
                 struct net_device *ldev = NULL;
 
                 if (p->link)
-                        ldev = dev_get_by_index(net, p->link);
+                        ldev = dev_get_by_index_rcu(net, p->link);
 
                 if ((ipv6_addr_is_multicast(&p->laddr) ||
                      likely(ipv6_chk_addr(net, &p->laddr, ldev, 0))) &&
                     likely(!ipv6_chk_addr(net, &p->raddr, NULL, 0)))
                         ret = 1;
 
-                if (ldev)
-                        dev_put(ldev);
         }
         return ret;
 }
@@ -693,23 +698,23 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
         struct ip6_tnl *t;
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
 
         if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
                                         &ipv6h->daddr)) != NULL) {
                 if (t->parms.proto != ipproto && t->parms.proto != 0) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                         goto discard;
                 }
 
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                         goto discard;
                 }
 
                 if (!ip6_tnl_rcv_ctl(t)) {
                         t->dev->stats.rx_dropped++;
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                         goto discard;
                 }
                 secpath_reset(skb);
@@ -727,10 +732,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 t->dev->stats.rx_packets++;
                 t->dev->stats.rx_bytes += skb->len;
                 netif_rx(skb);
-                read_unlock(&ip6_tnl_lock);
+                rcu_read_unlock();
                 return 0;
         }
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
         return 1;
 
 discard:
@@ -798,8 +803,9 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
         if (p->flags & IP6_TNL_F_CAP_XMIT) {
                 struct net_device *ldev = NULL;
 
+                rcu_read_lock();
                 if (p->link)
-                        ldev = dev_get_by_index(net, p->link);
+                        ldev = dev_get_by_index_rcu(net, p->link);
 
                 if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
                         printk(KERN_WARNING
@@ -813,8 +819,7 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
                                p->name);
                 else
                         ret = 1;
-                if (ldev)
-                        dev_put(ldev);
+                rcu_read_unlock();
         }
         return ret;
 }
@@ -1010,7 +1015,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
                 if (tel->encap_limit == 0) {
                         icmpv6_send(skb, ICMPV6_PARAMPROB,
-                                    ICMPV6_HDR_FIELD, offset + 2, skb->dev);
+                                    ICMPV6_HDR_FIELD, offset + 2);
                         return -1;
                 }
                 encap_limit = tel->encap_limit - 1;
@@ -1029,7 +1034,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
         if (err != 0) {
                 if (err == -EMSGSIZE)
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 return -1;
         }
 
@@ -1359,7 +1364,7 @@ static void ip6_tnl_dev_init(struct net_device *dev)
  * Return: 0
  **/
 
-static void ip6_fb_tnl_dev_init(struct net_device *dev)
+static void __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
         struct net *net = dev_net(dev);
@@ -1383,33 +1388,29 @@ static struct xfrm6_tunnel ip6ip6_handler = {
         .priority       =       1,
 };
 
-static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
+static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 {
         int h;
         struct ip6_tnl *t;
+        LIST_HEAD(list);
 
         for (h = 0; h < HASH_SIZE; h++) {
-                while ((t = ip6n->tnls_r_l[h]) != NULL)
-                        unregister_netdevice(t->dev);
+                t = ip6n->tnls_r_l[h];
+                while (t != NULL) {
+                        unregister_netdevice_queue(t->dev, &list);
+                        t = t->next;
+                }
         }
 
         t = ip6n->tnls_wc[0];
-        unregister_netdevice(t->dev);
+        unregister_netdevice_queue(t->dev, &list);
+        unregister_netdevice_many(&list);
 }
 
-static int ip6_tnl_init_net(struct net *net)
+static int __net_init ip6_tnl_init_net(struct net *net)
 {
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
         int err;
-        struct ip6_tnl_net *ip6n;
-
-        err = -ENOMEM;
-        ip6n = kzalloc(sizeof(struct ip6_tnl_net), GFP_KERNEL);
-        if (ip6n == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, ip6_tnl_net_id, ip6n);
-        if (err < 0)
-                goto err_assign;
 
         ip6n->tnls[0] = ip6n->tnls_wc;
         ip6n->tnls[1] = ip6n->tnls_r_l;
@@ -1432,27 +1433,23 @@ static int ip6_tnl_init_net(struct net *net)
 err_register:
         free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(ip6n);
-err_alloc:
         return err;
 }
 
-static void ip6_tnl_exit_net(struct net *net)
+static void __net_exit ip6_tnl_exit_net(struct net *net)
 {
-        struct ip6_tnl_net *ip6n;
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        ip6n = net_generic(net, ip6_tnl_net_id);
         rtnl_lock();
         ip6_tnl_destroy_tunnels(ip6n);
         rtnl_unlock();
-        kfree(ip6n);
 }
 
 static struct pernet_operations ip6_tnl_net_ops = {
         .init = ip6_tnl_init_net,
         .exit = ip6_tnl_exit_net,
+        .id   = &ip6_tnl_net_id,
+        .size = sizeof(struct ip6_tnl_net),
 };
 
 /**
@@ -1465,27 +1462,29 @@ static int __init ip6_tunnel_init(void)
 {
         int  err;
 
-        if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) {
+        err = register_pernet_device(&ip6_tnl_net_ops);
+        if (err < 0)
+                goto out_pernet;
+
+        err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
+        if (err < 0) {
                 printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
-                err = -EAGAIN;
-                goto out;
+                goto out_ip4ip6;
         }
 
-        if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) {
+        err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
+        if (err < 0) {
                 printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
-                err = -EAGAIN;
-                goto unreg_ip4ip6;
+                goto out_ip6ip6;
         }
 
-        err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
-        if (err < 0)
-                goto err_pernet;
         return 0;
-err_pernet:
-        xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
-unreg_ip4ip6:
+
+out_ip6ip6:
         xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
-out:
+out_ip4ip6:
+        unregister_pernet_device(&ip6_tnl_net_ops);
+out_pernet:
         return err;
 }
 
@@ -1501,7 +1500,7 @@ static void __exit ip6_tunnel_cleanup(void)
         if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
                 printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
 
-        unregister_pernet_gen_device(ip6_tnl_net_id, &ip6_tnl_net_ops);
+        unregister_pernet_device(&ip6_tnl_net_ops);
 }
 
 module_init(ip6_tunnel_init);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 716153941fc4..3e333268db89 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -33,6 +33,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
@@ -477,7 +478,7 @@ failure:
  *      Delete a VIF entry
  */
 
-static int mif6_delete(struct net *net, int vifi)
+static int mif6_delete(struct net *net, int vifi, struct list_head *head)
 {
         struct mif_device *v;
         struct net_device *dev;
@@ -519,7 +520,7 @@ static int mif6_delete(struct net *net, int vifi)
                 in6_dev->cnf.mc_forwarding--;
 
         if (v->flags & MIFF_REGISTER)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
         return 0;
@@ -976,6 +977,7 @@ static int ip6mr_device_event(struct notifier_block *this,
         struct net *net = dev_net(dev);
         struct mif_device *v;
         int ct;
+        LIST_HEAD(list);
 
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
@@ -983,8 +985,10 @@ static int ip6mr_device_event(struct notifier_block *this,
         v = &net->ipv6.vif6_table[0];
         for (ct = 0; ct < net->ipv6.maxvif; ct++, v++) {
                 if (v->dev == dev)
-                        mif6_delete(net, ct);
+                        mif6_delete(net, ct, &list);
         }
+        unregister_netdevice_many(&list);
+
         return NOTIFY_DONE;
 }
 
@@ -1110,6 +1114,9 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
         unsigned char ttls[MAXMIFS];
         int i;
 
+        if (mfc->mf6cc_parent >= MAXMIFS)
+                return -ENFILE;
+
         memset(ttls, 255, MAXMIFS);
         for (i = 0; i < MAXMIFS; i++) {
                 if (IF_ISSET(i, &mfc->mf6cc_ifset))
@@ -1188,14 +1195,16 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
         int i;
+        LIST_HEAD(list);
 
         /*
          *      Shut down all active vif entries
          */
         for (i = 0; i < net->ipv6.maxvif; i++) {
                 if (!(net->ipv6.vif6_table[i].flags & VIFF_STATIC))
-                        mif6_delete(net, i);
+                        mif6_delete(net, i, &list);
         }
+        unregister_netdevice_many(&list);
 
         /*
          *      Wipe the cache
@@ -1297,7 +1306,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
         switch (optname) {
         case MRT6_INIT:
                 if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_ICMPV6)
+                    inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                         return -EOPNOTSUPP;
                 if (optlen < sizeof(int))
                         return -EINVAL;
@@ -1325,7 +1334,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                 if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                         return -EFAULT;
                 rtnl_lock();
-                ret = mif6_delete(net, mifi);
+                ret = mif6_delete(net, mifi, NULL);
                 rtnl_unlock();
                 return ret;
 
@@ -1687,17 +1696,20 @@ ip6mr_fill_mroute(struct sk_buff *skb, struct mfc6_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net *net = mfc6_net(c);
-        struct net_device *dev = net->ipv6.vif6_table[c->mf6c_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mf6c_parent > MAXMIFS)
+                return -ENOENT;
+
+        if (MIF_EXISTS(net, c->mf6c_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv6.vif6_table[c->mf6c_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (MIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 2f2a5ca2c878..85cccd6ed0b7 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -53,6 +53,7 @@
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                 u8 type, u8 code, int offset, __be32 info)
 {
+        struct net *net = dev_net(skb->dev);
         __be32 spi;
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ip_comp_hdr *ipcomph =
@@ -63,7 +64,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
 
         spi = htonl(ntohs(ipcomph->cpi));
-        x = xfrm_state_lookup(&init_net, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
         if (!x)
                 return;
 
@@ -74,14 +75,15 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
 static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
         struct xfrm_state *t = NULL;
 
-        t = xfrm_state_alloc(&init_net);
+        t = xfrm_state_alloc(net);
         if (!t)
                 goto out;
 
         t->id.proto = IPPROTO_IPV6;
-        t->id.spi = xfrm6_tunnel_alloc_spi((xfrm_address_t *)&x->props.saddr);
+        t->id.spi = xfrm6_tunnel_alloc_spi(net, (xfrm_address_t *)&x->props.saddr);
         if (!t->id.spi)
                 goto error;
 
@@ -90,6 +92,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
         t->props.family = AF_INET6;
         t->props.mode = x->props.mode;
         memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));
+        memcpy(&t->mark, &x->mark, sizeof(t->mark));
 
         if (xfrm_init_state(t))
                 goto error;
@@ -108,13 +111,15 @@ error:
 
 static int ipcomp6_tunnel_attach(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
         int err = 0;
         struct xfrm_state *t = NULL;
         __be32 spi;
+        u32 mark = x->mark.m & x->mark.v;
 
-        spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&x->props.saddr);
+        spi = xfrm6_tunnel_spi_lookup(net, (xfrm_address_t *)&x->props.saddr);
         if (spi)
-                t = xfrm_state_lookup(&init_net, (xfrm_address_t *)&x->id.daddr,
+                t = xfrm_state_lookup(net, mark, (xfrm_address_t *)&x->id.daddr,
                                               spi, IPPROTO_IPV6, AF_INET6);
         if (!t) {
                 t = ipcomp6_tunnel_create(x);
@@ -154,16 +159,12 @@ static int ipcomp6_init_state(struct xfrm_state *x)
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp6_tunnel_attach(x);
                 if (err)
-                        goto error_tunnel;
+                        goto out;
         }
 
         err = 0;
 out:
         return err;
-error_tunnel:
-        ipcomp_destroy(x);
-
-        goto out;
 }
 
 static const struct xfrm_type ipcomp6_type =
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4f7aaf6996a3..33f60fca7aa7 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -36,6 +36,7 @@
 #include <linux/init.h>
 #include <linux/sysctl.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -64,7 +65,7 @@ int ip6_ra_control(struct sock *sk, int sel)
         struct ip6_ra_chain *ra, *new_ra, **rap;
 
         /* RA packet may be delivered ONLY to IPPROTO_RAW socket */
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num != IPPROTO_RAW)
                 return -ENOPROTOOPT;
 
         new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -106,7 +107,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
         if (inet_sk(sk)->is_icsk) {
                 if (opt &&
                     !((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
-                    inet_sk(sk)->daddr != LOOPBACK4_IPV6) {
+                    inet_sk(sk)->inet_daddr != LOOPBACK4_IPV6) {
                         struct inet_connection_sock *icsk = inet_csk(sk);
                         icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
                         icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
@@ -234,7 +235,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 
         case IPV6_V6ONLY:
                 if (optlen < sizeof(int) ||
-                    inet_sk(sk)->num)
+                    inet_sk(sk)->inet_num)
                         goto e_inval;
                 np->ipv6only = valbool;
                 retv = 0;
@@ -424,6 +425,7 @@ sticky_done:
 
                 fl.fl6_flowlabel = 0;
                 fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
 
                 if (optlen == 0)
                         goto update;
@@ -665,7 +667,7 @@ done:
         case IPV6_MTU_DISCOVER:
                 if (optlen < sizeof(int))
                         goto e_inval;
-                if (val<0 || val>3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                         goto e_inval;
                 np->pmtudisc = val;
                 retv = 0;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f9fcf690bd5d..c483ab9fd67b 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -43,6 +43,7 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -793,10 +794,10 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
         }
         spin_unlock_bh(&im->mca_lock);
 
-        write_lock_bh(&idev->mc_lock);
+        spin_lock_bh(&idev->mc_lock);
         pmc->next = idev->mc_tomb;
         idev->mc_tomb = pmc;
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock_bh(&idev->mc_lock);
 }
 
 static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
@@ -804,7 +805,7 @@ static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
         struct ifmcaddr6 *pmc, *pmc_prev;
         struct ip6_sf_list *psf, *psf_next;
 
-        write_lock_bh(&idev->mc_lock);
+        spin_lock_bh(&idev->mc_lock);
         pmc_prev = NULL;
         for (pmc=idev->mc_tomb; pmc; pmc=pmc->next) {
                 if (ipv6_addr_equal(&pmc->mca_addr, pmca))
@@ -817,7 +818,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
                 else
                         idev->mc_tomb = pmc->next;
         }
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock_bh(&idev->mc_lock);
+
         if (pmc) {
                 for (psf=pmc->mca_tomb; psf; psf=psf_next) {
                         psf_next = psf->sf_next;
@@ -832,10 +834,10 @@ static void mld_clear_delrec(struct inet6_dev *idev)
 {
         struct ifmcaddr6 *pmc, *nextpmc;
 
-        write_lock_bh(&idev->mc_lock);
+        spin_lock_bh(&idev->mc_lock);
         pmc = idev->mc_tomb;
         idev->mc_tomb = NULL;
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock_bh(&idev->mc_lock);
 
         for (; pmc; pmc = nextpmc) {
                 nextpmc = pmc->next;
@@ -1696,7 +1698,7 @@ static void mld_send_cr(struct inet6_dev *idev)
         int type, dtype;
 
         read_lock_bh(&idev->lock);
-        write_lock_bh(&idev->mc_lock);
+        spin_lock(&idev->mc_lock);
 
         /* deleted MCA's */
         pmc_prev = NULL;
@@ -1730,7 +1732,7 @@ static void mld_send_cr(struct inet6_dev *idev)
                 } else
                         pmc_prev = pmc;
         }
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock(&idev->mc_lock);
 
         /* change recs */
         for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
@@ -2311,7 +2313,7 @@ void ipv6_mc_up(struct inet6_dev *idev)
 void ipv6_mc_init_dev(struct inet6_dev *idev)
 {
         write_lock_bh(&idev->lock);
-        rwlock_init(&idev->mc_lock);
+        spin_lock_init(&idev->mc_lock);
         idev->mc_gq_running = 0;
         setup_timer(&idev->mc_gq_timer, mld_gq_timer_expire,
                         (unsigned long)idev);
@@ -2375,9 +2377,9 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
         struct net *net = seq_file_net(seq);
 
         state->idev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                 if (!idev)
                         continue;
                 read_lock_bh(&idev->lock);
@@ -2387,7 +2389,6 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
                         break;
                 }
                 read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
         }
         return im;
 }
@@ -2398,16 +2399,15 @@ static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr
 
         im = im->next;
         while (!im) {
-                if (likely(state->idev != NULL)) {
+                if (likely(state->idev != NULL))
                         read_unlock_bh(&state->idev->lock);
-                        in6_dev_put(state->idev);
-                }
-                state->dev = next_net_device(state->dev);
+
+                state->dev = next_net_device_rcu(state->dev);
                 if (!state->dev) {
                         state->idev = NULL;
                         break;
                 }
-                state->idev = in6_dev_get(state->dev);
+                state->idev = __in6_dev_get(state->dev);
                 if (!state->idev)
                         continue;
                 read_lock_bh(&state->idev->lock);
@@ -2426,31 +2426,31 @@ static struct ifmcaddr6 *igmp6_mc_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp6_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return igmp6_mc_get_idx(seq, *pos);
 }
 
 static void *igmp6_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ifmcaddr6 *im;
-        im = igmp6_mc_get_next(seq, v);
+        struct ifmcaddr6 *im = igmp6_mc_get_next(seq, v);
+
         ++*pos;
         return im;
 }
 
 static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
         struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
+
         if (likely(state->idev != NULL)) {
                 read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
                 state->idev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
@@ -2507,9 +2507,9 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
 
         state->idev = NULL;
         state->im = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                 if (unlikely(idev == NULL))
                         continue;
                 read_lock_bh(&idev->lock);
@@ -2525,7 +2525,6 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
                         spin_unlock_bh(&im->mca_lock);
                 }
                 read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
         }
         return psf;
 }
@@ -2539,16 +2538,15 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
                 spin_unlock_bh(&state->im->mca_lock);
                 state->im = state->im->next;
                 while (!state->im) {
-                        if (likely(state->idev != NULL)) {
+                        if (likely(state->idev != NULL))
                                 read_unlock_bh(&state->idev->lock);
-                                in6_dev_put(state->idev);
-                        }
-                        state->dev = next_net_device(state->dev);
+
+                        state->dev = next_net_device_rcu(state->dev);
                         if (!state->dev) {
                                 state->idev = NULL;
                                 goto out;
                         }
-                        state->idev = in6_dev_get(state->dev);
+                        state->idev = __in6_dev_get(state->dev);
                         if (!state->idev)
                                 continue;
                         read_lock_bh(&state->idev->lock);
@@ -2573,9 +2571,9 @@ static struct ip6_sf_list *igmp6_mcf_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp6_mcf_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp6_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2591,7 +2589,7 @@ static void *igmp6_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
         struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
         if (likely(state->im != NULL)) {
@@ -2600,11 +2598,10 @@ static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
         }
         if (likely(state->idev != NULL)) {
                 read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
                 state->idev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
@@ -2651,7 +2648,7 @@ static const struct file_operations igmp6_mcf_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int igmp6_proc_init(struct net *net)
+static int __net_init igmp6_proc_init(struct net *net)
 {
         int err;
 
@@ -2671,23 +2668,22 @@ out_proc_net_igmp6:
         goto out;
 }
 
-static void igmp6_proc_exit(struct net *net)
+static void __net_exit igmp6_proc_exit(struct net *net)
 {
         proc_net_remove(net, "mcfilter6");
         proc_net_remove(net, "igmp6");
 }
 #else
-static int igmp6_proc_init(struct net *net)
+static inline int igmp6_proc_init(struct net *net)
 {
         return 0;
 }
-static void igmp6_proc_exit(struct net *net)
+static inline void igmp6_proc_exit(struct net *net)
 {
-        ;
 }
 #endif
 
-static int igmp6_net_init(struct net *net)
+static int __net_init igmp6_net_init(struct net *net)
 {
         int err;
 
@@ -2713,7 +2709,7 @@ out_sock_create:
         goto out;
 }
 
-static void igmp6_net_exit(struct net *net)
+static void __net_exit igmp6_net_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv6.igmp_sk);
         igmp6_proc_exit(net);
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index f797e8c6f3b3..2794b6002836 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -56,7 +56,7 @@ static inline void *mip6_padn(__u8 *data, __u8 padlen)
 
 static inline void mip6_param_prob(struct sk_buff *skb, u8 code, int pos)
 {
-        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos, skb->dev);
+        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos);
 }
 
 static int mip6_mh_len(int type)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f74e4e2cdd06..da0a4d2adc69 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -59,6 +59,7 @@
 #include <linux/route.h>
 #include <linux/init.h>
 #include <linux/rcupdate.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -598,6 +599,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         icmp6h.icmp6_solicited = solicited;
         icmp6h.icmp6_override = override;
 
+        inc_opt |= ifp->idev->cnf.force_tllao;
         __ndisc_send(dev, neigh, daddr, src_addr,
                      &icmp6h, solicited_addr,
                      inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
@@ -1768,46 +1770,10 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *bu
         return ret;
 }
 
-int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl,
-                                 void __user *oldval, size_t __user *oldlenp,
-                                 void __user *newval, size_t newlen)
-{
-        struct net_device *dev = ctl->extra1;
-        struct inet6_dev *idev;
-        int ret;
-
-        if (ctl->ctl_name == NET_NEIGH_RETRANS_TIME ||
-            ctl->ctl_name == NET_NEIGH_REACHABLE_TIME)
-                ndisc_warn_deprecated_sysctl(ctl, "procfs", dev ? dev->name : "default");
-
-        switch (ctl->ctl_name) {
-        case NET_NEIGH_REACHABLE_TIME:
-                ret = sysctl_jiffies(ctl, oldval, oldlenp, newval, newlen);
-                break;
-        case NET_NEIGH_RETRANS_TIME_MS:
-        case NET_NEIGH_REACHABLE_TIME_MS:
-                 ret = sysctl_ms_jiffies(ctl, oldval, oldlenp, newval, newlen);
-                 break;
-        default:
-                ret = 0;
-        }
-
-        if (newval && newlen && ret > 0 &&
-            dev && (idev = in6_dev_get(dev)) != NULL) {
-                if (ctl->ctl_name == NET_NEIGH_REACHABLE_TIME ||
-                    ctl->ctl_name == NET_NEIGH_REACHABLE_TIME_MS)
-                        idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
-                idev->tstamp = jiffies;
-                inet6_ifinfo_notify(RTM_NEWLINK, idev);
-                in6_dev_put(idev);
-        }
-
-        return ret;
-}
 
 #endif
 
-static int ndisc_net_init(struct net *net)
+static int __net_init ndisc_net_init(struct net *net)
 {
         struct ipv6_pinfo *np;
         struct sock *sk;
@@ -1832,7 +1798,7 @@ static int ndisc_net_init(struct net *net)
         return 0;
 }
 
-static void ndisc_net_exit(struct net *net)
+static void __net_exit ndisc_net_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
 }
@@ -1855,10 +1821,8 @@ int __init ndisc_init(void)
         neigh_table_init(&nd_tbl);
 
 #ifdef CONFIG_SYSCTL
-        err = neigh_sysctl_register(NULL, &nd_tbl.parms, NET_IPV6,
-                                    NET_IPV6_NEIGH, "ipv6",
-                                    &ndisc_ifinfo_sysctl_change,
-                                    &ndisc_ifinfo_sysctl_strategy);
+        err = neigh_sysctl_register(NULL, &nd_tbl.parms, "ipv6",
+                                    &ndisc_ifinfo_sysctl_change);
         if (err)
                 goto out_unregister_pernet;
 #endif
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 1cf3f0c6a959..6a68a74d14a3 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -25,6 +25,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/ipv6.h>
@@ -36,7 +37,6 @@
 
 #define IPQ_QMAX_DEFAULT 1024
 #define IPQ_PROC_FS_NAME "ip6_queue"
-#define NET_IPQ_QMAX 2088
 #define NET_IPQ_QMAX_NAME "ip6_queue_maxlen"
 
 typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
@@ -499,10 +499,9 @@ ipq_rcv_nl_event(struct notifier_block *this,
 {
         struct netlink_notify *n = ptr;
 
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_IP6_FW && n->pid) {
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_IP6_FW) {
                 write_lock_bh(&queue_lock);
-                if ((n->net == &init_net) && (n->pid == peer_pid))
+                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
                         __ipq_reset();
                 write_unlock_bh(&queue_lock);
         }
@@ -518,14 +517,13 @@ static struct ctl_table_header *ipq_sysctl_header;
 
 static ctl_table ipq_table[] = {
         {
-                .ctl_name       = NET_IPQ_QMAX,
                 .procname       = NET_IPQ_QMAX_NAME,
                 .data           = &queue_maxlen,
                 .maxlen         = sizeof(queue_maxlen),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 #endif
 
@@ -625,7 +623,7 @@ cleanup_netlink_notifier:
 static void __exit ip6_queue_fini(void)
 {
         nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
+
         ipq_flush(NULL, 0);
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index cc9f8ef303fd..9210e312edf1 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -29,6 +29,7 @@
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter/x_tables.h>
 #include <net/netfilter/nf_log.h>
+#include "../../netfilter/xt_repldata.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -67,6 +68,12 @@ do {								\
 #define inline
 #endif
 
+void *ip6t_alloc_initial_table(const struct xt_table *info)
+{
+        return xt_alloc_initial_table(ip6t, IP6T);
+}
+EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
+
 /*
    We keep a set of rules for each CPU, so we can avoid write-locking
    them in the softirq when updating the counters and therefore
@@ -105,9 +112,9 @@ ip6_packet_match(const struct sk_buff *skb,
 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
 
         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
-                                       &ip6info->src), IP6T_INV_SRCIP)
-            || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
-                                          &ip6info->dst), IP6T_INV_DSTIP)) {
+                                       &ip6info->src), IP6T_INV_SRCIP) ||
+            FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
+                                       &ip6info->dst), IP6T_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
 /*
                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
@@ -201,7 +208,7 @@ ip6t_error(struct sk_buff *skb, const struct xt_target_param *par)
 
 /* Performance critical - called for every packet */
 static inline bool
-do_match(struct ip6t_entry_match *m, const struct sk_buff *skb,
+do_match(const struct ip6t_entry_match *m, const struct sk_buff *skb,
          struct xt_match_param *par)
 {
         par->match     = m->u.kernel.match;
@@ -215,7 +222,7 @@ do_match(struct ip6t_entry_match *m, const struct sk_buff *skb,
 }
 
 static inline struct ip6t_entry *
-get_entry(void *base, unsigned int offset)
+get_entry(const void *base, unsigned int offset)
 {
         return (struct ip6t_entry *)(base + offset);
 }
@@ -229,6 +236,12 @@ static inline bool unconditional(const struct ip6t_ip6 *ipv6)
         return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 }
 
+static inline const struct ip6t_entry_target *
+ip6t_get_target_c(const struct ip6t_entry *e)
+{
+        return ip6t_get_target((struct ip6t_entry *)e);
+}
+
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 /* This cries for unification! */
@@ -264,11 +277,11 @@ static struct nf_loginfo trace_loginfo = {
 
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
-get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
+get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
                       const char *hookname, const char **chainname,
                       const char **comment, unsigned int *rulenum)
 {
-        struct ip6t_standard_target *t = (void *)ip6t_get_target(s);
+        const struct ip6t_standard_target *t = (void *)ip6t_get_target_c(s);
 
         if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
                 /* Head of user chain: ERROR target with chainname */
@@ -277,11 +290,11 @@ get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
         } else if (s == e) {
                 (*rulenum)++;
 
-                if (s->target_offset == sizeof(struct ip6t_entry)
-                   && strcmp(t->target.u.kernel.target->name,
-                             IP6T_STANDARD_TARGET) == 0
-                   && t->verdict < 0
-                   && unconditional(&s->ipv6)) {
+                if (s->target_offset == sizeof(struct ip6t_entry) &&
+                    strcmp(t->target.u.kernel.target->name,
+                           IP6T_STANDARD_TARGET) == 0 &&
+                    t->verdict < 0 &&
+                    unconditional(&s->ipv6)) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
@@ -294,17 +307,18 @@ get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
         return 0;
 }
 
-static void trace_packet(struct sk_buff *skb,
+static void trace_packet(const struct sk_buff *skb,
                          unsigned int hook,
                          const struct net_device *in,
                          const struct net_device *out,
                          const char *tablename,
-                         struct xt_table_info *private,
-                         struct ip6t_entry *e)
+                         const struct xt_table_info *private,
+                         const struct ip6t_entry *e)
 {
-        void *table_base;
+        const void *table_base;
         const struct ip6t_entry *root;
         const char *hookname, *chainname, *comment;
+        const struct ip6t_entry *iter;
         unsigned int rulenum = 0;
 
         table_base = private->entries[smp_processor_id()];
@@ -313,10 +327,10 @@ static void trace_packet(struct sk_buff *skb,
         hookname = chainname = hooknames[hook];
         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 
-        IP6T_ENTRY_ITERATE(root,
-                           private->size - private->hook_entry[hook],
-                           get_chainname_rulenum,
-                           e, hookname, &chainname, &comment, &rulenum);
+        xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
+                if (get_chainname_rulenum(iter, e, hookname,
+                    &chainname, &comment, &rulenum) != 0)
+                        break;
 
         nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
                       "TRACE: %s:%s:%s:%u ",
@@ -345,9 +359,9 @@ ip6t_do_table(struct sk_buff *skb,
         /* Initializing verdict to NF_DROP keeps gcc happy. */
         unsigned int verdict = NF_DROP;
         const char *indev, *outdev;
-        void *table_base;
+        const void *table_base;
         struct ip6t_entry *e, *back;
-        struct xt_table_info *private;
+        const struct xt_table_info *private;
         struct xt_match_param mtpar;
         struct xt_target_param tgpar;
 
@@ -378,22 +392,27 @@ ip6t_do_table(struct sk_buff *skb,
         back = get_entry(table_base, private->underflow[hook]);
 
         do {
-                struct ip6t_entry_target *t;
+                const struct ip6t_entry_target *t;
+                const struct xt_entry_match *ematch;
 
                 IP_NF_ASSERT(e);
                 IP_NF_ASSERT(back);
                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
-                    &mtpar.thoff, &mtpar.fragoff, &hotdrop) ||
-                    IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
+                    &mtpar.thoff, &mtpar.fragoff, &hotdrop)) {
+ no_match:
                         e = ip6t_next_entry(e);
                         continue;
                 }
 
+                xt_ematch_foreach(ematch, e)
+                        if (do_match(ematch, skb, &mtpar) != 0)
+                                goto no_match;
+
                 ADD_COUNTER(e->counters,
                             ntohs(ipv6_hdr(skb)->payload_len) +
                             sizeof(struct ipv6hdr), 1);
 
-                t = ip6t_get_target(e);
+                t = ip6t_get_target_c(e);
                 IP_NF_ASSERT(t->u.kernel.target);
 
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
@@ -418,8 +437,8 @@ ip6t_do_table(struct sk_buff *skb,
                                 back = get_entry(table_base, back->comefrom);
                                 continue;
                         }
-                        if (table_base + v != ip6t_next_entry(e)
-                            && !(e->ipv6.flags & IP6T_F_GOTO)) {
+                        if (table_base + v != ip6t_next_entry(e) &&
+                            !(e->ipv6.flags & IP6T_F_GOTO)) {
                                 /* Save old back ptr in next entry */
                                 struct ip6t_entry *next = ip6t_next_entry(e);
                                 next->comefrom = (void *)back - table_base;
@@ -475,7 +494,7 @@ ip6t_do_table(struct sk_buff *skb,
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
-mark_source_chains(struct xt_table_info *newinfo,
+mark_source_chains(const struct xt_table_info *newinfo,
                    unsigned int valid_hooks, void *entry0)
 {
         unsigned int hook;
@@ -493,8 +512,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                 e->counters.pcnt = pos;
 
                 for (;;) {
-                        struct ip6t_standard_target *t
-                                = (void *)ip6t_get_target(e);
+                        const struct ip6t_standard_target *t
+                                = (void *)ip6t_get_target_c(e);
                         int visited = e->comefrom & (1 << hook);
 
                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
@@ -505,11 +524,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ip6t_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       IP6T_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->ipv6)) || visited) {
+                        if ((e->target_offset == sizeof(struct ip6t_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     IP6T_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 &&
+                             unconditional(&e->ipv6)) || visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -556,8 +575,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           IP6T_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           IP6T_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct ip6t_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -584,27 +603,23 @@ mark_source_chains(struct xt_table_info *newinfo,
         return 1;
 }
 
-static int
-cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
+static void cleanup_match(struct ip6t_entry_match *m, struct net *net)
 {
         struct xt_mtdtor_param par;
 
-        if (i && (*i)-- == 0)
-                return 1;
-
+        par.net       = net;
         par.match     = m->u.kernel.match;
         par.matchinfo = m->data;
         par.family    = NFPROTO_IPV6;
         if (par.match->destroy != NULL)
                 par.match->destroy(&par);
         module_put(par.match->me);
-        return 0;
 }
 
 static int
-check_entry(struct ip6t_entry *e, const char *name)
+check_entry(const struct ip6t_entry *e, const char *name)
 {
-        struct ip6t_entry_target *t;
+        const struct ip6t_entry_target *t;
 
         if (!ip6_checkentry(&e->ipv6)) {
                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
@@ -615,15 +630,14 @@ check_entry(struct ip6t_entry *e, const char *name)
             e->next_offset)
                 return -EINVAL;
 
-        t = ip6t_get_target(e);
+        t = ip6t_get_target_c(e);
         if (e->target_offset + t->u.target_size > e->next_offset)
                 return -EINVAL;
 
         return 0;
 }
 
-static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
-                       unsigned int *i)
+static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par)
 {
         const struct ip6t_ip6 *ipv6 = par->entryinfo;
         int ret;
@@ -638,13 +652,11 @@ static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
                          par.match->name);
                 return ret;
         }
-        ++*i;
         return 0;
 }
 
 static int
-find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
-                 unsigned int *i)
+find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par)
 {
         struct xt_match *match;
         int ret;
@@ -658,7 +670,7 @@ find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
         }
         m->u.kernel.match = match;
 
-        ret = check_match(m, par, i);
+        ret = check_match(m, par);
         if (ret)
                 goto err;
 
@@ -668,10 +680,11 @@ err:
         return ret;
 }
 
-static int check_target(struct ip6t_entry *e, const char *name)
+static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 {
         struct ip6t_entry_target *t = ip6t_get_target(e);
         struct xt_tgchk_param par = {
+                .net       = net,
                 .table     = name,
                 .entryinfo = e,
                 .target    = t->u.kernel.target,
@@ -693,27 +706,32 @@ static int check_target(struct ip6t_entry *e, const char *name)
 }
 
 static int
-find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
-                 unsigned int *i)
+find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
+                 unsigned int size)
 {
         struct ip6t_entry_target *t;
         struct xt_target *target;
         int ret;
         unsigned int j;
         struct xt_mtchk_param mtpar;
+        struct xt_entry_match *ematch;
 
         ret = check_entry(e, name);
         if (ret)
                 return ret;
 
         j = 0;
+        mtpar.net       = net;
         mtpar.table     = name;
         mtpar.entryinfo = &e->ipv6;
         mtpar.hook_mask = e->comefrom;
         mtpar.family    = NFPROTO_IPV6;
-        ret = IP6T_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
-        if (ret != 0)
-                goto cleanup_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = find_check_match(ematch, &mtpar);
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
 
         t = ip6t_get_target(e);
         target = try_then_request_module(xt_find_target(AF_INET6,
@@ -727,27 +745,29 @@ find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
         }
         t->u.kernel.target = target;
 
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
         if (ret)
                 goto err;
-
-        (*i)++;
         return 0;
  err:
         module_put(t->u.kernel.target->me);
  cleanup_matches:
-        IP6T_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
         return ret;
 }
 
-static bool check_underflow(struct ip6t_entry *e)
+static bool check_underflow(const struct ip6t_entry *e)
 {
         const struct ip6t_entry_target *t;
         unsigned int verdict;
 
         if (!unconditional(&e->ipv6))
                 return false;
-        t = ip6t_get_target(e);
+        t = ip6t_get_target_c(e);
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
                 return false;
         verdict = ((struct ip6t_standard_target *)t)->verdict;
@@ -758,17 +778,16 @@ static bool check_underflow(struct ip6t_entry *e)
 static int
 check_entry_size_and_hooks(struct ip6t_entry *e,
                            struct xt_table_info *newinfo,
-                           unsigned char *base,
-                           unsigned char *limit,
+                           const unsigned char *base,
+                           const unsigned char *limit,
                            const unsigned int *hook_entries,
                            const unsigned int *underflows,
-                           unsigned int valid_hooks,
-                           unsigned int *i)
+                           unsigned int valid_hooks)
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
-            || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -800,50 +819,41 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 }
 
-static int
-cleanup_entry(struct ip6t_entry *e, unsigned int *i)
+static void cleanup_entry(struct ip6t_entry *e, struct net *net)
 {
         struct xt_tgdtor_param par;
         struct ip6t_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_match *ematch;
 
         /* Cleanup all matches */
-        IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                cleanup_match(ematch, net);
         t = ip6t_get_target(e);
 
+        par.net      = net;
         par.target   = t->u.kernel.target;
         par.targinfo = t->data;
         par.family   = NFPROTO_IPV6;
         if (par.target->destroy != NULL)
                 par.target->destroy(&par);
         module_put(par.target->me);
-        return 0;
 }
 
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
-translate_table(const char *name,
-                unsigned int valid_hooks,
-                struct xt_table_info *newinfo,
-                void *entry0,
-                unsigned int size,
-                unsigned int number,
-                const unsigned int *hook_entries,
-                const unsigned int *underflows)
+translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+                const struct ip6t_replace *repl)
 {
+        struct ip6t_entry *iter;
         unsigned int i;
-        int ret;
+        int ret = 0;
 
-        newinfo->size = size;
-        newinfo->number = number;
+        newinfo->size = repl->size;
+        newinfo->number = repl->num_entries;
 
         /* Init all hooks to impossible value. */
         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
@@ -854,49 +864,58 @@ translate_table(const char *name,
         duprintf("translate_table: size %u\n", newinfo->size);
         i = 0;
         /* Walk through entries, checking offsets. */
-        ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
-                                check_entry_size_and_hooks,
-                                newinfo,
-                                entry0,
-                                entry0 + size,
-                                hook_entries, underflows, valid_hooks, &i);
-        if (ret != 0)
-                return ret;
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = check_entry_size_and_hooks(iter, newinfo, entry0,
+                                                 entry0 + repl->size,
+                                                 repl->hook_entry,
+                                                 repl->underflow,
+                                                 repl->valid_hooks);
+                if (ret != 0)
+                        return ret;
+                ++i;
+        }
 
-        if (i != number) {
+        if (i != repl->num_entries) {
                 duprintf("translate_table: %u not %u entries\n",
-                         i, number);
+                         i, repl->num_entries);
                 return -EINVAL;
         }
 
         /* Check hooks all assigned */
         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
                 /* Only hooks which are valid */
-                if (!(valid_hooks & (1 << i)))
+                if (!(repl->valid_hooks & (1 << i)))
                         continue;
                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
                         duprintf("Invalid hook entry %u %u\n",
-                                 i, hook_entries[i]);
+                                 i, repl->hook_entry[i]);
                         return -EINVAL;
                 }
                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
                         duprintf("Invalid underflow %u %u\n",
-                                 i, underflows[i]);
+                                 i, repl->underflow[i]);
                         return -EINVAL;
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
                 return -ELOOP;
 
         /* Finally, each sanity check must pass */
         i = 0;
-        ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
-                                find_check_entry, name, size, &i);
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = find_check_entry(iter, net, repl->name, repl->size);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
 
         if (ret != 0) {
-                IP6T_ENTRY_ITERATE(entry0, newinfo->size,
-                                   cleanup_entry, &i);
+                xt_entry_foreach(iter, entry0, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter, net);
+                }
                 return ret;
         }
 
@@ -909,33 +928,11 @@ translate_table(const char *name,
         return ret;
 }
 
-/* Gets counters. */
-static inline int
-add_entry_to_counter(const struct ip6t_entry *e,
-                     struct xt_counters total[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static inline int
-set_entry_to_counter(const struct ip6t_entry *e,
-                     struct ip6t_counters total[],
-                     unsigned int *i)
-{
-        SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
 static void
 get_counters(const struct xt_table_info *t,
              struct xt_counters counters[])
 {
+        struct ip6t_entry *iter;
         unsigned int cpu;
         unsigned int i;
         unsigned int curcpu;
@@ -951,32 +948,32 @@ get_counters(const struct xt_table_info *t,
         curcpu = smp_processor_id();
 
         i = 0;
-        IP6T_ENTRY_ITERATE(t->entries[curcpu],
-                           t->size,
-                           set_entry_to_counter,
-                           counters,
-                           &i);
+        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
+                SET_COUNTER(counters[i], iter->counters.bcnt,
+                            iter->counters.pcnt);
+                ++i;
+        }
 
         for_each_possible_cpu(cpu) {
                 if (cpu == curcpu)
                         continue;
                 i = 0;
                 xt_info_wrlock(cpu);
-                IP6T_ENTRY_ITERATE(t->entries[cpu],
-                                  t->size,
-                                  add_entry_to_counter,
-                                  counters,
-                                  &i);
+                xt_entry_foreach(iter, t->entries[cpu], t->size) {
+                        ADD_COUNTER(counters[i], iter->counters.bcnt,
+                                    iter->counters.pcnt);
+                        ++i;
+                }
                 xt_info_wrunlock(cpu);
         }
         local_bh_enable();
 }
 
-static struct xt_counters *alloc_counters(struct xt_table *table)
+static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
-        struct xt_table_info *private = table->private;
+        const struct xt_table_info *private = table->private;
 
         /* We need atomic snapshot of counters: rest doesn't change
            (other than comefrom, which userspace doesn't care
@@ -994,11 +991,11 @@ static struct xt_counters *alloc_counters(struct xt_table *table)
 
 static int
 copy_entries_to_user(unsigned int total_size,
-                     struct xt_table *table,
+                     const struct xt_table *table,
                      void __user *userptr)
 {
         unsigned int off, num;
-        struct ip6t_entry *e;
+        const struct ip6t_entry *e;
         struct xt_counters *counters;
         const struct xt_table_info *private = table->private;
         int ret = 0;
@@ -1050,7 +1047,7 @@ copy_entries_to_user(unsigned int total_size,
                         }
                 }
 
-                t = ip6t_get_target(e);
+                t = ip6t_get_target_c(e);
                 if (copy_to_user(userptr + off + e->target_offset
                                  + offsetof(struct ip6t_entry_target,
                                             u.user.name),
@@ -1067,7 +1064,7 @@ copy_entries_to_user(unsigned int total_size,
 }
 
 #ifdef CONFIG_COMPAT
-static void compat_standard_from_user(void *dst, void *src)
+static void compat_standard_from_user(void *dst, const void *src)
 {
         int v = *(compat_int_t *)src;
 
@@ -1076,7 +1073,7 @@ static void compat_standard_from_user(void *dst, void *src)
         memcpy(dst, &v, sizeof(v));
 }
 
-static int compat_standard_to_user(void __user *dst, void *src)
+static int compat_standard_to_user(void __user *dst, const void *src)
 {
         compat_int_t cv = *(int *)src;
 
@@ -1085,25 +1082,20 @@ static int compat_standard_to_user(void __user *dst, void *src)
         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 
-static inline int
-compat_calc_match(struct ip6t_entry_match *m, int *size)
-{
-        *size += xt_compat_match_offset(m->u.kernel.match);
-        return 0;
-}
-
-static int compat_calc_entry(struct ip6t_entry *e,
+static int compat_calc_entry(const struct ip6t_entry *e,
                              const struct xt_table_info *info,
-                             void *base, struct xt_table_info *newinfo)
+                             const void *base, struct xt_table_info *newinfo)
 {
-        struct ip6t_entry_target *t;
+        const struct xt_entry_match *ematch;
+        const struct ip6t_entry_target *t;
         unsigned int entry_offset;
         int off, i, ret;
 
         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
         entry_offset = (void *)e - base;
-        IP6T_MATCH_ITERATE(e, compat_calc_match, &off);
-        t = ip6t_get_target(e);
+        xt_ematch_foreach(ematch, e)
+                off += xt_compat_match_offset(ematch->u.kernel.match);
+        t = ip6t_get_target_c(e);
         off += xt_compat_target_offset(t->u.kernel.target);
         newinfo->size -= off;
         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
@@ -1124,7 +1116,9 @@ static int compat_calc_entry(struct ip6t_entry *e,
 static int compat_table_info(const struct xt_table_info *info,
                              struct xt_table_info *newinfo)
 {
+        struct ip6t_entry *iter;
         void *loc_cpu_entry;
+        int ret;
 
         if (!newinfo || !info)
                 return -EINVAL;
@@ -1133,13 +1127,17 @@ static int compat_table_info(const struct xt_table_info *info,
         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
         newinfo->initial_entries = 0;
         loc_cpu_entry = info->entries[raw_smp_processor_id()];
-        return IP6T_ENTRY_ITERATE(loc_cpu_entry, info->size,
-                                  compat_calc_entry, info, loc_cpu_entry,
-                                  newinfo);
+        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
+                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
+                if (ret != 0)
+                        return ret;
+        }
+        return 0;
 }
 #endif
 
-static int get_info(struct net *net, void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user,
+                    const int *len, int compat)
 {
         char name[IP6T_TABLE_MAXNAMELEN];
         struct xt_table *t;
@@ -1164,10 +1162,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         if (t && !IS_ERR(t)) {
                 struct ip6t_getinfo info;
                 const struct xt_table_info *private = t->private;
-
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
+
                 if (compat) {
-                        struct xt_table_info tmp;
                         ret = compat_table_info(private, &tmp);
                         xt_compat_flush_offsets(AF_INET6);
                         private = &tmp;
@@ -1199,7 +1197,8 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
 }
 
 static int
-get_entries(struct net *net, struct ip6t_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
+            const int *len)
 {
         int ret;
         struct ip6t_get_entries get;
@@ -1247,6 +1246,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
         struct xt_table_info *oldinfo;
         struct xt_counters *counters;
         const void *loc_cpu_old_entry;
+        struct ip6t_entry *iter;
 
         ret = 0;
         counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
@@ -1290,8 +1290,9 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
-        IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
-                           NULL);
+        xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+                cleanup_entry(iter, net);
+
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
                          sizeof(struct xt_counters) * num_counters) != 0)
@@ -1310,12 +1311,13 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(struct net *net, void __user *user, unsigned int len)
+do_replace(struct net *net, const void __user *user, unsigned int len)
 {
         int ret;
         struct ip6t_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct ip6t_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1336,9 +1338,7 @@ do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_table(tmp.name, tmp.valid_hooks,
-                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                              tmp.hook_entry, tmp.underflow);
+        ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
         if (ret != 0)
                 goto free_newinfo;
 
@@ -1351,27 +1351,15 @@ do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
 }
 
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
 static int
-add_counter_to_entry(struct ip6t_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static int
-do_add_counters(struct net *net, void __user *user, unsigned int len,
+do_add_counters(struct net *net, const void __user *user, unsigned int len,
                 int compat)
 {
         unsigned int i, curcpu;
@@ -1385,6 +1373,7 @@ do_add_counters(struct net *net, void __user *user, unsigned int len,
         const struct xt_table_info *private;
         int ret = 0;
         const void *loc_cpu_entry;
+        struct ip6t_entry *iter;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1443,11 +1432,10 @@ do_add_counters(struct net *net, void __user *user, unsigned int len,
         curcpu = smp_processor_id();
         xt_info_wrlock(curcpu);
         loc_cpu_entry = private->entries[curcpu];
-        IP6T_ENTRY_ITERATE(loc_cpu_entry,
-                          private->size,
-                          add_counter_to_entry,
-                          paddc,
-                          &i);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size) {
+                ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
+                ++i;
+        }
         xt_info_wrunlock(curcpu);
 
  unlock_up_free:
@@ -1476,45 +1464,40 @@ struct compat_ip6t_replace {
 static int
 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
                           unsigned int *size, struct xt_counters *counters,
-                          unsigned int *i)
+                          unsigned int i)
 {
         struct ip6t_entry_target *t;
         struct compat_ip6t_entry __user *ce;
         u_int16_t target_offset, next_offset;
         compat_uint_t origsize;
-        int ret;
+        const struct xt_entry_match *ematch;
+        int ret = 0;
 
-        ret = -EFAULT;
         origsize = *size;
         ce = (struct compat_ip6t_entry __user *)*dstptr;
-        if (copy_to_user(ce, e, sizeof(struct ip6t_entry)))
-                goto out;
-
-        if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
-                goto out;
+        if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
+            copy_to_user(&ce->counters, &counters[i],
+            sizeof(counters[i])) != 0)
+                return -EFAULT;
 
         *dstptr += sizeof(struct compat_ip6t_entry);
         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
 
-        ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
+        xt_ematch_foreach(ematch, e) {
+                ret = xt_compat_match_to_user(ematch, dstptr, size);
+                if (ret != 0)
+                        return ret;
+        }
         target_offset = e->target_offset - (origsize - *size);
-        if (ret)
-                goto out;
         t = ip6t_get_target(e);
         ret = xt_compat_target_to_user(t, dstptr, size);
         if (ret)
-                goto out;
-        ret = -EFAULT;
+                return ret;
         next_offset = e->next_offset - (origsize - *size);
-        if (put_user(target_offset, &ce->target_offset))
-                goto out;
-        if (put_user(next_offset, &ce->next_offset))
-                goto out;
-
-        (*i)++;
+        if (put_user(target_offset, &ce->target_offset) != 0 ||
+            put_user(next_offset, &ce->next_offset) != 0)
+                return -EFAULT;
         return 0;
-out:
-        return ret;
 }
 
 static int
@@ -1522,7 +1505,7 @@ compat_find_calc_match(struct ip6t_entry_match *m,
                        const char *name,
                        const struct ip6t_ip6 *ipv6,
                        unsigned int hookmask,
-                       int *size, unsigned int *i)
+                       int *size)
 {
         struct xt_match *match;
 
@@ -1536,47 +1519,32 @@ compat_find_calc_match(struct ip6t_entry_match *m,
         }
         m->u.kernel.match = match;
         *size += xt_compat_match_offset(match);
-
-        (*i)++;
-        return 0;
-}
-
-static int
-compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
-{
-        if (i && (*i)-- == 0)
-                return 1;
-
-        module_put(m->u.kernel.match->me);
         return 0;
 }
 
-static int
-compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
+static void compat_release_entry(struct compat_ip6t_entry *e)
 {
         struct ip6t_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_match *ematch;
 
         /* Cleanup all matches */
-        COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                module_put(ematch->u.kernel.match->me);
         t = compat_ip6t_get_target(e);
         module_put(t->u.kernel.target->me);
-        return 0;
 }
 
 static int
 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
                                   struct xt_table_info *newinfo,
                                   unsigned int *size,
-                                  unsigned char *base,
-                                  unsigned char *limit,
-                                  unsigned int *hook_entries,
-                                  unsigned int *underflows,
-                                  unsigned int *i,
+                                  const unsigned char *base,
+                                  const unsigned char *limit,
+                                  const unsigned int *hook_entries,
+                                  const unsigned int *underflows,
                                   const char *name)
 {
+        struct xt_entry_match *ematch;
         struct ip6t_entry_target *t;
         struct xt_target *target;
         unsigned int entry_offset;
@@ -1584,8 +1552,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1605,10 +1573,13 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
         entry_offset = (void *)e - (void *)base;
         j = 0;
-        ret = COMPAT_IP6T_MATCH_ITERATE(e, compat_find_calc_match, name,
-                                        &e->ipv6, e->comefrom, &off, &j);
-        if (ret != 0)
-                goto release_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = compat_find_calc_match(ematch, name,
+                                             &e->ipv6, e->comefrom, &off);
+                if (ret != 0)
+                        goto release_matches;
+                ++j;
+        }
 
         t = compat_ip6t_get_target(e);
         target = try_then_request_module(xt_find_target(AF_INET6,
@@ -1640,14 +1611,16 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
         /* Clear counters and comefrom */
         memset(&e->counters, 0, sizeof(e->counters));
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 
 out:
         module_put(t->u.kernel.target->me);
 release_matches:
-        IP6T_MATCH_ITERATE(e, compat_release_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                module_put(ematch->u.kernel.match->me);
+        }
         return ret;
 }
 
@@ -1661,6 +1634,7 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
         struct ip6t_entry *de;
         unsigned int origsize;
         int ret, h;
+        struct xt_entry_match *ematch;
 
         ret = 0;
         origsize = *size;
@@ -1671,10 +1645,11 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
         *dstptr += sizeof(struct ip6t_entry);
         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
 
-        ret = COMPAT_IP6T_MATCH_ITERATE(e, xt_compat_match_from_user,
-                                        dstptr, size);
-        if (ret)
-                return ret;
+        xt_ematch_foreach(ematch, e) {
+                ret = xt_compat_match_from_user(ematch, dstptr, size);
+                if (ret != 0)
+                        return ret;
+        }
         de->target_offset = e->target_offset - (origsize - *size);
         t = compat_ip6t_get_target(e);
         target = t->u.kernel.target;
@@ -1690,36 +1665,44 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
         return ret;
 }
 
-static int compat_check_entry(struct ip6t_entry *e, const char *name,
-                                     unsigned int *i)
+static int compat_check_entry(struct ip6t_entry *e, struct net *net,
+                              const char *name)
 {
         unsigned int j;
-        int ret;
+        int ret = 0;
         struct xt_mtchk_param mtpar;
+        struct xt_entry_match *ematch;
 
         j = 0;
+        mtpar.net       = net;
         mtpar.table     = name;
         mtpar.entryinfo = &e->ipv6;
         mtpar.hook_mask = e->comefrom;
         mtpar.family    = NFPROTO_IPV6;
-        ret = IP6T_MATCH_ITERATE(e, check_match, &mtpar, &j);
-        if (ret)
-                goto cleanup_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = check_match(ematch, &mtpar);
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
 
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
         if (ret)
                 goto cleanup_matches;
-
-        (*i)++;
         return 0;
 
  cleanup_matches:
-        IP6T_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
         return ret;
 }
 
 static int
-translate_compat_table(const char *name,
+translate_compat_table(struct net *net,
+                       const char *name,
                        unsigned int valid_hooks,
                        struct xt_table_info **pinfo,
                        void **pentry0,
@@ -1731,8 +1714,10 @@ translate_compat_table(const char *name,
         unsigned int i, j;
         struct xt_table_info *newinfo, *info;
         void *pos, *entry0, *entry1;
+        struct compat_ip6t_entry *iter0;
+        struct ip6t_entry *iter1;
         unsigned int size;
-        int ret;
+        int ret = 0;
 
         info = *pinfo;
         entry0 = *pentry0;
@@ -1749,13 +1734,17 @@ translate_compat_table(const char *name,
         j = 0;
         xt_compat_lock(AF_INET6);
         /* Walk through entries, checking offsets. */
-        ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
-                                        check_compat_entry_size_and_hooks,
-                                        info, &size, entry0,
-                                        entry0 + total_size,
-                                        hook_entries, underflows, &j, name);
-        if (ret != 0)
-                goto out_unlock;
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+                                                        entry0,
+                                                        entry0 + total_size,
+                                                        hook_entries,
+                                                        underflows,
+                                                        name);
+                if (ret != 0)
+                        goto out_unlock;
+                ++j;
+        }
 
         ret = -EINVAL;
         if (j != number) {
@@ -1794,9 +1783,12 @@ translate_compat_table(const char *name,
         entry1 = newinfo->entries[raw_smp_processor_id()];
         pos = entry1;
         size = total_size;
-        ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
-                                        compat_copy_entry_from_user,
-                                        &pos, &size, name, newinfo, entry1);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = compat_copy_entry_from_user(iter0, &pos, &size,
+                                                  name, newinfo, entry1);
+                if (ret != 0)
+                        break;
+        }
         xt_compat_flush_offsets(AF_INET6);
         xt_compat_unlock(AF_INET6);
         if (ret)
@@ -1807,13 +1799,32 @@ translate_compat_table(const char *name,
                 goto free_newinfo;
 
         i = 0;
-        ret = IP6T_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                                 name, &i);
+        xt_entry_foreach(iter1, entry1, newinfo->size) {
+                ret = compat_check_entry(iter1, net, name);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
         if (ret) {
+                /*
+                 * The first i matches need cleanup_entry (calls ->destroy)
+                 * because they had called ->check already. The other j-i
+                 * entries need only release.
+                 */
+                int skip = i;
                 j -= i;
-                COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
-                                                   compat_release_entry, &j);
-                IP6T_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+                xt_entry_foreach(iter0, entry0, newinfo->size) {
+                        if (skip-- > 0)
+                                continue;
+                        if (j-- == 0)
+                                break;
+                        compat_release_entry(iter0);
+                }
+                xt_entry_foreach(iter1, entry1, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter1, net);
+                }
                 xt_free_table_info(newinfo);
                 return ret;
         }
@@ -1831,7 +1842,11 @@ translate_compat_table(const char *name,
 free_newinfo:
         xt_free_table_info(newinfo);
 out:
-        COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                if (j-- == 0)
+                        break;
+                compat_release_entry(iter0);
+        }
         return ret;
 out_unlock:
         xt_compat_flush_offsets(AF_INET6);
@@ -1846,6 +1861,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
         struct compat_ip6t_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct ip6t_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1868,7 +1884,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+        ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
                                      &newinfo, &loc_cpu_entry, tmp.size,
                                      tmp.num_entries, tmp.hook_entry,
                                      tmp.underflow);
@@ -1884,7 +1900,8 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
@@ -1933,6 +1950,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
         int ret = 0;
         const void *loc_cpu_entry;
         unsigned int i = 0;
+        struct ip6t_entry *iter;
 
         counters = alloc_counters(table);
         if (IS_ERR(counters))
@@ -1945,9 +1963,12 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         pos = userptr;
         size = total_size;
-        ret = IP6T_ENTRY_ITERATE(loc_cpu_entry, total_size,
-                                 compat_copy_entry_to_user,
-                                 &pos, &size, counters, &i);
+        xt_entry_foreach(iter, loc_cpu_entry, total_size) {
+                ret = compat_copy_entry_to_user(iter, &pos,
+                                                &size, counters, i++);
+                if (ret != 0)
+                        break;
+        }
 
         vfree(counters);
         return ret;
@@ -2121,11 +2142,7 @@ struct xt_table *ip6t_register_table(struct net *net,
         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
         memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-        ret = translate_table(table->name, table->valid_hooks,
-                              newinfo, loc_cpu_entry, repl->size,
-                              repl->num_entries,
-                              repl->hook_entry,
-                              repl->underflow);
+        ret = translate_table(net, newinfo, loc_cpu_entry, repl);
         if (ret != 0)
                 goto out_free;
 
@@ -2142,17 +2159,19 @@ out:
         return ERR_PTR(ret);
 }
 
-void ip6t_unregister_table(struct xt_table *table)
+void ip6t_unregister_table(struct net *net, struct xt_table *table)
 {
         struct xt_table_info *private;
         void *loc_cpu_entry;
         struct module *table_owner = table->me;
+        struct ip6t_entry *iter;
 
         private = xt_unregister_table(table);
 
         /* Decrease module usage counts and free resources */
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
-        IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size)
+                cleanup_entry(iter, net);
         if (private->number > private->initial_entries)
                 module_put(table_owner);
         xt_free_table_info(private);
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 7018cac4fddc..b285fdf19050 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -249,8 +249,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 /* Max length: 11 "URGP=65535 " */
                 printk("URGP=%u ", ntohs(th->urg_ptr));
 
-                if ((logflags & IP6T_LOG_TCPOPT)
-                    && th->doff * 4 > sizeof(struct tcphdr)) {
+                if ((logflags & IP6T_LOG_TCPOPT) &&
+                    th->doff * 4 > sizeof(struct tcphdr)) {
                         u_int8_t _opt[60 - sizeof(struct tcphdr)];
                         const u_int8_t *op;
                         unsigned int i;
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 5a7f00cd15ce..39b50c3768e8 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -15,6 +15,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 
+#include <linux/gfp.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/icmpv6.h>
@@ -169,7 +170,7 @@ send_unreach(struct net *net, struct sk_buff *skb_in, unsigned char code,
         if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
                 skb_in->dev = net->loopback_dev;
 
-        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
+        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);
 }
 
 static unsigned int
@@ -223,8 +224,8 @@ static bool reject_tg6_check(const struct xt_tgchk_param *par)
                 return false;
         } else if (rejinfo->with == IP6T_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
-                if (e->ipv6.proto != IPPROTO_TCP
-                    || (e->ipv6.invflags & XT_INV_PROTO)) {
+                if (e->ipv6.proto != IPPROTO_TCP ||
+                    (e->ipv6.invflags & XT_INV_PROTO)) {
                         printk("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
                         return false;
                 }
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 3a82f24746b9..ac0b7c629d78 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -77,17 +77,14 @@ static bool ah_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                  ahinfo->hdrres, ah->reserved,
                  !(ahinfo->hdrres && ah->reserved));
 
-        return (ah != NULL)
-               &&
-               spi_match(ahinfo->spis[0], ahinfo->spis[1],
-                         ntohl(ah->spi),
-                         !!(ahinfo->invflags & IP6T_AH_INV_SPI))
-               &&
-               (!ahinfo->hdrlen ||
-                (ahinfo->hdrlen == hdrlen) ^
-                !!(ahinfo->invflags & IP6T_AH_INV_LEN))
-               &&
-               !(ahinfo->hdrres && ah->reserved);
+        return (ah != NULL) &&
+                spi_match(ahinfo->spis[0], ahinfo->spis[1],
+                          ntohl(ah->spi),
+                          !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&
+                (!ahinfo->hdrlen ||
+                 (ahinfo->hdrlen == hdrlen) ^
+                 !!(ahinfo->invflags & IP6T_AH_INV_LEN)) &&
+                !(ahinfo->hdrres && ah->reserved);
 }
 
 static bool ah_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 673aa0a5084e..7b91c2598ed5 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -70,41 +70,36 @@ frag_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
         pr_debug("res %02X %02X%04X %02X ",
                  fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
                  ntohs(fh->frag_off) & 0x6,
-                 !((fraginfo->flags & IP6T_FRAG_RES)
-                   && (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
+                 !((fraginfo->flags & IP6T_FRAG_RES) &&
+                   (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
         pr_debug("first %02X %02X %02X ",
                  fraginfo->flags & IP6T_FRAG_FST,
                  ntohs(fh->frag_off) & ~0x7,
-                 !((fraginfo->flags & IP6T_FRAG_FST)
-                   && (ntohs(fh->frag_off) & ~0x7)));
+                 !((fraginfo->flags & IP6T_FRAG_FST) &&
+                   (ntohs(fh->frag_off) & ~0x7)));
         pr_debug("mf %02X %02X %02X ",
                  fraginfo->flags & IP6T_FRAG_MF,
                  ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_MF)
-                   && !((ntohs(fh->frag_off) & IP6_MF))));
+                 !((fraginfo->flags & IP6T_FRAG_MF) &&
+                   !((ntohs(fh->frag_off) & IP6_MF))));
         pr_debug("last %02X %02X %02X\n",
                  fraginfo->flags & IP6T_FRAG_NMF,
                  ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_NMF)
-                   && (ntohs(fh->frag_off) & IP6_MF)));
-
-        return (fh != NULL)
-               &&
-               id_match(fraginfo->ids[0], fraginfo->ids[1],
-                        ntohl(fh->identification),
-                        !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_RES)
-                 && (fh->reserved || (ntohs(fh->frag_off) & 0x6)))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_FST)
-                 && (ntohs(fh->frag_off) & ~0x7))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_MF)
-                 && !(ntohs(fh->frag_off) & IP6_MF))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_NMF)
-                 && (ntohs(fh->frag_off) & IP6_MF));
+                 !((fraginfo->flags & IP6T_FRAG_NMF) &&
+                   (ntohs(fh->frag_off) & IP6_MF)));
+
+        return (fh != NULL) &&
+                id_match(fraginfo->ids[0], fraginfo->ids[1],
+                         ntohl(fh->identification),
+                         !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) &&
+                !((fraginfo->flags & IP6T_FRAG_RES) &&
+                  (fh->reserved || (ntohs(fh->frag_off) & 0x6))) &&
+                !((fraginfo->flags & IP6T_FRAG_FST) &&
+                  (ntohs(fh->frag_off) & ~0x7)) &&
+                !((fraginfo->flags & IP6T_FRAG_MF) &&
+                  !(ntohs(fh->frag_off) & IP6_MF)) &&
+                !((fraginfo->flags & IP6T_FRAG_NMF) &&
+                  (ntohs(fh->frag_off) & IP6_MF));
 }
 
 static bool frag_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 356b8d6f6baa..b77307fc8743 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -92,16 +92,13 @@ static bool rt_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                  !((rtinfo->flags & IP6T_RT_RES) &&
                    (((const struct rt0_hdr *)rh)->reserved)));
 
-        ret = (rh != NULL)
-              &&
+        ret = (rh != NULL) &&
               (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
                               rh->segments_left,
-                              !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
-              &&
+                              !!(rtinfo->invflags & IP6T_RT_INV_SGS))) &&
               (!(rtinfo->flags & IP6T_RT_LEN) ||
                ((rtinfo->hdrlen == hdrlen) ^
-                !!(rtinfo->invflags & IP6T_RT_INV_LEN)))
-              &&
+                !!(rtinfo->invflags & IP6T_RT_INV_LEN))) &&
               (!(rtinfo->flags & IP6T_RT_TYP) ||
                ((rtinfo->rt_type == rh->type) ^
                 !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 6f4383ad86f9..d6fc9aff3163 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -21,99 +22,26 @@ MODULE_DESCRIPTION("ip6tables filter table");
                             (1 << NF_INET_FORWARD) | \
                             (1 << NF_INET_LOCAL_OUT))
 
-static struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[3];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "filter",
-                .valid_hooks = FILTER_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
-
 static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_IPV6,
+        .priority       = NF_IP6_PRI_FILTER,
 };
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ip6t_in_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_filter);
-}
-
-static unsigned int
-ip6t_local_out_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
+ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
+                     const struct net_device *in, const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
 {
-#if 0
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("ip6t_hook: happy cracking.\n");
-                return NF_ACCEPT;
-        }
-#endif
+        const struct net *net = dev_net((in != NULL) ? in : out);
 
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv6.ip6table_filter);
+        return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
 }
 
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP6_PRI_FILTER,
-        },
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP6_PRI_FILTER,
-        },
-        {
-                .hook           = ip6t_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_FILTER,
-        },
-};
+static struct nf_hook_ops *filter_ops __read_mostly;
 
 /* Default to forward because I got too much mail already. */
 static int forward = NF_ACCEPT;
@@ -121,9 +49,18 @@ module_param(forward, bool, 0000);
 
 static int __net_init ip6table_filter_net_init(struct net *net)
 {
-        /* Register table */
+        struct ip6t_replace *repl;
+
+        repl = ip6t_alloc_initial_table(&packet_filter);
+        if (repl == NULL)
+                return -ENOMEM;
+        /* Entry 1 is the FORWARD hook */
+        ((struct ip6t_standard *)repl->entries)[1].target.verdict =
+                -forward - 1;
+
         net->ipv6.ip6table_filter =
-                ip6t_register_table(net, &packet_filter, &initial_table.repl);
+                ip6t_register_table(net, &packet_filter, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv6.ip6table_filter))
                 return PTR_ERR(net->ipv6.ip6table_filter);
         return 0;
@@ -131,7 +68,7 @@ static int __net_init ip6table_filter_net_init(struct net *net)
 
 static void __net_exit ip6table_filter_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_filter);
+        ip6t_unregister_table(net, net->ipv6.ip6table_filter);
 }
 
 static struct pernet_operations ip6table_filter_net_ops = {
@@ -148,17 +85,16 @@ static int __init ip6table_filter_init(void)
                 return -EINVAL;
         }
 
-        /* Entry 1 is the FORWARD hook */
-        initial_table.entries[1].target.verdict = -forward - 1;
-
         ret = register_pernet_subsys(&ip6table_filter_net_ops);
         if (ret < 0)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
-        if (ret < 0)
+        filter_ops = xt_hook_link(&packet_filter, ip6table_filter_hook);
+        if (IS_ERR(filter_ops)) {
+                ret = PTR_ERR(filter_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -169,7 +105,7 @@ static int __init ip6table_filter_init(void)
 
 static void __exit ip6table_filter_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&packet_filter, filter_ops);
         unregister_pernet_subsys(&ip6table_filter_net_ops);
 }
 
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 0ad91433ed61..6a102b57f356 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -10,6 +10,7 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -21,80 +22,17 @@ MODULE_DESCRIPTION("ip6tables mangle table");
                             (1 << NF_INET_LOCAL_OUT) | \
                             (1 << NF_INET_POST_ROUTING))
 
-static const struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[5];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "mangle",
-                .valid_hooks = MANGLE_VALID_HOOKS,
-                .num_entries = 6,
-                .size = sizeof(struct ip6t_standard) * 5 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ip6t_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ip6t_standard) * 4,
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ip6t_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ip6t_standard) * 4,
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* PRE_ROUTING */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* POST_ROUTING */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
-
 static const struct xt_table packet_mangler = {
         .name           = "mangle",
         .valid_hooks    = MANGLE_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_IPV6,
+        .priority       = NF_IP6_PRI_MANGLE,
 };
 
-/* The work comes in here from netfilter.c. */
-static unsigned int
-ip6t_in_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_mangle);
-}
-
-static unsigned int
-ip6t_post_routing_hook(unsigned int hook,
-                struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv6.ip6table_mangle);
-}
-
 static unsigned int
-ip6t_local_out_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
+ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
 {
-
         unsigned int ret;
         struct in6_addr saddr, daddr;
         u_int8_t hop_limit;
@@ -102,8 +40,8 @@ ip6t_local_out_hook(unsigned int hook,
 
 #if 0
         /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                 if (net_ratelimit())
                         printk("ip6t_hook: happy cracking.\n");
                 return NF_ACCEPT;
@@ -119,62 +57,46 @@ ip6t_local_out_hook(unsigned int hook,
         /* flowlabel and prio (includes version, which shouldn't change either */
         flowlabel = *((u_int32_t *)ipv6_hdr(skb));
 
-        ret = ip6t_do_table(skb, hook, in, out,
+        ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, NULL, out,
                             dev_net(out)->ipv6.ip6table_mangle);
 
-        if (ret != NF_DROP && ret != NF_STOLEN
-                && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
-                    || memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr))
-                    || skb->mark != mark
-                    || ipv6_hdr(skb)->hop_limit != hop_limit))
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
+             memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
+             skb->mark != mark ||
+             ipv6_hdr(skb)->hop_limit != hop_limit))
                 return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
 
         return ret;
 }
 
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-        {
-                .hook           = ip6t_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-        {
-                .hook           = ip6t_post_routing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_POST_ROUTING,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-};
+/* The work comes in here from netfilter.c. */
+static unsigned int
+ip6table_mangle_hook(unsigned int hook, struct sk_buff *skb,
+                     const struct net_device *in, const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
+{
+        if (hook == NF_INET_LOCAL_OUT)
+                return ip6t_mangle_out(skb, out);
+        if (hook == NF_INET_POST_ROUTING)
+                return ip6t_do_table(skb, hook, in, out,
+                                     dev_net(out)->ipv6.ip6table_mangle);
+        /* INPUT/FORWARD */
+        return ip6t_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv6.ip6table_mangle);
+}
 
+static struct nf_hook_ops *mangle_ops __read_mostly;
 static int __net_init ip6table_mangle_net_init(struct net *net)
 {
-        /* Register table */
+        struct ip6t_replace *repl;
+
+        repl = ip6t_alloc_initial_table(&packet_mangler);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv6.ip6table_mangle =
-                ip6t_register_table(net, &packet_mangler, &initial_table.repl);
+                ip6t_register_table(net, &packet_mangler, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv6.ip6table_mangle))
                 return PTR_ERR(net->ipv6.ip6table_mangle);
         return 0;
@@ -182,7 +104,7 @@ static int __net_init ip6table_mangle_net_init(struct net *net)
 
 static void __net_exit ip6table_mangle_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_mangle);
+        ip6t_unregister_table(net, net->ipv6.ip6table_mangle);
 }
 
 static struct pernet_operations ip6table_mangle_net_ops = {
@@ -199,9 +121,11 @@ static int __init ip6table_mangle_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
-        if (ret < 0)
+        mangle_ops = xt_hook_link(&packet_mangler, ip6table_mangle_hook);
+        if (IS_ERR(mangle_ops)) {
+                ret = PTR_ERR(mangle_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -212,7 +136,7 @@ static int __init ip6table_mangle_init(void)
 
 static void __exit ip6table_mangle_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&packet_mangler, mangle_ops);
         unregister_pernet_subsys(&ip6table_mangle_net_ops);
 }
 
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index ed1a1180f3b3..5b9926a011bd 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -5,88 +5,41 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 
 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
 
-static const struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[2];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "raw",
-                .valid_hooks = RAW_VALID_HOOKS,
-                .num_entries = 3,
-                .size = sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* PRE_ROUTING */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
-
 static const struct xt_table packet_raw = {
         .name = "raw",
         .valid_hooks = RAW_VALID_HOOKS,
         .me = THIS_MODULE,
         .af = NFPROTO_IPV6,
+        .priority = NF_IP6_PRI_RAW,
 };
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ip6t_pre_routing_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
+ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
+                  const struct net_device *in, const struct net_device *out,
+                  int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_raw);
-}
+        const struct net *net = dev_net((in != NULL) ? in : out);
 
-static unsigned int
-ip6t_local_out_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv6.ip6table_raw);
+        return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_raw);
 }
 
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
-        {
-          .hook = ip6t_pre_routing_hook,
-          .pf = NFPROTO_IPV6,
-          .hooknum = NF_INET_PRE_ROUTING,
-          .priority = NF_IP6_PRI_FIRST,
-          .owner = THIS_MODULE,
-        },
-        {
-          .hook = ip6t_local_out_hook,
-          .pf = NFPROTO_IPV6,
-          .hooknum = NF_INET_LOCAL_OUT,
-          .priority = NF_IP6_PRI_FIRST,
-          .owner = THIS_MODULE,
-        },
-};
+static struct nf_hook_ops *rawtable_ops __read_mostly;
 
 static int __net_init ip6table_raw_net_init(struct net *net)
 {
-        /* Register table */
+        struct ip6t_replace *repl;
+
+        repl = ip6t_alloc_initial_table(&packet_raw);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv6.ip6table_raw =
-                ip6t_register_table(net, &packet_raw, &initial_table.repl);
+                ip6t_register_table(net, &packet_raw, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv6.ip6table_raw))
                 return PTR_ERR(net->ipv6.ip6table_raw);
         return 0;
@@ -94,7 +47,7 @@ static int __net_init ip6table_raw_net_init(struct net *net)
 
 static void __net_exit ip6table_raw_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_raw);
+        ip6t_unregister_table(net, net->ipv6.ip6table_raw);
 }
 
 static struct pernet_operations ip6table_raw_net_ops = {
@@ -111,9 +64,11 @@ static int __init ip6table_raw_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
-        if (ret < 0)
+        rawtable_ops = xt_hook_link(&packet_raw, ip6table_raw_hook);
+        if (IS_ERR(rawtable_ops)) {
+                ret = PTR_ERR(rawtable_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -124,7 +79,7 @@ static int __init ip6table_raw_init(void)
 
 static void __exit ip6table_raw_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&packet_raw, rawtable_ops);
         unregister_pernet_subsys(&ip6table_raw_net_ops);
 }
 
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 41b444c60934..91aa2b4d83c9 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -17,6 +17,7 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
@@ -26,106 +27,37 @@ MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
                                 (1 << NF_INET_FORWARD) | \
                                 (1 << NF_INET_LOCAL_OUT)
 
-static const struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[3];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "security",
-                .valid_hooks = SECURITY_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
-
 static const struct xt_table security_table = {
         .name           = "security",
         .valid_hooks    = SECURITY_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_IPV6,
+        .priority       = NF_IP6_PRI_SECURITY,
 };
 
 static unsigned int
-ip6t_local_in_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_security);
-}
-
-static unsigned int
-ip6t_forward_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
+ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
+                       const struct net_device *in,
+                       const struct net_device *out,
+                       int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_security);
-}
+        const struct net *net = dev_net((in != NULL) ? in : out);
 
-static unsigned int
-ip6t_local_out_hook(unsigned int hook,
-                    struct sk_buff *skb,
-                    const struct net_device *in,
-                    const struct net_device *out,
-                    int (*okfn)(struct sk_buff *))
-{
-        /* TBD: handle short packets via raw socket */
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv6.ip6table_security);
+        return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_security);
 }
 
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
-        {
-                .hook           = ip6t_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP6_PRI_SECURITY,
-        },
-        {
-                .hook           = ip6t_forward_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP6_PRI_SECURITY,
-        },
-        {
-                .hook           = ip6t_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_SECURITY,
-        },
-};
+static struct nf_hook_ops *sectbl_ops __read_mostly;
 
 static int __net_init ip6table_security_net_init(struct net *net)
 {
-        net->ipv6.ip6table_security =
-                ip6t_register_table(net, &security_table, &initial_table.repl);
+        struct ip6t_replace *repl;
 
+        repl = ip6t_alloc_initial_table(&security_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv6.ip6table_security =
+                ip6t_register_table(net, &security_table, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv6.ip6table_security))
                 return PTR_ERR(net->ipv6.ip6table_security);
 
@@ -134,7 +66,7 @@ static int __net_init ip6table_security_net_init(struct net *net)
 
 static void __net_exit ip6table_security_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_security);
+        ip6t_unregister_table(net, net->ipv6.ip6table_security);
 }
 
 static struct pernet_operations ip6table_security_net_ops = {
@@ -150,9 +82,11 @@ static int __init ip6table_security_init(void)
         if (ret < 0)
                 return ret;
 
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
-        if (ret < 0)
+        sectbl_ops = xt_hook_link(&security_table, ip6table_security_hook);
+        if (IS_ERR(sectbl_ops)) {
+                ret = PTR_ERR(sectbl_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -163,7 +97,7 @@ cleanup_table:
 
 static void __exit ip6table_security_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&security_table, sectbl_ops);
         unregister_pernet_subsys(&ip6table_security_net_ops);
 }
 
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 5f2ec208a8c3..996c3f41fecd 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -20,12 +20,14 @@
 #include <net/ipv6.h>
 #include <net/inet_frag.h>
 
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 #include <net/netfilter/nf_log.h>
 
@@ -187,6 +189,26 @@ out:
         return nf_conntrack_confirm(skb);
 }
 
+static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
+                                                struct sk_buff *skb)
+{
+        u16 zone = NF_CT_DEFAULT_ZONE;
+
+        if (skb->nfct)
+                zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP6_DEFRAG_CONNTRACK_IN + zone;
+        else
+                return IP6_DEFRAG_CONNTRACK_OUT + zone;
+
+}
+
 static unsigned int ipv6_defrag(unsigned int hooknum,
                                 struct sk_buff *skb,
                                 const struct net_device *in,
@@ -196,11 +218,10 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
         struct sk_buff *reasm;
 
         /* Previously seen (loopback)?  */
-        if (skb->nfct)
+        if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
                 return NF_ACCEPT;
 
-        reasm = nf_ct_frag6_gather(skb);
-
+        reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
         /* queued */
         if (reasm == NULL)
                 return NF_STOLEN;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 642dcb127bab..9be81776415e 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -23,6 +23,7 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 #include <net/netfilter/nf_log.h>
 
@@ -128,7 +129,7 @@ static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb,
 }
 
 static int
-icmpv6_error_message(struct net *net,
+icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
                      struct sk_buff *skb,
                      unsigned int icmp6off,
                      enum ip_conntrack_info *ctinfo,
@@ -137,6 +138,7 @@ icmpv6_error_message(struct net *net,
         struct nf_conntrack_tuple intuple, origtuple;
         const struct nf_conntrack_tuple_hash *h;
         const struct nf_conntrack_l4proto *inproto;
+        u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
 
         NF_CT_ASSERT(skb->nfct == NULL);
 
@@ -163,7 +165,7 @@ icmpv6_error_message(struct net *net,
 
         *ctinfo = IP_CT_RELATED;
 
-        h = nf_conntrack_find_get(net, &intuple);
+        h = nf_conntrack_find_get(net, zone, &intuple);
         if (!h) {
                 pr_debug("icmpv6_error: no match\n");
                 return -NF_ACCEPT;
@@ -179,7 +181,8 @@ icmpv6_error_message(struct net *net,
 }
 
 static int
-icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
+icmpv6_error(struct net *net, struct nf_conn *tmpl,
+             struct sk_buff *skb, unsigned int dataoff,
              enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
 {
         const struct icmp6hdr *icmp6h;
@@ -215,7 +218,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
         if (icmp6h->icmp6_type >= 128)
                 return NF_ACCEPT;
 
-        return icmpv6_error_message(net, skb, dataoff, ctinfo, hooknum);
+        return icmpv6_error_message(net, tmpl, skb, dataoff, ctinfo, hooknum);
 }
 
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
@@ -244,18 +247,18 @@ static const struct nla_policy icmpv6_nla_policy[CTA_PROTO_MAX+1] = {
 static int icmpv6_nlattr_to_tuple(struct nlattr *tb[],
                                 struct nf_conntrack_tuple *tuple)
 {
-        if (!tb[CTA_PROTO_ICMPV6_TYPE]
-            || !tb[CTA_PROTO_ICMPV6_CODE]
-            || !tb[CTA_PROTO_ICMPV6_ID])
+        if (!tb[CTA_PROTO_ICMPV6_TYPE] ||
+            !tb[CTA_PROTO_ICMPV6_CODE] ||
+            !tb[CTA_PROTO_ICMPV6_ID])
                 return -EINVAL;
 
         tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMPV6_TYPE]);
         tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMPV6_CODE]);
         tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMPV6_ID]);
 
-        if (tuple->dst.u.icmp.type < 128
-            || tuple->dst.u.icmp.type - 128 >= sizeof(invmap)
-            || !invmap[tuple->dst.u.icmp.type - 128])
+        if (tuple->dst.u.icmp.type < 128 ||
+            tuple->dst.u.icmp.type - 128 >= sizeof(invmap) ||
+            !invmap[tuple->dst.u.icmp.type - 128])
                 return -EINVAL;
 
         return 0;
@@ -277,9 +280,7 @@ static struct ctl_table icmpv6_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #endif /* CONFIG_SYSCTL */
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index f3aba255ad9f..dd5b9bd61c62 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -27,6 +27,7 @@
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -45,9 +46,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
-#define NF_CT_FRAG6_HIGH_THRESH 262144 /* == 256*1024 */
-#define NF_CT_FRAG6_LOW_THRESH 196608  /* == 192*1024 */
-#define NF_CT_FRAG6_TIMEOUT IPV6_FRAG_TIMEOUT
 
 struct nf_ct_frag6_skb_cb
 {
@@ -63,6 +61,7 @@ struct nf_ct_frag6_queue
         struct inet_frag_queue  q;
 
         __be32                  id;             /* fragment id          */
+        u32                     user;
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
@@ -83,7 +82,6 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_FRAG6_LOW_THRESH,
                 .procname       = "nf_conntrack_frag6_low_thresh",
                 .data           = &nf_init_frags.low_thresh,
                 .maxlen         = sizeof(unsigned int),
@@ -91,14 +89,13 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
                 .procname       = "nf_conntrack_frag6_high_thresh",
                 .data           = &nf_init_frags.high_thresh,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0 }
+        { }
 };
 #endif
 
@@ -170,13 +167,14 @@ out:
 /* Creation primitives. */
 
 static __inline__ struct nf_ct_frag6_queue *
-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
 {
         struct inet_frag_queue *q;
         struct ip6_create_arg arg;
         unsigned int hash;
 
         arg.id = id;
+        arg.user = user;
         arg.src = src;
         arg.dst = dst;
 
@@ -472,7 +470,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */
         fp = skb_shinfo(head)->frag_list;
-        if (NFCT_FRAG6_CB(fp)->orig == NULL)
+        if (fp && NFCT_FRAG6_CB(fp)->orig == NULL)
                 /* at above code, head skb is divided into two skbs. */
                 fp = fp->next;
 
@@ -561,7 +559,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
         return 0;
 }
 
-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
+struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
 {
         struct sk_buff *clone;
         struct net_device *dev = skb->dev;
@@ -598,16 +596,10 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
         hdr = ipv6_hdr(clone);
         fhdr = (struct frag_hdr *)skb_transport_header(clone);
 
-        if (!(fhdr->frag_off & htons(0xFFF9))) {
-                pr_debug("Invalid fragment offset\n");
-                /* It is not a fragmented frame */
-                goto ret_orig;
-        }
-
         if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
                 nf_ct_frag6_evictor();
 
-        fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
+        fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
         if (fq == NULL) {
                 pr_debug("Can't find and can't create new queue\n");
                 goto ret_orig;
@@ -670,8 +662,8 @@ int nf_ct_frag6_init(void)
         nf_frags.frag_expire = nf_ct_frag6_expire;
         nf_frags.secret_interval = 10 * 60 * HZ;
         nf_init_frags.timeout = IPV6_FRAG_TIMEOUT;
-        nf_init_frags.high_thresh = 256 * 1024;
-        nf_init_frags.low_thresh = 192 * 1024;
+        nf_init_frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
+        nf_init_frags.low_thresh = IPV6_FRAG_LOW_THRESH;
         inet_frags_init_net(&nf_init_frags);
         inet_frags_init(&nf_frags);
 
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index c9605c3ad91f..58344c0fbd13 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -59,7 +59,7 @@ static const struct file_operations sockstat6_seq_fops = {
         .release = single_release_net,
 };
 
-static struct snmp_mib snmp6_ipstats_list[] = {
+static const struct snmp_mib snmp6_ipstats_list[] = {
 /* ipv6 mib according to RFC 2465 */
         SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INPKTS),
         SNMP_MIB_ITEM("Ip6InHdrErrors", IPSTATS_MIB_INHDRERRORS),
@@ -92,7 +92,7 @@ static struct snmp_mib snmp6_ipstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static struct snmp_mib snmp6_icmp6_list[] = {
+static const struct snmp_mib snmp6_icmp6_list[] = {
 /* icmpv6 mib according to RFC 2466 */
         SNMP_MIB_ITEM("Icmp6InMsgs", ICMP6_MIB_INMSGS),
         SNMP_MIB_ITEM("Icmp6InErrors", ICMP6_MIB_INERRORS),
@@ -120,7 +120,7 @@ static const char *const icmp6type2name[256] = {
 };
 
 
-static struct snmp_mib snmp6_udp6_list[] = {
+static const struct snmp_mib snmp6_udp6_list[] = {
         SNMP_MIB_ITEM("Udp6InDatagrams", UDP_MIB_INDATAGRAMS),
         SNMP_MIB_ITEM("Udp6NoPorts", UDP_MIB_NOPORTS),
         SNMP_MIB_ITEM("Udp6InErrors", UDP_MIB_INERRORS),
@@ -128,7 +128,7 @@ static struct snmp_mib snmp6_udp6_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static struct snmp_mib snmp6_udplite6_list[] = {
+static const struct snmp_mib snmp6_udplite6_list[] = {
         SNMP_MIB_ITEM("UdpLite6InDatagrams", UDP_MIB_INDATAGRAMS),
         SNMP_MIB_ITEM("UdpLite6NoPorts", UDP_MIB_NOPORTS),
         SNMP_MIB_ITEM("UdpLite6InErrors", UDP_MIB_INERRORS),
@@ -136,7 +136,7 @@ static struct snmp_mib snmp6_udplite6_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
+static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void __percpu **mib)
 {
         char name[32];
         int i;
@@ -170,8 +170,8 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
         return;
 }
 
-static inline void
-snmp6_seq_show_item(struct seq_file *seq, void **mib, struct snmp_mib *itemlist)
+static void snmp6_seq_show_item(struct seq_file *seq, void __percpu **mib,
+                                const struct snmp_mib *itemlist)
 {
         int i;
         for (i=0; itemlist[i].name; i++)
@@ -183,14 +183,15 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
 {
         struct net *net = (struct net *)seq->private;
 
-        snmp6_seq_show_item(seq, (void **)net->mib.ipv6_statistics,
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.ipv6_statistics,
                             snmp6_ipstats_list);
-        snmp6_seq_show_item(seq, (void **)net->mib.icmpv6_statistics,
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.icmpv6_statistics,
                             snmp6_icmp6_list);
-        snmp6_seq_show_icmpv6msg(seq, (void **)net->mib.icmpv6msg_statistics);
-        snmp6_seq_show_item(seq, (void **)net->mib.udp_stats_in6,
+        snmp6_seq_show_icmpv6msg(seq,
+                            (void __percpu **)net->mib.icmpv6msg_statistics);
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udp_stats_in6,
                             snmp6_udp6_list);
-        snmp6_seq_show_item(seq, (void **)net->mib.udplite_stats_in6,
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udplite_stats_in6,
                             snmp6_udplite6_list);
         return 0;
 }
@@ -213,9 +214,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
         struct inet6_dev *idev = (struct inet6_dev *)seq->private;
 
         seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
-        snmp6_seq_show_item(seq, (void **)idev->stats.ipv6, snmp6_ipstats_list);
-        snmp6_seq_show_item(seq, (void **)idev->stats.icmpv6, snmp6_icmp6_list);
-        snmp6_seq_show_icmpv6msg(seq, (void **)idev->stats.icmpv6msg);
+        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.ipv6,
+                            snmp6_ipstats_list);
+        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.icmpv6,
+                            snmp6_icmp6_list);
+        snmp6_seq_show_icmpv6msg(seq, (void __percpu **)idev->stats.icmpv6msg);
         return 0;
 }
 
@@ -259,7 +262,7 @@ int snmp6_unregister_dev(struct inet6_dev *idev)
         struct net *net = dev_net(idev->dev);
         if (!net->mib.proc_net_devsnmp6)
                 return -ENOENT;
-        if (!idev || !idev->stats.proc_dir_entry)
+        if (!idev->stats.proc_dir_entry)
                 return -EINVAL;
         remove_proc_entry(idev->stats.proc_dir_entry->name,
                           net->mib.proc_net_devsnmp6);
@@ -267,7 +270,7 @@ int snmp6_unregister_dev(struct inet6_dev *idev)
         return 0;
 }
 
-static int ipv6_proc_init_net(struct net *net)
+static int __net_init ipv6_proc_init_net(struct net *net)
 {
         if (!proc_net_fops_create(net, "sockstat6", S_IRUGO,
                         &sockstat6_seq_fops))
@@ -288,7 +291,7 @@ proc_dev_snmp6_fail:
         return -ENOMEM;
 }
 
-static void ipv6_proc_exit_net(struct net *net)
+static void __net_exit ipv6_proc_exit_net(struct net *net)
 {
         proc_net_remove(net, "sockstat6");
         proc_net_remove(net, "dev_snmp6");
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4f24570b0869..8763b1a0814a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -21,6 +21,7 @@
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
 #include <linux/in6.h>
@@ -72,7 +73,7 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
         int is_multicast = ipv6_addr_is_multicast(loc_addr);
 
         sk_for_each_from(sk, node)
-                if (inet_sk(sk)->num == num) {
+                if (inet_sk(sk)->inet_num == num) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
 
                         if (!net_eq(sock_net(sk), net))
@@ -249,7 +250,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
         /* Raw sockets are IPv6 only */
         if (addr_type == IPV6_ADDR_MAPPED)
-                return(-EADDRNOTAVAIL);
+                return -EADDRNOTAVAIL;
 
         lock_sock(sk);
 
@@ -257,6 +258,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (sk->sk_state != TCP_CLOSE)
                 goto out;
 
+        rcu_read_lock();
         /* Check if the address belongs to the host. */
         if (addr_type != IPV6_ADDR_ANY) {
                 struct net_device *dev = NULL;
@@ -272,13 +274,13 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
                         /* Binding to link-local address requires an interface */
                         if (!sk->sk_bound_dev_if)
-                                goto out;
+                                goto out_unlock;
 
-                        dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
-                        if (!dev) {
-                                err = -ENODEV;
-                                goto out;
-                        }
+                        err = -ENODEV;
+                        dev = dev_get_by_index_rcu(sock_net(sk),
+                                                   sk->sk_bound_dev_if);
+                        if (!dev)
+                                goto out_unlock;
                 }
 
                 /* ipv4 addr of the socket is invalid.  Only the
@@ -289,20 +291,18 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                         err = -EADDRNOTAVAIL;
                         if (!ipv6_chk_addr(sock_net(sk), &addr->sin6_addr,
                                            dev, 0)) {
-                                if (dev)
-                                        dev_put(dev);
-                                goto out;
+                                goto out_unlock;
                         }
                 }
-                if (dev)
-                        dev_put(dev);
         }
 
-        inet->rcv_saddr = inet->saddr = v4addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
         ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
         if (!(addr_type & IPV6_ADDR_MULTICAST))
                 ipv6_addr_copy(&np->saddr, &addr->sin6_addr);
         err = 0;
+out_unlock:
+        rcu_read_unlock();
 out:
         release_sock(sk);
         return err;
@@ -381,8 +381,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
         }
 
         /* Charge it to the socket. */
-        if (sock_queue_rcv_skb(sk,skb)<0) {
-                atomic_inc(&sk->sk_drops);
+        if (sock_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -416,14 +415,14 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
                                    skb_network_header_len(skb));
                 if (!csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                      &ipv6_hdr(skb)->daddr,
-                                     skb->len, inet->num, skb->csum))
+                                     skb->len, inet->inet_num, skb->csum))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
         if (!skb_csum_unnecessary(skb))
                 skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                                          &ipv6_hdr(skb)->daddr,
                                                          skb->len,
-                                                         inet->num, 0));
+                                                         inet->inet_num, 0));
 
         if (inet->hdrincl) {
                 if (skb_checksum_complete(skb)) {
@@ -497,7 +496,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                         sin6->sin6_scope_id = IP6CB(skb)->iif;
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (np->rxopt.all)
                 datagram_recv_ctl(sk, msg, skb);
@@ -518,7 +517,6 @@ csum_copy_err:
            as some normal condition.
          */
         err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-        atomic_inc(&sk->sk_drops);
         goto out;
 }
 
@@ -766,8 +764,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 proto = ntohs(sin6->sin6_port);
 
                 if (!proto)
-                        proto = inet->num;
-                else if (proto != inet->num)
+                        proto = inet->inet_num;
+                else if (proto != inet->inet_num)
                         return(-EINVAL);
 
                 if (proto > 255)
@@ -800,7 +798,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
 
-                proto = inet->num;
+                proto = inet->inet_num;
                 daddr = &np->daddr;
                 fl.fl6_flowlabel = np->flow_label;
         }
@@ -967,7 +965,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
 
         switch (optname) {
                 case IPV6_CHECKSUM:
-                        if (inet_sk(sk)->num == IPPROTO_ICMPV6 &&
+                        if (inet_sk(sk)->inet_num == IPPROTO_ICMPV6 &&
                             level == IPPROTO_IPV6) {
                                 /*
                                  * RFC3542 tells that IPV6_CHECKSUM socket
@@ -1007,7 +1005,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
                         break;
 
                 case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                 return -EOPNOTSUPP;
                         return rawv6_seticmpfilter(sk, level, optname, optval,
                                                    optlen);
@@ -1030,7 +1028,7 @@ static int compat_rawv6_setsockopt(struct sock *sk, int level, int optname,
         case SOL_RAW:
                 break;
         case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                         return -EOPNOTSUPP;
                 return rawv6_seticmpfilter(sk, level, optname, optval, optlen);
         case SOL_IPV6:
@@ -1087,7 +1085,7 @@ static int rawv6_getsockopt(struct sock *sk, int level, int optname,
                         break;
 
                 case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                 return -EOPNOTSUPP;
                         return rawv6_geticmpfilter(sk, level, optname, optval,
                                                    optlen);
@@ -1110,7 +1108,7 @@ static int compat_rawv6_getsockopt(struct sock *sk, int level, int optname,
         case SOL_RAW:
                 break;
         case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                         return -EOPNOTSUPP;
                 return rawv6_geticmpfilter(sk, level, optname, optval, optlen);
         case SOL_IPV6:
@@ -1157,7 +1155,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
 static void rawv6_close(struct sock *sk, long timeout)
 {
-        if (inet_sk(sk)->num == IPPROTO_RAW)
+        if (inet_sk(sk)->inet_num == IPPROTO_RAW)
                 ip6_ra_control(sk, -1);
         ip6mr_sk_done(sk);
         sk_common_release(sk);
@@ -1176,7 +1174,7 @@ static int rawv6_init_sk(struct sock *sk)
 {
         struct raw6_sock *rp = raw6_sk(sk);
 
-        switch (inet_sk(sk)->num) {
+        switch (inet_sk(sk)->inet_num) {
         case IPPROTO_ICMPV6:
                 rp->checksum = 1;
                 rp->offset   = 2;
@@ -1226,7 +1224,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
         dest  = &np->daddr;
         src   = &np->rcv_saddr;
         destp = 0;
-        srcp  = inet_sk(sp)->num;
+        srcp  = inet_sk(sp)->inet_num;
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
@@ -1278,7 +1276,7 @@ static const struct file_operations raw6_seq_fops = {
         .release =      seq_release_net,
 };
 
-static int raw6_init_net(struct net *net)
+static int __net_init raw6_init_net(struct net *net)
 {
         if (!proc_net_fops_create(net, "raw6", S_IRUGO, &raw6_seq_fops))
                 return -ENOMEM;
@@ -1286,7 +1284,7 @@ static int raw6_init_net(struct net *net)
         return 0;
 }
 
-static void raw6_exit_net(struct net *net)
+static void __net_exit raw6_exit_net(struct net *net)
 {
         proc_net_remove(net, "raw6");
 }
@@ -1338,7 +1336,6 @@ static struct inet_protosw rawv6_protosw = {
         .protocol       = IPPROTO_IP,   /* wild card */
         .prot           = &rawv6_prot,
         .ops            = &inet6_sockraw_ops,
-        .capability     = CAP_NET_RAW,
         .no_check       = UDP_CSUM_DEFAULT,
         .flags          = INET_PROTOSW_REUSE,
 };
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index da5bd0ed83df..6d4292ff5854 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -41,6 +41,7 @@
 #include <linux/random.h>
 #include <linux/jhash.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -72,6 +73,7 @@ struct frag_queue
         struct inet_frag_queue  q;
 
         __be32                  id;             /* fragment id          */
+        u32                     user;
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
@@ -141,7 +143,7 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
         struct ip6_create_arg *arg = a;
 
         fq = container_of(q, struct frag_queue, q);
-        return (fq->id == arg->id &&
+        return (fq->id == arg->id && fq->user == arg->user &&
                         ipv6_addr_equal(&fq->saddr, arg->src) &&
                         ipv6_addr_equal(&fq->daddr, arg->dst));
 }
@@ -163,6 +165,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a)
         struct ip6_create_arg *arg = a;
 
         fq->id = arg->id;
+        fq->user = arg->user;
         ipv6_addr_copy(&fq->saddr, arg->src);
         ipv6_addr_copy(&fq->daddr, arg->dst);
 }
@@ -208,18 +211,17 @@ static void ip6_frag_expire(unsigned long data)
         fq_kill(fq);
 
         net = container_of(fq->q.net, struct net, ipv6.frags);
-        dev = dev_get_by_index(net, fq->iif);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, fq->iif);
         if (!dev)
-                goto out;
+                goto out_rcu_unlock;
 
-        rcu_read_lock();
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
-        rcu_read_unlock();
 
         /* Don't send error if the first segment did not arrive. */
         if (!(fq->q.last_in & INET_FRAG_FIRST_IN) || !fq->q.fragments)
-                goto out;
+                goto out_rcu_unlock;
 
         /*
            But use as source device on which LAST ARRIVED
@@ -227,23 +229,23 @@ static void ip6_frag_expire(unsigned long data)
            pointer directly, device might already disappeared.
          */
         fq->q.fragments->dev = dev;
-        icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
+        icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0);
+out_rcu_unlock:
+        rcu_read_unlock();
 out:
-        if (dev)
-                dev_put(dev);
         spin_unlock(&fq->q.lock);
         fq_put(fq);
 }
 
 static __inline__ struct frag_queue *
-fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
-        struct inet6_dev *idev)
+fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst)
 {
         struct inet_frag_queue *q;
         struct ip6_create_arg arg;
         unsigned int hash;
 
         arg.id = id;
+        arg.user = IP6_DEFRAG_LOCAL_DELIVER;
         arg.src = src;
         arg.dst = dst;
 
@@ -252,13 +254,9 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
 
         q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
         if (q == NULL)
-                goto oom;
+                return NULL;
 
         return container_of(q, struct frag_queue, q);
-
-oom:
-        IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_REASMFAILS);
-        return NULL;
 }
 
 static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
@@ -604,8 +602,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
         if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh)
                 ip6_evictor(net, ip6_dst_idev(skb_dst(skb)));
 
-        if ((fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
-                          ip6_dst_idev(skb_dst(skb)))) != NULL) {
+        fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr);
+        if (fq != NULL) {
                 int ret;
 
                 spin_lock(&fq->q.lock);
@@ -636,7 +634,6 @@ static const struct inet6_protocol frag_protocol =
 #ifdef CONFIG_SYSCTL
 static struct ctl_table ip6_frags_ns_ctl_table[] = {
         {
-                .ctl_name       = NET_IPV6_IP6FRAG_HIGH_THRESH,
                 .procname       = "ip6frag_high_thresh",
                 .data           = &init_net.ipv6.frags.high_thresh,
                 .maxlen         = sizeof(int),
@@ -644,7 +641,6 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV6_IP6FRAG_LOW_THRESH,
                 .procname       = "ip6frag_low_thresh",
                 .data           = &init_net.ipv6.frags.low_thresh,
                 .maxlen         = sizeof(int),
@@ -652,37 +648,33 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV6_IP6FRAG_TIME,
                 .procname       = "ip6frag_time",
                 .data           = &init_net.ipv6.frags.timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         { }
 };
 
 static struct ctl_table ip6_frags_ctl_table[] = {
         {
-                .ctl_name       = NET_IPV6_IP6FRAG_SECRET_INTERVAL,
                 .procname       = "ip6frag_secret_interval",
                 .data           = &ip6_frags.secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         { }
 };
 
-static int ip6_frags_ns_sysctl_register(struct net *net)
+static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
 
         table = ip6_frags_ns_ctl_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
@@ -700,19 +692,20 @@ static int ip6_frags_ns_sysctl_register(struct net *net)
         return 0;
 
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 kfree(table);
 err_alloc:
         return -ENOMEM;
 }
 
-static void ip6_frags_ns_sysctl_unregister(struct net *net)
+static void __net_exit ip6_frags_ns_sysctl_unregister(struct net *net)
 {
         struct ctl_table *table;
 
         table = net->ipv6.sysctl.frags_hdr->ctl_table_arg;
         unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
-        kfree(table);
+        if (!net_eq(net, &init_net))
+                kfree(table);
 }
 
 static struct ctl_table_header *ip6_ctl_header;
@@ -748,10 +741,10 @@ static inline void ip6_frags_sysctl_unregister(void)
 }
 #endif
 
-static int ipv6_frags_init_net(struct net *net)
+static int __net_init ipv6_frags_init_net(struct net *net)
 {
-        net->ipv6.frags.high_thresh = 256 * 1024;
-        net->ipv6.frags.low_thresh = 192 * 1024;
+        net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
+        net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH;
         net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT;
 
         inet_frags_init_net(&net->ipv6.frags);
@@ -759,7 +752,7 @@ static int ipv6_frags_init_net(struct net *net)
         return ip6_frags_ns_sysctl_register(net);
 }
 
-static void ipv6_frags_exit_net(struct net *net)
+static void __net_exit ipv6_frags_exit_net(struct net *net)
 {
         ip6_frags_ns_sysctl_unregister(net);
         inet_frags_exit_net(&net->ipv6.frags, &ip6_frags);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d6fe7646a8ff..05ebd7833043 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -40,6 +40,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/nsproxy.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/snmp.h>
 #include <net/ipv6.h>
@@ -814,20 +815,13 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 {
         int flags = 0;
 
-        if (rt6_need_strict(&fl->fl6_dst))
+        if (fl->oif || rt6_need_strict(&fl->fl6_dst))
                 flags |= RT6_LOOKUP_F_IFACE;
 
         if (!ipv6_addr_any(&fl->fl6_src))
                 flags |= RT6_LOOKUP_F_HAS_SADDR;
-        else if (sk) {
-                unsigned int prefs = inet6_sk(sk)->srcprefs;
-                if (prefs & IPV6_PREFER_SRC_TMP)
-                        flags |= RT6_LOOKUP_F_SRCPREF_TMP;
-                if (prefs & IPV6_PREFER_SRC_PUBLIC)
-                        flags |= RT6_LOOKUP_F_SRCPREF_PUBLIC;
-                if (prefs & IPV6_PREFER_SRC_COA)
-                        flags |= RT6_LOOKUP_F_SRCPREF_COA;
-        }
+        else if (sk)
+                flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
 
         return fib6_rule_lookup(net, fl, flags, ip6_pol_route_output);
 }
@@ -886,7 +880,7 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
-        if (rt && rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
                 return dst;
 
         return NULL;
@@ -897,19 +891,24 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
         struct rt6_info *rt = (struct rt6_info *) dst;
 
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE)
-                        ip6_del_rt(rt);
-                else
+                if (rt->rt6i_flags & RTF_CACHE) {
+                        if (rt6_check_expired(rt)) {
+                                ip6_del_rt(rt);
+                                dst = NULL;
+                        }
+                } else {
                         dst_release(dst);
+                        dst = NULL;
+                }
         }
-        return NULL;
+        return dst;
 }
 
 static void ip6_link_failure(struct sk_buff *skb)
 {
         struct rt6_info *rt;
 
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
 
         rt = (struct rt6_info *) skb_dst(skb);
         if (rt) {
@@ -1471,9 +1470,10 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                 },
                         },
                 },
-                .gateway = *gateway,
         };
 
+        ipv6_addr_copy(&rdfl.gateway, gateway);
+
         if (rt6_need_strict(dest))
                 flags |= RT6_LOOKUP_F_IFACE;
 
@@ -1872,7 +1872,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
         switch (ipstats_mib_noroutes) {
         case IPSTATS_MIB_INNOROUTES:
                 type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
-                if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED) {
+                if (type == IPV6_ADDR_ANY) {
                         IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
                                       IPSTATS_MIB_INADDRERRORS);
                         break;
@@ -1883,7 +1883,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
                               ipstats_mib_noroutes);
                 break;
         }
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0);
         kfree_skb(skb);
         return 0;
 }
@@ -2546,7 +2546,6 @@ ctl_table ipv6_route_table_template[] = {
                 .proc_handler   =       ipv6_sysctl_rtcache_flush
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_THRESH,
                 .procname       =       "gc_thresh",
                 .data           =       &ip6_dst_ops_template.gc_thresh,
                 .maxlen         =       sizeof(int),
@@ -2554,7 +2553,6 @@ ctl_table ipv6_route_table_template[] = {
                 .proc_handler   =       proc_dointvec,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_MAX_SIZE,
                 .procname       =       "max_size",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_max_size,
                 .maxlen         =       sizeof(int),
@@ -2562,72 +2560,58 @@ ctl_table ipv6_route_table_template[] = {
                 .proc_handler   =       proc_dointvec,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL,
                 .procname       =       "gc_min_interval",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_TIMEOUT,
                 .procname       =       "gc_timeout",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_timeout,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_INTERVAL,
                 .procname       =       "gc_interval",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_ELASTICITY,
                 .procname       =       "gc_elasticity",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_elasticity,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_MTU_EXPIRES,
                 .procname       =       "mtu_expires",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_mtu_expires,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_MIN_ADVMSS,
                 .procname       =       "min_adv_mss",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_min_advmss,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
         },
         {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL_MS,
                 .procname       =       "gc_min_interval_ms",
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       proc_dointvec_ms_jiffies,
-                .strategy       =       sysctl_ms_jiffies,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
-struct ctl_table *ipv6_route_sysctl_init(struct net *net)
+struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
 {
         struct ctl_table *table;
 
@@ -2645,13 +2629,14 @@ struct ctl_table *ipv6_route_sysctl_init(struct net *net)
                 table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
                 table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
                 table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
+                table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
         }
 
         return table;
 }
 #endif
 
-static int ip6_route_net_init(struct net *net)
+static int __net_init ip6_route_net_init(struct net *net)
 {
         int ret = -ENOMEM;
 
@@ -2716,7 +2701,7 @@ out_ip6_dst_ops:
         goto out;
 }
 
-static void ip6_route_net_exit(struct net *net)
+static void __net_exit ip6_route_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
         proc_net_remove(net, "ipv6_route");
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index dbd19a78ca73..5abae10cd884 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -28,6 +28,7 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/icmp.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/init.h>
 #include <linux/netfilter_ipv4.h>
@@ -62,11 +63,10 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
-static void ipip6_fb_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
 
-static int sit_net_id;
+static int sit_net_id __read_mostly;
 struct sit_net {
         struct ip_tunnel *tunnels_r_l[HASH_SIZE];
         struct ip_tunnel *tunnels_r[HASH_SIZE];
@@ -77,8 +77,17 @@ struct sit_net {
         struct net_device *fb_tunnel_dev;
 };
 
-static DEFINE_RWLOCK(ipip6_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip6_lock);
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
+/*
+ * Must be invoked with rcu_read_lock
+ */
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                 struct net_device *dev, __be32 remote, __be32 local)
 {
@@ -87,26 +96,26 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
-        for (t = sitn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r_l[h0 ^ h1]) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for (t = sitn->tunnels_r[h0]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r[h0]) {
                 if (remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for (t = sitn->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_l[h1]) {
                 if (local == t->parms.iph.saddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        t = sitn->tunnels_wc[0];
+        t = rcu_dereference(sitn->tunnels_wc[0]);
         if ((t != NULL) && (t->dev->flags & IFF_UP))
                 return t;
         return NULL;
@@ -143,9 +152,9 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 
         for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipip6_lock);
+                        spin_lock_bh(&ipip6_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipip6_lock);
+                        spin_unlock_bh(&ipip6_lock);
                         break;
                 }
         }
@@ -155,10 +164,27 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipip6_bucket(sitn, t);
 
+        spin_lock_bh(&ipip6_lock);
         t->next = *tp;
-        write_lock_bh(&ipip6_lock);
-        *tp = t;
-        write_unlock_bh(&ipip6_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipip6_lock);
+}
+
+static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
+{
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel *t = netdev_priv(dev);
+
+        if (t->dev == sitn->fb_tunnel_dev) {
+                ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
+                t->ip6rd.relay_prefix = 0;
+                t->ip6rd.prefixlen = 16;
+                t->ip6rd.relay_prefixlen = 0;
+        } else {
+                struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
+                memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
+        }
+#endif
 }
 
 static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
@@ -204,6 +230,7 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
 
         nt->parms = *parms;
         ipip6_tunnel_init(dev);
+        ipip6_tunnel_clone_6rd(dev, sitn);
 
         if (parms->i_flags & SIT_ISATAP)
                 dev->priv_flags |= IFF_ISATAP;
@@ -222,15 +249,22 @@ failed:
         return NULL;
 }
 
+static DEFINE_SPINLOCK(ipip6_prl_lock);
+
+#define for_each_prl_rcu(start)                 \
+        for (prl = rcu_dereference(start);      \
+             prl;                               \
+             prl = rcu_dereference(prl->next))
+
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
-        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL;
+        struct ip_tunnel_prl_entry *prl;
 
-        for (p = t->prl; p; p = p->next)
-                if (p->addr == addr)
+        for_each_prl_rcu(t->prl)
+                if (prl->addr == addr)
                         break;
-        return p;
+        return prl;
 
 }
 
@@ -255,7 +289,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                 kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
                 NULL;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
 
         ca = t->prl_count < cmax ? t->prl_count : cmax;
 
@@ -273,7 +307,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
         }
 
         c = 0;
-        for (prl = t->prl; prl; prl = prl->next) {
+        for_each_prl_rcu(t->prl) {
                 if (c >= cmax)
                         break;
                 if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
@@ -285,7 +319,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                         break;
         }
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 
         len = sizeof(*kp) * c;
         ret = 0;
@@ -306,12 +340,14 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
         if (a->addr == htonl(INADDR_ANY))
                 return -EINVAL;
 
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
 
         for (p = t->prl; p; p = p->next) {
                 if (p->addr == a->addr) {
-                        if (chg)
-                                goto update;
+                        if (chg) {
+                                p->flags = a->flags;
+                                goto out;
+                        }
                         err = -EEXIST;
                         goto out;
                 }
@@ -329,45 +365,61 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
         }
 
         p->next = t->prl;
-        t->prl = p;
-        t->prl_count++;
-update:
         p->addr = a->addr;
         p->flags = a->flags;
+        t->prl_count++;
+        rcu_assign_pointer(t->prl, p);
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
         return err;
 }
 
+static void prl_entry_destroy_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_tunnel_prl_entry, rcu_head));
+}
+
+static void prl_list_destroy_rcu(struct rcu_head *head)
+{
+        struct ip_tunnel_prl_entry *p, *n;
+
+        p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
+        do {
+                n = p->next;
+                kfree(p);
+                p = n;
+        } while (p);
+}
+
 static int
 ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 {
         struct ip_tunnel_prl_entry *x, **p;
         int err = 0;
 
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
 
         if (a && a->addr != htonl(INADDR_ANY)) {
                 for (p = &t->prl; *p; p = &(*p)->next) {
                         if ((*p)->addr == a->addr) {
                                 x = *p;
                                 *p = x->next;
-                                kfree(x);
+                                call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
                                 t->prl_count--;
                                 goto out;
                         }
                 }
                 err = -ENXIO;
         } else {
-                while (t->prl) {
+                if (t->prl) {
+                        t->prl_count = 0;
                         x = t->prl;
-                        t->prl = t->prl->next;
-                        kfree(x);
-                        t->prl_count--;
+                        call_rcu(&x->rcu_head, prl_list_destroy_rcu);
+                        t->prl = NULL;
                 }
         }
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
         return err;
 }
 
@@ -377,7 +429,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
         struct ip_tunnel_prl_entry *p;
         int ok = 1;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         p = __ipip6_tunnel_locate_prl(t, iph->saddr);
         if (p) {
                 if (p->flags & PRL_DEFAULT)
@@ -393,7 +445,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
                 else
                         ok = 0;
         }
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
         return ok;
 }
 
@@ -403,9 +455,9 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
-                write_lock_bh(&ipip6_lock);
+                spin_lock_bh(&ipip6_lock);
                 sitn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip6_lock);
+                spin_unlock_bh(&ipip6_lock);
                 dev_put(dev);
         } else {
                 ipip6_tunnel_unlink(sitn, netdev_priv(dev));
@@ -458,7 +510,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         t = ipip6_tunnel_lookup(dev_net(skb->dev),
                                 skb->dev,
                                 iph->daddr,
@@ -476,7 +528,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -496,7 +548,7 @@ static int ipip6_rcv(struct sk_buff *skb)
 
         iph = ip_hdr(skb);
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                      iph->saddr, iph->daddr);
         if (tunnel != NULL) {
@@ -510,7 +562,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                 if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
                     !isatap_chksrc(skb, iph, tunnel)) {
                         tunnel->dev->stats.rx_errors++;
-                        read_unlock(&ipip6_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -521,28 +573,52 @@ static int ipip6_rcv(struct sk_buff *skb)
                 nf_reset(skb);
                 ipip6_ecn_decapsulate(iph, skb);
                 netif_rx(skb);
-                read_unlock(&ipip6_lock);
+                rcu_read_unlock();
                 return 0;
         }
 
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 out:
         kfree_skb(skb);
         return 0;
 }
 
-/* Returns the embedded IPv4 address if the IPv6 address
-   comes from 6to4 (RFC 3056) addr space */
-
-static inline __be32 try_6to4(struct in6_addr *v6dst)
+/*
+ * Returns the embedded IPv4 address if the IPv6 address
+ * comes from 6rd / 6to4 (RFC 3056) addr space.
+ */
+static inline
+__be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 {
         __be32 dst = 0;
 
+#ifdef CONFIG_IPV6_SIT_6RD
+        if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
+                              tunnel->ip6rd.prefixlen)) {
+                unsigned pbw0, pbi0;
+                int pbi1;
+                u32 d;
+
+                pbw0 = tunnel->ip6rd.prefixlen >> 5;
+                pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
+
+                d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
+                    tunnel->ip6rd.relay_prefixlen;
+
+                pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
+                if (pbi1 > 0)
+                        d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
+                             (32 - pbi1);
+
+                dst = tunnel->ip6rd.relay_prefix | htonl(d);
+        }
+#else
         if (v6dst->s6_addr16[0] == htons(0x2002)) {
                 /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
                 memcpy(&dst, &v6dst->s6_addr16[1], 4);
         }
+#endif
         return dst;
 }
 
@@ -555,10 +631,12 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                      struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *tiph = &tunnel->parms.iph;
         struct ipv6hdr *iph6 = ipv6_hdr(skb);
         u8     tos = tunnel->parms.iph.tos;
+        __be16 df = tiph->frag_off;
         struct rtable *rt;                      /* Route to the other host */
         struct net_device *tdev;                        /* Device to other host */
         struct iphdr  *iph;                     /* Our new IP header */
@@ -595,7 +673,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         }
 
         if (!dst)
-                dst = try_6to4(&iph6->daddr);
+                dst = try_6rd(&iph6->daddr, tunnel);
 
         if (!dst) {
                 struct neighbour *neigh = NULL;
@@ -648,25 +726,28 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 goto tx_error;
         }
 
-        if (tiph->frag_off)
+        if (df) {
                 mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
 
-        if (mtu < 68) {
-                stats->collisions++;
-                ip_rt_put(rt);
-                goto tx_error;
-        }
-        if (mtu < IPV6_MIN_MTU)
-                mtu = IPV6_MIN_MTU;
-        if (tunnel->parms.iph.daddr && skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+                if (mtu < 68) {
+                        stats->collisions++;
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
 
-        if (skb->len > mtu) {
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
-                ip_rt_put(rt);
-                goto tx_error;
+                if (mtu < IPV6_MIN_MTU) {
+                        mtu = IPV6_MIN_MTU;
+                        df = 0;
+                }
+
+                if (tunnel->parms.iph.daddr && skb_dst(skb))
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+
+                if (skb->len > mtu) {
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
         }
 
         if (tunnel->err_count > 0) {
@@ -688,7 +769,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -714,11 +795,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         iph                     =       ip_hdr(skb);
         iph->version            =       4;
         iph->ihl                =       sizeof(struct iphdr)>>2;
-        if (mtu > IPV6_MIN_MTU)
-                iph->frag_off   =       tiph->frag_off;
-        else
-                iph->frag_off   =       0;
-
+        iph->frag_off           =       df;
         iph->protocol           =       IPPROTO_IPV6;
         iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
         iph->daddr              =       rt->rt_dst;
@@ -785,9 +862,15 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
         struct ip_tunnel *t;
         struct net *net = dev_net(dev);
         struct sit_net *sitn = net_generic(net, sit_net_id);
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel_6rd ip6rd;
+#endif
 
         switch (cmd) {
         case SIOCGETTUNNEL:
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCGET6RD:
+#endif
                 t = NULL;
                 if (dev == sitn->fb_tunnel_dev) {
                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
@@ -798,9 +881,25 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 }
                 if (t == NULL)
                         t = netdev_priv(dev);
-                memcpy(&p, &t->parms, sizeof(p));
-                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
-                        err = -EFAULT;
+
+                err = -EFAULT;
+                if (cmd == SIOCGETTUNNEL) {
+                        memcpy(&p, &t->parms, sizeof(p));
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p,
+                                         sizeof(p)))
+                                goto done;
+#ifdef CONFIG_IPV6_SIT_6RD
+                } else {
+                        ipv6_addr_copy(&ip6rd.prefix, &t->ip6rd.prefix);
+                        ip6rd.relay_prefix = t->ip6rd.relay_prefix;
+                        ip6rd.prefixlen = t->ip6rd.prefixlen;
+                        ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd,
+                                         sizeof(ip6rd)))
+                                goto done;
+#endif
+                }
+                err = 0;
                 break;
 
         case SIOCADDTUNNEL:
@@ -921,6 +1020,54 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 netdev_state_change(dev);
                 break;
 
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCADD6RD:
+        case SIOCCHG6RD:
+        case SIOCDEL6RD:
+                err = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        goto done;
+
+                err = -EFAULT;
+                if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data,
+                                   sizeof(ip6rd)))
+                        goto done;
+
+                t = netdev_priv(dev);
+
+                if (cmd != SIOCDEL6RD) {
+                        struct in6_addr prefix;
+                        __be32 relay_prefix;
+
+                        err = -EINVAL;
+                        if (ip6rd.relay_prefixlen > 32 ||
+                            ip6rd.prefixlen + (32 - ip6rd.relay_prefixlen) > 64)
+                                goto done;
+
+                        ipv6_addr_prefix(&prefix, &ip6rd.prefix,
+                                         ip6rd.prefixlen);
+                        if (!ipv6_addr_equal(&prefix, &ip6rd.prefix))
+                                goto done;
+                        if (ip6rd.relay_prefixlen)
+                                relay_prefix = ip6rd.relay_prefix &
+                                               htonl(0xffffffffUL <<
+                                                     (32 - ip6rd.relay_prefixlen));
+                        else
+                                relay_prefix = 0;
+                        if (relay_prefix != ip6rd.relay_prefix)
+                                goto done;
+
+                        ipv6_addr_copy(&t->ip6rd.prefix, &prefix);
+                        t->ip6rd.relay_prefix = relay_prefix;
+                        t->ip6rd.prefixlen = ip6rd.prefixlen;
+                        t->ip6rd.relay_prefixlen = ip6rd.relay_prefixlen;
+                } else
+                        ipip6_tunnel_clone_6rd(dev, sitn);
+
+                err = 0;
+                break;
+#endif
+
         default:
                 err = -EINVAL;
         }
@@ -972,7 +1119,7 @@ static void ipip6_tunnel_init(struct net_device *dev)
         ipip6_tunnel_bind_dev(dev);
 }
 
-static void ipip6_fb_tunnel_init(struct net_device *dev)
+static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
@@ -997,33 +1144,27 @@ static struct xfrm_tunnel sit_handler = {
         .priority       =       1,
 };
 
-static void sit_destroy_tunnels(struct sit_net *sitn)
+static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
         int prio;
 
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = sitn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = sitn->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
 
-static int sit_init_net(struct net *net)
+static int __net_init sit_init_net(struct net *net)
 {
+        struct sit_net *sitn = net_generic(net, sit_net_id);
         int err;
-        struct sit_net *sitn;
-
-        err = -ENOMEM;
-        sitn = kzalloc(sizeof(struct sit_net), GFP_KERNEL);
-        if (sitn == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, sit_net_id, sitn);
-        if (err < 0)
-                goto err_assign;
 
         sitn->tunnels[0] = sitn->tunnels_wc;
         sitn->tunnels[1] = sitn->tunnels_l;
@@ -1039,6 +1180,7 @@ static int sit_init_net(struct net *net)
         dev_net_set(sitn->fb_tunnel_dev, net);
 
         ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+        ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
 
         if ((err = register_netdev(sitn->fb_tunnel_dev)))
                 goto err_reg_dev;
@@ -1049,35 +1191,34 @@ err_reg_dev:
         dev_put(sitn->fb_tunnel_dev);
         free_netdev(sitn->fb_tunnel_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(sitn);
-err_alloc:
         return err;
 }
 
-static void sit_exit_net(struct net *net)
+static void __net_exit sit_exit_net(struct net *net)
 {
-        struct sit_net *sitn;
+        struct sit_net *sitn = net_generic(net, sit_net_id);
+        LIST_HEAD(list);
 
-        sitn = net_generic(net, sit_net_id);
         rtnl_lock();
-        sit_destroy_tunnels(sitn);
-        unregister_netdevice(sitn->fb_tunnel_dev);
+        sit_destroy_tunnels(sitn, &list);
+        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(sitn);
 }
 
 static struct pernet_operations sit_net_ops = {
         .init = sit_init_net,
         .exit = sit_exit_net,
+        .id   = &sit_net_id,
+        .size = sizeof(struct sit_net),
 };
 
 static void __exit sit_cleanup(void)
 {
         xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
 
-        unregister_pernet_gen_device(sit_net_id, &sit_net_ops);
+        unregister_pernet_device(&sit_net_ops);
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 
 static int __init sit_init(void)
@@ -1086,15 +1227,14 @@ static int __init sit_init(void)
 
         printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n");
 
-        if (xfrm4_tunnel_register(&sit_handler, AF_INET6) < 0) {
+        err = register_pernet_device(&sit_net_ops);
+        if (err < 0)
+                return err;
+        err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
+        if (err < 0) {
+                unregister_pernet_device(&sit_net_ops);
                 printk(KERN_INFO "sit init: Can't add protocol\n");
-                return -EAGAIN;
         }
-
-        err = register_pernet_gen_device(&sit_net_id, &sit_net_ops);
-        if (err < 0)
-                xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
-
         return err;
 }
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 6b6ae913b5d4..34d1f0690d7e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -159,6 +159,8 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 
 struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp_options_received tcp_opt;
+        u8 *hash_location;
         struct inet_request_sock *ireq;
         struct inet6_request_sock *ireq6;
         struct tcp_request_sock *treq;
@@ -171,7 +173,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         int mss;
         struct dst_entry *dst;
         __u8 rcv_wscale;
-        struct tcp_options_received tcp_opt;
 
         if (!sysctl_tcp_syncookies || !th->ack)
                 goto out;
@@ -186,7 +187,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         /* check for timestamp cookie support */
         memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
 
         if (tcp_opt.saw_tstamp)
                 cookie_check_timestamp(&tcp_opt);
@@ -252,8 +253,9 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 }
                 ipv6_addr_copy(&fl.fl6_src, &ireq6->loc_addr);
                 fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_sk(sk)->sport;
+                fl.fl_ip_sport = inet_sk(sk)->inet_sport;
                 security_req_classify_flow(req, &fl);
                 if (ip6_dst_lookup(sk, &dst, &fl))
                         goto out_free;
@@ -267,7 +269,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
-                                  ireq->wscale_ok, &rcv_wscale);
+                                  ireq->wscale_ok, &rcv_wscale,
+                                  dst_metric(dst, RTAX_INITRWND));
 
         ireq->rcv_wscale = rcv_wscale;
 
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 0dc6a4e5ed4a..fa1d8f4e0051 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -9,6 +9,7 @@
 #include <linux/sysctl.h>
 #include <linux/in6.h>
 #include <linux/ipv6.h>
+#include <linux/slab.h>
 #include <net/ndisc.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
@@ -16,50 +17,46 @@
 
 static ctl_table ipv6_table_template[] = {
         {
-                .ctl_name       = NET_IPV6_ROUTE,
                 .procname       = "route",
                 .maxlen         = 0,
                 .mode           = 0555,
                 .child          = ipv6_route_table_template
         },
         {
-                .ctl_name       = NET_IPV6_ICMP,
                 .procname       = "icmp",
                 .maxlen         = 0,
                 .mode           = 0555,
                 .child          = ipv6_icmp_table_template
         },
         {
-                .ctl_name       = NET_IPV6_BINDV6ONLY,
                 .procname       = "bindv6only",
                 .data           = &init_net.ipv6.sysctl.bindv6only,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static ctl_table ipv6_rotable[] = {
         {
-                .ctl_name       = NET_IPV6_MLD_MAX_MSF,
                 .procname       = "mld_max_msf",
                 .data           = &sysctl_mld_max_msf,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 struct ctl_path net_ipv6_ctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv6", .ctl_name = NET_IPV6, },
+        { .procname = "net", },
+        { .procname = "ipv6", },
         { },
 };
 EXPORT_SYMBOL_GPL(net_ipv6_ctl_path);
 
-static int ipv6_sysctl_net_init(struct net *net)
+static int __net_init ipv6_sysctl_net_init(struct net *net)
 {
         struct ctl_table *ipv6_table;
         struct ctl_table *ipv6_route_table;
@@ -102,7 +99,7 @@ out_ipv6_table:
         goto out;
 }
 
-static void ipv6_sysctl_net_exit(struct net *net)
+static void __net_exit ipv6_sysctl_net_exit(struct net *net)
 {
         struct ctl_table *ipv6_table;
         struct ctl_table *ipv6_route_table;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 21d100b68b19..075f540ec197 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -38,6 +38,7 @@
 #include <linux/jhash.h>
 #include <linux/ipsec.h>
 #include <linux/times.h>
+#include <linux/slab.h>
 
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
@@ -96,7 +97,7 @@ static void tcp_v6_hash(struct sock *sk)
                         return;
                 }
                 local_bh_disable();
-                __inet6_hash(sk);
+                __inet6_hash(sk, NULL);
                 local_bh_enable();
         }
 }
@@ -226,10 +227,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 #endif
                         goto failure;
                 } else {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->saddr);
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->rcv_saddr);
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
+                                               &np->rcv_saddr);
                 }
 
                 return err;
@@ -243,8 +243,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         ipv6_addr_copy(&fl.fl6_src,
                        (saddr ? saddr : &np->saddr));
         fl.oif = sk->sk_bound_dev_if;
+        fl.mark = sk->sk_mark;
         fl.fl_ip_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
 
         if (np->opt && np->opt->srcrt) {
                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
@@ -276,7 +277,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         /* set the source address */
         ipv6_addr_copy(&np->saddr, saddr);
-        inet->rcv_saddr = LOOPBACK4_IPV6;
+        inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
         sk->sk_gso_type = SKB_GSO_TCPV6;
         __ip6_dst_store(sk, dst, NULL, NULL);
@@ -288,7 +289,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
 
         tcp_set_state(sk, TCP_SYN_SENT);
         err = inet6_hash_connect(&tcp_death_row, sk);
@@ -298,8 +299,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (!tp->write_seq)
                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
                                                              np->daddr.s6_addr32,
-                                                             inet->sport,
-                                                             inet->dport);
+                                                             inet->inet_sport,
+                                                             inet->inet_dport);
 
         err = tcp_connect(sk);
         if (err)
@@ -311,7 +312,7 @@ late_failure:
         tcp_set_state(sk, TCP_CLOSE);
         __sk_dst_reset(sk);
 failure:
-        inet->dport = 0;
+        inet->inet_dport = 0;
         sk->sk_route_caps = 0;
         return err;
 }
@@ -383,8 +384,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                         fl.oif = sk->sk_bound_dev_if;
-                        fl.fl_ip_dport = inet->dport;
-                        fl.fl_ip_sport = inet->sport;
+                        fl.mark = sk->sk_mark;
+                        fl.fl_ip_dport = inet->inet_dport;
+                        fl.fl_ip_sport = inet->inet_sport;
                         security_skb_classify_flow(skb, &fl);
 
                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
@@ -460,7 +462,8 @@ out:
 }
 
 
-static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
+static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
+                              struct request_values *rvp)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -477,6 +480,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
         fl.fl6_flowlabel = 0;
         fl.oif = treq->iif;
+        fl.mark = sk->sk_mark;
         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
         fl.fl_ip_sport = inet_rsk(req)->loc_port;
         security_req_classify_flow(req, &fl);
@@ -497,7 +501,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
         if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                 goto done;
 
-        skb = tcp_make_synack(sk, dst, req);
+        skb = tcp_make_synack(sk, dst, req, rvp);
         if (skb) {
                 struct tcphdr *th = tcp_hdr(skb);
 
@@ -517,6 +521,13 @@ done:
         return err;
 }
 
+static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
+                             struct request_values *rvp)
+{
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+        return tcp_v6_send_synack(sk, req, rvp);
+}
+
 static inline void syn_flood_warning(struct sk_buff *skb)
 {
 #ifdef CONFIG_SYN_COOKIES
@@ -873,7 +884,7 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                 if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash %s for (%pI6, %u)->(%pI6, %u)\n",
+                        printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
                                genhash ? "failed" : "mismatch",
                                &ip6h->saddr, ntohs(th->source),
                                &ip6h->daddr, ntohs(th->dest));
@@ -887,10 +898,11 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
         .family         =       AF_INET6,
         .obj_size       =       sizeof(struct tcp6_request_sock),
-        .rtx_syn_ack    =       tcp_v6_send_synack,
+        .rtx_syn_ack    =       tcp_v6_rtx_synack,
         .send_ack       =       tcp_v6_reqsk_send_ack,
         .destructor     =       tcp_v6_reqsk_destructor,
-        .send_reset     =       tcp_v6_send_reset
+        .send_reset     =       tcp_v6_send_reset,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1003,7 +1015,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 
         t1 = (struct tcphdr *) skb_push(buff, tot_len);
-        skb_reset_transport_header(skb);
+        skb_reset_transport_header(buff);
 
         /* Swap the send and the receive. */
         memset(t1, 0, sizeof(*t1));
@@ -1159,11 +1171,13 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
  */
 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp_extend_values tmp_ext;
+        struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct request_sock *req;
         struct inet6_request_sock *treq;
         struct ipv6_pinfo *np = inet6_sk(sk);
-        struct tcp_options_received tmp_opt;
         struct tcp_sock *tp = tcp_sk(sk);
-        struct request_sock *req = NULL;
         __u32 isn = TCP_SKB_CB(skb)->when;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
@@ -1202,8 +1216,52 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
+
+        if (tmp_opt.cookie_plus > 0 &&
+            tmp_opt.saw_tstamp &&
+            !tp->rx_opt.cookie_out_never &&
+            (sysctl_tcp_cookie_size > 0 ||
+             (tp->cookie_values != NULL &&
+              tp->cookie_values->cookie_desired > 0))) {
+                u8 *c;
+                u32 *d;
+                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
+                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
+
+                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
+                        goto drop_and_free;
+
+                /* Secret recipe starts with IP addresses */
+                d = &ipv6_hdr(skb)->daddr.s6_addr32[0];
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                d = &ipv6_hdr(skb)->saddr.s6_addr32[0];
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+
+                /* plus variable length Initiator Cookie */
+                c = (u8 *)mess;
+                while (l-- > 0)
+                        *c++ ^= *hash_location++;
 
-        tcp_parse_options(skb, &tmp_opt, 0);
+#ifdef CONFIG_SYN_COOKIES
+                want_cookie = 0;        /* not our kind of cookie */
+#endif
+                tmp_ext.cookie_out_never = 0; /* false */
+                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
+        } else if (!tp->rx_opt.cookie_in_always) {
+                /* redundant indications, but ensure initialization. */
+                tmp_ext.cookie_out_never = 1; /* true */
+                tmp_ext.cookie_plus = 0;
+        } else {
+                goto drop_and_free;
+        }
+        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
@@ -1236,23 +1294,21 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 
                 isn = tcp_v6_init_sequence(skb);
         }
-
         tcp_rsk(req)->snt_isn = isn;
 
         security_inet_conn_request(sk, skb, req);
 
-        if (tcp_v6_send_synack(sk, req))
-                goto drop;
+        if (tcp_v6_send_synack(sk, req,
+                               (struct request_values *)&tmp_ext) ||
+            want_cookie)
+                goto drop_and_free;
 
-        if (!want_cookie) {
-                inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
-                return 0;
-        }
+        inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+        return 0;
 
+drop_and_free:
+        reqsk_free(req);
 drop:
-        if (req)
-                reqsk_free(req);
-
         return 0; /* don't send reset */
 }
 
@@ -1290,11 +1346,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
-                ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->daddr);
+                ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
 
-                ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->saddr);
+                ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
 
                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 
@@ -1345,6 +1399,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 }
                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
                 fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_rsk(req)->loc_port;
                 security_req_classify_flow(req, &fl);
@@ -1431,7 +1486,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
         tcp_initialize_rcv_mss(newsk);
 
-        newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
+        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
+        newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
@@ -1448,7 +1504,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         }
 #endif
 
-        __inet6_hash(newsk);
+        __inet6_hash(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
@@ -1685,8 +1741,11 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v6_do_rcv(sk, skb);
                 }
-        } else
-                sk_add_backlog(sk, skb);
+        } else if (unlikely(sk_add_backlog(sk, skb))) {
+                bh_unlock_sock(sk);
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
+                goto discard_and_relse;
+        }
         bh_unlock_sock(sk);
 
         sock_put(sk);
@@ -1848,7 +1907,7 @@ static int tcp_v6_init_sock(struct sock *sk)
          */
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = 536;
+        tp->mss_cache = TCP_MSS_DEFAULT;
 
         tp->reordering = sysctl_tcp_reordering;
 
@@ -1864,6 +1923,19 @@ static int tcp_v6_init_sock(struct sock *sk)
         tp->af_specific = &tcp_sock_ipv6_specific;
 #endif
 
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
         sk->sk_sndbuf = sysctl_tcp_wmem[1];
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
@@ -1931,8 +2003,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 
         dest  = &np->daddr;
         src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
-        srcp  = ntohs(inet->sport);
+        destp = ntohs(inet->inet_dport);
+        srcp  = ntohs(inet->inet_sport);
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                 timer_active    = 1;
@@ -2045,7 +2117,7 @@ static struct tcp_seq_afinfo tcp6_seq_afinfo = {
         },
 };
 
-int tcp6_proc_init(struct net *net)
+int __net_init tcp6_proc_init(struct net *net)
 {
         return tcp_proc_register(net, &tcp6_seq_afinfo);
 }
@@ -2109,27 +2181,31 @@ static struct inet_protosw tcpv6_protosw = {
         .protocol       =       IPPROTO_TCP,
         .prot           =       &tcpv6_prot,
         .ops            =       &inet6_stream_ops,
-        .capability     =       -1,
         .no_check       =       0,
         .flags          =       INET_PROTOSW_PERMANENT |
                                 INET_PROTOSW_ICSK,
 };
 
-static int tcpv6_net_init(struct net *net)
+static int __net_init tcpv6_net_init(struct net *net)
 {
         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
                                     SOCK_RAW, IPPROTO_TCP, net);
 }
 
-static void tcpv6_net_exit(struct net *net)
+static void __net_exit tcpv6_net_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
-        inet_twsk_purge(net, &tcp_hashinfo, &tcp_death_row, AF_INET6);
+}
+
+static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
+{
+        inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
 }
 
 static struct pernet_operations tcpv6_net_ops = {
-        .init = tcpv6_net_init,
-        .exit = tcpv6_net_exit,
+        .init       = tcpv6_net_init,
+        .exit       = tcpv6_net_exit,
+        .exit_batch = tcpv6_net_exit_batch,
 };
 
 int __init tcpv6_init(void)
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 51e2832d13a6..fc3c86a47452 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -25,6 +25,7 @@
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
@@ -98,7 +99,7 @@ static int tunnel6_rcv(struct sk_buff *skb)
                 if (!handler->handler(skb))
                         return 0;
 
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 
 drop:
         kfree_skb(skb);
@@ -116,7 +117,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
                 if (!handler->handler(skb))
                         return 0;
 
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 
 drop:
         kfree_skb(skb);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index cf538ed5ef6a..90824852f598 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -34,6 +34,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 #include <net/ndisc.h>
@@ -53,7 +54,7 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
         const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
         const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        __be32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
+        __be32 sk1_rcv_saddr = inet_sk(sk)->inet_rcv_saddr;
         __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
         int sk_ipv6only = ipv6_only_sock(sk);
         int sk2_ipv6only = inet_v6_ipv6only(sk2);
@@ -63,8 +64,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
         /* if both are mapped, treat as IPv4 */
         if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED)
                 return (!sk2_ipv6only &&
-                        (!sk_rcv_saddr || !sk2_rcv_saddr ||
-                          sk_rcv_saddr == sk2_rcv_saddr));
+                        (!sk1_rcv_saddr || !sk2_rcv_saddr ||
+                          sk1_rcv_saddr == sk2_rcv_saddr));
 
         if (addr_type2 == IPV6_ADDR_ANY &&
             !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
@@ -81,9 +82,33 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
         return 0;
 }
 
+static unsigned int udp6_portaddr_hash(struct net *net,
+                                       const struct in6_addr *addr6,
+                                       unsigned int port)
+{
+        unsigned int hash, mix = net_hash_mix(net);
+
+        if (ipv6_addr_any(addr6))
+                hash = jhash_1word(0, mix);
+        else if (ipv6_addr_v4mapped(addr6))
+                hash = jhash_1word(addr6->s6_addr32[3], mix);
+        else
+                hash = jhash2(addr6->s6_addr32, 4, mix);
+
+        return hash ^ port;
+}
+
+
 int udp_v6_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal);
+        unsigned int hash2_nulladdr =
+                udp6_portaddr_hash(sock_net(sk), &in6addr_any, snum);
+        unsigned int hash2_partial = 
+                udp6_portaddr_hash(sock_net(sk), &inet6_sk(sk)->rcv_saddr, 0);
+
+        /* precompute partial secondary hash */
+        udp_sk(sk)->udp_portaddr_hash = hash2_partial;
+        return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal, hash2_nulladdr);
 }
 
 static inline int compute_score(struct sock *sk, struct net *net,
@@ -94,14 +119,14 @@ static inline int compute_score(struct sock *sk, struct net *net,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
                         sk->sk_family == PF_INET6) {
                 struct ipv6_pinfo *np = inet6_sk(sk);
                 struct inet_sock *inet = inet_sk(sk);
 
                 score = 0;
-                if (inet->dport) {
-                        if (inet->dport != sport)
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
                                 return -1;
                         score++;
                 }
@@ -124,6 +149,86 @@ static inline int compute_score(struct sock *sk, struct net *net,
         return score;
 }
 
+#define SCORE2_MAX (1 + 1 + 1)
+static inline int compute_score2(struct sock *sk, struct net *net,
+                                const struct in6_addr *saddr, __be16 sport,
+                                const struct in6_addr *daddr, unsigned short hnum,
+                                int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
+                        sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                struct inet_sock *inet = inet_sk(sk);
+
+                if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
+                        return -1;
+                score = 0;
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
+                                return -1;
+                        score++;
+                }
+                if (!ipv6_addr_any(&np->daddr)) {
+                        if (!ipv6_addr_equal(&np->daddr, saddr))
+                                return -1;
+                        score++;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score++;
+                }
+        }
+        return score;
+}
+
+
+/* called with read_rcu_lock() */
+static struct sock *udp6_lib_lookup2(struct net *net,
+                const struct in6_addr *saddr, __be16 sport,
+                const struct in6_addr *daddr, unsigned int hnum, int dif,
+                struct udp_hslot *hslot2, unsigned int slot2)
+{
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
+        int score, badness;
+
+begin:
+        result = NULL;
+        badness = -1;
+        udp_portaddr_for_each_entry_rcu(sk, node, &hslot2->head) {
+                score = compute_score2(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                        if (score == SCORE2_MAX)
+                                goto exact_match;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot2)
+                goto begin;
+
+        if (result) {
+exact_match:
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score2(result, net, saddr, sport,
+                                  daddr, hnum, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        return result;
+}
+
 static struct sock *__udp6_lib_lookup(struct net *net,
                                       struct in6_addr *saddr, __be16 sport,
                                       struct in6_addr *daddr, __be16 dport,
@@ -132,11 +237,35 @@ static struct sock *__udp6_lib_lookup(struct net *net,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
-        struct udp_hslot *hslot = &udptable->hash[hash];
+        unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
+        struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness;
 
         rcu_read_lock();
+        if (hslot->count > 10) {
+                hash2 = udp6_portaddr_hash(net, daddr, hnum);
+                slot2 = hash2 & udptable->mask;
+                hslot2 = &udptable->hash2[slot2];
+                if (hslot->count < hslot2->count)
+                        goto begin;
+
+                result = udp6_lib_lookup2(net, saddr, sport,
+                                          daddr, hnum, dif,
+                                          hslot2, slot2);
+                if (!result) {
+                        hash2 = udp6_portaddr_hash(net, &in6addr_any, hnum);
+                        slot2 = hash2 & udptable->mask;
+                        hslot2 = &udptable->hash2[slot2];
+                        if (hslot->count < hslot2->count)
+                                goto begin;
+
+                        result = udp6_lib_lookup2(net, saddr, sport,
+                                                  &in6addr_any, hnum, dif,
+                                                  hslot2, slot2);
+                }
+                rcu_read_unlock();
+                return result;
+        }
 begin:
         result = NULL;
         badness = -1;
@@ -152,7 +281,7 @@ begin:
          * not the expected one, we must restart lookup.
          * We probably met an item that was moved to another chain.
          */
-        if (get_nulls_value(node) != hash)
+        if (get_nulls_value(node) != slot)
                 goto begin;
 
         if (result) {
@@ -194,7 +323,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
-        unsigned int ulen, copied;
+        unsigned int ulen;
         int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
@@ -213,10 +342,9 @@ try_again:
                 goto out;
 
         ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
-        if (copied > ulen)
-                copied = ulen;
-        else if (copied < ulen)
+        if (len > ulen)
+                len = ulen;
+        else if (len < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
         is_udp4 = (skb->protocol == htons(ETH_P_IP));
@@ -227,14 +355,14 @@ try_again:
          * coverage checksum (UDP-Lite), do it before the copy.
          */
 
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
                 if (udp_lib_checksum_complete(skb))
                         goto csum_copy_err;
         }
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied       );
+                                              msg->msg_iov,len);
         else {
                 err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
                 if (err == -EINVAL)
@@ -252,7 +380,7 @@ try_again:
                                         UDP_MIB_INDATAGRAMS, is_udplite);
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (msg->msg_name) {
@@ -265,8 +393,8 @@ try_again:
                 sin6->sin6_scope_id = 0;
 
                 if (is_udp4)
-                        ipv6_addr_set(&sin6->sin6_addr, 0, 0,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
+                                               &sin6->sin6_addr);
                 else {
                         ipv6_addr_copy(&sin6->sin6_addr,
                                        &ipv6_hdr(skb)->saddr);
@@ -283,7 +411,7 @@ try_again:
                         datagram_recv_ctl(sk, msg, skb);
         }
 
-        err = copied;
+        err = len;
         if (flags & MSG_TRUNC)
                 err = ulen;
 
@@ -383,18 +511,18 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                         goto drop;
         }
 
-        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                         UDP6_INC_STATS_BH(sock_net(sk),
                                         UDP_MIB_RCVBUFERRORS, is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
+                goto drop_no_sk_drops_inc;
         }
 
         return 0;
 drop:
+        atomic_inc(&sk->sk_drops);
+drop_no_sk_drops_inc:
         UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
         kfree_skb(skb);
         return -1;
@@ -415,10 +543,11 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
                 if (!net_eq(sock_net(s), net))
                         continue;
 
-                if (s->sk_hash == num && s->sk_family == PF_INET6) {
+                if (udp_sk(s)->udp_port_hash == num &&
+                    s->sk_family == PF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(s);
-                        if (inet->dport) {
-                                if (inet->dport != rmt_port)
+                        if (inet->inet_dport) {
+                                if (inet->inet_dport != rmt_port)
                                         continue;
                         }
                         if (!ipv6_addr_any(&np->daddr) &&
@@ -440,6 +569,37 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
         return NULL;
 }
 
+static void flush_stack(struct sock **stack, unsigned int count,
+                        struct sk_buff *skb, unsigned int final)
+{
+        unsigned int i;
+        struct sock *sk;
+        struct sk_buff *skb1;
+
+        for (i = 0; i < count; i++) {
+                skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+
+                sk = stack[i];
+                if (skb1) {
+                        bh_lock_sock(sk);
+                        if (!sock_owned_by_user(sk))
+                                udpv6_queue_rcv_skb(sk, skb1);
+                        else if (sk_add_backlog(sk, skb1)) {
+                                kfree_skb(skb1);
+                                bh_unlock_sock(sk);
+                                goto drop;
+                        }
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+drop:
+                atomic_inc(&sk->sk_drops);
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_INERRORS, IS_UDPLITE(sk));
+        }
+}
 /*
  * Note: called only from the BH handler context,
  * so we don't need to lock the hashes.
@@ -448,41 +608,43 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                 struct in6_addr *saddr, struct in6_addr *daddr,
                 struct udp_table *udptable)
 {
-        struct sock *sk, *sk2;
+        struct sock *sk, *stack[256 / sizeof(struct sock *)];
         const struct udphdr *uh = udp_hdr(skb);
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
         int dif;
+        unsigned int i, count = 0;
 
         spin_lock(&hslot->lock);
         sk = sk_nulls_head(&hslot->head);
         dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (!sk) {
-                kfree_skb(skb);
-                goto out;
-        }
-
-        sk2 = sk;
-        while ((sk2 = udp_v6_mcast_next(net, sk_nulls_next(sk2), uh->dest, daddr,
-                                        uh->source, saddr, dif))) {
-                struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
-                if (buff) {
-                        bh_lock_sock(sk2);
-                        if (!sock_owned_by_user(sk2))
-                                udpv6_queue_rcv_skb(sk2, buff);
-                        else
-                                sk_add_backlog(sk2, buff);
-                        bh_unlock_sock(sk2);
+        while (sk) {
+                stack[count++] = sk;
+                sk = udp_v6_mcast_next(net, sk_nulls_next(sk), uh->dest, daddr,
+                                       uh->source, saddr, dif);
+                if (unlikely(count == ARRAY_SIZE(stack))) {
+                        if (!sk)
+                                break;
+                        flush_stack(stack, count, skb, ~0);
+                        count = 0;
                 }
         }
-        bh_lock_sock(sk);
-        if (!sock_owned_by_user(sk))
-                udpv6_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
-        bh_unlock_sock(sk);
-out:
+        /*
+         * before releasing the lock, we must take reference on sockets
+         */
+        for (i = 0; i < count; i++)
+                sock_hold(stack[i]);
+
         spin_unlock(&hslot->lock);
+
+        if (count) {
+                flush_stack(stack, count, skb, count - 1);
+
+                for (i = 0; i < count; i++)
+                        sock_put(stack[i]);
+        } else {
+                kfree_skb(skb);
+        }
         return 0;
 }
 
@@ -523,12 +685,11 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh,
 int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
+        struct net *net = dev_net(skb->dev);
         struct sock *sk;
         struct udphdr *uh;
-        struct net_device *dev = skb->dev;
         struct in6_addr *saddr, *daddr;
         u32 ulen = 0;
-        struct net *net = dev_net(skb->dev);
 
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto short_packet;
@@ -587,7 +748,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
                                 proto == IPPROTO_UDPLITE);
 
-                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
+                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 
                 kfree_skb(skb);
                 return 0;
@@ -598,8 +759,12 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                atomic_inc(&sk->sk_drops);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+                goto discard;
+        }
         bh_unlock_sock(sk);
         sock_put(sk);
         return 0;
@@ -792,7 +957,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (ipv6_addr_v4mapped(daddr)) {
                         struct sockaddr_in sin;
                         sin.sin_family = AF_INET;
-                        sin.sin_port = sin6 ? sin6->sin6_port : inet->dport;
+                        sin.sin_port = sin6 ? sin6->sin6_port : inet->inet_dport;
                         sin.sin_addr.s_addr = daddr->s6_addr32[3];
                         msg->msg_name = &sin;
                         msg->msg_namelen = sizeof(sin);
@@ -865,7 +1030,7 @@ do_udp_sendmsg:
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
 
-                fl.fl_ip_dport = inet->dport;
+                fl.fl_ip_dport = inet->inet_dport;
                 daddr = &np->daddr;
                 fl.fl6_flowlabel = np->flow_label;
                 connected = 1;
@@ -877,6 +1042,8 @@ do_udp_sendmsg:
         if (!fl.oif)
                 fl.oif = np->sticky_pktinfo.ipi6_ifindex;
 
+        fl.mark = sk->sk_mark;
+
         if (msg->msg_controllen) {
                 opt = &opt_space;
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
@@ -909,7 +1076,7 @@ do_udp_sendmsg:
                 fl.fl6_dst.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
         if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
 
         /* merge ip6_build_xmit from ip6_output */
         if (opt && opt->srcrt) {
@@ -1190,10 +1357,10 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
 
         dest  = &np->daddr;
         src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
-        srcp  = ntohs(inet->sport);
+        destp = ntohs(inet->inet_dport);
+        srcp  = ntohs(inet->inet_sport);
         seq_printf(seq,
-                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
                    bucket,
                    src->s6_addr32[0], src->s6_addr32[1],
@@ -1236,7 +1403,7 @@ static struct udp_seq_afinfo udp6_seq_afinfo = {
         },
 };
 
-int udp6_proc_init(struct net *net)
+int __net_init udp6_proc_init(struct net *net)
 {
         return udp_proc_register(net, &udp6_seq_afinfo);
 }
@@ -1282,7 +1449,6 @@ static struct inet_protosw udpv6_protosw = {
         .protocol =  IPPROTO_UDP,
         .prot =      &udpv6_prot,
         .ops =       &inet6_dgram_ops,
-        .capability =-1,
         .no_check =  UDP_CSUM_DEFAULT,
         .flags =     INET_PROTOSW_PERMANENT,
 };
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index d737a27ee010..5f48fadc27f7 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -62,7 +62,6 @@ static struct inet_protosw udplite6_protosw = {
         .protocol       = IPPROTO_UDPLITE,
         .prot           = &udplitev6_prot,
         .ops            = &inet6_dgram_ops,
-        .capability     = -1,
         .no_check       = 0,
         .flags          = INET_PROTOSW_PERMANENT,
 };
@@ -105,12 +104,12 @@ static struct udp_seq_afinfo udplite6_seq_afinfo = {
         },
 };
 
-static int udplite6_proc_init_net(struct net *net)
+static int __net_init udplite6_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udplite6_seq_afinfo);
 }
 
-static void udplite6_proc_exit_net(struct net *net)
+static void __net_exit udplite6_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udplite6_seq_afinfo);
 }
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 9084582d236b..2bc98ede1235 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -101,7 +101,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                         break;
                 }
 
-                x = xfrm_state_lookup_byaddr(net, dst, src, proto, AF_INET6);
+                x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6);
                 if (!x)
                         continue;
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 3927832227b9..b809812c8d30 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -5,6 +5,7 @@
  * Copyright (c) 2004-2006 Herbert Xu <herbert@gondor.apana.org.au>
  */
 
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index c4f4eef032a3..0c92112dcba3 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -38,7 +38,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
 
         if (!skb->local_df && skb->len > mtu) {
                 skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 ret = -EMSGSIZE;
         }
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8ec3d45cd1d9..00bf7c962b7e 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -24,7 +24,6 @@
 #include <net/mip6.h>
 #endif
 
-static struct dst_ops xfrm6_dst_ops;
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 
 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
@@ -117,14 +116,15 @@ static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
         return 0;
 }
 
-static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+                          struct flowi *fl)
 {
         struct rt6_info *rt = (struct rt6_info*)xdst->route;
 
         xdst->u.dst.dev = dev;
         dev_hold(dev);
 
-        xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
+        xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
@@ -224,8 +224,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 static inline int xfrm6_garbage_collect(struct dst_ops *ops)
 {
-        xfrm6_policy_afinfo.garbage_collect(&init_net);
-        return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2);
+        struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
+
+        xfrm6_policy_afinfo.garbage_collect(net);
+        return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
 }
 
 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -309,9 +311,8 @@ static void xfrm6_policy_fini(void)
 #ifdef CONFIG_SYSCTL
 static struct ctl_table xfrm6_policy_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "xfrm6_gc_thresh",
-                .data           = &xfrm6_dst_ops.gc_thresh,
+                .data           = &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
@@ -327,13 +328,6 @@ int __init xfrm6_init(void)
         int ret;
         unsigned int gc_thresh;
 
-        ret = xfrm6_policy_init();
-        if (ret)
-                goto out;
-
-        ret = xfrm6_state_init();
-        if (ret)
-                goto out_policy;
         /*
          * We need a good default value for the xfrm6 gc threshold.
          * In ipv4 we set it to the route hash table size * 8, which
@@ -347,6 +341,15 @@ int __init xfrm6_init(void)
          */
         gc_thresh = FIB6_TABLE_HASHSZ * 8;
         xfrm6_dst_ops.gc_thresh = (gc_thresh < 1024) ? 1024 : gc_thresh;
+
+        ret = xfrm6_policy_init();
+        if (ret)
+                goto out;
+
+        ret = xfrm6_state_init();
+        if (ret)
+                goto out_policy;
+
 #ifdef CONFIG_SYSCTL
         sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv6_ctl_path,
                                                 xfrm6_policy_table);
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 81a95c00e503..2ce3a8278f26 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -23,41 +23,51 @@
  */
 #include <linux/module.h>
 #include <linux/xfrm.h>
-#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/rculist.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ipv6.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
 #include <linux/mutex.h>
+#include <net/netns/generic.h>
+
+#define XFRM6_TUNNEL_SPI_BYADDR_HSIZE 256
+#define XFRM6_TUNNEL_SPI_BYSPI_HSIZE 256
+
+#define XFRM6_TUNNEL_SPI_MIN    1
+#define XFRM6_TUNNEL_SPI_MAX    0xffffffff
+
+struct xfrm6_tunnel_net {
+        struct hlist_head spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
+        struct hlist_head spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
+        u32 spi;
+};
+
+static int xfrm6_tunnel_net_id __read_mostly;
+static inline struct xfrm6_tunnel_net *xfrm6_tunnel_pernet(struct net *net)
+{
+        return net_generic(net, xfrm6_tunnel_net_id);
+}
 
 /*
  * xfrm_tunnel_spi things are for allocating unique id ("spi")
  * per xfrm_address_t.
  */
 struct xfrm6_tunnel_spi {
-        struct hlist_node list_byaddr;
-        struct hlist_node list_byspi;
-        xfrm_address_t addr;
-        u32 spi;
-        atomic_t refcnt;
+        struct hlist_node       list_byaddr;
+        struct hlist_node       list_byspi;
+        xfrm_address_t          addr;
+        u32                     spi;
+        atomic_t                refcnt;
+        struct rcu_head         rcu_head;
 };
 
-static DEFINE_RWLOCK(xfrm6_tunnel_spi_lock);
-
-static u32 xfrm6_tunnel_spi;
-
-#define XFRM6_TUNNEL_SPI_MIN    1
-#define XFRM6_TUNNEL_SPI_MAX    0xffffffff
+static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
 
 static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 
-#define XFRM6_TUNNEL_SPI_BYADDR_HSIZE 256
-#define XFRM6_TUNNEL_SPI_BYSPI_HSIZE 256
-
-static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
-static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
-
 static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
         unsigned h;
@@ -75,49 +85,14 @@ static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
         return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }
 
-
-static int xfrm6_tunnel_spi_init(void)
-{
-        int i;
-
-        xfrm6_tunnel_spi = 0;
-        xfrm6_tunnel_spi_kmem = kmem_cache_create("xfrm6_tunnel_spi",
-                                                  sizeof(struct xfrm6_tunnel_spi),
-                                                  0, SLAB_HWCACHE_ALIGN,
-                                                  NULL);
-        if (!xfrm6_tunnel_spi_kmem)
-                return -ENOMEM;
-
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
-                INIT_HLIST_HEAD(&xfrm6_tunnel_spi_byaddr[i]);
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++)
-                INIT_HLIST_HEAD(&xfrm6_tunnel_spi_byspi[i]);
-        return 0;
-}
-
-static void xfrm6_tunnel_spi_fini(void)
-{
-        int i;
-
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++) {
-                if (!hlist_empty(&xfrm6_tunnel_spi_byaddr[i]))
-                        return;
-        }
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++) {
-                if (!hlist_empty(&xfrm6_tunnel_spi_byspi[i]))
-                        return;
-        }
-        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
-        xfrm6_tunnel_spi_kmem = NULL;
-}
-
-static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
+static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
         struct hlist_node *pos;
 
-        hlist_for_each_entry(x6spi, pos,
-                             &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
+        hlist_for_each_entry_rcu(x6spi, pos,
+                             &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                              list_byaddr) {
                 if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0)
                         return x6spi;
@@ -126,28 +101,29 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
         return NULL;
 }
 
-__be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_spi *x6spi;
         u32 spi;
 
-        read_lock_bh(&xfrm6_tunnel_spi_lock);
-        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
+        rcu_read_lock_bh();
+        x6spi = __xfrm6_tunnel_spi_lookup(net, saddr);
         spi = x6spi ? x6spi->spi : 0;
-        read_unlock_bh(&xfrm6_tunnel_spi_lock);
+        rcu_read_unlock_bh();
         return htonl(spi);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_spi_lookup);
 
-static int __xfrm6_tunnel_spi_check(u32 spi)
+static int __xfrm6_tunnel_spi_check(struct net *net, u32 spi)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
         int index = xfrm6_tunnel_spi_hash_byspi(spi);
         struct hlist_node *pos;
 
         hlist_for_each_entry(x6spi, pos,
-                             &xfrm6_tunnel_spi_byspi[index],
+                             &xfrm6_tn->spi_byspi[index],
                              list_byspi) {
                 if (x6spi->spi == spi)
                         return -1;
@@ -155,32 +131,33 @@ static int __xfrm6_tunnel_spi_check(u32 spi)
         return index;
 }
 
-static u32 __xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
+static u32 __xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         u32 spi;
         struct xfrm6_tunnel_spi *x6spi;
         int index;
 
-        if (xfrm6_tunnel_spi < XFRM6_TUNNEL_SPI_MIN ||
-            xfrm6_tunnel_spi >= XFRM6_TUNNEL_SPI_MAX)
-                xfrm6_tunnel_spi = XFRM6_TUNNEL_SPI_MIN;
+        if (xfrm6_tn->spi < XFRM6_TUNNEL_SPI_MIN ||
+            xfrm6_tn->spi >= XFRM6_TUNNEL_SPI_MAX)
+                xfrm6_tn->spi = XFRM6_TUNNEL_SPI_MIN;
         else
-                xfrm6_tunnel_spi++;
+                xfrm6_tn->spi++;
 
-        for (spi = xfrm6_tunnel_spi; spi <= XFRM6_TUNNEL_SPI_MAX; spi++) {
-                index = __xfrm6_tunnel_spi_check(spi);
+        for (spi = xfrm6_tn->spi; spi <= XFRM6_TUNNEL_SPI_MAX; spi++) {
+                index = __xfrm6_tunnel_spi_check(net, spi);
                 if (index >= 0)
                         goto alloc_spi;
         }
-        for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tunnel_spi; spi++) {
-                index = __xfrm6_tunnel_spi_check(spi);
+        for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tn->spi; spi++) {
+                index = __xfrm6_tunnel_spi_check(net, spi);
                 if (index >= 0)
                         goto alloc_spi;
         }
         spi = 0;
         goto out;
 alloc_spi:
-        xfrm6_tunnel_spi = spi;
+        xfrm6_tn->spi = spi;
         x6spi = kmem_cache_alloc(xfrm6_tunnel_spi_kmem, GFP_ATOMIC);
         if (!x6spi)
                 goto out;
@@ -189,54 +166,61 @@ alloc_spi:
         x6spi->spi = spi;
         atomic_set(&x6spi->refcnt, 1);
 
-        hlist_add_head(&x6spi->list_byspi, &xfrm6_tunnel_spi_byspi[index]);
+        hlist_add_head_rcu(&x6spi->list_byspi, &xfrm6_tn->spi_byspi[index]);
 
         index = xfrm6_tunnel_spi_hash_byaddr(saddr);
-        hlist_add_head(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
+        hlist_add_head_rcu(&x6spi->list_byaddr, &xfrm6_tn->spi_byaddr[index]);
 out:
         return spi;
 }
 
-__be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_spi *x6spi;
         u32 spi;
 
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
-        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
+        x6spi = __xfrm6_tunnel_spi_lookup(net, saddr);
         if (x6spi) {
                 atomic_inc(&x6spi->refcnt);
                 spi = x6spi->spi;
         } else
-                spi = __xfrm6_tunnel_alloc_spi(saddr);
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+                spi = __xfrm6_tunnel_alloc_spi(net, saddr);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
 
         return htonl(spi);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_alloc_spi);
 
-void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
+static void x6spi_destroy_rcu(struct rcu_head *head)
+{
+        kmem_cache_free(xfrm6_tunnel_spi_kmem,
+                        container_of(head, struct xfrm6_tunnel_spi, rcu_head));
+}
+
+void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
         struct hlist_node *pos, *n;
 
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
 
         hlist_for_each_entry_safe(x6spi, pos, n,
-                                  &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
+                                  &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                                   list_byaddr)
         {
                 if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
                         if (atomic_dec_and_test(&x6spi->refcnt)) {
-                                hlist_del(&x6spi->list_byaddr);
-                                hlist_del(&x6spi->list_byspi);
-                                kmem_cache_free(xfrm6_tunnel_spi_kmem, x6spi);
+                                hlist_del_rcu(&x6spi->list_byaddr);
+                                hlist_del_rcu(&x6spi->list_byspi);
+                                call_rcu(&x6spi->rcu_head, x6spi_destroy_rcu);
                                 break;
                         }
                 }
         }
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_free_spi);
@@ -254,10 +238,11 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 
 static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 {
+        struct net *net = dev_net(skb->dev);
         struct ipv6hdr *iph = ipv6_hdr(skb);
         __be32 spi;
 
-        spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
+        spi = xfrm6_tunnel_spi_lookup(net, (xfrm_address_t *)&iph->saddr);
         return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
 }
 
@@ -317,7 +302,9 @@ static int xfrm6_tunnel_init_state(struct xfrm_state *x)
 
 static void xfrm6_tunnel_destroy(struct xfrm_state *x)
 {
-        xfrm6_tunnel_free_spi((xfrm_address_t *)&x->props.saddr);
+        struct net *net = xs_net(x);
+
+        xfrm6_tunnel_free_spi(net, (xfrm_address_t *)&x->props.saddr);
 }
 
 static const struct xfrm_type xfrm6_tunnel_type = {
@@ -342,34 +329,73 @@ static struct xfrm6_tunnel xfrm46_tunnel_handler = {
         .priority       = 2,
 };
 
+static int __net_init xfrm6_tunnel_net_init(struct net *net)
+{
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
+        unsigned int i;
+
+        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
+                INIT_HLIST_HEAD(&xfrm6_tn->spi_byaddr[i]);
+        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++)
+                INIT_HLIST_HEAD(&xfrm6_tn->spi_byspi[i]);
+        xfrm6_tn->spi = 0;
+
+        return 0;
+}
+
+static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
+{
+}
+
+static struct pernet_operations xfrm6_tunnel_net_ops = {
+        .init   = xfrm6_tunnel_net_init,
+        .exit   = xfrm6_tunnel_net_exit,
+        .id     = &xfrm6_tunnel_net_id,
+        .size   = sizeof(struct xfrm6_tunnel_net),
+};
+
 static int __init xfrm6_tunnel_init(void)
 {
-        if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0)
-                goto err;
-        if (xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6))
-                goto unreg;
-        if (xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET))
-                goto dereg6;
-        if (xfrm6_tunnel_spi_init() < 0)
-                goto dereg46;
+        int rv;
+
+        xfrm6_tunnel_spi_kmem = kmem_cache_create("xfrm6_tunnel_spi",
+                                                  sizeof(struct xfrm6_tunnel_spi),
+                                                  0, SLAB_HWCACHE_ALIGN,
+                                                  NULL);
+        if (!xfrm6_tunnel_spi_kmem)
+                return -ENOMEM;
+        rv = register_pernet_subsys(&xfrm6_tunnel_net_ops);
+        if (rv < 0)
+                goto out_pernet;
+        rv = xfrm_register_type(&xfrm6_tunnel_type, AF_INET6);
+        if (rv < 0)
+                goto out_type;
+        rv = xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6);
+        if (rv < 0)
+                goto out_xfrm6;
+        rv = xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET);
+        if (rv < 0)
+                goto out_xfrm46;
         return 0;
 
-dereg46:
-        xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
-dereg6:
+out_xfrm46:
         xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
-unreg:
+out_xfrm6:
         xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
-err:
-        return -EAGAIN;
+out_type:
+        unregister_pernet_subsys(&xfrm6_tunnel_net_ops);
+out_pernet:
+        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
+        return rv;
 }
 
 static void __exit xfrm6_tunnel_fini(void)
 {
-        xfrm6_tunnel_spi_fini();
         xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
         xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
         xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
+        unregister_pernet_subsys(&xfrm6_tunnel_net_ops);
+        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
 }
 
 module_init(xfrm6_tunnel_init);
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 66c7a20011f3..da3d21c41d90 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -40,6 +40,7 @@
 #include <linux/net.h>
 #include <linux/netdevice.h>
 #include <linux/uio.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/smp_lock.h>
 #include <linux/socket.h>
@@ -1298,6 +1299,7 @@ static int ipx_setsockopt(struct socket *sock, int level, int optname,
         int opt;
         int rc = -EINVAL;
 
+        lock_kernel();
         if (optlen != sizeof(int))
                 goto out;
 
@@ -1312,6 +1314,7 @@ static int ipx_setsockopt(struct socket *sock, int level, int optname,
         ipx_sk(sk)->type = opt;
         rc = 0;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -1323,6 +1326,7 @@ static int ipx_getsockopt(struct socket *sock, int level, int optname,
         int len;
         int rc = -ENOPROTOOPT;
 
+        lock_kernel();
         if (!(level == SOL_IPX && optname == IPX_TYPE))
                 goto out;
 
@@ -1343,6 +1347,7 @@ static int ipx_getsockopt(struct socket *sock, int level, int optname,
 
         rc = 0;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -1352,12 +1357,13 @@ static struct proto ipx_proto = {
         .obj_size = sizeof(struct ipx_sock),
 };
 
-static int ipx_create(struct net *net, struct socket *sock, int protocol)
+static int ipx_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
         int rc = -ESOCKTNOSUPPORT;
         struct sock *sk;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         /*
@@ -1390,6 +1396,7 @@ static int ipx_release(struct socket *sock)
         if (!sk)
                 goto out;
 
+        lock_kernel();
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_state_change(sk);
 
@@ -1397,6 +1404,7 @@ static int ipx_release(struct socket *sock)
         sock->sk = NULL;
         sk_refcnt_debug_release(sk);
         ipx_destroy_socket(sk);
+        unlock_kernel();
 out:
         return 0;
 }
@@ -1424,7 +1432,8 @@ static __be16 ipx_first_free_socketnum(struct ipx_interface *intrfc)
         return htons(socketNum);
 }
 
-static int ipx_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+static int __ipx_bind(struct socket *sock,
+                        struct sockaddr *uaddr, int addr_len)
 {
         struct sock *sk = sock->sk;
         struct ipx_sock *ipxs = ipx_sk(sk);
@@ -1519,6 +1528,17 @@ out:
         return rc;
 }
 
+static int ipx_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+{
+        int rc;
+
+        lock_kernel();
+        rc = __ipx_bind(sock, uaddr, addr_len);
+        unlock_kernel();
+
+        return rc;
+}
+
 static int ipx_connect(struct socket *sock, struct sockaddr *uaddr,
         int addr_len, int flags)
 {
@@ -1531,6 +1551,7 @@ static int ipx_connect(struct socket *sock, struct sockaddr *uaddr,
         sk->sk_state    = TCP_CLOSE;
         sock->state     = SS_UNCONNECTED;
 
+        lock_kernel();
         if (addr_len != sizeof(*addr))
                 goto out;
         addr = (struct sockaddr_ipx *)uaddr;
@@ -1550,7 +1571,7 @@ static int ipx_connect(struct socket *sock, struct sockaddr *uaddr,
                         IPX_NODE_LEN);
 #endif  /* CONFIG_IPX_INTERN */
 
-                rc = ipx_bind(sock, (struct sockaddr *)&uaddr,
+                rc = __ipx_bind(sock, (struct sockaddr *)&uaddr,
                               sizeof(struct sockaddr_ipx));
                 if (rc)
                         goto out;
@@ -1577,6 +1598,7 @@ static int ipx_connect(struct socket *sock, struct sockaddr *uaddr,
                 ipxrtr_put(rt);
         rc = 0;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -1592,6 +1614,7 @@ static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
 
         *uaddr_len = sizeof(struct sockaddr_ipx);
 
+        lock_kernel();
         if (peer) {
                 rc = -ENOTCONN;
                 if (sk->sk_state != TCP_ESTABLISHED)
@@ -1626,6 +1649,19 @@ static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
 
         rc = 0;
 out:
+        unlock_kernel();
+        return rc;
+}
+
+static unsigned int ipx_datagram_poll(struct file *file, struct socket *sock,
+                           poll_table *wait)
+{
+        int rc;
+
+        lock_kernel();
+        rc = datagram_poll(file, sock, wait);
+        unlock_kernel();
+
         return rc;
 }
 
@@ -1700,6 +1736,7 @@ static int ipx_sendmsg(struct kiocb *iocb, struct socket *sock,
         int rc = -EINVAL;
         int flags = msg->msg_flags;
 
+        lock_kernel();
         /* Socket gets bound below anyway */
 /*      if (sk->sk_zapped)
                 return -EIO; */ /* Socket not bound */
@@ -1723,7 +1760,7 @@ static int ipx_sendmsg(struct kiocb *iocb, struct socket *sock,
                         memcpy(uaddr.sipx_node, ipxs->intrfc->if_node,
                                 IPX_NODE_LEN);
 #endif
-                        rc = ipx_bind(sock, (struct sockaddr *)&uaddr,
+                        rc = __ipx_bind(sock, (struct sockaddr *)&uaddr,
                                         sizeof(struct sockaddr_ipx));
                         if (rc)
                                 goto out;
@@ -1751,6 +1788,7 @@ static int ipx_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (rc >= 0)
                 rc = len;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -1765,6 +1803,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *skb;
         int copied, rc;
 
+        lock_kernel();
         /* put the autobinding in */
         if (!ipxs->port) {
                 struct sockaddr_ipx uaddr;
@@ -1779,7 +1818,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
                 memcpy(uaddr.sipx_node, ipxs->intrfc->if_node, IPX_NODE_LEN);
 #endif  /* CONFIG_IPX_INTERN */
 
-                rc = ipx_bind(sock, (struct sockaddr *)&uaddr,
+                rc = __ipx_bind(sock, (struct sockaddr *)&uaddr,
                               sizeof(struct sockaddr_ipx));
                 if (rc)
                         goto out;
@@ -1823,6 +1862,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
 out_free:
         skb_free_datagram(sk, skb);
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -1834,6 +1874,7 @@ static int ipx_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         struct sock *sk = sock->sk;
         void __user *argp = (void __user *)arg;
 
+        lock_kernel();
         switch (cmd) {
         case TIOCOUTQ:
                 amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
@@ -1896,6 +1937,7 @@ static int ipx_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 rc = -ENOIOCTLCMD;
                 break;
         }
+        unlock_kernel();
 
         return rc;
 }
@@ -1927,13 +1969,13 @@ static int ipx_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long
  * Socket family declarations
  */
 
-static struct net_proto_family ipx_family_ops = {
+static const struct net_proto_family ipx_family_ops = {
         .family         = PF_IPX,
         .create         = ipx_create,
         .owner          = THIS_MODULE,
 };
 
-static const struct proto_ops SOCKOPS_WRAPPED(ipx_dgram_ops) = {
+static const struct proto_ops ipx_dgram_ops = {
         .family         = PF_IPX,
         .owner          = THIS_MODULE,
         .release        = ipx_release,
@@ -1942,7 +1984,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(ipx_dgram_ops) = {
         .socketpair     = sock_no_socketpair,
         .accept         = sock_no_accept,
         .getname        = ipx_getname,
-        .poll           = datagram_poll,
+        .poll           = ipx_datagram_poll,
         .ioctl          = ipx_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = ipx_compat_ioctl,
@@ -1957,8 +1999,6 @@ static const struct proto_ops SOCKOPS_WRAPPED(ipx_dgram_ops) = {
         .sendpage       = sock_no_sendpage,
 };
 
-SOCKOPS_WRAP(ipx_dgram, PF_IPX);
-
 static struct packet_type ipx_8023_packet_type __read_mostly = {
         .type           = cpu_to_be16(ETH_P_802_3),
         .func           = ipx_rcv,
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index 576178482f89..26b5bfcf1d03 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -13,45 +13,15 @@
 #include <net/tcp_states.h>
 #include <net/ipx.h>
 
-static __inline__ struct ipx_interface *ipx_get_interface_idx(loff_t pos)
-{
-        struct ipx_interface *i;
-
-        list_for_each_entry(i, &ipx_interfaces, node)
-                if (!pos--)
-                        goto out;
-        i = NULL;
-out:
-        return i;
-}
-
-static struct ipx_interface *ipx_interfaces_next(struct ipx_interface *i)
-{
-        struct ipx_interface *rc = NULL;
-
-        if (i->node.next != &ipx_interfaces)
-                rc = list_entry(i->node.next, struct ipx_interface, node);
-        return rc;
-}
-
 static void *ipx_seq_interface_start(struct seq_file *seq, loff_t *pos)
 {
-        loff_t l = *pos;
-
         spin_lock_bh(&ipx_interfaces_lock);
-        return l ? ipx_get_interface_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&ipx_interfaces, *pos);
 }
 
 static void *ipx_seq_interface_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ipx_interface *i;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                i = ipx_interfaces_head();
-        else
-                i = ipx_interfaces_next(v);
-        return i;
+        return seq_list_next(v, &ipx_interfaces, pos);
 }
 
 static void ipx_seq_interface_stop(struct seq_file *seq, void *v)
@@ -63,7 +33,7 @@ static int ipx_seq_interface_show(struct seq_file *seq, void *v)
 {
         struct ipx_interface *i;
 
-        if (v == SEQ_START_TOKEN) {
+        if (v == &ipx_interfaces) {
                 seq_puts(seq, "Network    Node_Address   Primary  Device     "
                               "Frame_Type");
 #ifdef IPX_REFCNT_DEBUG
@@ -73,7 +43,7 @@ static int ipx_seq_interface_show(struct seq_file *seq, void *v)
                 goto out;
         }
 
-        i = v;
+        i = list_entry(v, struct ipx_interface, node);
         seq_printf(seq, "%08lX   ", (unsigned long int)ntohl(i->if_netnum));
         seq_printf(seq, "%02X%02X%02X%02X%02X%02X   ",
                         i->if_node[0], i->if_node[1], i->if_node[2],
@@ -89,53 +59,15 @@ out:
         return 0;
 }
 
-static struct ipx_route *ipx_routes_head(void)
-{
-        struct ipx_route *rc = NULL;
-
-        if (!list_empty(&ipx_routes))
-                rc = list_entry(ipx_routes.next, struct ipx_route, node);
-        return rc;
-}
-
-static struct ipx_route *ipx_routes_next(struct ipx_route *r)
-{
-        struct ipx_route *rc = NULL;
-
-        if (r->node.next != &ipx_routes)
-                rc = list_entry(r->node.next, struct ipx_route, node);
-        return rc;
-}
-
-static __inline__ struct ipx_route *ipx_get_route_idx(loff_t pos)
-{
-        struct ipx_route *r;
-
-        list_for_each_entry(r, &ipx_routes, node)
-                if (!pos--)
-                        goto out;
-        r = NULL;
-out:
-        return r;
-}
-
 static void *ipx_seq_route_start(struct seq_file *seq, loff_t *pos)
 {
-        loff_t l = *pos;
         read_lock_bh(&ipx_routes_lock);
-        return l ? ipx_get_route_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&ipx_routes, *pos);
 }
 
 static void *ipx_seq_route_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ipx_route *r;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                r = ipx_routes_head();
-        else
-                r = ipx_routes_next(v);
-        return r;
+        return seq_list_next(v, &ipx_routes, pos);
 }
 
 static void ipx_seq_route_stop(struct seq_file *seq, void *v)
@@ -147,11 +79,13 @@ static int ipx_seq_route_show(struct seq_file *seq, void *v)
 {
         struct ipx_route *rt;
 
-        if (v == SEQ_START_TOKEN) {
+        if (v == &ipx_routes) {
                 seq_puts(seq, "Network    Router_Net   Router_Node\n");
                 goto out;
         }
-        rt = v;
+
+        rt = list_entry(v, struct ipx_route, node);
+
         seq_printf(seq, "%08lX   ", (unsigned long int)ntohl(rt->ir_net));
         if (rt->ir_routed)
                 seq_printf(seq, "%08lX     %02X%02X%02X%02X%02X%02X\n",
@@ -226,9 +160,9 @@ static void *ipx_seq_socket_next(struct seq_file *seq, void *v, loff_t *pos)
         spin_unlock_bh(&i->if_sklist_lock);
         sk = NULL;
         for (;;) {
-                i = ipx_interfaces_next(i);
-                if (!i)
+                if (i->node.next == &ipx_interfaces)
                         break;
+                i = list_entry(i->node.next, struct ipx_interface, node);
                 spin_lock_bh(&i->if_sklist_lock);
                 if (!hlist_empty(&i->if_sklist)) {
                         sk = sk_head(&i->if_sklist);
diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c
index e16c11423527..30f4519b092f 100644
--- a/net/ipx/ipx_route.c
+++ b/net/ipx/ipx_route.c
@@ -9,6 +9,7 @@
 
 #include <linux/list.h>
 #include <linux/route.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 
 #include <net/ipx.h>
diff --git a/net/ipx/sysctl_net_ipx.c b/net/ipx/sysctl_net_ipx.c
index 633fcab35580..bd6dca00fb85 100644
--- a/net/ipx/sysctl_net_ipx.c
+++ b/net/ipx/sysctl_net_ipx.c
@@ -18,19 +18,18 @@ extern int sysctl_ipx_pprop_broadcasting;
 
 static struct ctl_table ipx_table[] = {
         {
-                .ctl_name       = NET_IPX_PPROP_BROADCASTING,
                 .procname       = "ipx_pprop_broadcasting",
                 .data           = &sysctl_ipx_pprop_broadcasting,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        { 0 },
+        { },
 };
 
 static struct ctl_path ipx_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipx", .ctl_name = NET_IPX, },
+        { .procname = "net", },
+        { .procname = "ipx", },
         { }
 };
 
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index dd35641835f4..2a4efcea3423 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -48,6 +48,7 @@
 #include <linux/smp_lock.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/net.h>
 #include <linux/irda.h>
@@ -61,7 +62,7 @@
 
 #include <net/irda/af_irda.h>
 
-static int irda_create(struct net *net, struct socket *sock, int protocol);
+static int irda_create(struct net *net, struct socket *sock, int protocol, int kern);
 
 static const struct proto_ops irda_stream_ops;
 static const struct proto_ops irda_seqpacket_ops;
@@ -714,11 +715,14 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_irda saddr;
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
+        int err;
 
+        lock_kernel();
         memset(&saddr, 0, sizeof(saddr));
         if (peer) {
+                err  = -ENOTCONN;
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        return -ENOTCONN;
+                        goto out;
 
                 saddr.sir_family = AF_IRDA;
                 saddr.sir_lsap_sel = self->dtsap_sel;
@@ -735,8 +739,10 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
         /* uaddr_len come to us uninitialised */
         *uaddr_len = sizeof (struct sockaddr_irda);
         memcpy(uaddr, &saddr, *uaddr_len);
-
-        return 0;
+        err = 0;
+out:
+        unlock_kernel();
+        return err;
 }
 
 /*
@@ -748,21 +754,25 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
 static int irda_listen(struct socket *sock, int backlog)
 {
         struct sock *sk = sock->sk;
+        int err = -EOPNOTSUPP;
 
         IRDA_DEBUG(2, "%s()\n", __func__);
 
+        lock_kernel();
         if ((sk->sk_type != SOCK_STREAM) && (sk->sk_type != SOCK_SEQPACKET) &&
             (sk->sk_type != SOCK_DGRAM))
-                return -EOPNOTSUPP;
+                goto out;
 
         if (sk->sk_state != TCP_LISTEN) {
                 sk->sk_max_ack_backlog = backlog;
                 sk->sk_state           = TCP_LISTEN;
 
-                return 0;
+                err = 0;
         }
+out:
+        unlock_kernel();
 
-        return -EOPNOTSUPP;
+        return err;
 }
 
 /*
@@ -783,36 +793,40 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr_len != sizeof(struct sockaddr_irda))
                 return -EINVAL;
 
+        lock_kernel();
 #ifdef CONFIG_IRDA_ULTRA
         /* Special care for Ultra sockets */
         if ((sk->sk_type == SOCK_DGRAM) &&
             (sk->sk_protocol == IRDAPROTO_ULTRA)) {
                 self->pid = addr->sir_lsap_sel;
+                err = -EOPNOTSUPP;
                 if (self->pid & 0x80) {
                         IRDA_DEBUG(0, "%s(), extension in PID not supp!\n", __func__);
-                        return -EOPNOTSUPP;
+                        goto out;
                 }
                 err = irda_open_lsap(self, self->pid);
                 if (err < 0)
-                        return err;
+                        goto out;
 
                 /* Pretend we are connected */
                 sock->state = SS_CONNECTED;
                 sk->sk_state   = TCP_ESTABLISHED;
+                err = 0;
 
-                return 0;
+                goto out;
         }
 #endif /* CONFIG_IRDA_ULTRA */
 
         self->ias_obj = irias_new_object(addr->sir_name, jiffies);
+        err = -ENOMEM;
         if (self->ias_obj == NULL)
-                return -ENOMEM;
+                goto out;
 
         err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name);
         if (err < 0) {
                 kfree(self->ias_obj->name);
                 kfree(self->ias_obj);
-                return err;
+                goto out;
         }
 
         /*  Register with LM-IAS */
@@ -820,7 +834,10 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                  self->stsap_sel, IAS_KERNEL_ATTR);
         irias_insert_object(self->ias_obj);
 
-        return 0;
+        err = 0;
+out:
+        unlock_kernel();
+        return err;
 }
 
 /*
@@ -839,22 +856,26 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
 
         IRDA_DEBUG(2, "%s()\n", __func__);
 
-        err = irda_create(sock_net(sk), newsock, sk->sk_protocol);
+        lock_kernel();
+        err = irda_create(sock_net(sk), newsock, sk->sk_protocol, 0);
         if (err)
-                return err;
+                goto out;
 
+        err = -EINVAL;
         if (sock->state != SS_UNCONNECTED)
-                return -EINVAL;
+                goto out;
 
         if ((sk = sock->sk) == NULL)
-                return -EINVAL;
+                goto out;
 
+        err = -EOPNOTSUPP;
         if ((sk->sk_type != SOCK_STREAM) && (sk->sk_type != SOCK_SEQPACKET) &&
             (sk->sk_type != SOCK_DGRAM))
-                return -EOPNOTSUPP;
+                goto out;
 
+        err = -EINVAL;
         if (sk->sk_state != TCP_LISTEN)
-                return -EINVAL;
+                goto out;
 
         /*
          *      The read queue this time is holding sockets ready to use
@@ -875,18 +896,20 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
                         break;
 
                 /* Non blocking operation */
+                err = -EWOULDBLOCK;
                 if (flags & O_NONBLOCK)
-                        return -EWOULDBLOCK;
+                        goto out;
 
                 err = wait_event_interruptible(*(sk->sk_sleep),
                                         skb_peek(&sk->sk_receive_queue));
                 if (err)
-                        return err;
+                        goto out;
         }
 
         newsk = newsock->sk;
+        err = -EIO;
         if (newsk == NULL)
-                return -EIO;
+                goto out;
 
         newsk->sk_state = TCP_ESTABLISHED;
 
@@ -894,10 +917,11 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
 
         /* Now attach up the new socket */
         new->tsap = irttp_dup(self->tsap, new);
+        err = -EPERM; /* value does not seem to make sense. -arnd */
         if (!new->tsap) {
                 IRDA_DEBUG(0, "%s(), dup failed!\n", __func__);
                 kfree_skb(skb);
-                return -1;
+                goto out;
         }
 
         new->stsap_sel = new->tsap->stsap_sel;
@@ -921,8 +945,10 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
         newsock->state = SS_CONNECTED;
 
         irda_connect_response(new);
-
-        return 0;
+        err = 0;
+out:
+        unlock_kernel();
+        return err;
 }
 
 /*
@@ -955,28 +981,34 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
 
         IRDA_DEBUG(2, "%s(%p)\n", __func__, self);
 
+        lock_kernel();
         /* Don't allow connect for Ultra sockets */
+        err = -ESOCKTNOSUPPORT;
         if ((sk->sk_type == SOCK_DGRAM) && (sk->sk_protocol == IRDAPROTO_ULTRA))
-                return -ESOCKTNOSUPPORT;
+                goto out;
 
         if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
                 sock->state = SS_CONNECTED;
-                return 0;   /* Connect completed during a ERESTARTSYS event */
+                err = 0;
+                goto out;   /* Connect completed during a ERESTARTSYS event */
         }
 
         if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
                 sock->state = SS_UNCONNECTED;
-                return -ECONNREFUSED;
+                err = -ECONNREFUSED;
+                goto out;
         }
 
+        err = -EISCONN;      /* No reconnect on a seqpacket socket */
         if (sk->sk_state == TCP_ESTABLISHED)
-                return -EISCONN;      /* No reconnect on a seqpacket socket */
+                goto out;
 
         sk->sk_state   = TCP_CLOSE;
         sock->state = SS_UNCONNECTED;
 
+        err = -EINVAL;
         if (addr_len != sizeof(struct sockaddr_irda))
-                return -EINVAL;
+                goto out;
 
         /* Check if user supplied any destination device address */
         if ((!addr->sir_addr) || (addr->sir_addr == DEV_ADDR_ANY)) {
@@ -984,7 +1016,7 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
                 err = irda_discover_daddr_and_lsap_sel(self, addr->sir_name);
                 if (err) {
                         IRDA_DEBUG(0, "%s(), auto-connect failed!\n", __func__);
-                        return err;
+                        goto out;
                 }
         } else {
                 /* Use the one provided by the user */
@@ -1000,7 +1032,7 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
                         err = irda_find_lsap_sel(self, addr->sir_name);
                         if (err) {
                                 IRDA_DEBUG(0, "%s(), connect failed!\n", __func__);
-                                return err;
+                                goto out;
                         }
                 } else {
                         /* Directly connect to the remote LSAP
@@ -1025,29 +1057,35 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
                                     self->max_sdu_size_rx, NULL);
         if (err) {
                 IRDA_DEBUG(0, "%s(), connect failed!\n", __func__);
-                return err;
+                goto out;
         }
 
         /* Now the loop */
+        err = -EINPROGRESS;
         if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
-                return -EINPROGRESS;
+                goto out;
 
+        err = -ERESTARTSYS;
         if (wait_event_interruptible(*(sk->sk_sleep),
                                      (sk->sk_state != TCP_SYN_SENT)))
-                return -ERESTARTSYS;
+                goto out;
 
         if (sk->sk_state != TCP_ESTABLISHED) {
                 sock->state = SS_UNCONNECTED;
                 err = sock_error(sk);
-                return err? err : -ECONNRESET;
+                if (!err)
+                        err = -ECONNRESET;
+                goto out;
         }
 
         sock->state = SS_CONNECTED;
 
         /* At this point, IrLMP has assigned our source address */
         self->saddr = irttp_get_saddr(self->tsap);
-
-        return 0;
+        err = 0;
+out:
+        unlock_kernel();
+        return err;
 }
 
 static struct proto irda_proto = {
@@ -1062,7 +1100,8 @@ static struct proto irda_proto = {
  *    Create IrDA socket
  *
  */
-static int irda_create(struct net *net, struct socket *sock, int protocol)
+static int irda_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         struct irda_sock *self;
@@ -1192,6 +1231,7 @@ static int irda_release(struct socket *sock)
         if (sk == NULL)
                 return 0;
 
+        lock_kernel();
         lock_sock(sk);
         sk->sk_state       = TCP_CLOSE;
         sk->sk_shutdown   |= SEND_SHUTDOWN;
@@ -1210,6 +1250,7 @@ static int irda_release(struct socket *sock)
         /* Destroy networking socket if we are the last reference on it,
          * i.e. if(sk->sk_refcnt == 0) -> sk_free(sk) */
         sock_put(sk);
+        unlock_kernel();
 
         /* Notes on socket locking and deallocation... - Jean II
          * In theory we should put pairs of sock_hold() / sock_put() to
@@ -1257,28 +1298,37 @@ static int irda_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         IRDA_DEBUG(4, "%s(), len=%zd\n", __func__, len);
 
+        lock_kernel();
         /* Note : socket.c set MSG_EOR on SEQPACKET sockets */
         if (msg->msg_flags & ~(MSG_DONTWAIT | MSG_EOR | MSG_CMSG_COMPAT |
-                               MSG_NOSIGNAL))
-                return -EINVAL;
+                               MSG_NOSIGNAL)) {
+                err = -EINVAL;
+                goto out;
+        }
 
         if (sk->sk_shutdown & SEND_SHUTDOWN)
                 goto out_err;
 
-        if (sk->sk_state != TCP_ESTABLISHED)
-                return -ENOTCONN;
+        if (sk->sk_state != TCP_ESTABLISHED) {
+                err = -ENOTCONN;
+                goto out;
+        }
 
         self = irda_sk(sk);
 
         /* Check if IrTTP is wants us to slow down */
 
         if (wait_event_interruptible(*(sk->sk_sleep),
-            (self->tx_flow != FLOW_STOP  ||  sk->sk_state != TCP_ESTABLISHED)))
-                return -ERESTARTSYS;
+            (self->tx_flow != FLOW_STOP  ||  sk->sk_state != TCP_ESTABLISHED))) {
+                err = -ERESTARTSYS;
+                goto out;
+        }
 
         /* Check if we are still connected */
-        if (sk->sk_state != TCP_ESTABLISHED)
-                return -ENOTCONN;
+        if (sk->sk_state != TCP_ESTABLISHED) {
+                err = -ENOTCONN;
+                goto out;
+        }
 
         /* Check that we don't send out too big frames */
         if (len > self->max_data_size) {
@@ -1310,11 +1360,16 @@ static int irda_sendmsg(struct kiocb *iocb, struct socket *sock,
                 IRDA_DEBUG(0, "%s(), err=%d\n", __func__, err);
                 goto out_err;
         }
+
+        unlock_kernel();
         /* Tell client how much data we actually sent */
         return len;
 
- out_err:
-        return sk_stream_error(sk, msg->msg_flags, err);
+out_err:
+        err = sk_stream_error(sk, msg->msg_flags, err);
+out:
+        unlock_kernel();
+        return err;
 
 }
 
@@ -1335,13 +1390,14 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
 
         IRDA_DEBUG(4, "%s()\n", __func__);
 
+        lock_kernel();
         if ((err = sock_error(sk)) < 0)
-                return err;
+                goto out;
 
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
         if (!skb)
-                return err;
+                goto out;
 
         skb_reset_transport_header(skb);
         copied = skb->len;
@@ -1369,8 +1425,12 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
                         irttp_flow_request(self->tsap, FLOW_START);
                 }
         }
-
+        unlock_kernel();
         return copied;
+
+out:
+        unlock_kernel();
+        return err;
 }
 
 /*
@@ -1388,15 +1448,19 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
 
         IRDA_DEBUG(3, "%s()\n", __func__);
 
+        lock_kernel();
         if ((err = sock_error(sk)) < 0)
-                return err;
+                goto out;
 
+        err = -EINVAL;
         if (sock->flags & __SO_ACCEPTCON)
-                return(-EINVAL);
+                goto out;
 
+        err =-EOPNOTSUPP;
         if (flags & MSG_OOB)
-                return -EOPNOTSUPP;
+                goto out;
 
+        err = 0;
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
         timeo = sock_rcvtimeo(sk, noblock);
 
@@ -1408,7 +1472,7 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
 
                 if (skb == NULL) {
                         DEFINE_WAIT(wait);
-                        int ret = 0;
+                        err = 0;
 
                         if (copied >= target)
                                 break;
@@ -1418,25 +1482,25 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
                         /*
                          *      POSIX 1003.1g mandates this order.
                          */
-                        ret = sock_error(sk);
-                        if (ret)
+                        err = sock_error(sk);
+                        if (err)
                                 ;
                         else if (sk->sk_shutdown & RCV_SHUTDOWN)
                                 ;
                         else if (noblock)
-                                ret = -EAGAIN;
+                                err = -EAGAIN;
                         else if (signal_pending(current))
-                                ret = sock_intr_errno(timeo);
+                                err = sock_intr_errno(timeo);
                         else if (sk->sk_state != TCP_ESTABLISHED)
-                                ret = -ENOTCONN;
+                                err = -ENOTCONN;
                         else if (skb_peek(&sk->sk_receive_queue) == NULL)
                                 /* Wait process until data arrives */
                                 schedule();
 
                         finish_wait(sk->sk_sleep, &wait);
 
-                        if (ret)
-                                return ret;
+                        if (err)
+                                goto out;
                         if (sk->sk_shutdown & RCV_SHUTDOWN)
                                 break;
 
@@ -1489,7 +1553,9 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
                 }
         }
 
-        return copied;
+out:
+        unlock_kernel();
+        return err ? : copied;
 }
 
 /*
@@ -1507,18 +1573,23 @@ static int irda_sendmsg_dgram(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *skb;
         int err;
 
+        lock_kernel();
+
         IRDA_DEBUG(4, "%s(), len=%zd\n", __func__, len);
 
+        err = -EINVAL;
         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
-                return -EINVAL;
+                goto out;
 
         if (sk->sk_shutdown & SEND_SHUTDOWN) {
                 send_sig(SIGPIPE, current, 0);
-                return -EPIPE;
+                err = -EPIPE;
+                goto out;
         }
 
+        err = -ENOTCONN;
         if (sk->sk_state != TCP_ESTABLISHED)
-                return -ENOTCONN;
+                goto out;
 
         self = irda_sk(sk);
 
@@ -1535,8 +1606,9 @@ static int irda_sendmsg_dgram(struct kiocb *iocb, struct socket *sock,
 
         skb = sock_alloc_send_skb(sk, len + self->max_header_size,
                                   msg->msg_flags & MSG_DONTWAIT, &err);
+        err = -ENOBUFS;
         if (!skb)
-                return -ENOBUFS;
+                goto out;
 
         skb_reserve(skb, self->max_header_size);
         skb_reset_transport_header(skb);
@@ -1546,7 +1618,7 @@ static int irda_sendmsg_dgram(struct kiocb *iocb, struct socket *sock,
         err = memcpy_fromiovec(skb_transport_header(skb), msg->msg_iov, len);
         if (err) {
                 kfree_skb(skb);
-                return err;
+                goto out;
         }
 
         /*
@@ -1556,9 +1628,13 @@ static int irda_sendmsg_dgram(struct kiocb *iocb, struct socket *sock,
         err = irttp_udata_request(self->tsap, skb);
         if (err) {
                 IRDA_DEBUG(0, "%s(), err=%d\n", __func__, err);
-                return err;
+                goto out;
         }
+        unlock_kernel();
         return len;
+out:
+        unlock_kernel();
+        return err;
 }
 
 /*
@@ -1580,12 +1656,15 @@ static int irda_sendmsg_ultra(struct kiocb *iocb, struct socket *sock,
 
         IRDA_DEBUG(4, "%s(), len=%zd\n", __func__, len);
 
+        lock_kernel();
+        err = -EINVAL;
         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
-                return -EINVAL;
+                goto out;
 
+        err = -EPIPE;
         if (sk->sk_shutdown & SEND_SHUTDOWN) {
                 send_sig(SIGPIPE, current, 0);
-                return -EPIPE;
+                goto out;
         }
 
         self = irda_sk(sk);
@@ -1593,16 +1672,18 @@ static int irda_sendmsg_ultra(struct kiocb *iocb, struct socket *sock,
         /* Check if an address was specified with sendto. Jean II */
         if (msg->msg_name) {
                 struct sockaddr_irda *addr = (struct sockaddr_irda *) msg->msg_name;
+                err = -EINVAL;
                 /* Check address, extract pid. Jean II */
                 if (msg->msg_namelen < sizeof(*addr))
-                        return -EINVAL;
+                        goto out;
                 if (addr->sir_family != AF_IRDA)
-                        return -EINVAL;
+                        goto out;
 
                 pid = addr->sir_lsap_sel;
                 if (pid & 0x80) {
                         IRDA_DEBUG(0, "%s(), extension in PID not supp!\n", __func__);
-                        return -EOPNOTSUPP;
+                        err = -EOPNOTSUPP;
+                        goto out;
                 }
         } else {
                 /* Check that the socket is properly bound to an Ultra
@@ -1611,7 +1692,8 @@ static int irda_sendmsg_ultra(struct kiocb *iocb, struct socket *sock,
                     (sk->sk_state != TCP_ESTABLISHED)) {
                         IRDA_DEBUG(0, "%s(), socket not bound to Ultra PID.\n",
                                    __func__);
-                        return -ENOTCONN;
+                        err = -ENOTCONN;
+                        goto out;
                 }
                 /* Use PID from socket */
                 bound = 1;
@@ -1630,8 +1712,9 @@ static int irda_sendmsg_ultra(struct kiocb *iocb, struct socket *sock,
 
         skb = sock_alloc_send_skb(sk, len + self->max_header_size,
                                   msg->msg_flags & MSG_DONTWAIT, &err);
+        err = -ENOBUFS;
         if (!skb)
-                return -ENOBUFS;
+                goto out;
 
         skb_reserve(skb, self->max_header_size);
         skb_reset_transport_header(skb);
@@ -1641,16 +1724,16 @@ static int irda_sendmsg_ultra(struct kiocb *iocb, struct socket *sock,
         err = memcpy_fromiovec(skb_transport_header(skb), msg->msg_iov, len);
         if (err) {
                 kfree_skb(skb);
-                return err;
+                goto out;
         }
 
         err = irlmp_connless_data_request((bound ? self->lsap : NULL),
                                           skb, pid);
-        if (err) {
+        if (err)
                 IRDA_DEBUG(0, "%s(), err=%d\n", __func__, err);
-                return err;
-        }
-        return len;
+out:
+        unlock_kernel();
+        return err ? : len;
 }
 #endif /* CONFIG_IRDA_ULTRA */
 
@@ -1664,6 +1747,8 @@ static int irda_shutdown(struct socket *sock, int how)
 
         IRDA_DEBUG(1, "%s(%p)\n", __func__, self);
 
+        lock_kernel();
+
         sk->sk_state       = TCP_CLOSE;
         sk->sk_shutdown   |= SEND_SHUTDOWN;
         sk->sk_state_change(sk);
@@ -1684,6 +1769,8 @@ static int irda_shutdown(struct socket *sock, int how)
         self->daddr = DEV_ADDR_ANY;     /* Until we get re-connected */
         self->saddr = 0x0;              /* so IrLMP assign us any link */
 
+        unlock_kernel();
+
         return 0;
 }
 
@@ -1699,6 +1786,7 @@ static unsigned int irda_poll(struct file * file, struct socket *sock,
 
         IRDA_DEBUG(4, "%s()\n", __func__);
 
+        lock_kernel();
         poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
@@ -1746,18 +1834,34 @@ static unsigned int irda_poll(struct file * file, struct socket *sock,
         default:
                 break;
         }
+        unlock_kernel();
         return mask;
 }
 
+static unsigned int irda_datagram_poll(struct file *file, struct socket *sock,
+                           poll_table *wait)
+{
+        int err;
+
+        lock_kernel();
+        err = datagram_poll(file, sock, wait);
+        unlock_kernel();
+
+        return err;
+}
+
 /*
  * Function irda_ioctl (sock, cmd, arg)
  */
 static int irda_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
+        int err;
 
         IRDA_DEBUG(4, "%s(), cmd=%#x\n", __func__, cmd);
 
+        lock_kernel();
+        err = -EINVAL;
         switch (cmd) {
         case TIOCOUTQ: {
                 long amount;
@@ -1765,9 +1869,8 @@ static int irda_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
                 if (amount < 0)
                         amount = 0;
-                if (put_user(amount, (unsigned int __user *)arg))
-                        return -EFAULT;
-                return 0;
+                err = put_user(amount, (unsigned int __user *)arg);
+                break;
         }
 
         case TIOCINQ: {
@@ -1776,15 +1879,14 @@ static int irda_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 /* These two are safe on a single CPU system as only user tasks fiddle here */
                 if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
                         amount = skb->len;
-                if (put_user(amount, (unsigned int __user *)arg))
-                        return -EFAULT;
-                return 0;
+                err = put_user(amount, (unsigned int __user *)arg);
+                break;
         }
 
         case SIOCGSTAMP:
                 if (sk != NULL)
-                        return sock_get_timestamp(sk, (struct timeval __user *)arg);
-                return -EINVAL;
+                        err = sock_get_timestamp(sk, (struct timeval __user *)arg);
+                break;
 
         case SIOCGIFADDR:
         case SIOCSIFADDR:
@@ -1796,14 +1898,14 @@ static int irda_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         case SIOCSIFNETMASK:
         case SIOCGIFMETRIC:
         case SIOCSIFMETRIC:
-                return -EINVAL;
+                break;
         default:
                 IRDA_DEBUG(1, "%s(), doing device ioctl!\n", __func__);
-                return -ENOIOCTLCMD;
+                err = -ENOIOCTLCMD;
         }
+        unlock_kernel();
 
-        /*NOTREACHED*/
-        return 0;
+        return err;
 }
 
 #ifdef CONFIG_COMPAT
@@ -1825,7 +1927,7 @@ static int irda_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
  *    Set some options for the socket
  *
  */
-static int irda_setsockopt(struct socket *sock, int level, int optname,
+static int __irda_setsockopt(struct socket *sock, int level, int optname,
                            char __user *optval, unsigned int optlen)
 {
         struct sock *sk = sock->sk;
@@ -2083,6 +2185,18 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
         return 0;
 }
 
+static int irda_setsockopt(struct socket *sock, int level, int optname,
+                           char __user *optval, unsigned int optlen)
+{
+        int err;
+
+        lock_kernel();
+        err = __irda_setsockopt(sock, level, optname, optval, optlen);
+        unlock_kernel();
+
+        return err;
+}
+
 /*
  * Function irda_extract_ias_value(ias_opt, ias_value)
  *
@@ -2135,7 +2249,7 @@ static int irda_extract_ias_value(struct irda_ias_set *ias_opt,
 /*
  * Function irda_getsockopt (sock, level, optname, optval, optlen)
  */
-static int irda_getsockopt(struct socket *sock, int level, int optname,
+static int __irda_getsockopt(struct socket *sock, int level, int optname,
                            char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
@@ -2463,13 +2577,25 @@ bed:
         return 0;
 }
 
-static struct net_proto_family irda_family_ops = {
+static int irda_getsockopt(struct socket *sock, int level, int optname,
+                           char __user *optval, int __user *optlen)
+{
+        int err;
+
+        lock_kernel();
+        err = __irda_getsockopt(sock, level, optname, optval, optlen);
+        unlock_kernel();
+
+        return err;
+}
+
+static const struct net_proto_family irda_family_ops = {
         .family = PF_IRDA,
         .create = irda_create,
         .owner  = THIS_MODULE,
 };
 
-static const struct proto_ops SOCKOPS_WRAPPED(irda_stream_ops) = {
+static const struct proto_ops irda_stream_ops = {
         .family =       PF_IRDA,
         .owner =        THIS_MODULE,
         .release =      irda_release,
@@ -2493,7 +2619,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(irda_stream_ops) = {
         .sendpage =     sock_no_sendpage,
 };
 
-static const struct proto_ops SOCKOPS_WRAPPED(irda_seqpacket_ops) = {
+static const struct proto_ops irda_seqpacket_ops = {
         .family =       PF_IRDA,
         .owner =        THIS_MODULE,
         .release =      irda_release,
@@ -2502,7 +2628,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(irda_seqpacket_ops) = {
         .socketpair =   sock_no_socketpair,
         .accept =       irda_accept,
         .getname =      irda_getname,
-        .poll =         datagram_poll,
+        .poll =         irda_datagram_poll,
         .ioctl =        irda_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = irda_compat_ioctl,
@@ -2517,7 +2643,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(irda_seqpacket_ops) = {
         .sendpage =     sock_no_sendpage,
 };
 
-static const struct proto_ops SOCKOPS_WRAPPED(irda_dgram_ops) = {
+static const struct proto_ops irda_dgram_ops = {
         .family =       PF_IRDA,
         .owner =        THIS_MODULE,
         .release =      irda_release,
@@ -2526,7 +2652,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(irda_dgram_ops) = {
         .socketpair =   sock_no_socketpair,
         .accept =       irda_accept,
         .getname =      irda_getname,
-        .poll =         datagram_poll,
+        .poll =         irda_datagram_poll,
         .ioctl =        irda_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = irda_compat_ioctl,
@@ -2542,7 +2668,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(irda_dgram_ops) = {
 };
 
 #ifdef CONFIG_IRDA_ULTRA
-static const struct proto_ops SOCKOPS_WRAPPED(irda_ultra_ops) = {
+static const struct proto_ops irda_ultra_ops = {
         .family =       PF_IRDA,
         .owner =        THIS_MODULE,
         .release =      irda_release,
@@ -2551,7 +2677,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(irda_ultra_ops) = {
         .socketpair =   sock_no_socketpair,
         .accept =       sock_no_accept,
         .getname =      irda_getname,
-        .poll =         datagram_poll,
+        .poll =         irda_datagram_poll,
         .ioctl =        irda_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = irda_compat_ioctl,
@@ -2567,13 +2693,6 @@ static const struct proto_ops SOCKOPS_WRAPPED(irda_ultra_ops) = {
 };
 #endif /* CONFIG_IRDA_ULTRA */
 
-SOCKOPS_WRAP(irda_stream, PF_IRDA);
-SOCKOPS_WRAP(irda_seqpacket, PF_IRDA);
-SOCKOPS_WRAP(irda_dgram, PF_IRDA);
-#ifdef CONFIG_IRDA_ULTRA
-SOCKOPS_WRAP(irda_ultra, PF_IRDA);
-#endif /* CONFIG_IRDA_ULTRA */
-
 /*
  * Function irsock_init (pro)
  *
diff --git a/net/irda/discovery.c b/net/irda/discovery.c
index a6f99b5a1499..c1c8ae939126 100644
--- a/net/irda/discovery.c
+++ b/net/irda/discovery.c
@@ -34,6 +34,7 @@
 #include <linux/socket.h>
 #include <linux/fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include <net/irda/irda.h>
 #include <net/irda/irlmp.h>
diff --git a/net/irda/ircomm/ircomm_core.c b/net/irda/ircomm/ircomm_core.c
index 018c92941aba..e97082017f4f 100644
--- a/net/irda/ircomm/ircomm_core.c
+++ b/net/irda/ircomm/ircomm_core.c
@@ -33,6 +33,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 
 #include <net/irda/irda.h>
 #include <net/irda/irmod.h>
diff --git a/net/irda/ircomm/ircomm_lmp.c b/net/irda/ircomm/ircomm_lmp.c
index 7ba96618660e..08fb54dc8c41 100644
--- a/net/irda/ircomm/ircomm_lmp.c
+++ b/net/irda/ircomm/ircomm_lmp.c
@@ -31,6 +31,7 @@
  ********************************************************************/
 
 #include <linux/init.h>
+#include <linux/gfp.h>
 
 #include <net/irda/irda.h>
 #include <net/irda/irlmp.h>
diff --git a/net/irda/ircomm/ircomm_param.c b/net/irda/ircomm/ircomm_param.c
index d57aefd9fe77..e2e893b474e9 100644
--- a/net/irda/ircomm/ircomm_param.c
+++ b/net/irda/ircomm/ircomm_param.c
@@ -28,6 +28,7 @@
  *
  ********************************************************************/
 
+#include <linux/gfp.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
 
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 811984d9324b..faa82ca2dfdc 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -33,6 +33,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/seq_file.h>
 #include <linux/termios.h>
@@ -496,9 +497,6 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
 
         IRDA_DEBUG(0, "%s()\n", __func__ );
 
-        if (!tty)
-                return;
-
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRCOMM_TTY_MAGIC, return;);
 
@@ -1007,9 +1005,6 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRCOMM_TTY_MAGIC, return;);
 
-        if (!tty)
-                return;
-
         /* ircomm_tty_flush_buffer(tty); */
         ircomm_tty_shutdown(self);
 
diff --git a/net/irda/irda_device.c b/net/irda/irda_device.c
index bf92e1473447..25cc2e695158 100644
--- a/net/irda/irda_device.c
+++ b/net/irda/irda_device.c
@@ -41,6 +41,7 @@
 #include <linux/tty.h>
 #include <linux/kmod.h>
 #include <linux/spinlock.h>
+#include <linux/slab.h>
 
 #include <asm/ioctls.h>
 #include <asm/uaccess.h>
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 294e34d3517c..79a1e5a23e10 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -31,6 +31,7 @@
 #include <linux/string.h>
 #include <linux/init.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
diff --git a/net/irda/iriap_event.c b/net/irda/iriap_event.c
index a301cbd93785..703774e29e32 100644
--- a/net/irda/iriap_event.c
+++ b/net/irda/iriap_event.c
@@ -24,6 +24,8 @@
  *
  ********************************************************************/
 
+#include <linux/slab.h>
+
 #include <net/irda/irda.h>
 #include <net/irda/irlmp.h>
 #include <net/irda/iriap.h>
diff --git a/net/irda/irias_object.c b/net/irda/irias_object.c
index 99ebb96f1386..f07ed9fd5792 100644
--- a/net/irda/irias_object.c
+++ b/net/irda/irias_object.c
@@ -22,6 +22,7 @@
  *
  ********************************************************************/
 
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/module.h>
diff --git a/net/irda/irlan/irlan_client.c b/net/irda/irlan/irlan_client.c
index 42f7d960d055..7ed3af957935 100644
--- a/net/irda/irlan/irlan_client.c
+++ b/net/irda/irlan/irlan_client.c
@@ -28,6 +28,7 @@
 
 #include <linux/kernel.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index 315ead3cb926..a788f9e9427d 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -27,6 +27,7 @@
 
 #include <linux/kernel.h>
 #include <linux/string.h>
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/proc_fs.h>
@@ -1128,34 +1129,14 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len)
  */
 static void *irlan_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        int i = 1;
-        struct irlan_cb *self;
-
         rcu_read_lock();
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        list_for_each_entry(self, &irlans, dev_list) {
-                if (*pos == i)
-                        return self;
-                ++i;
-        }
-        return NULL;
+        return seq_list_start_head(&irlans, *pos);
 }
 
 /* Return entry after v, and increment pos */
 static void *irlan_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct list_head *nxt;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                nxt = irlans.next;
-        else
-                nxt = ((struct irlan_cb *)v)->dev_list.next;
-
-        return (nxt == &irlans) ? NULL
-                : list_entry(nxt, struct irlan_cb, dev_list);
+        return seq_list_next(v, &irlans, pos);
 }
 
 /* End of reading /proc file */
@@ -1170,10 +1151,10 @@ static void irlan_seq_stop(struct seq_file *seq, void *v)
  */
 static int irlan_seq_show(struct seq_file *seq, void *v)
 {
-        if (v == SEQ_START_TOKEN)
+        if (v == &irlans)
                 seq_puts(seq, "IrLAN instances:\n");
         else {
-                struct irlan_cb *self = v;
+                struct irlan_cb *self = list_entry(v, struct irlan_cb, dev_list);
 
                 IRDA_ASSERT(self != NULL, return -1;);
                 IRDA_ASSERT(self->magic == IRLAN_MAGIC, return -1;);
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index d340110f5c0c..9616c32d1076 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -321,14 +321,15 @@ static void irlan_eth_set_multicast_list(struct net_device *dev)
                 /* Enable promiscuous mode */
                 IRDA_WARNING("Promiscuous mode not implemented by IrLAN!\n");
         }
-        else if ((dev->flags & IFF_ALLMULTI) || dev->mc_count > HW_MAX_ADDRS) {
+        else if ((dev->flags & IFF_ALLMULTI) ||
+                 netdev_mc_count(dev) > HW_MAX_ADDRS) {
                 /* Disable promiscuous mode, use normal mode. */
                 IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__ );
                 /* hardware_set_filter(NULL); */
 
                 irlan_set_multicast_filter(self, TRUE);
         }
-        else if (dev->mc_count) {
+        else if (!netdev_mc_empty(dev)) {
                 IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__ );
                 /* Walk the address list, and load the filter */
                 /* hardware_set_filter(dev->mc_list); */
diff --git a/net/irda/irlan/irlan_provider.c b/net/irda/irlan/irlan_provider.c
index 3f81f81b2dfa..5cf5e6c872bb 100644
--- a/net/irda/irlan/irlan_provider.c
+++ b/net/irda/irlan/irlan_provider.c
@@ -34,6 +34,7 @@
 #include <linux/init.h>
 #include <linux/random.h>
 #include <linux/bitops.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/byteorder.h>
diff --git a/net/irda/irlap.c b/net/irda/irlap.c
index 356e65b1dc42..783c5f367d29 100644
--- a/net/irda/irlap.c
+++ b/net/irda/irlap.c
@@ -450,10 +450,10 @@ void irlap_disconnect_request(struct irlap_cb *self)
 
         /* Check if we are in the right state for disconnecting */
         switch (self->state) {
-        case LAP_XMIT_P:        /* FALLTROUGH */
-        case LAP_XMIT_S:        /* FALLTROUGH */
-        case LAP_CONN:          /* FALLTROUGH */
-        case LAP_RESET_WAIT:    /* FALLTROUGH */
+        case LAP_XMIT_P:        /* FALLTHROUGH */
+        case LAP_XMIT_S:        /* FALLTHROUGH */
+        case LAP_CONN:          /* FALLTHROUGH */
+        case LAP_RESET_WAIT:    /* FALLTHROUGH */
         case LAP_RESET_CHECK:
                 irlap_do_event(self, DISCONNECT_REQUEST, NULL, NULL);
                 break;
@@ -485,9 +485,9 @@ void irlap_disconnect_indication(struct irlap_cb *self, LAP_REASON reason)
                 IRDA_DEBUG(1, "%s(), Sending reset request!\n", __func__);
                 irlap_do_event(self, RESET_REQUEST, NULL, NULL);
                 break;
-        case LAP_NO_RESPONSE:      /* FALLTROUGH */
-        case LAP_DISC_INDICATION:  /* FALLTROUGH */
-        case LAP_FOUND_NONE:       /* FALLTROUGH */
+        case LAP_NO_RESPONSE:      /* FALLTHROUGH */
+        case LAP_DISC_INDICATION:  /* FALLTHROUGH */
+        case LAP_FOUND_NONE:       /* FALLTHROUGH */
         case LAP_MEDIA_BUSY:
                 irlmp_link_disconnect_indication(self->notify.instance, self,
                                                  reason, NULL);
diff --git a/net/irda/irlap_event.c b/net/irda/irlap_event.c
index c5c51959e3ce..d434c8880745 100644
--- a/net/irda/irlap_event.c
+++ b/net/irda/irlap_event.c
@@ -29,6 +29,7 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include <net/irda/irda.h>
 #include <net/irda/irlap_event.h>
@@ -1741,7 +1742,7 @@ static int irlap_state_reset(struct irlap_cb *self, IRLAP_EVENT event,
  * Function irlap_state_xmit_s (event, skb, info)
  *
  *   XMIT_S, The secondary station has been given the right to transmit,
- *   and we therefor do not expect to receive any transmissions from other
+ *   and we therefore do not expect to receive any transmissions from other
  *   stations.
  */
 static int irlap_state_xmit_s(struct irlap_cb *self, IRLAP_EVENT event,
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index 7af2e74deda8..688222cbf55b 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -29,6 +29,7 @@
 #include <linux/if_ether.h>
 #include <linux/netdevice.h>
 #include <linux/irda.h>
+#include <linux/slab.h>
 
 #include <net/pkt_sched.h>
 #include <net/sock.h>
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 7bf5b913828b..0e7d8bde145d 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -105,7 +105,7 @@ int __init irlmp_init(void)
 
         init_timer(&irlmp->discovery_timer);
 
-        /* Do discovery every 3 seconds, conditionaly */
+        /* Do discovery every 3 seconds, conditionally */
         if (sysctl_discovery)
                 irlmp_start_discovery_timer(irlmp,
                                             sysctl_discovery_timeout*HZ);
@@ -1842,7 +1842,7 @@ LM_REASON irlmp_convert_lap_reason( LAP_REASON lap_reason)
                 reason = LM_CONNECT_FAILURE;
                 break;
         default:
-                IRDA_DEBUG(1, "%s(), Unknow IrLAP disconnect reason %d!\n",
+                IRDA_DEBUG(1, "%s(), Unknown IrLAP disconnect reason %d!\n",
                            __func__, lap_reason);
                 reason = LM_LAP_DISCONNECT;
                 break;
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index b001c361ad30..4300df35d37d 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -249,6 +249,7 @@
 #include <linux/poll.h>
 #include <linux/capability.h>
 #include <linux/ctype.h>        /* isspace() */
+#include <linux/string.h>       /* skip_spaces() */
 #include <asm/uaccess.h>
 #include <linux/init.h>
 
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index cccc2e93234f..df18ab4b6c5e 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -11,6 +11,7 @@
 #include "irnet_irda.h"         /* Private header */
 #include <linux/sched.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 
 /*
@@ -1403,8 +1404,8 @@ irnet_connect_indication(void *		instance,
   /* Socket already connecting ? On primary ? */
   if(0
 #ifdef ALLOW_SIMULT_CONNECT
-     || ((irttp_is_primary(server->tsap) == 1)  /* primary */
-         && (test_and_clear_bit(0, &new->ttp_connect)))
+     || ((irttp_is_primary(server->tsap) == 1) &&       /* primary */
+         (test_and_clear_bit(0, &new->ttp_connect)))
 #endif /* ALLOW_SIMULT_CONNECT */
      )
     {
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 7dea882dbb75..6a1a202710c5 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include "irnet_ppp.h"          /* Private header */
 /* Please put other headers in irnet.h - Thanks */
@@ -76,9 +77,8 @@ irnet_ctrl_write(irnet_socket *	ap,
       /* Look at the next command */
       start = next;
 
-      /* Scrap whitespaces before the command */
-      while(isspace(*start))
-        start++;
+        /* Scrap whitespaces before the command */
+        start = skip_spaces(start);
 
       /* ',' is our command separator */
       next = strchr(start, ',');
@@ -133,8 +133,7 @@ irnet_ctrl_write(irnet_socket *	ap,
               char *    endp;
 
               /* Scrap whitespaces before the command */
-              while(isspace(*begp))
-                begp++;
+              begp = skip_spaces(begp);
 
               /* Convert argument to a number (last arg is the base) */
               addr = simple_strtoul(begp, &endp, 16);
@@ -700,15 +699,18 @@ dev_irnet_ioctl(
 
       /* Query PPP channel and unit number */
     case PPPIOCGCHAN:
+      lock_kernel();
       if(ap->ppp_open && !put_user(ppp_channel_index(&ap->chan),
                                                 (int __user *)argp))
         err = 0;
+      unlock_kernel();
       break;
     case PPPIOCGUNIT:
       lock_kernel();
       if(ap->ppp_open && !put_user(ppp_unit_number(&ap->chan),
                                                 (int __user *)argp))
-      err = 0;
+        err = 0;
+      unlock_kernel();
       break;
 
       /* All these ioctls can be passed both directly and from ppp_generic,
diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index 476b307bd801..6c7c4b92e4f8 100644
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -15,6 +15,7 @@
 
 #include <linux/socket.h>
 #include <linux/irda.h>
+#include <linux/gfp.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/irda/irda.h>
@@ -124,7 +125,7 @@ static int irda_nl_get_mode(struct sk_buff *skb, struct genl_info *info)
         return ret;
 }
 
-static struct nla_policy irda_nl_policy[IRDA_NL_ATTR_MAX + 1] = {
+static const struct nla_policy irda_nl_policy[IRDA_NL_ATTR_MAX + 1] = {
         [IRDA_NL_ATTR_IFNAME] = { .type = NLA_NUL_STRING,
                                   .len = IFNAMSIZ-1 },
         [IRDA_NL_ATTR_MODE] = { .type = NLA_U32 },
diff --git a/net/irda/irqueue.c b/net/irda/irqueue.c
index ba01938becb5..849aaf0dabb5 100644
--- a/net/irda/irqueue.c
+++ b/net/irda/irqueue.c
@@ -192,6 +192,7 @@
  * Jean II
  */
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include <net/irda/irda.h>
 #include <net/irda/irqueue.h>
diff --git a/net/irda/irsysctl.c b/net/irda/irsysctl.c
index 5c86567e5a78..d0b70dadf73b 100644
--- a/net/irda/irsysctl.c
+++ b/net/irda/irsysctl.c
@@ -113,26 +113,21 @@ static int do_discovery(ctl_table *table, int write,
 /* One file */
 static ctl_table irda_table[] = {
         {
-                .ctl_name       = NET_IRDA_DISCOVERY,
                 .procname       = "discovery",
                 .data           = &sysctl_discovery,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = do_discovery,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_IRDA_DEVNAME,
                 .procname       = "devname",
                 .data           = sysctl_devname,
                 .maxlen         = 65,
                 .mode           = 0644,
                 .proc_handler   = do_devname,
-                .strategy       = sysctl_string
         },
 #ifdef CONFIG_IRDA_DEBUG
         {
-                .ctl_name       = NET_IRDA_DEBUG,
                 .procname       = "debug",
                 .data           = &irda_debug,
                 .maxlen         = sizeof(int),
@@ -142,7 +137,6 @@ static ctl_table irda_table[] = {
 #endif
 #ifdef CONFIG_IRDA_FAST_RR
         {
-                .ctl_name       = NET_IRDA_FAST_POLL,
                 .procname       = "fast_poll_increase",
                 .data           = &sysctl_fast_poll_increase,
                 .maxlen         = sizeof(int),
@@ -151,18 +145,15 @@ static ctl_table irda_table[] = {
         },
 #endif
         {
-                .ctl_name       = NET_IRDA_DISCOVERY_SLOTS,
                 .procname       = "discovery_slots",
                 .data           = &sysctl_discovery_slots,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_discovery_slots,
                 .extra2         = &max_discovery_slots
         },
         {
-                .ctl_name       = NET_IRDA_DISCOVERY_TIMEOUT,
                 .procname       = "discovery_timeout",
                 .data           = &sysctl_discovery_timeout,
                 .maxlen         = sizeof(int),
@@ -170,99 +161,83 @@ static ctl_table irda_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IRDA_SLOT_TIMEOUT,
                 .procname       = "slot_timeout",
                 .data           = &sysctl_slot_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_slot_timeout,
                 .extra2         = &max_slot_timeout
         },
         {
-                .ctl_name       = NET_IRDA_MAX_BAUD_RATE,
                 .procname       = "max_baud_rate",
                 .data           = &sysctl_max_baud_rate,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_baud_rate,
                 .extra2         = &max_max_baud_rate
         },
         {
-                .ctl_name       = NET_IRDA_MIN_TX_TURN_TIME,
                 .procname       = "min_tx_turn_time",
                 .data           = &sysctl_min_tx_turn_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_min_tx_turn_time,
                 .extra2         = &max_min_tx_turn_time
         },
         {
-                .ctl_name       = NET_IRDA_MAX_TX_DATA_SIZE,
                 .procname       = "max_tx_data_size",
                 .data           = &sysctl_max_tx_data_size,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_tx_data_size,
                 .extra2         = &max_max_tx_data_size
         },
         {
-                .ctl_name       = NET_IRDA_MAX_TX_WINDOW,
                 .procname       = "max_tx_window",
                 .data           = &sysctl_max_tx_window,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_tx_window,
                 .extra2         = &max_max_tx_window
         },
         {
-                .ctl_name       = NET_IRDA_MAX_NOREPLY_TIME,
                 .procname       = "max_noreply_time",
                 .data           = &sysctl_max_noreply_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_noreply_time,
                 .extra2         = &max_max_noreply_time
         },
         {
-                .ctl_name       = NET_IRDA_WARN_NOREPLY_TIME,
                 .procname       = "warn_noreply_time",
                 .data           = &sysctl_warn_noreply_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_warn_noreply_time,
                 .extra2         = &max_warn_noreply_time
         },
         {
-                .ctl_name       = NET_IRDA_LAP_KEEPALIVE_TIME,
                 .procname       = "lap_keepalive_time",
                 .data           = &sysctl_lap_keepalive_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_lap_keepalive_time,
                 .extra2         = &max_lap_keepalive_time
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_path irda_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "irda", .ctl_name = NET_IRDA, },
+        { .procname = "net", },
+        { .procname = "irda", },
         { }
 };
 
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 9cb79f95bf63..47db1d8a0d92 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -28,6 +28,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index bada1b9c670b..c18286a2167b 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -221,7 +221,7 @@ static int afiucv_pm_restore_thaw(struct device *dev)
         return 0;
 }
 
-static struct dev_pm_ops afiucv_pm_ops = {
+static const struct dev_pm_ops afiucv_pm_ops = {
         .prepare = afiucv_pm_prepare,
         .complete = afiucv_pm_complete,
         .freeze = afiucv_pm_freeze,
@@ -428,7 +428,6 @@ static void iucv_sock_close(struct sock *sk)
                 break;
 
         default:
-                sock_set_flag(sk, SOCK_ZAPPED);
                 /* nothing to do here */
                 break;
         }
@@ -482,7 +481,8 @@ static struct sock *iucv_sock_alloc(struct socket *sock, int proto, gfp_t prio)
 }
 
 /* Create an IUCV socket */
-static int iucv_sock_create(struct net *net, struct socket *sock, int protocol)
+static int iucv_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -536,7 +536,7 @@ void iucv_accept_enqueue(struct sock *parent, struct sock *sk)
         list_add_tail(&iucv_sk(sk)->accept_q, &par->accept_q);
         spin_unlock_irqrestore(&par->accept_q_lock, flags);
         iucv_sk(sk)->parent = parent;
-        parent->sk_ack_backlog++;
+        sk_acceptq_added(parent);
 }
 
 void iucv_accept_unlink(struct sock *sk)
@@ -547,7 +547,7 @@ void iucv_accept_unlink(struct sock *sk)
         spin_lock_irqsave(&par->accept_q_lock, flags);
         list_del_init(&iucv_sk(sk)->accept_q);
         spin_unlock_irqrestore(&par->accept_q_lock, flags);
-        iucv_sk(sk)->parent->sk_ack_backlog--;
+        sk_acceptq_removed(iucv_sk(sk)->parent);
         iucv_sk(sk)->parent = NULL;
         sock_put(sk);
 }
@@ -1715,7 +1715,7 @@ static const struct proto_ops iucv_sock_ops = {
         .getsockopt     = iucv_sock_getsockopt,
 };
 
-static struct net_proto_family iucv_sock_family_ops = {
+static const struct net_proto_family iucv_sock_family_ops = {
         .family = AF_IUCV,
         .owner  = THIS_MODULE,
         .create = iucv_sock_create,
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 3973d0e61e56..fd8b28361a64 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -93,7 +93,7 @@ static int iucv_pm_freeze(struct device *);
 static int iucv_pm_thaw(struct device *);
 static int iucv_pm_restore(struct device *);
 
-static struct dev_pm_ops iucv_pm_ops = {
+static const struct dev_pm_ops iucv_pm_ops = {
         .prepare = iucv_pm_prepare,
         .complete = iucv_pm_complete,
         .freeze = iucv_pm_freeze,
@@ -1768,7 +1768,6 @@ static void iucv_tasklet_fn(unsigned long ignored)
  */
 static void iucv_work_fn(struct work_struct *work)
 {
-        typedef void iucv_irq_fn(struct iucv_irq_data *);
         LIST_HEAD(work_queue);
         struct iucv_irq_list *p, *n;
 
@@ -1878,14 +1877,25 @@ int iucv_path_table_empty(void)
 static int iucv_pm_freeze(struct device *dev)
 {
         int cpu;
+        struct iucv_irq_list *p, *n;
         int rc = 0;
 
 #ifdef CONFIG_PM_DEBUG
         printk(KERN_WARNING "iucv_pm_freeze\n");
 #endif
+        if (iucv_pm_state != IUCV_PM_FREEZING) {
+                for_each_cpu_mask_nr(cpu, iucv_irq_cpumask)
+                        smp_call_function_single(cpu, iucv_block_cpu_almost,
+                                                 NULL, 1);
+                cancel_work_sync(&iucv_work);
+                list_for_each_entry_safe(p, n, &iucv_work_queue, list) {
+                        list_del_init(&p->list);
+                        iucv_sever_pathid(p->data.ippathid,
+                                          iucv_error_no_listener);
+                        kfree(p);
+                }
+        }
         iucv_pm_state = IUCV_PM_FREEZING;
-        for_each_cpu_mask_nr(cpu, iucv_irq_cpumask)
-                smp_call_function_single(cpu, iucv_block_cpu_almost, NULL, 1);
         if (dev->driver && dev->driver->pm && dev->driver->pm->freeze)
                 rc = dev->driver->pm->freeze(dev);
         if (iucv_path_table_empty())
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 4e98193dfa0f..ba9a3fcc2fed 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -26,6 +26,7 @@
 #include <linux/in6.h>
 #include <linux/proc_fs.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/xfrm.h>
@@ -35,16 +36,16 @@
 #define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x))
 #define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x))
 
-static int pfkey_net_id;
+static int pfkey_net_id __read_mostly;
 struct netns_pfkey {
         /* List of all pfkey sockets. */
         struct hlist_head table;
         atomic_t socks_nr;
 };
-static DECLARE_WAIT_QUEUE_HEAD(pfkey_table_wait);
-static DEFINE_RWLOCK(pfkey_table_lock);
-static atomic_t pfkey_table_users = ATOMIC_INIT(0);
+static DEFINE_MUTEX(pfkey_mutex);
 
+#define DUMMY_MARK 0
+static struct xfrm_mark dummy_mark = {0, 0};
 struct pfkey_sock {
         /* struct sock must be the first member of struct pfkey_sock */
         struct sock     sk;
@@ -108,50 +109,6 @@ static void pfkey_sock_destruct(struct sock *sk)
         atomic_dec(&net_pfkey->socks_nr);
 }
 
-static void pfkey_table_grab(void)
-{
-        write_lock_bh(&pfkey_table_lock);
-
-        if (atomic_read(&pfkey_table_users)) {
-                DECLARE_WAITQUEUE(wait, current);
-
-                add_wait_queue_exclusive(&pfkey_table_wait, &wait);
-                for(;;) {
-                        set_current_state(TASK_UNINTERRUPTIBLE);
-                        if (atomic_read(&pfkey_table_users) == 0)
-                                break;
-                        write_unlock_bh(&pfkey_table_lock);
-                        schedule();
-                        write_lock_bh(&pfkey_table_lock);
-                }
-
-                __set_current_state(TASK_RUNNING);
-                remove_wait_queue(&pfkey_table_wait, &wait);
-        }
-}
-
-static __inline__ void pfkey_table_ungrab(void)
-{
-        write_unlock_bh(&pfkey_table_lock);
-        wake_up(&pfkey_table_wait);
-}
-
-static __inline__ void pfkey_lock_table(void)
-{
-        /* read_lock() synchronizes us to pfkey_table_grab */
-
-        read_lock(&pfkey_table_lock);
-        atomic_inc(&pfkey_table_users);
-        read_unlock(&pfkey_table_lock);
-}
-
-static __inline__ void pfkey_unlock_table(void)
-{
-        if (atomic_dec_and_test(&pfkey_table_users))
-                wake_up(&pfkey_table_wait);
-}
-
-
 static const struct proto_ops pfkey_ops;
 
 static void pfkey_insert(struct sock *sk)
@@ -159,16 +116,16 @@ static void pfkey_insert(struct sock *sk)
         struct net *net = sock_net(sk);
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
 
-        pfkey_table_grab();
-        sk_add_node(sk, &net_pfkey->table);
-        pfkey_table_ungrab();
+        mutex_lock(&pfkey_mutex);
+        sk_add_node_rcu(sk, &net_pfkey->table);
+        mutex_unlock(&pfkey_mutex);
 }
 
 static void pfkey_remove(struct sock *sk)
 {
-        pfkey_table_grab();
-        sk_del_node_init(sk);
-        pfkey_table_ungrab();
+        mutex_lock(&pfkey_mutex);
+        sk_del_node_init_rcu(sk);
+        mutex_unlock(&pfkey_mutex);
 }
 
 static struct proto key_proto = {
@@ -177,7 +134,8 @@ static struct proto key_proto = {
         .obj_size = sizeof(struct pfkey_sock),
 };
 
-static int pfkey_create(struct net *net, struct socket *sock, int protocol)
+static int pfkey_create(struct net *net, struct socket *sock, int protocol,
+                        int kern)
 {
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
         struct sock *sk;
@@ -222,6 +180,8 @@ static int pfkey_release(struct socket *sock)
         sock_orphan(sk);
         sock->sk = NULL;
         skb_queue_purge(&sk->sk_write_queue);
+
+        synchronize_rcu();
         sock_put(sk);
 
         return 0;
@@ -276,8 +236,8 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
         if (!skb)
                 return -ENOMEM;
 
-        pfkey_lock_table();
-        sk_for_each(sk, node, &net_pfkey->table) {
+        rcu_read_lock();
+        sk_for_each_rcu(sk, node, &net_pfkey->table) {
                 struct pfkey_sock *pfk = pfkey_sk(sk);
                 int err2;
 
@@ -308,7 +268,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                 if ((broadcast_flags & BROADCAST_REGISTERED) && err)
                         err = err2;
         }
-        pfkey_unlock_table();
+        rcu_read_unlock();
 
         if (one_sk != NULL)
                 err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
@@ -690,7 +650,7 @@ static struct  xfrm_state *pfkey_xfrm_state_lookup(struct net *net, struct sadb_
         if (!xaddr)
                 return NULL;
 
-        return xfrm_state_lookup(net, xaddr, sa->sadb_sa_spi, proto, family);
+        return xfrm_state_lookup(net, DUMMY_MARK, xaddr, sa->sadb_sa_spi, proto, family);
 }
 
 #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1)))
@@ -1192,6 +1152,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                         x->aalg->alg_key_len = key->sadb_key_bits;
                         memcpy(x->aalg->alg_key, key+1, keysize);
                 }
+                x->aalg->alg_trunc_len = a->uinfo.auth.icv_truncbits;
                 x->props.aalgo = sa->sadb_sa_auth;
                 /* x->algo.flags = sa->sadb_sa_flags; */
         }
@@ -1358,7 +1319,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         }
 
         if (hdr->sadb_msg_seq) {
-                x = xfrm_find_acq_byseq(net, hdr->sadb_msg_seq);
+                x = xfrm_find_acq_byseq(net, DUMMY_MARK, hdr->sadb_msg_seq);
                 if (x && xfrm_addr_cmp(&x->id.daddr, xdaddr, family)) {
                         xfrm_state_put(x);
                         x = NULL;
@@ -1366,7 +1327,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         }
 
         if (!x)
-                x = xfrm_find_acq(net, mode, reqid, proto, xdaddr, xsaddr, 1, family);
+                x = xfrm_find_acq(net, &dummy_mark, mode, reqid, proto, xdaddr, xsaddr, 1, family);
 
         if (x == NULL)
                 return -ENOENT;
@@ -1415,7 +1376,7 @@ static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, struct sadb_msg *
         if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0)
                 return 0;
 
-        x = xfrm_find_acq_byseq(net, hdr->sadb_msg_seq);
+        x = xfrm_find_acq_byseq(net, DUMMY_MARK, hdr->sadb_msg_seq);
         if (x == NULL)
                 return 0;
 
@@ -1710,6 +1671,23 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         return 0;
 }
 
+static int unicast_flush_resp(struct sock *sk, struct sadb_msg *ihdr)
+{
+        struct sk_buff *skb;
+        struct sadb_msg *hdr;
+
+        skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
+        if (!skb)
+                return -ENOBUFS;
+
+        hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
+        memcpy(hdr, ihdr, sizeof(struct sadb_msg));
+        hdr->sadb_msg_errno = (uint8_t) 0;
+        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
+}
+
 static int key_notify_sa_flush(struct km_event *c)
 {
         struct sk_buff *skb;
@@ -1738,7 +1716,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
         unsigned proto;
         struct km_event c;
         struct xfrm_audit audit_info;
-        int err;
+        int err, err2;
 
         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
         if (proto == 0)
@@ -1748,8 +1726,13 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
         audit_info.sessionid = audit_get_sessionid(current);
         audit_info.secid = 0;
         err = xfrm_state_flush(net, proto, &audit_info);
-        if (err)
-                return err;
+        err2 = unicast_flush_resp(sk, hdr);
+        if (err || err2) {
+                if (err == -ESRCH) /* empty table - go quietly */
+                        err = 0;
+                return err ? err : err2;
+        }
+
         c.data.proto = proto;
         c.seq = hdr->sadb_msg_seq;
         c.pid = hdr->sadb_msg_pid;
@@ -2147,10 +2130,9 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c
         int err;
 
         out_skb = pfkey_xfrm_policy2msg_prep(xp);
-        if (IS_ERR(out_skb)) {
-                err = PTR_ERR(out_skb);
-                goto out;
-        }
+        if (IS_ERR(out_skb))
+                return PTR_ERR(out_skb);
+
         err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
         if (err < 0)
                 return err;
@@ -2166,7 +2148,6 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c
         out_hdr->sadb_msg_seq = c->seq;
         out_hdr->sadb_msg_pid = c->pid;
         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
-out:
         return 0;
 
 }
@@ -2344,7 +2325,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
                         return err;
         }
 
-        xp = xfrm_policy_bysel_ctx(net, XFRM_POLICY_TYPE_MAIN,
+        xp = xfrm_policy_bysel_ctx(net, DUMMY_MARK, XFRM_POLICY_TYPE_MAIN,
                                    pol->sadb_x_policy_dir - 1, &sel, pol_ctx,
                                    1, &err);
         security_xfrm_policy_free(pol_ctx);
@@ -2592,8 +2573,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
                 return -EINVAL;
 
         delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
-        xp = xfrm_policy_byid(net, XFRM_POLICY_TYPE_MAIN, dir,
-                              pol->sadb_x_policy_id, delete, &err);
+        xp = xfrm_policy_byid(net, DUMMY_MARK, XFRM_POLICY_TYPE_MAIN,
+                              dir, pol->sadb_x_policy_id, delete, &err);
         if (xp == NULL)
                 return -ENOENT;
 
@@ -2704,14 +2685,19 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         struct net *net = sock_net(sk);
         struct km_event c;
         struct xfrm_audit audit_info;
-        int err;
+        int err, err2;
 
         audit_info.loginuid = audit_get_loginuid(current);
         audit_info.sessionid = audit_get_sessionid(current);
         audit_info.secid = 0;
         err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);
-        if (err)
+        err2 = unicast_flush_resp(sk, hdr);
+        if (err || err2) {
+                if (err == -ESRCH) /* empty table - old silent behavior */
+                        return 0;
                 return err;
+        }
+
         c.data.type = XFRM_POLICY_TYPE_MAIN;
         c.event = XFRM_MSG_FLUSHPOLICY;
         c.pid = hdr->sadb_msg_pid;
@@ -3017,12 +3003,11 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_e
 static u32 get_acqseq(void)
 {
         u32 res;
-        static u32 acqseq;
-        static DEFINE_SPINLOCK(acqseq_lock);
+        static atomic_t acqseq;
 
-        spin_lock_bh(&acqseq_lock);
-        res = (++acqseq ? : ++acqseq);
-        spin_unlock_bh(&acqseq_lock);
+        do {
+                res = atomic_inc_return(&acqseq);
+        } while (!res);
         return res;
 }
 
@@ -3606,7 +3591,7 @@ static int pfkey_recvmsg(struct kiocb *kiocb,
         if (err)
                 goto out_free;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         err = (flags & MSG_TRUNC) ? skb->len : copied;
 
@@ -3644,7 +3629,7 @@ static const struct proto_ops pfkey_ops = {
         .recvmsg        =       pfkey_recvmsg,
 };
 
-static struct net_proto_family pfkey_family_ops = {
+static const struct net_proto_family pfkey_family_ops = {
         .family =       PF_KEY,
         .create =       pfkey_create,
         .owner  =       THIS_MODULE,
@@ -3653,9 +3638,8 @@ static struct net_proto_family pfkey_family_ops = {
 #ifdef CONFIG_PROC_FS
 static int pfkey_seq_show(struct seq_file *f, void *v)
 {
-        struct sock *s;
+        struct sock *s = sk_entry(v);
 
-        s = (struct sock *)v;
         if (v == SEQ_START_TOKEN)
                 seq_printf(f ,"sk       RefCnt Rmem   Wmem   User   Inode\n");
         else
@@ -3674,19 +3658,9 @@ static void *pfkey_seq_start(struct seq_file *f, loff_t *ppos)
 {
         struct net *net = seq_file_net(f);
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
-        struct sock *s;
-        struct hlist_node *node;
-        loff_t pos = *ppos;
-
-        read_lock(&pfkey_table_lock);
-        if (pos == 0)
-                return SEQ_START_TOKEN;
-
-        sk_for_each(s, node, &net_pfkey->table)
-                if (pos-- == 1)
-                        return s;
 
-        return NULL;
+        rcu_read_lock();
+        return seq_hlist_start_head_rcu(&net_pfkey->table, *ppos);
 }
 
 static void *pfkey_seq_next(struct seq_file *f, void *v, loff_t *ppos)
@@ -3694,15 +3668,12 @@ static void *pfkey_seq_next(struct seq_file *f, void *v, loff_t *ppos)
         struct net *net = seq_file_net(f);
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
 
-        ++*ppos;
-        return (v == SEQ_START_TOKEN) ?
-                sk_head(&net_pfkey->table) :
-                        sk_next((struct sock *)v);
+        return seq_hlist_next_rcu(v, &net_pfkey->table, ppos);
 }
 
 static void pfkey_seq_stop(struct seq_file *f, void *v)
 {
-        read_unlock(&pfkey_table_lock);
+        rcu_read_unlock();
 }
 
 static const struct seq_operations pfkey_seq_ops = {
@@ -3736,17 +3707,17 @@ static int __net_init pfkey_init_proc(struct net *net)
         return 0;
 }
 
-static void pfkey_exit_proc(struct net *net)
+static void __net_exit pfkey_exit_proc(struct net *net)
 {
         proc_net_remove(net, "pfkey");
 }
 #else
-static int __net_init pfkey_init_proc(struct net *net)
+static inline int pfkey_init_proc(struct net *net)
 {
         return 0;
 }
 
-static void pfkey_exit_proc(struct net *net)
+static inline void pfkey_exit_proc(struct net *net)
 {
 }
 #endif
@@ -3764,28 +3735,14 @@ static struct xfrm_mgr pfkeyv2_mgr =
 
 static int __net_init pfkey_net_init(struct net *net)
 {
-        struct netns_pfkey *net_pfkey;
+        struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
         int rv;
 
-        net_pfkey = kmalloc(sizeof(struct netns_pfkey), GFP_KERNEL);
-        if (!net_pfkey) {
-                rv = -ENOMEM;
-                goto out_kmalloc;
-        }
         INIT_HLIST_HEAD(&net_pfkey->table);
         atomic_set(&net_pfkey->socks_nr, 0);
-        rv = net_assign_generic(net, pfkey_net_id, net_pfkey);
-        if (rv < 0)
-                goto out_assign;
+
         rv = pfkey_init_proc(net);
-        if (rv < 0)
-                goto out_proc;
-        return 0;
 
-out_proc:
-out_assign:
-        kfree(net_pfkey);
-out_kmalloc:
         return rv;
 }
 
@@ -3795,19 +3752,20 @@ static void __net_exit pfkey_net_exit(struct net *net)
 
         pfkey_exit_proc(net);
         BUG_ON(!hlist_empty(&net_pfkey->table));
-        kfree(net_pfkey);
 }
 
 static struct pernet_operations pfkey_net_ops = {
         .init = pfkey_net_init,
         .exit = pfkey_net_exit,
+        .id   = &pfkey_net_id,
+        .size = sizeof(struct netns_pfkey),
 };
 
 static void __exit ipsec_pfkey_exit(void)
 {
-        unregister_pernet_gen_subsys(pfkey_net_id, &pfkey_net_ops);
         xfrm_unregister_km(&pfkeyv2_mgr);
         sock_unregister(PF_KEY);
+        unregister_pernet_subsys(&pfkey_net_ops);
         proto_unregister(&key_proto);
 }
 
@@ -3818,21 +3776,22 @@ static int __init ipsec_pfkey_init(void)
         if (err != 0)
                 goto out;
 
-        err = sock_register(&pfkey_family_ops);
+        err = register_pernet_subsys(&pfkey_net_ops);
         if (err != 0)
                 goto out_unregister_key_proto;
+        err = sock_register(&pfkey_family_ops);
+        if (err != 0)
+                goto out_unregister_pernet;
         err = xfrm_register_km(&pfkeyv2_mgr);
         if (err != 0)
                 goto out_sock_unregister;
-        err = register_pernet_gen_subsys(&pfkey_net_id, &pfkey_net_ops);
-        if (err != 0)
-                goto out_xfrm_unregister_km;
 out:
         return err;
-out_xfrm_unregister_km:
-        xfrm_unregister_km(&pfkeyv2_mgr);
+
 out_sock_unregister:
         sock_unregister(PF_KEY);
+out_unregister_pernet:
+        unregister_pernet_subsys(&pfkey_net_ops);
 out_unregister_key_proto:
         proto_unregister(&key_proto);
         goto out;
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index bda96d18fd98..d5d8d555c410 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -29,6 +29,7 @@
 #include <linux/inet.h>
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
diff --git a/net/lapb/lapb_in.c b/net/lapb/lapb_in.c
index 6762e7c751eb..21904a002449 100644
--- a/net/lapb/lapb_in.c
+++ b/net/lapb/lapb_in.c
@@ -27,6 +27,7 @@
 #include <linux/inet.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
diff --git a/net/lapb/lapb_out.c b/net/lapb/lapb_out.c
index 339cc5f2684f..c75a79540f9f 100644
--- a/net/lapb/lapb_out.c
+++ b/net/lapb/lapb_out.c
@@ -25,6 +25,7 @@
 #include <linux/net.h>
 #include <linux/inet.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
diff --git a/net/lapb/lapb_subr.c b/net/lapb/lapb_subr.c
index b827f47ac133..43a2a7fb327b 100644
--- a/net/lapb/lapb_subr.c
+++ b/net/lapb/lapb_subr.c
@@ -24,6 +24,7 @@
 #include <linux/net.h>
 #include <linux/inet.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 7aa4fd170104..2db6a9f75913 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/rtnetlink.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/llc.h>
 #include <net/llc_sap.h>
 #include <net/llc_pdu.h>
@@ -47,6 +48,10 @@ static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout);
 #define dprintk(args...)
 #endif
 
+/* Maybe we'll add some more in the future. */
+#define LLC_CMSG_PKTINFO        1
+
+
 /**
  *      llc_ui_next_link_no - return the next unused link number for a sap
  *      @sap: Address of sap to get link number from.
@@ -136,18 +141,22 @@ static struct proto llc_proto = {
         .name     = "LLC",
         .owner    = THIS_MODULE,
         .obj_size = sizeof(struct llc_sock),
+        .slab_flags = SLAB_DESTROY_BY_RCU,
 };
 
 /**
  *      llc_ui_create - alloc and init a new llc_ui socket
+ *      @net: network namespace (must be default network)
  *      @sock: Socket to initialize and attach allocated sk to.
  *      @protocol: Unused.
+ *      @kern: on behalf of kernel or userspace
  *
  *      Allocate and initialize a new llc_ui socket, validate the user wants a
  *      socket type we have available.
  *      Returns 0 upon success, negative upon failure.
  */
-static int llc_ui_create(struct net *net, struct socket *sock, int protocol)
+static int llc_ui_create(struct net *net, struct socket *sock, int protocol,
+                         int kern)
 {
         struct sock *sk;
         int rc = -ESOCKTNOSUPPORT;
@@ -155,7 +164,7 @@ static int llc_ui_create(struct net *net, struct socket *sock, int protocol)
         if (!capable(CAP_NET_RAW))
                 return -EPERM;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         if (likely(sock->type == SOCK_DGRAM || sock->type == SOCK_STREAM)) {
@@ -189,10 +198,8 @@ static int llc_ui_release(struct socket *sock)
                 llc->laddr.lsap, llc->daddr.lsap);
         if (!llc_send_disc(sk))
                 llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
-        if (!sock_flag(sk, SOCK_ZAPPED)) {
-                llc_sap_put(llc->sap);
+        if (!sock_flag(sk, SOCK_ZAPPED))
                 llc_sap_remove_socket(llc->sap, sk);
-        }
         release_sock(sk);
         if (llc->dev)
                 dev_put(llc->dev);
@@ -252,7 +259,14 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
         if (!sock_flag(sk, SOCK_ZAPPED))
                 goto out;
         rc = -ENODEV;
-        llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
+        if (sk->sk_bound_dev_if) {
+                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                if (llc->dev && addr->sllc_arphrd != llc->dev->type) {
+                        dev_put(llc->dev);
+                        llc->dev = NULL;
+                }
+        } else
+                llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
         if (!llc->dev)
                 goto out;
         rc = -EUSERS;
@@ -303,7 +317,25 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 goto out;
         rc = -ENODEV;
         rtnl_lock();
-        llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd, addr->sllc_mac);
+        if (sk->sk_bound_dev_if) {
+                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                if (llc->dev) {
+                        if (!addr->sllc_arphrd)
+                                addr->sllc_arphrd = llc->dev->type;
+                        if (llc_mac_null(addr->sllc_mac))
+                                memcpy(addr->sllc_mac, llc->dev->dev_addr,
+                                       IFHWADDRLEN);
+                        if (addr->sllc_arphrd != llc->dev->type ||
+                            !llc_mac_match(addr->sllc_mac,
+                                           llc->dev->dev_addr)) {
+                                rc = -EINVAL;
+                                dev_put(llc->dev);
+                                llc->dev = NULL;
+                        }
+                }
+        } else
+                llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
+                                           addr->sllc_mac);
         rtnl_unlock();
         if (!llc->dev)
                 goto out;
@@ -319,7 +351,6 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 rc = -EBUSY; /* some other network layer is using the sap */
                 if (!sap)
                         goto out;
-                llc_sap_hold(sap);
         } else {
                 struct llc_addr laddr, daddr;
                 struct sock *ask;
@@ -588,6 +619,20 @@ static int llc_wait_data(struct sock *sk, long timeo)
         return rc;
 }
 
+static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
+{
+        struct llc_sock *llc = llc_sk(skb->sk);
+
+        if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
+                struct llc_pktinfo info;
+
+                info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
+                llc_pdu_decode_dsap(skb, &info.lpi_sap);
+                llc_pdu_decode_da(skb, info.lpi_mac);
+                put_cmsg(msg, SOL_LLC, LLC_OPT_PKTINFO, sizeof(info), &info);
+        }
+}
+
 /**
  *      llc_ui_accept - accept a new incoming connection.
  *      @sock: Socket which connections arrive on.
@@ -809,6 +854,8 @@ copy_uaddr:
                 memcpy(uaddr, llc_ui_skb_cb(skb), sizeof(*uaddr));
                 msg->msg_namelen = sizeof(*uaddr);
         }
+        if (llc_sk(sk)->cmsg_flags)
+                llc_cmsg_rcv(msg, skb);
         goto out;
 }
 
@@ -1027,6 +1074,12 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
                         goto out;
                 llc->rw = opt;
                 break;
+        case LLC_OPT_PKTINFO:
+                if (opt)
+                        llc->cmsg_flags |= LLC_CMSG_PKTINFO;
+                else
+                        llc->cmsg_flags &= ~LLC_CMSG_PKTINFO;
+                break;
         default:
                 rc = -ENOPROTOOPT;
                 goto out;
@@ -1080,6 +1133,9 @@ static int llc_ui_getsockopt(struct socket *sock, int level, int optname,
                 val = llc->k;                           break;
         case LLC_OPT_RX_WIN:
                 val = llc->rw;                          break;
+        case LLC_OPT_PKTINFO:
+                val = (llc->cmsg_flags & LLC_CMSG_PKTINFO) != 0;
+                break;
         default:
                 rc = -ENOPROTOOPT;
                 goto out;
@@ -1092,7 +1148,7 @@ out:
         return rc;
 }
 
-static struct net_proto_family llc_ui_family_ops = {
+static const struct net_proto_family llc_ui_family_ops = {
         .family = PF_LLC,
         .create = llc_ui_create,
         .owner  = THIS_MODULE,
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index 019c780512e8..ea225bd2672c 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -18,6 +18,7 @@
  * See the GNU General Public License for more details.
  */
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/llc_conn.h>
 #include <net/llc_sap.h>
 #include <net/sock.h>
@@ -1437,7 +1438,7 @@ static void llc_process_tmr_ev(struct sock *sk, struct sk_buff *skb)
                         llc_conn_state_process(sk, skb);
                 else {
                         llc_set_backlog_type(skb, LLC_EVENT);
-                        sk_add_backlog(sk, skb);
+                        __sk_add_backlog(sk, skb);
                 }
         }
 }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index c6bab39b018e..ba137a6a224d 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/llc_sap.h>
 #include <net/llc_conn.h>
 #include <net/sock.h>
@@ -468,6 +469,19 @@ static int llc_exec_conn_trans_actions(struct sock *sk,
         return rc;
 }
 
+static inline bool llc_estab_match(const struct llc_sap *sap,
+                                   const struct llc_addr *daddr,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return llc->laddr.lsap == laddr->lsap &&
+                llc->daddr.lsap == daddr->lsap &&
+                llc_mac_match(llc->laddr.mac, laddr->mac) &&
+                llc_mac_match(llc->daddr.mac, daddr->mac);
+}
+
 /**
  *      __llc_lookup_established - Finds connection for the remote/local sap/mac
  *      @sap: SAP
@@ -484,23 +498,35 @@ static struct sock *__llc_lookup_established(struct llc_sap *sap,
                                              struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (llc->laddr.lsap == laddr->lsap &&
-                    llc->daddr.lsap == daddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac) &&
-                    llc_mac_match(llc->daddr.mac, daddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_estab_match(sap, daddr, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_estab_match(sap, daddr, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
 found:
-        read_unlock(&sap->sk_list.lock);
+        rcu_read_unlock();
         return rc;
 }
 
@@ -516,6 +542,53 @@ struct sock *llc_lookup_established(struct llc_sap *sap,
         return sk;
 }
 
+static inline bool llc_listener_match(const struct llc_sap *sap,
+                                      const struct llc_addr *laddr,
+                                      const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
+                llc->laddr.lsap == laddr->lsap &&
+                llc_mac_match(llc->laddr.mac, laddr->mac);
+}
+
+static struct sock *__llc_lookup_listener(struct llc_sap *sap,
+                                          struct llc_addr *laddr)
+{
+        struct sock *rc;
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_listener_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_listener_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
+                        goto found;
+                }
+        }
+        rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
+found:
+        rcu_read_unlock();
+        return rc;
+}
+
 /**
  *      llc_lookup_listener - Finds listener for local MAC + SAP
  *      @sap: SAP
@@ -529,24 +602,12 @@ struct sock *llc_lookup_established(struct llc_sap *sap,
 static struct sock *llc_lookup_listener(struct llc_sap *sap,
                                         struct llc_addr *laddr)
 {
-        struct sock *rc;
-        struct hlist_node *node;
+        static struct llc_addr null_addr;
+        struct sock *rc = __llc_lookup_listener(sap, laddr);
 
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
+        if (!rc)
+                rc = __llc_lookup_listener(sap, &null_addr);
 
-                if (rc->sk_type == SOCK_STREAM && rc->sk_state == TCP_LISTEN &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    (llc_mac_match(llc->laddr.mac, laddr->mac) ||
-                     llc_mac_null(llc->laddr.mac))) {
-                        sock_hold(rc);
-                        goto found;
-                }
-        }
-        rc = NULL;
-found:
-        read_unlock(&sap->sk_list.lock);
         return rc;
 }
 
@@ -647,15 +708,22 @@ static int llc_find_offset(int state, int ev_type)
  *      @sap: SAP
  *      @sk: socket
  *
- *      This function adds a socket to sk_list of a SAP.
+ *      This function adds a socket to the hash tables of a SAP.
  */
 void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
 {
+        struct llc_sock *llc = llc_sk(sk);
+        struct hlist_head *dev_hb = llc_sk_dev_hash(sap, llc->dev->ifindex);
+        struct hlist_nulls_head *laddr_hb = llc_sk_laddr_hash(sap, &llc->laddr);
+
         llc_sap_hold(sap);
-        write_lock_bh(&sap->sk_list.lock);
         llc_sk(sk)->sap = sap;
-        sk_add_node(sk, &sap->sk_list.list);
-        write_unlock_bh(&sap->sk_list.lock);
+
+        spin_lock_bh(&sap->sk_lock);
+        sap->sk_count++;
+        sk_nulls_add_node_rcu(sk, laddr_hb);
+        hlist_add_head(&llc->dev_hash_node, dev_hb);
+        spin_unlock_bh(&sap->sk_lock);
 }
 
 /**
@@ -663,14 +731,18 @@ void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
  *      @sap: SAP
  *      @sk: socket
  *
- *      This function removes a connection from sk_list.list of a SAP if
+ *      This function removes a connection from the hash tables of a SAP if
  *      the connection was in this list.
  */
 void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
 {
-        write_lock_bh(&sap->sk_list.lock);
-        sk_del_node_init(sk);
-        write_unlock_bh(&sap->sk_list.lock);
+        struct llc_sock *llc = llc_sk(sk);
+
+        spin_lock_bh(&sap->sk_lock);
+        sk_nulls_del_node_init_rcu(sk);
+        hlist_del(&llc->dev_hash_node);
+        sap->sk_count--;
+        spin_unlock_bh(&sap->sk_lock);
         llc_sap_put(sap);
 }
 
@@ -756,7 +828,8 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
         else {
                 dprintk("%s: adding to backlog...\n", __func__);
                 llc_set_backlog_type(skb, LLC_PACKET);
-                sk_add_backlog(sk, skb);
+                if (sk_add_backlog(sk, skb))
+                        goto drop_unlock;
         }
 out:
         bh_unlock_sock(sk);
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index ff4c0ab96a69..78167e81dfeb 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -23,7 +23,7 @@
 #include <net/llc.h>
 
 LIST_HEAD(llc_sap_list);
-DEFINE_RWLOCK(llc_sap_list_lock);
+DEFINE_SPINLOCK(llc_sap_list_lock);
 
 /**
  *      llc_sap_alloc - allocates and initializes sap.
@@ -33,40 +33,19 @@ DEFINE_RWLOCK(llc_sap_list_lock);
 static struct llc_sap *llc_sap_alloc(void)
 {
         struct llc_sap *sap = kzalloc(sizeof(*sap), GFP_ATOMIC);
+        int i;
 
         if (sap) {
                 /* sap->laddr.mac - leave as a null, it's filled by bind */
                 sap->state = LLC_SAP_STATE_ACTIVE;
-                rwlock_init(&sap->sk_list.lock);
+                spin_lock_init(&sap->sk_lock);
+                for (i = 0; i < LLC_SK_LADDR_HASH_ENTRIES; i++)
+                        INIT_HLIST_NULLS_HEAD(&sap->sk_laddr_hash[i], i);
                 atomic_set(&sap->refcnt, 1);
         }
         return sap;
 }
 
-/**
- *      llc_add_sap - add sap to station list
- *      @sap: Address of the sap
- *
- *      Adds a sap to the LLC's station sap list.
- */
-static void llc_add_sap(struct llc_sap *sap)
-{
-        list_add_tail(&sap->node, &llc_sap_list);
-}
-
-/**
- *      llc_del_sap - del sap from station list
- *      @sap: Address of the sap
- *
- *      Removes a sap to the LLC's station sap list.
- */
-static void llc_del_sap(struct llc_sap *sap)
-{
-        write_lock_bh(&llc_sap_list_lock);
-        list_del(&sap->node);
-        write_unlock_bh(&llc_sap_list_lock);
-}
-
 static struct llc_sap *__llc_sap_find(unsigned char sap_value)
 {
         struct llc_sap* sap;
@@ -90,13 +69,13 @@ out:
  */
 struct llc_sap *llc_sap_find(unsigned char sap_value)
 {
-        struct llc_sap* sap;
+        struct llc_sap *sap;
 
-        read_lock_bh(&llc_sap_list_lock);
+        rcu_read_lock_bh();
         sap = __llc_sap_find(sap_value);
         if (sap)
                 llc_sap_hold(sap);
-        read_unlock_bh(&llc_sap_list_lock);
+        rcu_read_unlock_bh();
         return sap;
 }
 
@@ -117,7 +96,7 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
 {
         struct llc_sap *sap = NULL;
 
-        write_lock_bh(&llc_sap_list_lock);
+        spin_lock_bh(&llc_sap_list_lock);
         if (__llc_sap_find(lsap)) /* SAP already exists */
                 goto out;
         sap = llc_sap_alloc();
@@ -125,9 +104,9 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
                 goto out;
         sap->laddr.lsap = lsap;
         sap->rcv_func   = func;
-        llc_add_sap(sap);
+        list_add_tail_rcu(&sap->node, &llc_sap_list);
 out:
-        write_unlock_bh(&llc_sap_list_lock);
+        spin_unlock_bh(&llc_sap_list_lock);
         return sap;
 }
 
@@ -142,8 +121,14 @@ out:
  */
 void llc_sap_close(struct llc_sap *sap)
 {
-        WARN_ON(!hlist_empty(&sap->sk_list.list));
-        llc_del_sap(sap);
+        WARN_ON(sap->sk_count);
+
+        spin_lock_bh(&llc_sap_list_lock);
+        list_del_rcu(&sap->node);
+        spin_unlock_bh(&llc_sap_list_lock);
+
+        synchronize_rcu();
+
         kfree(sap);
 }
 
diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
index a89917130a7b..25c31c0a3fdb 100644
--- a/net/llc/llc_if.c
+++ b/net/llc/llc_if.c
@@ -11,6 +11,7 @@
  *
  * See the GNU General Public License for more details.
  */
+#include <linux/gfp.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 57ad974e4d94..f99687439139 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -12,6 +12,7 @@
  * See the GNU General Public License for more details.
  */
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c
index 754f4fedc852..b38a1079a98e 100644
--- a/net/llc/llc_output.c
+++ b/net/llc/llc_output.c
@@ -33,48 +33,19 @@
 int llc_mac_hdr_init(struct sk_buff *skb,
                      const unsigned char *sa, const unsigned char *da)
 {
-        int rc = 0;
+        int rc = -EINVAL;
 
         switch (skb->dev->type) {
-#ifdef CONFIG_TR
-        case ARPHRD_IEEE802_TR: {
-                struct net_device *dev = skb->dev;
-                struct trh_hdr *trh;
-
-                skb_push(skb, sizeof(*trh));
-                skb_reset_mac_header(skb);
-                trh = tr_hdr(skb);
-                trh->ac = AC;
-                trh->fc = LLC_FRAME;
-                if (sa)
-                        memcpy(trh->saddr, sa, dev->addr_len);
-                else
-                        memset(trh->saddr, 0, dev->addr_len);
-                if (da) {
-                        memcpy(trh->daddr, da, dev->addr_len);
-                        tr_source_route(skb, trh, dev);
-                        skb_reset_mac_header(skb);
-                }
-                break;
-        }
-#endif
+        case ARPHRD_IEEE802_TR:
         case ARPHRD_ETHER:
-        case ARPHRD_LOOPBACK: {
-                unsigned short len = skb->len;
-                struct ethhdr *eth;
-
-                skb_push(skb, sizeof(*eth));
-                skb_reset_mac_header(skb);
-                eth = eth_hdr(skb);
-                eth->h_proto = htons(len);
-                memcpy(eth->h_dest, da, ETH_ALEN);
-                memcpy(eth->h_source, sa, ETH_ALEN);
+        case ARPHRD_LOOPBACK:
+                rc = dev_hard_header(skb, skb->dev, ETH_P_802_2, da, sa,
+                                     skb->len);
+                if (rc > 0)
+                        rc = 0;
                 break;
-        }
         default:
-                printk(KERN_WARNING "device type not supported: %d\n",
-                       skb->dev->type);
-                rc = -EINVAL;
+                WARN(1, "device type not supported: %d\n", skb->dev->type);
         }
         return rc;
 }
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index be47ac427f6b..7af1ff2d1f19 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -32,21 +32,23 @@ static void llc_ui_format_mac(struct seq_file *seq, u8 *addr)
 
 static struct sock *llc_get_sk_idx(loff_t pos)
 {
-        struct list_head *sap_entry;
         struct llc_sap *sap;
-        struct hlist_node *node;
         struct sock *sk = NULL;
-
-        list_for_each(sap_entry, &llc_sap_list) {
-                sap = list_entry(sap_entry, struct llc_sap, node);
-
-                read_lock_bh(&sap->sk_list.lock);
-                sk_for_each(sk, node, &sap->sk_list.list) {
-                        if (!pos)
-                                goto found;
-                        --pos;
+        int i;
+
+        list_for_each_entry_rcu(sap, &llc_sap_list, node) {
+                spin_lock_bh(&sap->sk_lock);
+                for (i = 0; i < LLC_SK_LADDR_HASH_ENTRIES; i++) {
+                        struct hlist_nulls_head *head = &sap->sk_laddr_hash[i];
+                        struct hlist_nulls_node *node;
+
+                        sk_nulls_for_each(sk, node, head) {
+                                if (!pos)
+                                        goto found; /* keep the lock */
+                                --pos;
+                        }
                 }
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
         sk = NULL;
 found:
@@ -57,10 +59,23 @@ static void *llc_seq_start(struct seq_file *seq, loff_t *pos)
 {
         loff_t l = *pos;
 
-        read_lock_bh(&llc_sap_list_lock);
+        rcu_read_lock_bh();
         return l ? llc_get_sk_idx(--l) : SEQ_START_TOKEN;
 }
 
+static struct sock *laddr_hash_next(struct llc_sap *sap, int bucket)
+{
+        struct hlist_nulls_node *node;
+        struct sock *sk = NULL;
+
+        while (++bucket < LLC_SK_LADDR_HASH_ENTRIES)
+                sk_nulls_for_each(sk, node, &sap->sk_laddr_hash[bucket])
+                        goto out;
+
+out:
+        return sk;
+}
+
 static void *llc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct sock* sk, *next;
@@ -73,25 +88,23 @@ static void *llc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 goto out;
         }
         sk = v;
-        next = sk_next(sk);
+        next = sk_nulls_next(sk);
         if (next) {
                 sk = next;
                 goto out;
         }
         llc = llc_sk(sk);
         sap = llc->sap;
-        read_unlock_bh(&sap->sk_list.lock);
-        sk = NULL;
-        for (;;) {
-                if (sap->node.next == &llc_sap_list)
-                        break;
-                sap = list_entry(sap->node.next, struct llc_sap, node);
-                read_lock_bh(&sap->sk_list.lock);
-                if (!hlist_empty(&sap->sk_list.list)) {
-                        sk = sk_head(&sap->sk_list.list);
-                        break;
-                }
-                read_unlock_bh(&sap->sk_list.lock);
+        sk = laddr_hash_next(sap, llc_sk_laddr_hashfn(sap, &llc->laddr));
+        if (sk)
+                goto out;
+        spin_unlock_bh(&sap->sk_lock);
+        list_for_each_entry_continue_rcu(sap, &llc_sap_list, node) {
+                spin_lock_bh(&sap->sk_lock);
+                sk = laddr_hash_next(sap, -1);
+                if (sk)
+                        break; /* keep the lock */
+                spin_unlock_bh(&sap->sk_lock);
         }
 out:
         return sk;
@@ -104,9 +117,9 @@ static void llc_seq_stop(struct seq_file *seq, void *v)
                 struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
-        read_unlock_bh(&llc_sap_list_lock);
+        rcu_read_unlock_bh();
 }
 
 static int llc_seq_socket_show(struct seq_file *seq, void *v)
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 008de1fc42ca..94e7fca75b85 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -23,6 +23,7 @@
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <linux/llc.h>
+#include <linux/slab.h>
 
 static int llc_mac_header_len(unsigned short devtype)
 {
@@ -30,7 +31,7 @@ static int llc_mac_header_len(unsigned short devtype)
         case ARPHRD_ETHER:
         case ARPHRD_LOOPBACK:
                 return sizeof(struct ethhdr);
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 return sizeof(struct trh_hdr);
 #endif
@@ -297,6 +298,17 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
         llc_sap_state_process(sap, skb);
 }
 
+static inline bool llc_dgram_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc_mac_match(llc->laddr.mac, laddr->mac);
+}
+
 /**
  *      llc_lookup_dgram - Finds dgram socket for the local sap/mac
  *      @sap: SAP
@@ -309,25 +321,68 @@ static struct sock *llc_lookup_dgram(struct llc_sap *sap,
                                      const struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (rc->sk_type == SOCK_DGRAM &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock_bh();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_dgram_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_dgram_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
 found:
-        read_unlock_bh(&sap->sk_list.lock);
+        rcu_read_unlock_bh();
         return rc;
 }
 
+static inline bool llc_mcast_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sk_buff *skb,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc->dev == skb->dev;
+}
+
+static void llc_do_mcast(struct llc_sap *sap, struct sk_buff *skb,
+                         struct sock **stack, int count)
+{
+        struct sk_buff *skb1;
+        int i;
+
+        for (i = 0; i < count; i++) {
+                skb1 = skb_clone(skb, GFP_ATOMIC);
+                if (!skb1) {
+                        sock_put(stack[i]);
+                        continue;
+                }
+
+                llc_sap_rcv(sap, skb1, stack[i]);
+                sock_put(stack[i]);
+        }
+}
+
 /**
  *      llc_sap_mcast - Deliver multicast PDU's to all matching datagram sockets.
  *      @sap: SAP
@@ -340,32 +395,31 @@ static void llc_sap_mcast(struct llc_sap *sap,
                           const struct llc_addr *laddr,
                           struct sk_buff *skb)
 {
-        struct sock *sk;
+        int i = 0, count = 256 / sizeof(struct sock *);
+        struct sock *sk, *stack[count];
         struct hlist_node *node;
+        struct llc_sock *llc;
+        struct hlist_head *dev_hb = llc_sk_dev_hash(sap, skb->dev->ifindex);
 
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(sk, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(sk);
-                struct sk_buff *skb1;
+        spin_lock_bh(&sap->sk_lock);
+        hlist_for_each_entry(llc, node, dev_hb, dev_hash_node) {
 
-                if (sk->sk_type != SOCK_DGRAM)
-                        continue;
+                sk = &llc->sk;
 
-                if (llc->laddr.lsap != laddr->lsap)
+                if (!llc_mcast_match(sap, laddr, skb, sk))
                         continue;
 
-                if (llc->dev != skb->dev)
-                        continue;
-
-                skb1 = skb_clone(skb, GFP_ATOMIC);
-                if (!skb1)
-                        break;
-
                 sock_hold(sk);
-                llc_sap_rcv(sap, skb1, sk);
-                sock_put(sk);
+                if (i < count)
+                        stack[i++] = sk;
+                else {
+                        llc_do_mcast(sap, skb, stack, i);
+                        i = 0;
+                }
         }
-        read_unlock_bh(&sap->sk_list.lock);
+        spin_unlock_bh(&sap->sk_lock);
+
+        llc_do_mcast(sap, skb, stack, i);
 }
 
 
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 83da13339490..e4dae0244d76 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -13,6 +13,7 @@
  */
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <net/llc.h>
 #include <net/llc_sap.h>
 #include <net/llc_conn.h>
diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
index 57b9304d444c..e2ebe3586263 100644
--- a/net/llc/sysctl_net_llc.c
+++ b/net/llc/sysctl_net_llc.c
@@ -15,86 +15,73 @@
 
 static struct ctl_table llc2_timeout_table[] = {
         {
-                .ctl_name       = NET_LLC2_ACK_TIMEOUT,
                 .procname       = "ack",
                 .data           = &sysctl_llc2_ack_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_LLC2_BUSY_TIMEOUT,
                 .procname       = "busy",
                 .data           = &sysctl_llc2_busy_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_LLC2_P_TIMEOUT,
                 .procname       = "p",
                 .data           = &sysctl_llc2_p_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_LLC2_REJ_TIMEOUT,
                 .procname       = "rej",
                 .data           = &sysctl_llc2_rej_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
-        { 0 },
+        { },
 };
 
 static struct ctl_table llc_station_table[] = {
         {
-                .ctl_name       = NET_LLC_STATION_ACK_TIMEOUT,
                 .procname       = "ack_timeout",
                 .data           = &sysctl_llc_station_ack_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
-        { 0 },
+        { },
 };
 
 static struct ctl_table llc2_dir_timeout_table[] = {
         {
-                .ctl_name       = NET_LLC2,
                 .procname       = "timeout",
                 .mode           = 0555,
                 .child          = llc2_timeout_table,
         },
-        { 0 },
+        { },
 };
 
 static struct ctl_table llc_table[] = {
         {
-                .ctl_name       = NET_LLC2,
                 .procname       = "llc2",
                 .mode           = 0555,
                 .child          = llc2_dir_timeout_table,
         },
         {
-                .ctl_name       = NET_LLC_STATION,
                 .procname       = "station",
                 .mode           = 0555,
                 .child          = llc_station_table,
         },
-        { 0 },
+        { },
 };
 
 static struct ctl_path llc_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "llc", .ctl_name = NET_LLC, },
+        { .procname = "net", },
+        { .procname = "llc", },
         { }
 };
 
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 4d5543af3123..a952b7f8c648 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -96,18 +96,6 @@ menuconfig MAC80211_DEBUG_MENU
         ---help---
           This option collects various mac80211 debug settings.
 
-config MAC80211_DEBUG_PACKET_ALIGNMENT
-        bool "Enable packet alignment debugging"
-        depends on MAC80211_DEBUG_MENU
-        ---help---
-          This option is recommended for driver authors and strongly
-          discouraged for everybody else, it will trigger a warning
-          when a driver hands mac80211 a buffer that is aligned in
-          a way that will cause problems with the IP stack on some
-          architectures.
-
-          Say N unless you're writing a mac80211 based driver.
-
 config MAC80211_NOINLINE
         bool "Do not inline TX/RX handlers"
         depends on MAC80211_DEBUG_MENU
@@ -194,6 +182,19 @@ config MAC80211_VERBOSE_MPL_DEBUG
 
           Do not select this option.
 
+config MAC80211_VERBOSE_MHWMP_DEBUG
+        bool "Verbose mesh HWMP routing debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very
+          verbose mesh routing (HWMP) debugging messages (when mac80211
+          is taking part in a mesh network).
+          It should not be selected on production systems as those
+          messages are remotely triggerable.
+
+          Do not select this option.
+
 config MAC80211_DEBUG_COUNTERS
         bool "Extra statistics for TX/RX debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 9f3cf7129324..04420291e7ad 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -2,14 +2,14 @@ obj-$(CONFIG_MAC80211) += mac80211.o
 
 # mac80211 objects
 mac80211-y := \
-        main.o \
+        main.o status.o \
         sta_info.o \
         wep.o \
         wpa.o \
-        scan.o \
+        scan.o offchannel.o \
         ht.o agg-tx.o agg-rx.o \
         ibss.o \
-        mlme.o \
+        mlme.o work.o \
         iface.o \
         rate.o \
         michael.o \
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index ce8e0e772bab..f9516a27e233 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/ieee80211.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -41,7 +42,7 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                sta->sta.addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        if (drv_ampdu_action(local, IEEE80211_AMPDU_RX_STOP,
+        if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
                              &sta->sta, tid, NULL))
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggregation for tid %d\n", tid);
@@ -82,12 +83,11 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
                                         u16 initiator, u16 reason)
 {
-        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -135,7 +135,7 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
 
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer "
-                       "for addba resp frame\n", sdata->dev->name);
+                       "for addba resp frame\n", sdata->name);
                 return;
         }
 
@@ -143,10 +143,10 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
@@ -166,7 +166,7 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_process_addba_request(struct ieee80211_local *local,
@@ -206,9 +206,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
          * check if configuration can support the BA policy
          * and if buffer size does not exceeds max value */
         /* XXX: check own ht delayed BA capability?? */
-        if (((ba_policy != 1)
-                && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
-                || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
+        if (((ba_policy != 1) &&
+             (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA))) ||
+            (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
                 status = WLAN_STATUS_INVALID_QOS_PARAM;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
@@ -280,7 +280,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                 goto end;
         }
 
-        ret = drv_ampdu_action(local, IEEE80211_AMPDU_RX_START,
+        ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
                                &sta->sta, tid, &start_seq_num);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 89e238b001de..87782a4bb541 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/ieee80211.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -58,17 +59,17 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer "
-                                "for addba request frame\n", sdata->dev->name);
+                                "for addba request frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
@@ -91,7 +92,7 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.addba_req.start_seq_num =
                                         cpu_to_le16(start_seq_num << 4);
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
@@ -104,7 +105,7 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer for "
-                        "bar frame\n", sdata->dev->name);
+                        "bar frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -113,14 +114,15 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
                                          IEEE80211_STYPE_BACK_REQ);
         memcpy(bar->ra, ra, ETH_ALEN);
-        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
         bar_control |= (u16)(tid << 12);
         bar->control = cpu_to_le16(bar_control);
         bar->start_seq_num = cpu_to_le16(ssn);
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
 }
 
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
@@ -143,7 +145,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 
-        ret = drv_ampdu_action(local, IEEE80211_AMPDU_TX_STOP,
+        ret = drv_ampdu_action(local, sta->sdata,
+                               IEEE80211_AMPDU_TX_STOP,
                                &sta->sta, tid, NULL);
 
         /* HW shall not deny going back to legacy */
@@ -177,10 +180,10 @@ static void sta_addba_resp_timer_expired(unsigned long data)
 
         /* check if the TID waits for addBA response */
         spin_lock_bh(&sta->lock);
-        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK)) !=
+        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK |
+                       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                 HT_ADDBA_REQUESTED_MSK) {
                 spin_unlock_bh(&sta->lock);
-                *state = HT_AGG_STATE_IDLE;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
                                 "(or no longer) expecting addBA response there",
@@ -202,11 +205,11 @@ static inline int ieee80211_ac_from_tid(int tid)
         return ieee802_1d_to_ac[tid & 7];
 }
 
-int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata;
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
         u8 *state;
         int ret = 0;
         u16 start_seq_num;
@@ -214,36 +217,32 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         if (WARN_ON(!local->ops->ampdu_action))
                 return -EINVAL;
 
-        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
+        if ((tid >= STA_TID_NUM) ||
+            !(local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION))
                 return -EINVAL;
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
-               ra, tid);
+               pubsta->addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find the station\n");
-#endif
-                ret = -ENOENT;
-                goto unlock;
-        }
-
         /*
          * The aggregation code is not prepared to handle
          * anything but STA/AP due to the BSSID handling.
          * IBSS could work in the code but isn't supported
          * by drivers or the standard.
          */
-        if (sta->sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-            sta->sdata->vif.type != NL80211_IFTYPE_AP) {
-                ret = -EINVAL;
-                goto unlock;
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+            sdata->vif.type != NL80211_IFTYPE_AP)
+                return -EINVAL;
+
+        if (test_sta_flags(sta, WLAN_STA_DISASSOC)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Disassociation is in progress. "
+                       "Denying BA session request\n");
+#endif
+                return -EINVAL;
         }
 
         if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
@@ -251,15 +250,12 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 printk(KERN_DEBUG "Suspend in progress. "
                        "Denying BA session request\n");
 #endif
-                ret = -EINVAL;
-                goto unlock;
+                return -EINVAL;
         }
 
         spin_lock_bh(&sta->lock);
         spin_lock(&local->ampdu_lock);
 
-        sdata = sta->sdata;
-
         /* we have tried too many times, receiver does not want A-MPDU */
         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
                 ret = -EBUSY;
@@ -314,10 +310,10 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
          * call back right away, it must see that the flow has begun */
         *state |= HT_ADDBA_REQUESTED_MSK;
 
-        start_seq_num = sta->tid_seq[tid];
+        start_seq_num = sta->tid_seq[tid] >> 4;
 
-        ret = drv_ampdu_action(local, IEEE80211_AMPDU_TX_START,
-                               &sta->sta, tid, &start_seq_num);
+        ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
+                               pubsta, tid, &start_seq_num);
 
         if (ret) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -342,7 +338,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         sta->ampdu_mlme.dialog_token_allocator;
         sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
 
-        ieee80211_send_addba_request(sta->sdata, ra, tid,
+        ieee80211_send_addba_request(sdata, pubsta->addr, tid,
                          sta->ampdu_mlme.tid_tx[tid]->dialog_token,
                          sta->ampdu_mlme.tid_tx[tid]->ssn,
                          0x40, 5000);
@@ -354,7 +350,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
 #endif
-        goto unlock;
+        return 0;
 
  err_free:
         kfree(sta->ampdu_mlme.tid_tx[tid]);
@@ -366,8 +362,6 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
  err_unlock_sta:
         spin_unlock(&local->ampdu_lock);
         spin_unlock_bh(&sta->lock);
- unlock:
-        rcu_read_unlock();
         return ret;
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
@@ -434,13 +428,15 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_splice_finish(local, sta, tid);
         spin_unlock(&local->ampdu_lock);
 
-        drv_ampdu_action(local, IEEE80211_AMPDU_TX_OPERATIONAL,
+        drv_ampdu_action(local, sta->sdata,
+                         IEEE80211_AMPDU_TX_OPERATIONAL,
                          &sta->sta, tid, NULL);
 }
 
-void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         u8 *state;
 
@@ -453,7 +449,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         }
 
         rcu_read_lock();
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
                 rcu_read_unlock();
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -489,10 +485,11 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
 
-void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
                                       const u8 *ra, u16 tid)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_ra_tid *ra_tid;
         struct sk_buff *skb = dev_alloc_skb(0);
 
@@ -500,13 +497,14 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping start BA session", skb->dev->name);
+                               "dropping start BA session", sdata->name);
 #endif
                 return;
         }
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
         memcpy(&ra_tid->ra, ra, ETH_ALEN);
         ra_tid->tid = tid;
+        ra_tid->vif = vif;
 
         skb->pkt_type = IEEE80211_ADDBA_MSG;
         skb_queue_tail(&local->skb_queue, skb);
@@ -536,13 +534,12 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         return ret;
 }
 
-int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
-                                 u8 *ra, u16 tid,
+int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                                  enum ieee80211_back_parties initiator)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        int ret = 0;
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
 
         if (!local->ops->ampdu_action)
                 return -EINVAL;
@@ -550,22 +547,14 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         if (tid >= STA_TID_NUM)
                 return -EINVAL;
 
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-                return -ENOENT;
-        }
-
-        ret = __ieee80211_stop_tx_ba_session(sta, tid, initiator);
-        rcu_read_unlock();
-        return ret;
+        return __ieee80211_stop_tx_ba_session(sta, tid, initiator);
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 
-void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
+void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         u8 *state;
 
@@ -583,7 +572,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         rcu_read_lock();
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
@@ -628,10 +617,11 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
 
-void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
                                      const u8 *ra, u16 tid)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_ra_tid *ra_tid;
         struct sk_buff *skb = dev_alloc_skb(0);
 
@@ -639,13 +629,14 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping stop BA session", skb->dev->name);
+                               "dropping stop BA session", sdata->name);
 #endif
                 return;
         }
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
         memcpy(&ra_tid->ra, ra, ETH_ALEN);
         ra_tid->tid = tid;
+        ra_tid->vif = vif;
 
         skb->pkt_type = IEEE80211_DELBA_MSG;
         skb_queue_tail(&local->skb_queue, skb);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7b5131bd6fa1..edc872e22c9b 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1,7 +1,7 @@
 /*
  * mac80211 configuration hooks for cfg80211
  *
- * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
  *
  * This file is GPLv2 as found in COPYING.
  */
@@ -9,6 +9,7 @@
 #include <linux/ieee80211.h>
 #include <linux/nl80211.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <linux/rcupdate.h>
 #include <net/cfg80211.h>
@@ -36,6 +37,15 @@ static bool nl80211_type_check(enum nl80211_iftype type)
         }
 }
 
+static bool nl80211_params_check(enum nl80211_iftype type,
+                                 struct vif_params *params)
+{
+        if (!nl80211_type_check(type))
+                return false;
+
+        return true;
+}
+
 static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
                                enum nl80211_iftype type, u32 *flags,
                                struct vif_params *params)
@@ -45,7 +55,7 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
         struct ieee80211_sub_if_data *sdata;
         int err;
 
-        if (!nl80211_type_check(type))
+        if (!nl80211_params_check(type, params))
                 return -EINVAL;
 
         err = ieee80211_if_add(local, name, &dev, type, params);
@@ -69,17 +79,15 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                                   enum nl80211_iftype type, u32 *flags,
                                   struct vif_params *params)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         int ret;
 
-        if (netif_running(dev))
+        if (ieee80211_sdata_running(sdata))
                 return -EBUSY;
 
-        if (!nl80211_type_check(type))
+        if (!nl80211_params_check(type, params))
                 return -EINVAL;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         ret = ieee80211_if_change_type(sdata, type);
         if (ret)
                 return ret;
@@ -92,6 +100,13 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags)
                 return 0;
 
+        if (type == NL80211_IFTYPE_AP_VLAN &&
+            params && params->use_4addr == 0)
+                rcu_assign_pointer(sdata->u.vlan.sta, NULL);
+        else if (type == NL80211_IFTYPE_STATION &&
+                 params && params->use_4addr >= 0)
+                sdata->u.mgd.use_4addr = params->use_4addr;
+
         sdata->u.mntr_flags = *flags;
         return 0;
 }
@@ -134,7 +149,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         rcu_read_lock();
 
         if (mac_addr) {
-                sta = sta_info_get(sdata->local, mac_addr);
+                sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta) {
                         ieee80211_key_free(key);
                         err = -ENOENT;
@@ -165,7 +180,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
         if (mac_addr) {
                 ret = -ENOENT;
 
-                sta = sta_info_get(sdata->local, mac_addr);
+                sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta)
                         goto out_unlock;
 
@@ -212,7 +227,7 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
         rcu_read_lock();
 
         if (mac_addr) {
-                sta = sta_info_get(sdata->local, mac_addr);
+                sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta)
                         goto out;
 
@@ -338,7 +353,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         sinfo->rx_packets = sta->rx_packets;
         sinfo->tx_packets = sta->tx_packets;
 
-        if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
+        if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
+            (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
                 sinfo->filled |= STATION_INFO_SIGNAL;
                 sinfo->signal = (s8)sta->last_signal;
         }
@@ -377,13 +393,13 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
                                  int idx, u8 *mac, struct station_info *sinfo)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sta_info *sta;
         int ret = -ENOENT;
 
         rcu_read_lock();
 
-        sta = sta_info_get_by_idx(local, idx, dev);
+        sta = sta_info_get_by_idx(sdata, idx);
         if (sta) {
                 ret = 0;
                 memcpy(mac, sta->sta.addr, ETH_ALEN);
@@ -398,15 +414,13 @@ static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac, struct station_info *sinfo)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sta_info *sta;
         int ret = -ENOENT;
 
         rcu_read_lock();
 
-        /* XXX: verify sta->dev == dev */
-
-        sta = sta_info_get(local, mac);
+        sta = sta_info_get_bss(sdata, mac);
         if (sta) {
                 ret = 0;
                 sta_set_sinfo(sta, sinfo);
@@ -502,6 +516,8 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
                 if (old)
                         memcpy(new->tail, old->tail, new_tail_len);
 
+        sdata->vif.bss_conf.dtim_period = new->dtim_period;
+
         rcu_assign_pointer(sdata->u.ap.beacon, new);
 
         synchronize_rcu();
@@ -715,7 +731,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         } else
                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (compare_ether_addr(mac, dev->dev_addr) == 0)
+        if (compare_ether_addr(mac, sdata->vif.addr) == 0)
                 return -EINVAL;
 
         if (is_multicast_ether_addr(mac))
@@ -734,17 +750,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
                 sdata->vif.type == NL80211_IFTYPE_AP;
 
-        rcu_read_lock();
-
-        err = sta_info_insert(sta);
+        err = sta_info_insert_rcu(sta);
         if (err) {
-                /* STA has been freed */
-                if (err == -EEXIST && layer2_update) {
-                        /* Need to update layer 2 devices on reassociation */
-                        sta = sta_info_get(local, mac);
-                        if (sta)
-                                ieee80211_send_layer2_update(sta);
-                }
                 rcu_read_unlock();
                 return err;
         }
@@ -762,27 +769,13 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
-        struct sta_info *sta;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (mac) {
-                rcu_read_lock();
-
-                /* XXX: get sta belonging to dev */
-                sta = sta_info_get(local, mac);
-                if (!sta) {
-                        rcu_read_unlock();
-                        return -ENOENT;
-                }
-
-                sta_info_unlink(&sta);
-                rcu_read_unlock();
-
-                sta_info_destroy(sta);
-        } else
-                sta_info_flush(local, sdata);
+        if (mac)
+                return sta_info_destroy_addr_bss(sdata, mac);
 
+        sta_info_flush(local, sdata);
         return 0;
 }
 
@@ -791,14 +784,14 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                                     u8 *mac,
                                     struct station_parameters *params)
 {
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
 
         rcu_read_lock();
 
-        /* XXX: get sta belonging to dev */
-        sta = sta_info_get(local, mac);
+        sta = sta_info_get_bss(sdata, mac);
         if (!sta) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -813,6 +806,15 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                         return -EINVAL;
                 }
 
+                if (params->vlan->ieee80211_ptr->use_4addr) {
+                        if (vlansdata->u.vlan.sta) {
+                                rcu_read_unlock();
+                                return -EBUSY;
+                        }
+
+                        rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+                }
+
                 sta->sdata = vlansdata;
                 ieee80211_send_layer2_update(sta);
         }
@@ -828,7 +830,6 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
         struct sta_info *sta;
@@ -837,7 +838,7 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         rcu_read_lock();
-        sta = sta_info_get(local, next_hop);
+        sta = sta_info_get(sdata, next_hop);
         if (!sta) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -876,7 +877,6 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
                                     struct net_device *dev,
                                     u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
         struct sta_info *sta;
@@ -885,7 +885,7 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, next_hop);
+        sta = sta_info_get(sdata, next_hop);
         if (!sta) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -914,7 +914,7 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         pinfo->generation = mesh_paths_generation;
 
         pinfo->filled = MPATH_INFO_FRAME_QLEN |
-                        MPATH_INFO_DSN |
+                        MPATH_INFO_SN |
                         MPATH_INFO_METRIC |
                         MPATH_INFO_EXPTIME |
                         MPATH_INFO_DISCOVERY_TIMEOUT |
@@ -922,7 +922,7 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                         MPATH_INFO_FLAGS;
 
         pinfo->frame_qlen = mpath->frame_queue.qlen;
-        pinfo->dsn = mpath->dsn;
+        pinfo->sn = mpath->sn;
         pinfo->metric = mpath->metric;
         if (time_before(jiffies, mpath->exp_time))
                 pinfo->exptime = jiffies_to_msecs(mpath->exp_time - jiffies);
@@ -934,8 +934,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                 pinfo->flags |= NL80211_MPATH_FLAG_ACTIVE;
         if (mpath->flags & MESH_PATH_RESOLVING)
                 pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
-        if (mpath->flags & MESH_PATH_DSN_VALID)
-                pinfo->flags |= NL80211_MPATH_FLAG_DSN_VALID;
+        if (mpath->flags & MESH_PATH_SN_VALID)
+                pinfo->flags |= NL80211_MPATH_FLAG_SN_VALID;
         if (mpath->flags & MESH_PATH_FIXED)
                 pinfo->flags |= NL80211_MPATH_FLAG_FIXED;
         if (mpath->flags & MESH_PATH_RESOLVING)
@@ -1008,7 +1008,10 @@ static int ieee80211_set_mesh_params(struct wiphy *wiphy,
 {
         struct mesh_config *conf;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_mesh *ifmsh;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        ifmsh = &sdata->u.mesh;
 
         /* Set the config options which we are interested in setting */
         conf = &(sdata->u.mesh.mshcfg);
@@ -1043,6 +1046,10 @@ static int ieee80211_set_mesh_params(struct wiphy *wiphy,
                            mask))
                 conf->dot11MeshHWMPnetDiameterTraversalTime =
                         nconf->dot11MeshHWMPnetDiameterTraversalTime;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ROOTMODE, mask)) {
+                conf->dot11MeshHWMPRootMode = nconf->dot11MeshHWMPRootMode;
+                ieee80211_mesh_root_setup(ifmsh);
+        }
         return 0;
 }
 
@@ -1066,6 +1073,13 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                         params->use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
+
+        if (!sdata->vif.bss_conf.use_short_slot &&
+            sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ) {
+                sdata->vif.bss_conf.use_short_slot = true;
+                changed |= BSS_CHANGED_ERP_SLOT;
+        }
+
         if (params->use_short_slot_time >= 0) {
                 sdata->vif.bss_conf.use_short_slot =
                         params->use_short_slot_time;
@@ -1109,6 +1123,13 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         p.cw_max = params->cwmax;
         p.cw_min = params->cwmin;
         p.txop = params->txop;
+
+        /*
+         * Setting tx queue params disables u-apsd because it's only
+         * called in master mode.
+         */
+        p.uapsd = false;
+
         if (drv_conf_tx(local, params->queue, &p)) {
                 printk(KERN_DEBUG "%s: failed to set TX queue "
                        "parameters for queue %d\n",
@@ -1211,6 +1232,13 @@ static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         struct ieee80211_local *local = wiphy_priv(wiphy);
         int err;
 
+        if (changed & WIPHY_PARAM_COVERAGE_CLASS) {
+                err = drv_set_coverage_class(local, wiphy->coverage_class);
+
+                if (err)
+                        return err;
+        }
+
         if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
                 err = drv_set_rts_threshold(local, wiphy->rts_threshold);
 
@@ -1298,6 +1326,50 @@ static int ieee80211_testmode_cmd(struct wiphy *wiphy, void *data, int len)
 }
 #endif
 
+int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
+                             enum ieee80211_smps_mode smps_mode)
+{
+        const u8 *ap;
+        enum ieee80211_smps_mode old_req;
+        int err;
+
+        old_req = sdata->u.mgd.req_smps;
+        sdata->u.mgd.req_smps = smps_mode;
+
+        if (old_req == smps_mode &&
+            smps_mode != IEEE80211_SMPS_AUTOMATIC)
+                return 0;
+
+        /*
+         * If not associated, or current association is not an HT
+         * association, there's no need to send an action frame.
+         */
+        if (!sdata->u.mgd.associated ||
+            sdata->local->oper_channel_type == NL80211_CHAN_NO_HT) {
+                mutex_lock(&sdata->local->iflist_mtx);
+                ieee80211_recalc_smps(sdata->local, sdata);
+                mutex_unlock(&sdata->local->iflist_mtx);
+                return 0;
+        }
+
+        ap = sdata->u.mgd.associated->bssid;
+
+        if (smps_mode == IEEE80211_SMPS_AUTOMATIC) {
+                if (sdata->u.mgd.powersave)
+                        smps_mode = IEEE80211_SMPS_DYNAMIC;
+                else
+                        smps_mode = IEEE80211_SMPS_OFF;
+        }
+
+        /* send SM PS frame to AP */
+        err = ieee80211_send_smps_action(sdata, smps_mode,
+                                         ap, ap);
+        if (err)
+                sdata->u.mgd.req_smps = old_req;
+
+        return err;
+}
+
 static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
                                     bool enabled, int timeout)
 {
@@ -1305,6 +1377,9 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_conf *conf = &local->hw.conf;
 
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
                 return -EOPNOTSUPP;
 
@@ -1315,6 +1390,11 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         sdata->u.mgd.powersave = enabled;
         conf->dynamic_ps_timeout = timeout;
 
+        /* no change, but if automatic follow powersave */
+        mutex_lock(&sdata->u.mgd.mtx);
+        __ieee80211_request_smps(sdata, sdata->u.mgd.req_smps);
+        mutex_unlock(&sdata->u.mgd.mtx);
+
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 
@@ -1330,39 +1410,52 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int i, err = -EINVAL;
-        u32 target_rate;
-        struct ieee80211_supported_band *sband;
+        int i;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        /*
+         * This _could_ be supported by providing a hook for
+         * drivers for this function, but at this point it
+         * doesn't seem worth bothering.
+         */
+        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                return -EOPNOTSUPP;
 
-        /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
-         * target_rate = X, rate->fixed = 1 means only rate X
-         * target_rate = X, rate->fixed = 0 means all rates <= X */
-        sdata->max_ratectrl_rateidx = -1;
-        sdata->force_unicast_rateidx = -1;
 
-        if (mask->fixed)
-                target_rate = mask->fixed / 100;
-        else if (mask->maxrate)
-                target_rate = mask->maxrate / 100;
-        else
-                return 0;
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
 
-        for (i=0; i< sband->n_bitrates; i++) {
-                struct ieee80211_rate *brate = &sband->bitrates[i];
-                int this_rate = brate->bitrate;
+        return 0;
+}
 
-                if (target_rate == this_rate) {
-                        sdata->max_ratectrl_rateidx = i;
-                        if (mask->fixed)
-                                sdata->force_unicast_rateidx = i;
-                        err = 0;
-                        break;
-                }
-        }
+static int ieee80211_remain_on_channel(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       struct ieee80211_channel *chan,
+                                       enum nl80211_channel_type channel_type,
+                                       unsigned int duration,
+                                       u64 *cookie)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        return err;
+        return ieee80211_wk_remain_on_channel(sdata, chan, channel_type,
+                                              duration, cookie);
+}
+
+static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
+                                              struct net_device *dev,
+                                              u64 cookie)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        return ieee80211_wk_cancel_remain_on_channel(sdata, cookie);
+}
+
+static int ieee80211_action(struct wiphy *wiphy, struct net_device *dev,
+                            struct ieee80211_channel *chan,
+                            enum nl80211_channel_type channel_type,
+                            const u8 *buf, size_t len, u64 *cookie)
+{
+        return ieee80211_mgd_action(IEEE80211_DEV_TO_SUB_IF(dev), chan,
+                                    channel_type, buf, len, cookie);
 }
 
 struct cfg80211_ops mac80211_config_ops = {
@@ -1411,4 +1504,7 @@ struct cfg80211_ops mac80211_config_ops = {
         CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
         .set_power_mgmt = ieee80211_set_power_mgmt,
         .set_bitrate_mask = ieee80211_set_bitrate_mask,
+        .remain_on_channel = ieee80211_remain_on_channel,
+        .cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,
+        .action = ieee80211_action,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 96991b68f048..637929b65ccc 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -1,3 +1,4 @@
+
 /*
  * mac80211 debugfs for wireless PHYs
  *
@@ -38,16 +39,10 @@ static const struct file_operations name## _ops = {			\
 };
 
 #define DEBUGFS_ADD(name)                                               \
-        local->debugfs.name = debugfs_create_file(#name, 0400, phyd,    \
-                                                  local, &name## _ops);
+        debugfs_create_file(#name, 0400, phyd, local, &name## _ops);
 
 #define DEBUGFS_ADD_MODE(name, mode)                                    \
-        local->debugfs.name = debugfs_create_file(#name, mode, phyd,    \
-                                                  local, &name## _ops);
-
-#define DEBUGFS_DEL(name)                                               \
-        debugfs_remove(local->debugfs.name);                            \
-        local->debugfs.name = NULL;
+        debugfs_create_file(#name, mode, phyd, local, &name## _ops);
 
 
 DEBUGFS_READONLY_FILE(frequency, 20, "%d",
@@ -57,7 +52,7 @@ DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#08x",
                       local->wep_iv & 0xffffff);
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
-                      local->rate_ctrl ? local->rate_ctrl->ops->name : "<unset>");
+        local->rate_ctrl ? local->rate_ctrl->ops->name : "hw/driver");
 
 static ssize_t tsf_read(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
@@ -163,6 +158,130 @@ static const struct file_operations noack_ops = {
         .open = mac80211_open_file_generic
 };
 
+static ssize_t uapsd_queues_read(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        int res;
+        char buf[10];
+
+        res = scnprintf(buf, sizeof(buf), "0x%x\n", local->uapsd_queues);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+}
+
+static ssize_t uapsd_queues_write(struct file *file,
+                                  const char __user *user_buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        unsigned long val;
+        char buf[10];
+        size_t len;
+        int ret;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+
+        ret = strict_strtoul(buf, 0, &val);
+
+        if (ret)
+                return -EINVAL;
+
+        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
+                return -ERANGE;
+
+        local->uapsd_queues = val;
+
+        return count;
+}
+
+static const struct file_operations uapsd_queues_ops = {
+        .read = uapsd_queues_read,
+        .write = uapsd_queues_write,
+        .open = mac80211_open_file_generic
+};
+
+static ssize_t uapsd_max_sp_len_read(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        int res;
+        char buf[10];
+
+        res = scnprintf(buf, sizeof(buf), "0x%x\n", local->uapsd_max_sp_len);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+}
+
+static ssize_t uapsd_max_sp_len_write(struct file *file,
+                                      const char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        unsigned long val;
+        char buf[10];
+        size_t len;
+        int ret;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+
+        ret = strict_strtoul(buf, 0, &val);
+
+        if (ret)
+                return -EINVAL;
+
+        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
+                return -ERANGE;
+
+        local->uapsd_max_sp_len = val;
+
+        return count;
+}
+
+static const struct file_operations uapsd_max_sp_len_ops = {
+        .read = uapsd_max_sp_len_read,
+        .write = uapsd_max_sp_len_write,
+        .open = mac80211_open_file_generic
+};
+
+static ssize_t channel_type_read(struct file *file, char __user *user_buf,
+                       size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        const char *buf;
+
+        switch (local->hw.conf.channel_type) {
+        case NL80211_CHAN_NO_HT:
+                buf = "no ht\n";
+                break;
+        case NL80211_CHAN_HT20:
+                buf = "ht20\n";
+                break;
+        case NL80211_CHAN_HT40MINUS:
+                buf = "ht40-\n";
+                break;
+        case NL80211_CHAN_HT40PLUS:
+                buf = "ht40+\n";
+                break;
+        default:
+                buf = "???";
+                break;
+        }
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
+}
+
+static const struct file_operations channel_type_ops = {
+        .read = channel_type_read,
+        .open = mac80211_open_file_generic
+};
+
 static ssize_t queues_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -233,12 +352,7 @@ static const struct file_operations stats_ ##name## _ops = {		\
 };
 
 #define DEBUGFS_STATS_ADD(name)                                         \
-        local->debugfs.stats.name = debugfs_create_file(#name, 0400, statsd,\
-                local, &stats_ ##name## _ops);
-
-#define DEBUGFS_STATS_DEL(name)                                         \
-        debugfs_remove(local->debugfs.stats.name);                      \
-        local->debugfs.stats.name = NULL;
+        debugfs_create_file(#name, 0400, statsd, local, &stats_ ##name## _ops);
 
 DEBUGFS_STATS_FILE(transmitted_fragment_count, 20, "%u",
                    local->dot11TransmittedFragmentCount);
@@ -324,9 +438,11 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(queues);
         DEBUGFS_ADD_MODE(reset, 0200);
         DEBUGFS_ADD(noack);
+        DEBUGFS_ADD(uapsd_queues);
+        DEBUGFS_ADD(uapsd_max_sp_len);
+        DEBUGFS_ADD(channel_type);
 
         statsd = debugfs_create_dir("statistics", phyd);
-        local->debugfs.statistics = statsd;
 
         /* if the dir failed, don't put all the other things into the root! */
         if (!statsd)
@@ -367,57 +483,3 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_STATS_ADD(dot11FCSErrorCount);
         DEBUGFS_STATS_ADD(dot11RTSSuccessCount);
 }
-
-void debugfs_hw_del(struct ieee80211_local *local)
-{
-        DEBUGFS_DEL(frequency);
-        DEBUGFS_DEL(total_ps_buffered);
-        DEBUGFS_DEL(wep_iv);
-        DEBUGFS_DEL(tsf);
-        DEBUGFS_DEL(queues);
-        DEBUGFS_DEL(reset);
-        DEBUGFS_DEL(noack);
-
-        DEBUGFS_STATS_DEL(transmitted_fragment_count);
-        DEBUGFS_STATS_DEL(multicast_transmitted_frame_count);
-        DEBUGFS_STATS_DEL(failed_count);
-        DEBUGFS_STATS_DEL(retry_count);
-        DEBUGFS_STATS_DEL(multiple_retry_count);
-        DEBUGFS_STATS_DEL(frame_duplicate_count);
-        DEBUGFS_STATS_DEL(received_fragment_count);
-        DEBUGFS_STATS_DEL(multicast_received_frame_count);
-        DEBUGFS_STATS_DEL(transmitted_frame_count);
-        DEBUGFS_STATS_DEL(num_scans);
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-        DEBUGFS_STATS_DEL(tx_handlers_drop);
-        DEBUGFS_STATS_DEL(tx_handlers_queued);
-        DEBUGFS_STATS_DEL(tx_handlers_drop_unencrypted);
-        DEBUGFS_STATS_DEL(tx_handlers_drop_fragment);
-        DEBUGFS_STATS_DEL(tx_handlers_drop_wep);
-        DEBUGFS_STATS_DEL(tx_handlers_drop_not_assoc);
-        DEBUGFS_STATS_DEL(tx_handlers_drop_unauth_port);
-        DEBUGFS_STATS_DEL(rx_handlers_drop);
-        DEBUGFS_STATS_DEL(rx_handlers_queued);
-        DEBUGFS_STATS_DEL(rx_handlers_drop_nullfunc);
-        DEBUGFS_STATS_DEL(rx_handlers_drop_defrag);
-        DEBUGFS_STATS_DEL(rx_handlers_drop_short);
-        DEBUGFS_STATS_DEL(rx_handlers_drop_passive_scan);
-        DEBUGFS_STATS_DEL(tx_expand_skb_head);
-        DEBUGFS_STATS_DEL(tx_expand_skb_head_cloned);
-        DEBUGFS_STATS_DEL(rx_expand_skb_head);
-        DEBUGFS_STATS_DEL(rx_expand_skb_head2);
-        DEBUGFS_STATS_DEL(rx_handlers_fragments);
-        DEBUGFS_STATS_DEL(tx_status_drop);
-#endif
-        DEBUGFS_STATS_DEL(dot11ACKFailureCount);
-        DEBUGFS_STATS_DEL(dot11RTSFailureCount);
-        DEBUGFS_STATS_DEL(dot11FCSErrorCount);
-        DEBUGFS_STATS_DEL(dot11RTSSuccessCount);
-
-        debugfs_remove(local->debugfs.statistics);
-        local->debugfs.statistics = NULL;
-        debugfs_remove(local->debugfs.stations);
-        local->debugfs.stations = NULL;
-        debugfs_remove(local->debugfs.keys);
-        local->debugfs.keys = NULL;
-}
diff --git a/net/mac80211/debugfs.h b/net/mac80211/debugfs.h
index dd2541935c27..68e6a2050f9a 100644
--- a/net/mac80211/debugfs.h
+++ b/net/mac80211/debugfs.h
@@ -3,14 +3,12 @@
 
 #ifdef CONFIG_MAC80211_DEBUGFS
 extern void debugfs_hw_add(struct ieee80211_local *local);
-extern void debugfs_hw_del(struct ieee80211_local *local);
 extern int mac80211_open_file_generic(struct inode *inode, struct file *file);
 #else
 static inline void debugfs_hw_add(struct ieee80211_local *local)
 {
         return;
 }
-static inline void debugfs_hw_del(struct ieee80211_local *local) {}
 #endif
 
 #endif /* __MAC80211_DEBUGFS_H */
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 99c752588b30..97c9e46e859e 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/kobject.h>
+#include <linux/slab.h>
 #include "ieee80211_i.h"
 #include "key.h"
 #include "debugfs.h"
@@ -56,7 +57,7 @@ KEY_CONF_FILE(keyidx, D);
 KEY_CONF_FILE(hw_key_idx, D);
 KEY_FILE(flags, X);
 KEY_FILE(tx_rx_count, D);
-KEY_READ(ifindex, sdata->dev->ifindex, 20, "%d\n");
+KEY_READ(ifindex, sdata->name, IFNAMSIZ + 2, "%s\n");
 KEY_OPS(ifindex);
 
 static ssize_t key_algorithm_read(struct file *file,
@@ -225,8 +226,8 @@ static ssize_t key_key_read(struct file *file, char __user *userbuf,
 KEY_OPS(key);
 
 #define DEBUGFS_ADD(name) \
-        key->debugfs.name = debugfs_create_file(#name, 0400,\
-                                key->debugfs.dir, key, &key_##name##_ops);
+        debugfs_create_file(#name, 0400, key->debugfs.dir, \
+                            key, &key_##name##_ops);
 
 void ieee80211_debugfs_key_add(struct ieee80211_key *key)
   {
@@ -271,30 +272,12 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         DEBUGFS_ADD(ifindex);
 };
 
-#define DEBUGFS_DEL(name) \
-        debugfs_remove(key->debugfs.name); key->debugfs.name = NULL;
-
 void ieee80211_debugfs_key_remove(struct ieee80211_key *key)
 {
         if (!key)
                 return;
 
-        DEBUGFS_DEL(keylen);
-        DEBUGFS_DEL(flags);
-        DEBUGFS_DEL(keyidx);
-        DEBUGFS_DEL(hw_key_idx);
-        DEBUGFS_DEL(tx_rx_count);
-        DEBUGFS_DEL(algorithm);
-        DEBUGFS_DEL(tx_spec);
-        DEBUGFS_DEL(rx_spec);
-        DEBUGFS_DEL(replays);
-        DEBUGFS_DEL(icverrors);
-        DEBUGFS_DEL(key);
-        DEBUGFS_DEL(ifindex);
-
-        debugfs_remove(key->debugfs.stalink);
-        key->debugfs.stalink = NULL;
-        debugfs_remove(key->debugfs.dir);
+        debugfs_remove_recursive(key->debugfs.dir);
         key->debugfs.dir = NULL;
 }
 void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata)
@@ -302,7 +285,7 @@ void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata)
         char buf[50];
         struct ieee80211_key *key;
 
-        if (!sdata->debugfsdir)
+        if (!sdata->debugfs.dir)
                 return;
 
         /* this is running under the key lock */
@@ -310,9 +293,9 @@ void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata)
         key = sdata->default_key;
         if (key) {
                 sprintf(buf, "../keys/%d", key->debugfs.cnt);
-                sdata->common_debugfs.default_key =
+                sdata->debugfs.default_key =
                         debugfs_create_symlink("default_key",
-                                               sdata->debugfsdir, buf);
+                                               sdata->debugfs.dir, buf);
         } else
                 ieee80211_debugfs_key_remove_default(sdata);
 }
@@ -322,8 +305,8 @@ void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata)
         if (!sdata)
                 return;
 
-        debugfs_remove(sdata->common_debugfs.default_key);
-        sdata->common_debugfs.default_key = NULL;
+        debugfs_remove(sdata->debugfs.default_key);
+        sdata->debugfs.default_key = NULL;
 }
 
 void ieee80211_debugfs_key_add_mgmt_default(struct ieee80211_sub_if_data *sdata)
@@ -331,7 +314,7 @@ void ieee80211_debugfs_key_add_mgmt_default(struct ieee80211_sub_if_data *sdata)
         char buf[50];
         struct ieee80211_key *key;
 
-        if (!sdata->debugfsdir)
+        if (!sdata->debugfs.dir)
                 return;
 
         /* this is running under the key lock */
@@ -339,9 +322,9 @@ void ieee80211_debugfs_key_add_mgmt_default(struct ieee80211_sub_if_data *sdata)
         key = sdata->default_mgmt_key;
         if (key) {
                 sprintf(buf, "../keys/%d", key->debugfs.cnt);
-                sdata->common_debugfs.default_mgmt_key =
+                sdata->debugfs.default_mgmt_key =
                         debugfs_create_symlink("default_mgmt_key",
-                                               sdata->debugfsdir, buf);
+                                               sdata->debugfs.dir, buf);
         } else
                 ieee80211_debugfs_key_remove_mgmt_default(sdata);
 }
@@ -351,8 +334,8 @@ void ieee80211_debugfs_key_remove_mgmt_default(struct ieee80211_sub_if_data *sda
         if (!sdata)
                 return;
 
-        debugfs_remove(sdata->common_debugfs.default_mgmt_key);
-        sdata->common_debugfs.default_mgmt_key = NULL;
+        debugfs_remove(sdata->debugfs.default_mgmt_key);
+        sdata->debugfs.default_mgmt_key = NULL;
 }
 
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 61234e79022b..83d4289d954b 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -13,6 +13,7 @@
 #include <linux/interrupt.h>
 #include <linux/netdevice.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include <linux/notifier.h>
 #include <net/mac80211.h>
 #include <net/cfg80211.h>
@@ -41,6 +42,34 @@ static ssize_t ieee80211_if_read(
         return ret;
 }
 
+static ssize_t ieee80211_if_write(
+        struct ieee80211_sub_if_data *sdata,
+        const char __user *userbuf,
+        size_t count, loff_t *ppos,
+        ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int))
+{
+        u8 *buf;
+        ssize_t ret;
+
+        buf = kmalloc(count, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = -EFAULT;
+        if (copy_from_user(buf, userbuf, count))
+                goto freebuf;
+
+        ret = -ENODEV;
+        rtnl_lock();
+        if (sdata->dev->reg_state == NETREG_REGISTERED)
+                ret = (*write)(sdata, buf, count);
+        rtnl_unlock();
+
+freebuf:
+        kfree(buf);
+        return ret;
+}
+
 #define IEEE80211_IF_FMT(name, field, format_string)                    \
 static ssize_t ieee80211_if_fmt_##name(                                 \
         const struct ieee80211_sub_if_data *sdata, char *buf,           \
@@ -71,7 +100,7 @@ static ssize_t ieee80211_if_fmt_##name(					\
         return scnprintf(buf, buflen, "%pM\n", sdata->field);           \
 }
 
-#define __IEEE80211_IF_FILE(name)                                       \
+#define __IEEE80211_IF_FILE(name, _write)                               \
 static ssize_t ieee80211_if_read_##name(struct file *file,              \
                                         char __user *userbuf,           \
                                         size_t count, loff_t *ppos)     \
@@ -82,22 +111,99 @@ static ssize_t ieee80211_if_read_##name(struct file *file,		\
 }                                                                       \
 static const struct file_operations name##_ops = {                      \
         .read = ieee80211_if_read_##name,                               \
+        .write = (_write),                                              \
         .open = mac80211_open_file_generic,                             \
 }
 
+#define __IEEE80211_IF_FILE_W(name)                                     \
+static ssize_t ieee80211_if_write_##name(struct file *file,             \
+                                         const char __user *userbuf,    \
+                                         size_t count, loff_t *ppos)    \
+{                                                                       \
+        return ieee80211_if_write(file->private_data, userbuf, count,   \
+                                  ppos, ieee80211_if_parse_##name);     \
+}                                                                       \
+__IEEE80211_IF_FILE(name, ieee80211_if_write_##name)
+
+
 #define IEEE80211_IF_FILE(name, field, format)                          \
                 IEEE80211_IF_FMT_##format(name, field)                  \
-                __IEEE80211_IF_FILE(name)
+                __IEEE80211_IF_FILE(name, NULL)
 
 /* common attributes */
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
-IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
-IEEE80211_IF_FILE(max_ratectrl_rateidx, max_ratectrl_rateidx, DEC);
+IEEE80211_IF_FILE(rc_rateidx_mask_2ghz, rc_rateidx_mask[IEEE80211_BAND_2GHZ],
+                  HEX);
+IEEE80211_IF_FILE(rc_rateidx_mask_5ghz, rc_rateidx_mask[IEEE80211_BAND_5GHZ],
+                  HEX);
 
 /* STA attributes */
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
 IEEE80211_IF_FILE(aid, u.mgd.aid, DEC);
-IEEE80211_IF_FILE(capab, u.mgd.capab, HEX);
+
+static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
+                              enum ieee80211_smps_mode smps_mode)
+{
+        struct ieee80211_local *local = sdata->local;
+        int err;
+
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_STATIC_SMPS) &&
+            smps_mode == IEEE80211_SMPS_STATIC)
+                return -EINVAL;
+
+        /* auto should be dynamic if in PS mode */
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS) &&
+            (smps_mode == IEEE80211_SMPS_DYNAMIC ||
+             smps_mode == IEEE80211_SMPS_AUTOMATIC))
+                return -EINVAL;
+
+        /* supported only on managed interfaces for now */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        mutex_lock(&local->iflist_mtx);
+        err = __ieee80211_request_smps(sdata, smps_mode);
+        mutex_unlock(&local->iflist_mtx);
+
+        return err;
+}
+
+static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
+        [IEEE80211_SMPS_AUTOMATIC] = "auto",
+        [IEEE80211_SMPS_OFF] = "off",
+        [IEEE80211_SMPS_STATIC] = "static",
+        [IEEE80211_SMPS_DYNAMIC] = "dynamic",
+};
+
+static ssize_t ieee80211_if_fmt_smps(const struct ieee80211_sub_if_data *sdata,
+                                     char *buf, int buflen)
+{
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        return snprintf(buf, buflen, "request: %s\nused: %s\n",
+                        smps_modes[sdata->u.mgd.req_smps],
+                        smps_modes[sdata->u.mgd.ap_smps]);
+}
+
+static ssize_t ieee80211_if_parse_smps(struct ieee80211_sub_if_data *sdata,
+                                       const char *buf, int buflen)
+{
+        enum ieee80211_smps_mode mode;
+
+        for (mode = 0; mode < IEEE80211_SMPS_NUM_MODES; mode++) {
+                if (strncmp(buf, smps_modes[mode], buflen) == 0) {
+                        int err = ieee80211_set_smps(sdata, mode);
+                        if (!err)
+                                return buflen;
+                        return err;
+                }
+        }
+
+        return -EINVAL;
+}
+
+__IEEE80211_IF_FILE_W(smps);
 
 /* AP attributes */
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
@@ -109,7 +215,7 @@ static ssize_t ieee80211_if_fmt_num_buffered_multicast(
         return scnprintf(buf, buflen, "%u\n",
                          skb_queue_len(&sdata->u.ap.ps_bc_buf));
 }
-__IEEE80211_IF_FILE(num_buffered_multicast);
+__IEEE80211_IF_FILE(num_buffered_multicast, NULL);
 
 /* WDS attributes */
 IEEE80211_IF_FILE(peer, u.wds.remote_addr, MAC);
@@ -149,49 +255,55 @@ IEEE80211_IF_FILE(path_refresh_time,
                 u.mesh.mshcfg.path_refresh_time, DEC);
 IEEE80211_IF_FILE(min_discovery_timeout,
                 u.mesh.mshcfg.min_discovery_timeout, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPRootMode,
+                u.mesh.mshcfg.dot11MeshHWMPRootMode, DEC);
 #endif
 
 
-#define DEBUGFS_ADD(name, type)\
-        sdata->debugfs.type.name = debugfs_create_file(#name, 0400,\
-                sdata->debugfsdir, sdata, &name##_ops);
+#define DEBUGFS_ADD(name) \
+        debugfs_create_file(#name, 0400, sdata->debugfs.dir, \
+                            sdata, &name##_ops);
+
+#define DEBUGFS_ADD_MODE(name, mode) \
+        debugfs_create_file(#name, mode, sdata->debugfs.dir, \
+                            sdata, &name##_ops);
 
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, sta);
-        DEBUGFS_ADD(force_unicast_rateidx, sta);
-        DEBUGFS_ADD(max_ratectrl_rateidx, sta);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
-        DEBUGFS_ADD(bssid, sta);
-        DEBUGFS_ADD(aid, sta);
-        DEBUGFS_ADD(capab, sta);
+        DEBUGFS_ADD(bssid);
+        DEBUGFS_ADD(aid);
+        DEBUGFS_ADD_MODE(smps, 0600);
 }
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, ap);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
-        DEBUGFS_ADD(num_sta_ps, ap);
-        DEBUGFS_ADD(dtim_count, ap);
-        DEBUGFS_ADD(num_buffered_multicast, ap);
+        DEBUGFS_ADD(num_sta_ps);
+        DEBUGFS_ADD(dtim_count);
+        DEBUGFS_ADD(num_buffered_multicast);
 }
 
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, wds);
-        DEBUGFS_ADD(force_unicast_rateidx, wds);
-        DEBUGFS_ADD(max_ratectrl_rateidx, wds);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
-        DEBUGFS_ADD(peer, wds);
+        DEBUGFS_ADD(peer);
 }
 
 static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, vlan);
-        DEBUGFS_ADD(force_unicast_rateidx, vlan);
-        DEBUGFS_ADD(max_ratectrl_rateidx, vlan);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 }
 
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -199,30 +311,32 @@ static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
 }
 
 #ifdef CONFIG_MAC80211_MESH
-#define MESHSTATS_ADD(name)\
-        sdata->mesh_stats.name = debugfs_create_file(#name, 0400,\
-                sdata->mesh_stats_dir, sdata, &name##_ops);
 
 static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
 {
-        sdata->mesh_stats_dir = debugfs_create_dir("mesh_stats",
-                                sdata->debugfsdir);
+        struct dentry *dir = debugfs_create_dir("mesh_stats",
+                                                sdata->debugfs.dir);
+
+#define MESHSTATS_ADD(name)\
+        debugfs_create_file(#name, 0400, dir, sdata, &name##_ops);
+
         MESHSTATS_ADD(fwded_mcast);
         MESHSTATS_ADD(fwded_unicast);
         MESHSTATS_ADD(fwded_frames);
         MESHSTATS_ADD(dropped_frames_ttl);
         MESHSTATS_ADD(dropped_frames_no_route);
         MESHSTATS_ADD(estab_plinks);
+#undef MESHSTATS_ADD
 }
 
-#define MESHPARAMS_ADD(name)\
-        sdata->mesh_config.name = debugfs_create_file(#name, 0600,\
-                sdata->mesh_config_dir, sdata, &name##_ops);
-
 static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
 {
-        sdata->mesh_config_dir = debugfs_create_dir("mesh_config",
-                                sdata->debugfsdir);
+        struct dentry *dir = debugfs_create_dir("mesh_config",
+                                                sdata->debugfs.dir);
+
+#define MESHPARAMS_ADD(name) \
+        debugfs_create_file(#name, 0600, dir, sdata, &name##_ops);
+
         MESHPARAMS_ADD(dot11MeshMaxRetries);
         MESHPARAMS_ADD(dot11MeshRetryTimeout);
         MESHPARAMS_ADD(dot11MeshConfirmTimeout);
@@ -236,12 +350,14 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(dot11MeshHWMPmaxPREQretries);
         MESHPARAMS_ADD(path_refresh_time);
         MESHPARAMS_ADD(min_discovery_timeout);
+
+#undef MESHPARAMS_ADD
 }
 #endif
 
 static void add_files(struct ieee80211_sub_if_data *sdata)
 {
-        if (!sdata->debugfsdir)
+        if (!sdata->debugfs.dir)
                 return;
 
         switch (sdata->vif.type) {
@@ -274,208 +390,37 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
         }
 }
 
-#define DEBUGFS_DEL(name, type)                                 \
-        do {                                                    \
-                debugfs_remove(sdata->debugfs.type.name);       \
-                sdata->debugfs.type.name = NULL;                \
-        } while (0)
-
-static void del_sta_files(struct ieee80211_sub_if_data *sdata)
-{
-        DEBUGFS_DEL(drop_unencrypted, sta);
-        DEBUGFS_DEL(force_unicast_rateidx, sta);
-        DEBUGFS_DEL(max_ratectrl_rateidx, sta);
-
-        DEBUGFS_DEL(bssid, sta);
-        DEBUGFS_DEL(aid, sta);
-        DEBUGFS_DEL(capab, sta);
-}
-
-static void del_ap_files(struct ieee80211_sub_if_data *sdata)
-{
-        DEBUGFS_DEL(drop_unencrypted, ap);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
-
-        DEBUGFS_DEL(num_sta_ps, ap);
-        DEBUGFS_DEL(dtim_count, ap);
-        DEBUGFS_DEL(num_buffered_multicast, ap);
-}
-
-static void del_wds_files(struct ieee80211_sub_if_data *sdata)
-{
-        DEBUGFS_DEL(drop_unencrypted, wds);
-        DEBUGFS_DEL(force_unicast_rateidx, wds);
-        DEBUGFS_DEL(max_ratectrl_rateidx, wds);
-
-        DEBUGFS_DEL(peer, wds);
-}
-
-static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
-{
-        DEBUGFS_DEL(drop_unencrypted, vlan);
-        DEBUGFS_DEL(force_unicast_rateidx, vlan);
-        DEBUGFS_DEL(max_ratectrl_rateidx, vlan);
-}
-
-static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
-{
-}
-
-#ifdef CONFIG_MAC80211_MESH
-#define MESHSTATS_DEL(name)                     \
-        do {                                            \
-                debugfs_remove(sdata->mesh_stats.name); \
-                sdata->mesh_stats.name = NULL;          \
-        } while (0)
-
-static void del_mesh_stats(struct ieee80211_sub_if_data *sdata)
-{
-        MESHSTATS_DEL(fwded_mcast);
-        MESHSTATS_DEL(fwded_unicast);
-        MESHSTATS_DEL(fwded_frames);
-        MESHSTATS_DEL(dropped_frames_ttl);
-        MESHSTATS_DEL(dropped_frames_no_route);
-        MESHSTATS_DEL(estab_plinks);
-        debugfs_remove(sdata->mesh_stats_dir);
-        sdata->mesh_stats_dir = NULL;
-}
-
-#define MESHPARAMS_DEL(name)                    \
-        do {                                            \
-                debugfs_remove(sdata->mesh_config.name);        \
-                sdata->mesh_config.name = NULL;         \
-        } while (0)
-
-static void del_mesh_config(struct ieee80211_sub_if_data *sdata)
-{
-        MESHPARAMS_DEL(dot11MeshMaxRetries);
-        MESHPARAMS_DEL(dot11MeshRetryTimeout);
-        MESHPARAMS_DEL(dot11MeshConfirmTimeout);
-        MESHPARAMS_DEL(dot11MeshHoldingTimeout);
-        MESHPARAMS_DEL(dot11MeshTTL);
-        MESHPARAMS_DEL(auto_open_plinks);
-        MESHPARAMS_DEL(dot11MeshMaxPeerLinks);
-        MESHPARAMS_DEL(dot11MeshHWMPactivePathTimeout);
-        MESHPARAMS_DEL(dot11MeshHWMPpreqMinInterval);
-        MESHPARAMS_DEL(dot11MeshHWMPnetDiameterTraversalTime);
-        MESHPARAMS_DEL(dot11MeshHWMPmaxPREQretries);
-        MESHPARAMS_DEL(path_refresh_time);
-        MESHPARAMS_DEL(min_discovery_timeout);
-        debugfs_remove(sdata->mesh_config_dir);
-        sdata->mesh_config_dir = NULL;
-}
-#endif
-
-static void del_files(struct ieee80211_sub_if_data *sdata)
-{
-        if (!sdata->debugfsdir)
-                return;
-
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_MESH_POINT:
-#ifdef CONFIG_MAC80211_MESH
-                del_mesh_stats(sdata);
-                del_mesh_config(sdata);
-#endif
-                break;
-        case NL80211_IFTYPE_STATION:
-                del_sta_files(sdata);
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                /* XXX */
-                break;
-        case NL80211_IFTYPE_AP:
-                del_ap_files(sdata);
-                break;
-        case NL80211_IFTYPE_WDS:
-                del_wds_files(sdata);
-                break;
-        case NL80211_IFTYPE_MONITOR:
-                del_monitor_files(sdata);
-                break;
-        case NL80211_IFTYPE_AP_VLAN:
-                del_vlan_files(sdata);
-                break;
-        default:
-                break;
-        }
-}
-
-static int notif_registered;
-
 void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata)
 {
         char buf[10+IFNAMSIZ];
 
-        if (!notif_registered)
-                return;
-
-        sprintf(buf, "netdev:%s", sdata->dev->name);
-        sdata->debugfsdir = debugfs_create_dir(buf,
+        sprintf(buf, "netdev:%s", sdata->name);
+        sdata->debugfs.dir = debugfs_create_dir(buf,
                 sdata->local->hw.wiphy->debugfsdir);
         add_files(sdata);
 }
 
 void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
 {
-        del_files(sdata);
-        debugfs_remove(sdata->debugfsdir);
-        sdata->debugfsdir = NULL;
+        if (!sdata->debugfs.dir)
+                return;
+
+        debugfs_remove_recursive(sdata->debugfs.dir);
+        sdata->debugfs.dir = NULL;
 }
 
-static int netdev_notify(struct notifier_block *nb,
-                         unsigned long state,
-                         void *ndev)
+void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
 {
-        struct net_device *dev = ndev;
         struct dentry *dir;
-        struct ieee80211_sub_if_data *sdata;
-        char buf[10+IFNAMSIZ];
-
-        if (state != NETDEV_CHANGENAME)
-                return 0;
+        char buf[10 + IFNAMSIZ];
 
-        if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
-                return 0;
-
-        if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
-                return 0;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        dir = sdata->debugfsdir;
+        dir = sdata->debugfs.dir;
 
         if (!dir)
-                return 0;
+                return;
 
-        sprintf(buf, "netdev:%s", dev->name);
+        sprintf(buf, "netdev:%s", sdata->name);
         if (!debugfs_rename(dir->d_parent, dir, dir->d_parent, buf))
                 printk(KERN_ERR "mac80211: debugfs: failed to rename debugfs "
                        "dir to %s\n", buf);
-
-        return 0;
-}
-
-static struct notifier_block mac80211_debugfs_netdev_notifier = {
-        .notifier_call = netdev_notify,
-};
-
-void ieee80211_debugfs_netdev_init(void)
-{
-        int err;
-
-        err = register_netdevice_notifier(&mac80211_debugfs_netdev_notifier);
-        if (err) {
-                printk(KERN_ERR
-                       "mac80211: failed to install netdev notifier,"
-                       " disabling per-netdev debugfs!\n");
-        } else
-                notif_registered = 1;
-}
-
-void ieee80211_debugfs_netdev_exit(void)
-{
-        unregister_netdevice_notifier(&mac80211_debugfs_netdev_notifier);
-        notif_registered = 0;
 }
diff --git a/net/mac80211/debugfs_netdev.h b/net/mac80211/debugfs_netdev.h
index 7af731f0b731..79025e79f4d6 100644
--- a/net/mac80211/debugfs_netdev.h
+++ b/net/mac80211/debugfs_netdev.h
@@ -6,8 +6,7 @@
 #ifdef CONFIG_MAC80211_DEBUGFS
 void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata);
-void ieee80211_debugfs_netdev_init(void);
-void ieee80211_debugfs_netdev_exit(void);
+void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata);
 #else
 static inline void ieee80211_debugfs_add_netdev(
         struct ieee80211_sub_if_data *sdata)
@@ -15,10 +14,8 @@ static inline void ieee80211_debugfs_add_netdev(
 static inline void ieee80211_debugfs_remove_netdev(
         struct ieee80211_sub_if_data *sdata)
 {}
-static inline void ieee80211_debugfs_netdev_init(void)
-{}
-
-static inline void ieee80211_debugfs_netdev_exit(void)
+static inline void ieee80211_debugfs_rename_netdev(
+        struct ieee80211_sub_if_data *sdata)
 {}
 #endif
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 33a2e892115b..d92800bb2d2f 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -44,7 +44,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
                 STA_OPS(name)
 
 STA_FILE(aid, sta.aid, D);
-STA_FILE(dev, sdata->dev->name, S);
+STA_FILE(dev, sdata->name, S);
 STA_FILE(rx_packets, rx_packets, LU);
 STA_FILE(tx_packets, tx_packets, LU);
 STA_FILE(rx_bytes, rx_bytes, LU);
@@ -57,7 +57,6 @@ STA_FILE(tx_filtered, tx_filtered_count, LU);
 STA_FILE(tx_retry_failed, tx_retry_failed, LU);
 STA_FILE(tx_retry_count, tx_retry_count, LU);
 STA_FILE(last_signal, last_signal, D);
-STA_FILE(last_qual, last_qual, D);
 STA_FILE(last_noise, last_noise, D);
 STA_FILE(wep_weak_iv_count, wep_weak_iv_count, LU);
 
@@ -67,10 +66,11 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         char buf[100];
         struct sta_info *sta = file->private_data;
         u32 staflags = get_sta_flags(sta);
-        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s",
+        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s%s",
                 staflags & WLAN_STA_AUTH ? "AUTH\n" : "",
                 staflags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
-                staflags & WLAN_STA_PS ? "PS\n" : "",
+                staflags & WLAN_STA_PS_STA ? "PS (sta)\n" : "",
+                staflags & WLAN_STA_PS_DRIVER ? "PS (driver)\n" : "",
                 staflags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
                 staflags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
                 staflags & WLAN_STA_WME ? "WME\n" : "",
@@ -120,36 +120,38 @@ STA_OPS(last_seq_ctrl);
 static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
                                         size_t count, loff_t *ppos)
 {
-        char buf[30 + STA_TID_NUM * 70], *p = buf;
+        char buf[64 + STA_TID_NUM * 40], *p = buf;
         int i;
         struct sta_info *sta = file->private_data;
 
         spin_lock_bh(&sta->lock);
-        p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
+        p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
                         sta->ampdu_mlme.dialog_token_allocator + 1);
+        p += scnprintf(p, sizeof(buf) + buf - p,
+                       "TID\t\tRX\tDTKN\tSSN\t\tTX\tDTKN\tSSN\tpending\n");
         for (i = 0; i < STA_TID_NUM; i++) {
-                p += scnprintf(p, sizeof(buf)+buf-p, "TID %02d:", i);
-                p += scnprintf(p, sizeof(buf)+buf-p, " RX=%x",
+                p += scnprintf(p, sizeof(buf) + buf - p, "%02d", i);
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
                                 sta->ampdu_mlme.tid_state_rx[i]);
-                p += scnprintf(p, sizeof(buf)+buf-p, "/DTKN=%#.2x",
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
                                 sta->ampdu_mlme.tid_state_rx[i] ?
                                 sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
-                p += scnprintf(p, sizeof(buf)+buf-p, "/SSN=%#.3x",
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
                                 sta->ampdu_mlme.tid_state_rx[i] ?
                                 sta->ampdu_mlme.tid_rx[i]->ssn : 0);
 
-                p += scnprintf(p, sizeof(buf)+buf-p, " TX=%x",
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
                                 sta->ampdu_mlme.tid_state_tx[i]);
-                p += scnprintf(p, sizeof(buf)+buf-p, "/DTKN=%#.2x",
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
                                 sta->ampdu_mlme.tid_state_tx[i] ?
                                 sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
-                p += scnprintf(p, sizeof(buf)+buf-p, "/SSN=%#.3x",
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
                                 sta->ampdu_mlme.tid_state_tx[i] ?
                                 sta->ampdu_mlme.tid_tx[i]->ssn : 0);
-                p += scnprintf(p, sizeof(buf)+buf-p, "/pending=%03d",
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t%03d",
                                 sta->ampdu_mlme.tid_state_tx[i] ?
                                 skb_queue_len(&sta->ampdu_mlme.tid_tx[i]->pending) : 0);
-                p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+                p += scnprintf(p, sizeof(buf) + buf - p, "\n");
         }
         spin_unlock_bh(&sta->lock);
 
@@ -157,14 +159,92 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(agg_status);
 
+static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
+                                size_t count, loff_t *ppos)
+{
+#define PRINT_HT_CAP(_cond, _str) \
+        do { \
+        if (_cond) \
+                        p += scnprintf(p, sizeof(buf)+buf-p, "\t" _str "\n"); \
+        } while (0)
+        char buf[512], *p = buf;
+        int i;
+        struct sta_info *sta = file->private_data;
+        struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
+
+        p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
+                        htc->ht_supported ? "" : "not ");
+        if (htc->ht_supported) {
+                p += scnprintf(p, sizeof(buf)+buf-p, "cap: %#.4x\n", htc->cap);
+
+                PRINT_HT_CAP((htc->cap & BIT(0)), "RX LDCP");
+                PRINT_HT_CAP((htc->cap & BIT(1)), "HT20/HT40");
+                PRINT_HT_CAP(!(htc->cap & BIT(1)), "HT20");
+
+                PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 0, "Static SM Power Save");
+                PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 1, "Dynamic SM Power Save");
+                PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 3, "SM Power Save disabled");
+
+                PRINT_HT_CAP((htc->cap & BIT(4)), "RX Greenfield");
+                PRINT_HT_CAP((htc->cap & BIT(5)), "RX HT20 SGI");
+                PRINT_HT_CAP((htc->cap & BIT(6)), "RX HT40 SGI");
+                PRINT_HT_CAP((htc->cap & BIT(7)), "TX STBC");
+
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 0, "No RX STBC");
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 1, "RX STBC 1-stream");
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 2, "RX STBC 2-streams");
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 3, "RX STBC 3-streams");
+
+                PRINT_HT_CAP((htc->cap & BIT(10)), "HT Delayed Block Ack");
+
+                PRINT_HT_CAP((htc->cap & BIT(11)), "Max AMSDU length: "
+                             "3839 bytes");
+                PRINT_HT_CAP(!(htc->cap & BIT(11)), "Max AMSDU length: "
+                             "7935 bytes");
+
+                /*
+                 * For beacons and probe response this would mean the BSS
+                 * does or does not allow the usage of DSSS/CCK HT40.
+                 * Otherwise it means the STA does or does not use
+                 * DSSS/CCK HT40.
+                 */
+                PRINT_HT_CAP((htc->cap & BIT(12)), "DSSS/CCK HT40");
+                PRINT_HT_CAP(!(htc->cap & BIT(12)), "No DSSS/CCK HT40");
+
+                /* BIT(13) is reserved */
+
+                PRINT_HT_CAP((htc->cap & BIT(14)), "40 MHz Intolerant");
+
+                PRINT_HT_CAP((htc->cap & BIT(15)), "L-SIG TXOP protection");
+
+                p += scnprintf(p, sizeof(buf)+buf-p, "ampdu factor/density: %d/%d\n",
+                                htc->ampdu_factor, htc->ampdu_density);
+                p += scnprintf(p, sizeof(buf)+buf-p, "MCS mask:");
+
+                for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                        p += scnprintf(p, sizeof(buf)+buf-p, " %.2x",
+                                        htc->mcs.rx_mask[i]);
+                p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+
+                /* If not set this is meaningless */
+                if (le16_to_cpu(htc->mcs.rx_highest)) {
+                        p += scnprintf(p, sizeof(buf)+buf-p,
+                                       "MCS rx highest: %d Mbps\n",
+                                       le16_to_cpu(htc->mcs.rx_highest));
+                }
+
+                p += scnprintf(p, sizeof(buf)+buf-p, "MCS tx params: %x\n",
+                                htc->mcs.tx_params);
+        }
+
+        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+}
+STA_OPS(ht_capa);
+
 #define DEBUGFS_ADD(name) \
-        sta->debugfs.name = debugfs_create_file(#name, 0400, \
+        debugfs_create_file(#name, 0400, \
                 sta->debugfs.dir, sta, &sta_ ##name## _ops);
 
-#define DEBUGFS_DEL(name) \
-        debugfs_remove(sta->debugfs.name);\
-        sta->debugfs.name = NULL;
-
 
 void ieee80211_sta_debugfs_add(struct sta_info *sta)
 {
@@ -209,36 +289,13 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(tx_retry_failed);
         DEBUGFS_ADD(tx_retry_count);
         DEBUGFS_ADD(last_signal);
-        DEBUGFS_ADD(last_qual);
         DEBUGFS_ADD(last_noise);
         DEBUGFS_ADD(wep_weak_iv_count);
+        DEBUGFS_ADD(ht_capa);
 }
 
 void ieee80211_sta_debugfs_remove(struct sta_info *sta)
 {
-        DEBUGFS_DEL(flags);
-        DEBUGFS_DEL(num_ps_buf_frames);
-        DEBUGFS_DEL(inactive_ms);
-        DEBUGFS_DEL(last_seq_ctrl);
-        DEBUGFS_DEL(agg_status);
-        DEBUGFS_DEL(aid);
-        DEBUGFS_DEL(dev);
-        DEBUGFS_DEL(rx_packets);
-        DEBUGFS_DEL(tx_packets);
-        DEBUGFS_DEL(rx_bytes);
-        DEBUGFS_DEL(tx_bytes);
-        DEBUGFS_DEL(rx_duplicates);
-        DEBUGFS_DEL(rx_fragments);
-        DEBUGFS_DEL(rx_dropped);
-        DEBUGFS_DEL(tx_fragments);
-        DEBUGFS_DEL(tx_filtered);
-        DEBUGFS_DEL(tx_retry_failed);
-        DEBUGFS_DEL(tx_retry_count);
-        DEBUGFS_DEL(last_signal);
-        DEBUGFS_DEL(last_qual);
-        DEBUGFS_DEL(last_noise);
-        DEBUGFS_DEL(wep_weak_iv_count);
-
-        debugfs_remove(sta->debugfs.dir);
+        debugfs_remove_recursive(sta->debugfs.dir);
         sta->debugfs.dir = NULL;
 }
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 020a94a31106..c3d844093a2f 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -14,6 +14,8 @@ static inline int drv_start(struct ieee80211_local *local)
 {
         int ret;
 
+        might_sleep();
+
         local->started = true;
         smp_mb();
         ret = local->ops->start(&local->hw);
@@ -23,6 +25,8 @@ static inline int drv_start(struct ieee80211_local *local)
 
 static inline void drv_stop(struct ieee80211_local *local)
 {
+        might_sleep();
+
         local->ops->stop(&local->hw);
         trace_drv_stop(local);
 
@@ -36,35 +40,47 @@ static inline void drv_stop(struct ieee80211_local *local)
 }
 
 static inline int drv_add_interface(struct ieee80211_local *local,
-                                    struct ieee80211_if_init_conf *conf)
+                                    struct ieee80211_vif *vif)
 {
-        int ret = local->ops->add_interface(&local->hw, conf);
-        trace_drv_add_interface(local, conf->mac_addr, conf->vif, ret);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->add_interface(&local->hw, vif);
+        trace_drv_add_interface(local, vif_to_sdata(vif), ret);
         return ret;
 }
 
 static inline void drv_remove_interface(struct ieee80211_local *local,
-                                        struct ieee80211_if_init_conf *conf)
+                                        struct ieee80211_vif *vif)
 {
-        local->ops->remove_interface(&local->hw, conf);
-        trace_drv_remove_interface(local, conf->mac_addr, conf->vif);
+        might_sleep();
+
+        local->ops->remove_interface(&local->hw, vif);
+        trace_drv_remove_interface(local, vif_to_sdata(vif));
 }
 
 static inline int drv_config(struct ieee80211_local *local, u32 changed)
 {
-        int ret = local->ops->config(&local->hw, changed);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->config(&local->hw, changed);
         trace_drv_config(local, changed, ret);
         return ret;
 }
 
 static inline void drv_bss_info_changed(struct ieee80211_local *local,
-                                        struct ieee80211_vif *vif,
+                                        struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_bss_conf *info,
                                         u32 changed)
 {
+        might_sleep();
+
         if (local->ops->bss_info_changed)
-                local->ops->bss_info_changed(&local->hw, vif, info, changed);
-        trace_drv_bss_info_changed(local, vif, info, changed);
+                local->ops->bss_info_changed(&local->hw, &sdata->vif, info, changed);
+        trace_drv_bss_info_changed(local, sdata, info, changed);
 }
 
 static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
@@ -106,36 +122,53 @@ static inline int drv_set_tim(struct ieee80211_local *local,
 }
 
 static inline int drv_set_key(struct ieee80211_local *local,
-                              enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                              enum set_key_cmd cmd,
+                              struct ieee80211_sub_if_data *sdata,
                               struct ieee80211_sta *sta,
                               struct ieee80211_key_conf *key)
 {
-        int ret = local->ops->set_key(&local->hw, cmd, vif, sta, key);
-        trace_drv_set_key(local, cmd, vif, sta, key, ret);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key);
+        trace_drv_set_key(local, cmd, sdata, sta, key, ret);
         return ret;
 }
 
 static inline void drv_update_tkip_key(struct ieee80211_local *local,
+                                       struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_key_conf *conf,
-                                       const u8 *address, u32 iv32,
+                                       struct sta_info *sta, u32 iv32,
                                        u16 *phase1key)
 {
+        struct ieee80211_sta *ista = NULL;
+
+        if (sta)
+                ista = &sta->sta;
+
         if (local->ops->update_tkip_key)
-                local->ops->update_tkip_key(&local->hw, conf, address,
-                                            iv32, phase1key);
-        trace_drv_update_tkip_key(local, conf, address, iv32);
+                local->ops->update_tkip_key(&local->hw, &sdata->vif, conf,
+                                            ista, iv32, phase1key);
+        trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
 }
 
 static inline int drv_hw_scan(struct ieee80211_local *local,
                               struct cfg80211_scan_request *req)
 {
-        int ret = local->ops->hw_scan(&local->hw, req);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->hw_scan(&local->hw, req);
         trace_drv_hw_scan(local, req, ret);
         return ret;
 }
 
 static inline void drv_sw_scan_start(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->sw_scan_start)
                 local->ops->sw_scan_start(&local->hw);
         trace_drv_sw_scan_start(local);
@@ -143,6 +176,8 @@ static inline void drv_sw_scan_start(struct ieee80211_local *local)
 
 static inline void drv_sw_scan_complete(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->sw_scan_complete)
                 local->ops->sw_scan_complete(&local->hw);
         trace_drv_sw_scan_complete(local);
@@ -153,6 +188,8 @@ static inline int drv_get_stats(struct ieee80211_local *local,
 {
         int ret = -EOPNOTSUPP;
 
+        might_sleep();
+
         if (local->ops->get_stats)
                 ret = local->ops->get_stats(&local->hw, stats);
         trace_drv_get_stats(local, stats, ret);
@@ -172,43 +209,93 @@ static inline int drv_set_rts_threshold(struct ieee80211_local *local,
                                         u32 value)
 {
         int ret = 0;
+
+        might_sleep();
+
         if (local->ops->set_rts_threshold)
                 ret = local->ops->set_rts_threshold(&local->hw, value);
         trace_drv_set_rts_threshold(local, value, ret);
         return ret;
 }
 
+static inline int drv_set_coverage_class(struct ieee80211_local *local,
+                                         u8 value)
+{
+        int ret = 0;
+        might_sleep();
+
+        if (local->ops->set_coverage_class)
+                local->ops->set_coverage_class(&local->hw, value);
+        else
+                ret = -EOPNOTSUPP;
+
+        trace_drv_set_coverage_class(local, value, ret);
+        return ret;
+}
+
 static inline void drv_sta_notify(struct ieee80211_local *local,
-                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_sub_if_data *sdata,
                                   enum sta_notify_cmd cmd,
                                   struct ieee80211_sta *sta)
 {
         if (local->ops->sta_notify)
-                local->ops->sta_notify(&local->hw, vif, cmd, sta);
-        trace_drv_sta_notify(local, vif, cmd, sta);
+                local->ops->sta_notify(&local->hw, &sdata->vif, cmd, sta);
+        trace_drv_sta_notify(local, sdata, cmd, sta);
+}
+
+static inline int drv_sta_add(struct ieee80211_local *local,
+                              struct ieee80211_sub_if_data *sdata,
+                              struct ieee80211_sta *sta)
+{
+        int ret = 0;
+
+        might_sleep();
+
+        if (local->ops->sta_add)
+                ret = local->ops->sta_add(&local->hw, &sdata->vif, sta);
+        else if (local->ops->sta_notify)
+                local->ops->sta_notify(&local->hw, &sdata->vif,
+                                        STA_NOTIFY_ADD, sta);
+
+        trace_drv_sta_add(local, sdata, sta, ret);
+
+        return ret;
+}
+
+static inline void drv_sta_remove(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_sta *sta)
+{
+        might_sleep();
+
+        if (local->ops->sta_remove)
+                local->ops->sta_remove(&local->hw, &sdata->vif, sta);
+        else if (local->ops->sta_notify)
+                local->ops->sta_notify(&local->hw, &sdata->vif,
+                                        STA_NOTIFY_REMOVE, sta);
+
+        trace_drv_sta_remove(local, sdata, sta);
 }
 
 static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
                               const struct ieee80211_tx_queue_params *params)
 {
         int ret = -EOPNOTSUPP;
+
+        might_sleep();
+
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, queue, params);
         trace_drv_conf_tx(local, queue, params, ret);
         return ret;
 }
 
-static inline int drv_get_tx_stats(struct ieee80211_local *local,
-                                   struct ieee80211_tx_queue_stats *stats)
-{
-        int ret = local->ops->get_tx_stats(&local->hw, stats);
-        trace_drv_get_tx_stats(local, stats, ret);
-        return ret;
-}
-
 static inline u64 drv_get_tsf(struct ieee80211_local *local)
 {
         u64 ret = -1ULL;
+
+        might_sleep();
+
         if (local->ops->get_tsf)
                 ret = local->ops->get_tsf(&local->hw);
         trace_drv_get_tsf(local, ret);
@@ -217,6 +304,8 @@ static inline u64 drv_get_tsf(struct ieee80211_local *local)
 
 static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
 {
+        might_sleep();
+
         if (local->ops->set_tsf)
                 local->ops->set_tsf(&local->hw, tsf);
         trace_drv_set_tsf(local, tsf);
@@ -224,6 +313,8 @@ static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
 
 static inline void drv_reset_tsf(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->reset_tsf)
                 local->ops->reset_tsf(&local->hw);
         trace_drv_reset_tsf(local);
@@ -232,6 +323,9 @@ static inline void drv_reset_tsf(struct ieee80211_local *local)
 static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 {
         int ret = 1;
+
+        might_sleep();
+
         if (local->ops->tx_last_beacon)
                 ret = local->ops->tx_last_beacon(&local->hw);
         trace_drv_tx_last_beacon(local, ret);
@@ -239,22 +333,34 @@ static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 }
 
 static inline int drv_ampdu_action(struct ieee80211_local *local,
+                                   struct ieee80211_sub_if_data *sdata,
                                    enum ieee80211_ampdu_mlme_action action,
                                    struct ieee80211_sta *sta, u16 tid,
                                    u16 *ssn)
 {
         int ret = -EOPNOTSUPP;
         if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(&local->hw, action,
+                ret = local->ops->ampdu_action(&local->hw, &sdata->vif, action,
                                                sta, tid, ssn);
-        trace_drv_ampdu_action(local, action, sta, tid, ssn, ret);
+        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, ret);
         return ret;
 }
 
 
 static inline void drv_rfkill_poll(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->rfkill_poll)
                 local->ops->rfkill_poll(&local->hw);
 }
+
+static inline void drv_flush(struct ieee80211_local *local, bool drop)
+{
+        might_sleep();
+
+        trace_drv_flush(local, drop);
+        if (local->ops->flush)
+                local->ops->flush(&local->hw, drop);
+}
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 37b9051afcf3..41baf730a5c7 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -25,10 +25,12 @@ static inline void trace_ ## name(proto) {}
 #define STA_PR_FMT      " sta:%pM"
 #define STA_PR_ARG      __entry->sta_addr
 
-#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, vif)
-#define VIF_ASSIGN      __entry->vif_type = vif ? vif->type : 0; __entry->vif = vif
-#define VIF_PR_FMT      " vif:%p(%d)"
-#define VIF_PR_ARG      __entry->vif, __entry->vif_type
+#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, sdata) \
+                        __string(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
+#define VIF_ASSIGN      __entry->vif_type = sdata->vif.type; __entry->sdata = sdata; \
+                        __assign_str(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
+#define VIF_PR_FMT      " vif:%s(%d)"
+#define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type
 
 TRACE_EVENT(drv_start,
         TP_PROTO(struct ieee80211_local *local, int ret),
@@ -70,11 +72,10 @@ TRACE_EVENT(drv_stop,
 
 TRACE_EVENT(drv_add_interface,
         TP_PROTO(struct ieee80211_local *local,
-                 const u8 *addr,
-                 struct ieee80211_vif *vif,
+                 struct ieee80211_sub_if_data *sdata,
                  int ret),
 
-        TP_ARGS(local, addr, vif, ret),
+        TP_ARGS(local, sdata, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -86,7 +87,7 @@ TRACE_EVENT(drv_add_interface,
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
-                memcpy(__entry->addr, addr, 6);
+                memcpy(__entry->addr, sdata->vif.addr, 6);
                 __entry->ret = ret;
         ),
 
@@ -97,10 +98,9 @@ TRACE_EVENT(drv_add_interface,
 );
 
 TRACE_EVENT(drv_remove_interface,
-        TP_PROTO(struct ieee80211_local *local,
-                 const u8 *addr, struct ieee80211_vif *vif),
+        TP_PROTO(struct ieee80211_local *local, struct ieee80211_sub_if_data *sdata),
 
-        TP_ARGS(local, addr, vif),
+        TP_ARGS(local, sdata),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -111,7 +111,7 @@ TRACE_EVENT(drv_remove_interface,
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
-                memcpy(__entry->addr, addr, 6);
+                memcpy(__entry->addr, sdata->vif.addr, 6);
         ),
 
         TP_printk(
@@ -131,27 +131,47 @@ TRACE_EVENT(drv_config,
                 LOCAL_ENTRY
                 __field(u32, changed)
                 __field(int, ret)
+                __field(u32, flags)
+                __field(int, power_level)
+                __field(int, dynamic_ps_timeout)
+                __field(int, max_sleep_period)
+                __field(u16, listen_interval)
+                __field(u8, long_frame_max_tx_count)
+                __field(u8, short_frame_max_tx_count)
+                __field(int, center_freq)
+                __field(int, channel_type)
+                __field(int, smps)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 __entry->changed = changed;
                 __entry->ret = ret;
+                __entry->flags = local->hw.conf.flags;
+                __entry->power_level = local->hw.conf.power_level;
+                __entry->dynamic_ps_timeout = local->hw.conf.dynamic_ps_timeout;
+                __entry->max_sleep_period = local->hw.conf.max_sleep_period;
+                __entry->listen_interval = local->hw.conf.listen_interval;
+                __entry->long_frame_max_tx_count = local->hw.conf.long_frame_max_tx_count;
+                __entry->short_frame_max_tx_count = local->hw.conf.short_frame_max_tx_count;
+                __entry->center_freq = local->hw.conf.channel->center_freq;
+                __entry->channel_type = local->hw.conf.channel_type;
+                __entry->smps = local->hw.conf.smps_mode;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " ch:%#x ret:%d",
-                LOCAL_PR_ARG, __entry->changed, __entry->ret
+                LOCAL_PR_FMT " ch:%#x freq:%d ret:%d",
+                LOCAL_PR_ARG, __entry->changed, __entry->center_freq, __entry->ret
         )
 );
 
 TRACE_EVENT(drv_bss_info_changed,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_vif *vif,
+                 struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_bss_conf *info,
                  u32 changed),
 
-        TP_ARGS(local, vif, info, changed),
+        TP_ARGS(local, sdata, info, changed),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -167,6 +187,8 @@ TRACE_EVENT(drv_bss_info_changed,
                 __field(u64, timestamp)
                 __field(u32, basic_rates)
                 __field(u32, changed)
+                __field(bool, enable_beacon)
+                __field(u16, ht_operation_mode)
         ),
 
         TP_fast_assign(
@@ -183,6 +205,8 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->assoc_cap = info->assoc_capability;
                 __entry->timestamp = info->timestamp;
                 __entry->basic_rates = info->basic_rates;
+                __entry->enable_beacon = info->enable_beacon;
+                __entry->ht_operation_mode = info->ht_operation_mode;
         ),
 
         TP_printk(
@@ -271,11 +295,11 @@ TRACE_EVENT(drv_set_tim,
 
 TRACE_EVENT(drv_set_key,
         TP_PROTO(struct ieee80211_local *local,
-                 enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                 enum set_key_cmd cmd, struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_sta *sta,
                  struct ieee80211_key_conf *key, int ret),
 
-        TP_ARGS(local, cmd, vif, sta, key, ret),
+        TP_ARGS(local, cmd, sdata, sta, key, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -307,26 +331,29 @@ TRACE_EVENT(drv_set_key,
 
 TRACE_EVENT(drv_update_tkip_key,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_key_conf *conf,
-                 const u8 *address, u32 iv32),
+                 struct ieee80211_sta *sta, u32 iv32),
 
-        TP_ARGS(local, conf, address, iv32),
+        TP_ARGS(local, sdata, conf, sta, iv32),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
-                __array(u8, addr, 6)
+                VIF_ENTRY
+                STA_ENTRY
                 __field(u32, iv32)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
-                memcpy(__entry->addr, address, 6);
+                VIF_ASSIGN;
+                STA_ASSIGN;
                 __entry->iv32 = iv32;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " addr:%pM iv32:%#x",
-                LOCAL_PR_ARG, __entry->addr, __entry->iv32
+                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " iv32:%#x",
+                LOCAL_PR_ARG,VIF_PR_ARG,STA_PR_ARG, __entry->iv32
         )
 );
 
@@ -467,13 +494,36 @@ TRACE_EVENT(drv_set_rts_threshold,
         )
 );
 
+TRACE_EVENT(drv_set_coverage_class,
+        TP_PROTO(struct ieee80211_local *local, u8 value, int ret),
+
+        TP_ARGS(local, value, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u8, value)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+                __entry->value = value;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " value:%d ret:%d",
+                LOCAL_PR_ARG, __entry->value, __entry->ret
+        )
+);
+
 TRACE_EVENT(drv_sta_notify,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_vif *vif,
+                 struct ieee80211_sub_if_data *sdata,
                  enum sta_notify_cmd cmd,
                  struct ieee80211_sta *sta),
 
-        TP_ARGS(local, vif, cmd, sta),
+        TP_ARGS(local, sdata, cmd, sta),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -495,59 +545,88 @@ TRACE_EVENT(drv_sta_notify,
         )
 );
 
-TRACE_EVENT(drv_conf_tx,
-        TP_PROTO(struct ieee80211_local *local, u16 queue,
-                 const struct ieee80211_tx_queue_params *params,
-                 int ret),
+TRACE_EVENT(drv_sta_add,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_sta *sta, int ret),
 
-        TP_ARGS(local, queue, params, ret),
+        TP_ARGS(local, sdata, sta, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
-                __field(u16, queue)
-                __field(u16, txop)
-                __field(u16, cw_min)
-                __field(u16, cw_max)
-                __field(u8, aifs)
+                VIF_ENTRY
+                STA_ENTRY
                 __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
-                __entry->queue = queue;
+                VIF_ASSIGN;
+                STA_ASSIGN;
                 __entry->ret = ret;
-                __entry->txop = params->txop;
-                __entry->cw_max = params->cw_max;
-                __entry->cw_min = params->cw_min;
-                __entry->aifs = params->aifs;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " queue:%d ret:%d",
-                LOCAL_PR_ARG, __entry->queue, __entry->ret
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->ret
         )
 );
 
-TRACE_EVENT(drv_get_tx_stats,
+TRACE_EVENT(drv_sta_remove,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_tx_queue_stats *stats,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_sta *sta),
+
+        TP_ARGS(local, sdata, sta),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_conf_tx,
+        TP_PROTO(struct ieee80211_local *local, u16 queue,
+                 const struct ieee80211_tx_queue_params *params,
                  int ret),
 
-        TP_ARGS(local, stats, ret),
+        TP_ARGS(local, queue, params, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                __field(u16, queue)
+                __field(u16, txop)
+                __field(u16, cw_min)
+                __field(u16, cw_max)
+                __field(u8, aifs)
                 __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                __entry->queue = queue;
                 __entry->ret = ret;
+                __entry->txop = params->txop;
+                __entry->cw_max = params->cw_max;
+                __entry->cw_min = params->cw_min;
+                __entry->aifs = params->aifs;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " ret:%d",
-                LOCAL_PR_ARG, __entry->ret
+                LOCAL_PR_FMT " queue:%d ret:%d",
+                LOCAL_PR_ARG, __entry->queue, __entry->ret
         )
 );
 
@@ -634,11 +713,12 @@ TRACE_EVENT(drv_tx_last_beacon,
 
 TRACE_EVENT(drv_ampdu_action,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  enum ieee80211_ampdu_mlme_action action,
                  struct ieee80211_sta *sta, u16 tid,
                  u16 *ssn, int ret),
 
-        TP_ARGS(local, action, sta, tid, ssn, ret),
+        TP_ARGS(local, sdata, action, sta, tid, ssn, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -647,20 +727,43 @@ TRACE_EVENT(drv_ampdu_action,
                 __field(u16, tid)
                 __field(u16, ssn)
                 __field(int, ret)
+                VIF_ENTRY
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 STA_ASSIGN;
                 __entry->ret = ret;
                 __entry->action = action;
                 __entry->tid = tid;
-                __entry->ssn = *ssn;
+                __entry->ssn = ssn ? *ssn : 0;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_flush,
+        TP_PROTO(struct ieee80211_local *local, bool drop),
+
+        TP_ARGS(local, drop),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(bool, drop)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->drop = drop;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT  STA_PR_FMT " action:%d tid:%d ret:%d",
-                LOCAL_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid, __entry->ret
+                LOCAL_PR_FMT " drop:%d",
+                LOCAL_PR_ARG, __entry->drop
         )
 );
 #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index cdc58e61d921..bb677a73b7c9 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -34,9 +34,28 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
 
         ht_cap->ht_supported = true;
 
-        ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) & sband->ht_cap.cap;
-        ht_cap->cap &= ~IEEE80211_HT_CAP_SM_PS;
-        ht_cap->cap |= sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS;
+        /*
+         * The bits listed in this expression should be
+         * the same for the peer and us, if the station
+         * advertises more then we can't use those thus
+         * we mask them out.
+         */
+        ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) &
+                (sband->ht_cap.cap |
+                 ~(IEEE80211_HT_CAP_LDPC_CODING |
+                   IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                   IEEE80211_HT_CAP_GRN_FLD |
+                   IEEE80211_HT_CAP_SGI_20 |
+                   IEEE80211_HT_CAP_SGI_40 |
+                   IEEE80211_HT_CAP_DSSSCCK40));
+        /*
+         * The STBC bits are asymmetric -- if we don't have
+         * TX then mask out the peer's RX and vice versa.
+         */
+        if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC))
+                ht_cap->cap &= ~IEEE80211_HT_CAP_RX_STBC;
+        if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC))
+                ht_cap->cap &= ~IEEE80211_HT_CAP_TX_STBC;
 
         ampdu_info = ht_cap_ie->ampdu_params_info;
         ht_cap->ampdu_factor =
@@ -106,7 +125,7 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer "
-                                        "for delba frame\n", sdata->dev->name);
+                                        "for delba frame\n", sdata->name);
                 return;
         }
 
@@ -114,10 +133,10 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
@@ -134,7 +153,7 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.delba.params = cpu_to_le16(params);
         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
@@ -166,3 +185,50 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                 spin_unlock_bh(&sta->lock);
         }
 }
+
+int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
+                               enum ieee80211_smps_mode smps, const u8 *da,
+                               const u8 *bssid)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *action_frame;
+
+        /* 27 = header + category + action + smps mode */
+        skb = dev_alloc_skb(27 + local->hw.extra_tx_headroom);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        action_frame = (void *)skb_put(skb, 27);
+        memcpy(action_frame->da, da, ETH_ALEN);
+        memcpy(action_frame->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(action_frame->bssid, bssid, ETH_ALEN);
+        action_frame->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_ACTION);
+        action_frame->u.action.category = WLAN_CATEGORY_HT;
+        action_frame->u.action.u.ht_smps.action = WLAN_HT_ACTION_SMPS;
+        switch (smps) {
+        case IEEE80211_SMPS_AUTOMATIC:
+        case IEEE80211_SMPS_NUM_MODES:
+                WARN_ON(1);
+        case IEEE80211_SMPS_OFF:
+                action_frame->u.action.u.ht_smps.smps_control =
+                                WLAN_HT_SMPS_CONTROL_DISABLED;
+                break;
+        case IEEE80211_SMPS_STATIC:
+                action_frame->u.action.u.ht_smps.smps_control =
+                                WLAN_HT_SMPS_CONTROL_STATIC;
+                break;
+        case IEEE80211_SMPS_DYNAMIC:
+                action_frame->u.action.u.ht_smps.smps_control =
+                                WLAN_HT_SMPS_CONTROL_DYNAMIC;
+                break;
+        }
+
+        /* we'll do more on status of this frame */
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        ieee80211_tx_skb(sdata, skb);
+
+        return 0;
+}
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index f1362f32c17d..e2976da4e0d9 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
@@ -117,7 +118,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_PROBE_RESP);
         memset(mgmt->da, 0xff, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
         mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
         mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
@@ -187,15 +188,17 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_bss *bss)
 {
+        struct cfg80211_bss *cbss =
+                container_of((void *)bss, struct cfg80211_bss, priv);
         struct ieee80211_supported_band *sband;
         u32 basic_rates;
         int i, j;
-        u16 beacon_int = bss->cbss.beacon_interval;
+        u16 beacon_int = cbss->beacon_interval;
 
         if (beacon_int < 10)
                 beacon_int = 10;
 
-        sband = sdata->local->hw.wiphy->bands[bss->cbss.channel->band];
+        sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
 
         basic_rates = 0;
 
@@ -212,12 +215,12 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        __ieee80211_sta_join_ibss(sdata, bss->cbss.bssid,
+        __ieee80211_sta_join_ibss(sdata, cbss->bssid,
                                   beacon_int,
-                                  bss->cbss.channel,
+                                  cbss->channel,
                                   basic_rates,
-                                  bss->cbss.capability,
-                                  bss->cbss.tsf);
+                                  cbss->capability,
+                                  cbss->tsf);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -229,6 +232,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         int freq;
+        struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         struct sta_info *sta;
         struct ieee80211_channel *channel;
@@ -252,7 +256,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, mgmt->sa);
+                sta = sta_info_get(sdata, mgmt->sa);
                 if (sta) {
                         u32 prev_rates;
 
@@ -266,16 +270,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                 printk(KERN_DEBUG "%s: updated supp_rates set "
                                     "for %pM based on beacon info (0x%llx | "
                                     "0x%llx -> 0x%llx)\n",
-                                    sdata->dev->name,
+                                    sdata->name,
                                     sta->sta.addr,
                                     (unsigned long long) prev_rates,
                                     (unsigned long long) supp_rates,
                                     (unsigned long long) sta->sta.supp_rates[band]);
 #endif
-                } else
-                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
-
-                rcu_read_unlock();
+                        rcu_read_unlock();
+                } else {
+                        rcu_read_unlock();
+                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
+                                               supp_rates, GFP_KERNEL);
+                }
         }
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
@@ -283,25 +289,23 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         if (!bss)
                 return;
 
+        cbss = container_of((void *)bss, struct cfg80211_bss, priv);
+
         /* was just updated in ieee80211_bss_info_update */
-        beacon_timestamp = bss->cbss.tsf;
+        beacon_timestamp = cbss->tsf;
 
         /* check if we need to merge IBSS */
 
-        /* merge only on beacons (???) */
-        if (!beacon)
-                goto put_bss;
-
         /* we use a fixed BSSID */
-        if (sdata->u.ibss.bssid)
+        if (sdata->u.ibss.fixed_bssid)
                 goto put_bss;
 
         /* not an IBSS */
-        if (!(bss->cbss.capability & WLAN_CAPABILITY_IBSS))
+        if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
                 goto put_bss;
 
         /* different channel */
-        if (bss->cbss.channel != local->oper_channel)
+        if (cbss->channel != local->oper_channel)
                 goto put_bss;
 
         /* different SSID */
@@ -311,7 +315,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 goto put_bss;
 
         /* same BSSID */
-        if (memcmp(bss->cbss.bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
+        if (memcmp(cbss->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
                 goto put_bss;
 
         if (rx_status->flag & RX_FLAG_TSFT) {
@@ -364,10 +368,11 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: beacon TSF higher than "
                        "local TSF - IBSS merge with BSSID %pM\n",
-                       sdata->dev->name, mgmt->bssid);
+                       sdata->name, mgmt->bssid);
 #endif
                 ieee80211_sta_join_ibss(sdata, bss);
-                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
+                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
+                                       supp_rates, GFP_KERNEL);
         }
 
  put_bss:
@@ -380,8 +385,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
  * must be callable in atomic context.
  */
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid,u8 *addr, u32 supp_rates)
+                                        u8 *bssid,u8 *addr, u32 supp_rates,
+                                        gfp_t gfp)
 {
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int band = local->hw.conf.channel->band;
@@ -393,19 +400,22 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
                 if (net_ratelimit())
                         printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
-                               sdata->dev->name, addr);
+                               sdata->name, addr);
                 return NULL;
         }
 
+        if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
+                return NULL;
+
         if (compare_ether_addr(bssid, sdata->u.ibss.bssid))
                 return NULL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
+               wiphy_name(local->hw.wiphy), addr, sdata->name);
 #endif
 
-        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
+        sta = sta_info_alloc(sdata, addr, gfp);
         if (!sta)
                 return NULL;
 
@@ -417,9 +427,9 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
 
         rate_control_rate_init(sta);
 
+        /* If it fails, maybe we raced another insertion? */
         if (sta_info_insert(sta))
-                return NULL;
-
+                return sta_info_get(sdata, addr);
         return sta;
 }
 
@@ -445,6 +455,9 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
         return active;
 }
 
+/*
+ * This function is called with state == IEEE80211_IBSS_MLME_JOINED
+ */
 
 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 {
@@ -455,6 +468,10 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 
         ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
 
+        if (time_before(jiffies, ifibss->last_scan_completed +
+                       IEEE80211_IBSS_MERGE_INTERVAL))
+                return;
+
         if (ieee80211_sta_active_ibss(sdata))
                 return;
 
@@ -462,7 +479,7 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
                 return;
 
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
-               "IBSS networks with same SSID (merge)\n", sdata->dev->name);
+               "IBSS networks with same SSID (merge)\n", sdata->name);
 
         ieee80211_request_internal_scan(sdata, ifibss->ssid, ifibss->ssid_len);
 }
@@ -484,13 +501,13 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                  * random number generator get different BSSID. */
                 get_random_bytes(bssid, ETH_ALEN);
                 for (i = 0; i < ETH_ALEN; i++)
-                        bssid[i] ^= sdata->dev->dev_addr[i];
+                        bssid[i] ^= sdata->vif.addr[i];
                 bssid[0] &= ~0x01;
                 bssid[0] |= 0x02;
         }
 
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
-               sdata->dev->name, bssid);
+               sdata->name, bssid);
 
         sband = local->hw.wiphy->bands[ifibss->channel->band];
 
@@ -506,11 +523,15 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                                   capability, 0);
 }
 
+/*
+ * This function is called with state == IEEE80211_IBSS_MLME_SEARCH
+ */
+
 static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
+        struct cfg80211_bss *cbss;
         struct ieee80211_channel *chan = NULL;
         const u8 *bssid = NULL;
         int active_ibss;
@@ -519,7 +540,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         active_ibss = ieee80211_sta_active_ibss(sdata);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
-               sdata->dev->name, active_ibss);
+               sdata->name, active_ibss);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         if (active_ibss)
@@ -534,21 +555,23 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 chan = ifibss->channel;
         if (!is_zero_ether_addr(ifibss->bssid))
                 bssid = ifibss->bssid;
-        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan, bssid,
-                                       ifibss->ssid, ifibss->ssid_len,
-                                       WLAN_CAPABILITY_IBSS |
-                                       WLAN_CAPABILITY_PRIVACY,
-                                       capability);
+        cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
+                                ifibss->ssid, ifibss->ssid_len,
+                                WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_PRIVACY,
+                                capability);
+
+        if (cbss) {
+                struct ieee80211_bss *bss;
 
-        if (bss) {
+                bss = (void *)cbss->priv;
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
-                       "%pM\n", bss->cbss.bssid, ifibss->bssid);
+                       "%pM\n", cbss->bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
-                       sdata->dev->name, bss->cbss.bssid);
+                       sdata->name, cbss->bssid);
 
                 ieee80211_sta_join_ibss(sdata, bss);
                 ieee80211_rx_bss_put(local, bss);
@@ -560,18 +583,14 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         /* Selected IBSS not found in current scan results - try to scan */
-        if (ifibss->state == IEEE80211_IBSS_MLME_JOINED &&
-            !ieee80211_sta_active_ibss(sdata)) {
-                mod_timer(&ifibss->timer,
-                          round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
-        } else if (time_after(jiffies, ifibss->last_scan_completed +
+        if (time_after(jiffies, ifibss->last_scan_completed +
                                         IEEE80211_SCAN_INTERVAL)) {
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
-                       "join\n", sdata->dev->name);
+                       "join\n", sdata->name);
 
                 ieee80211_request_internal_scan(sdata, ifibss->ssid,
                                                 ifibss->ssid_len);
-        } else if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) {
+        } else {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
                 if (time_after(jiffies, ifibss->ibss_join_req +
@@ -581,7 +600,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                 return;
                         }
                         printk(KERN_DEBUG "%s: IBSS not allowed on"
-                               " %d MHz\n", sdata->dev->name,
+                               " %d MHz\n", sdata->name,
                                local->hw.conf.channel->center_freq);
 
                         /* No IBSS found - decrease scan interval and continue
@@ -589,7 +608,6 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
                 }
 
-                ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
                 mod_timer(&ifibss->timer,
                           round_jiffies(jiffies + interval));
         }
@@ -615,7 +633,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
                " (tx_last_beacon=%d)\n",
-               sdata->dev->name, mgmt->sa, mgmt->da,
+               sdata->name, mgmt->sa, mgmt->da,
                mgmt->bssid, tx_last_beacon);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
@@ -633,13 +651,13 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
                        "from %pM\n",
-                       sdata->dev->name, mgmt->sa);
+                       sdata->name, mgmt->sa);
 #endif
                 return;
         }
         if (pos[1] != 0 &&
             (pos[1] != ifibss->ssid_len ||
-             !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
+             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
                 /* Ignore ProbeReq for foreign SSID */
                 return;
         }
@@ -653,9 +671,10 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
-               sdata->dev->name, resp->da);
+               sdata->name, resp->da);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        ieee80211_tx_skb(sdata, skb, 0);
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
 }
 
 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
@@ -666,7 +685,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         size_t baselen;
         struct ieee802_11_elems elems;
 
-        if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+        if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -739,7 +758,7 @@ static void ieee80211_ibss_work(struct work_struct *work)
         if (WARN_ON(local->suspended))
                 return;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (local->scanning)
@@ -822,7 +841,7 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         continue;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 10d316e455de..241533e1bc03 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2,7 +2,7 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
- * Copyright 2007-2008  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2007-2010  Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -23,6 +23,7 @@
 #include <linux/types.h>
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
+#include <net/ieee80211_radiotap.h>
 #include <net/cfg80211.h>
 #include <net/mac80211.h>
 #include "key.h"
@@ -57,6 +58,15 @@ struct ieee80211_local;
 
 #define TU_TO_EXP_TIME(x)       (jiffies + usecs_to_jiffies((x) * 1024))
 
+#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+        (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |   \
+         IEEE80211_WMM_IE_STA_QOSINFO_AC_BE |   \
+         IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |   \
+         IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
+
+#define IEEE80211_DEFAULT_MAX_SP_LEN            \
+        IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+
 struct ieee80211_fragment_entry {
         unsigned long first_frag_time;
         unsigned int seq;
@@ -70,9 +80,6 @@ struct ieee80211_fragment_entry {
 
 
 struct ieee80211_bss {
-        /* Yes, this is a hack */
-        struct cfg80211_bss cbss;
-
         /* don't want to look up all the time */
         size_t ssid_len;
         u8 ssid[IEEE80211_MAX_SSID_LEN];
@@ -80,6 +87,7 @@ struct ieee80211_bss {
         u8 dtim_period;
 
         bool wmm_used;
+        bool uapsd_supported;
 
         unsigned long last_probe_resp;
 
@@ -139,7 +147,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
-        struct net_device *dev;
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
@@ -162,21 +169,17 @@ typedef unsigned __bitwise__ ieee80211_rx_result;
 /* frame is destined to interface currently processed (incl. multicast frames) */
 #define IEEE80211_RX_RA_MATCH           BIT(1)
 #define IEEE80211_RX_AMSDU              BIT(2)
-#define IEEE80211_RX_CMNTR_REPORTED     BIT(3)
-#define IEEE80211_RX_FRAGMENTED         BIT(4)
+#define IEEE80211_RX_FRAGMENTED         BIT(3)
+/* only add flags here that do not change with subframes of an aMPDU */
 
 struct ieee80211_rx_data {
         struct sk_buff *skb;
-        struct net_device *dev;
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         struct ieee80211_key *key;
-        struct ieee80211_rx_status *status;
-        struct ieee80211_rate *rate;
 
         unsigned int flags;
-        int sent_ps_buffered;
         int queue;
         u32 tkip_iv32;
         u16 tkip_iv16;
@@ -209,6 +212,9 @@ struct ieee80211_if_wds {
 
 struct ieee80211_if_vlan {
         struct list_head list;
+
+        /* used for all tx if the VLAN is configured to 4-addr mode */
+        struct sta_info *sta;
 };
 
 struct mesh_stats {
@@ -228,31 +234,77 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-enum ieee80211_mgd_state {
-        IEEE80211_MGD_STATE_IDLE,
-        IEEE80211_MGD_STATE_PROBE,
-        IEEE80211_MGD_STATE_AUTH,
-        IEEE80211_MGD_STATE_ASSOC,
+enum ieee80211_work_type {
+        IEEE80211_WORK_ABORT,
+        IEEE80211_WORK_DIRECT_PROBE,
+        IEEE80211_WORK_AUTH,
+        IEEE80211_WORK_ASSOC,
+        IEEE80211_WORK_REMAIN_ON_CHANNEL,
 };
 
-struct ieee80211_mgd_work {
+/**
+ * enum work_done_result - indicates what to do after work was done
+ *
+ * @WORK_DONE_DESTROY: This work item is no longer needed, destroy.
+ * @WORK_DONE_REQUEUE: This work item was reset to be reused, and
+ *      should be requeued.
+ */
+enum work_done_result {
+        WORK_DONE_DESTROY,
+        WORK_DONE_REQUEUE,
+};
+
+struct ieee80211_work {
         struct list_head list;
-        struct ieee80211_bss *bss;
-        int ie_len;
-        u8 prev_bssid[ETH_ALEN];
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        u8 ssid_len;
+
+        struct rcu_head rcu_head;
+
+        struct ieee80211_sub_if_data *sdata;
+
+        enum work_done_result (*done)(struct ieee80211_work *wk,
+                                      struct sk_buff *skb);
+
+        struct ieee80211_channel *chan;
+        enum nl80211_channel_type chan_type;
+
         unsigned long timeout;
-        enum ieee80211_mgd_state state;
-        u16 auth_alg, auth_transaction;
+        enum ieee80211_work_type type;
 
-        int tries;
+        u8 filter_ta[ETH_ALEN];
 
-        u8 key[WLAN_KEY_LEN_WEP104];
-        u8 key_len, key_idx;
+        bool started;
+
+        union {
+                struct {
+                        int tries;
+                        u16 algorithm, transaction;
+                        u8 ssid[IEEE80211_MAX_SSID_LEN];
+                        u8 ssid_len;
+                        u8 key[WLAN_KEY_LEN_WEP104];
+                        u8 key_len, key_idx;
+                        bool privacy;
+                } probe_auth;
+                struct {
+                        struct cfg80211_bss *bss;
+                        const u8 *supp_rates;
+                        const u8 *ht_information_ie;
+                        enum ieee80211_smps_mode smps;
+                        int tries;
+                        u16 capability;
+                        u8 prev_bssid[ETH_ALEN];
+                        u8 ssid[IEEE80211_MAX_SSID_LEN];
+                        u8 ssid_len;
+                        u8 supp_rates_len;
+                        bool wmm_used, use_11n, uapsd_used;
+                } assoc;
+                struct {
+                        u32 duration;
+                } remain;
+        };
 
+        int ie_len;
         /* must be last */
-        u8 ie[0]; /* for auth or assoc frame, not probe */
+        u8 ie[0];
 };
 
 /* flags used in struct ieee80211_if_managed.flags */
@@ -260,15 +312,11 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_BEACON_POLL       = BIT(0),
         IEEE80211_STA_CONNECTION_POLL   = BIT(1),
         IEEE80211_STA_CONTROL_PORT      = BIT(2),
-        IEEE80211_STA_WMM_ENABLED       = BIT(3),
         IEEE80211_STA_DISABLE_11N       = BIT(4),
         IEEE80211_STA_CSA_RECEIVED      = BIT(5),
         IEEE80211_STA_MFP_ENABLED       = BIT(6),
-};
-
-/* flags for MLME request */
-enum ieee80211_sta_request {
-        IEEE80211_STA_REQ_SCAN,
+        IEEE80211_STA_UAPSD_ENABLED     = BIT(7),
+        IEEE80211_STA_NULLFUNC_ACKED    = BIT(8),
 };
 
 struct ieee80211_if_managed {
@@ -285,21 +333,18 @@ struct ieee80211_if_managed {
         int probe_send_count;
 
         struct mutex mtx;
-        struct ieee80211_bss *associated;
-        struct ieee80211_mgd_work *old_associate_work;
-        struct list_head work_list;
+        struct cfg80211_bss *associated;
 
         u8 bssid[ETH_ALEN];
 
         u16 aid;
-        u16 capab;
 
         struct sk_buff_head skb_queue;
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
-
-        unsigned long request;
+        enum ieee80211_smps_mode req_smps, /* requested smps mode */
+                                 ap_smps; /* smps mode AP thinks we're in */
 
         unsigned int flags;
 
@@ -312,6 +357,8 @@ struct ieee80211_if_managed {
         } mfp; /* management frame protection */
 
         int wmm_last_param_set;
+
+        u8 use_4addr;
 };
 
 enum ieee80211_ibss_request {
@@ -353,6 +400,7 @@ struct ieee80211_if_mesh {
         struct work_struct work;
         struct timer_list housekeeping_timer;
         struct timer_list mesh_path_timer;
+        struct timer_list mesh_path_root_timer;
         struct sk_buff_head skb_queue;
 
         unsigned long timers_running;
@@ -362,23 +410,23 @@ struct ieee80211_if_mesh {
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
         size_t mesh_id_len;
         /* Active Path Selection Protocol Identifier */
-        u8 mesh_pp_id[4];
+        u8 mesh_pp_id;
         /* Active Path Selection Metric Identifier */
-        u8 mesh_pm_id[4];
+        u8 mesh_pm_id;
         /* Congestion Control Mode Identifier */
-        u8 mesh_cc_id[4];
+        u8 mesh_cc_id;
         /* Synchronization Protocol Identifier */
-        u8 mesh_sp_id[4];
+        u8 mesh_sp_id;
         /* Authentication Protocol Identifier */
-        u8 mesh_auth_id[4];
-        /* Local mesh Destination Sequence Number */
-        u32 dsn;
+        u8 mesh_auth_id;
+        /* Local mesh Sequence Number */
+        u32 sn;
         /* Last used PREQ ID */
         u32 preq_id;
         atomic_t mpaths;
-        /* Timestamp of last DSN update */
-        unsigned long last_dsn_update;
-        /* Timestamp of last DSN sent */
+        /* Timestamp of last SN update */
+        unsigned long last_sn_update;
+        /* Timestamp of last SN sent */
         unsigned long last_preq;
         struct mesh_rmc *rmc;
         spinlock_t mesh_preq_queue_lock;
@@ -430,6 +478,8 @@ struct ieee80211_sub_if_data {
 
         int drop_unencrypted;
 
+        char name[IFNAMSIZ];
+
         /*
          * keep track of whether the HT opmode (stored in
          * vif.bss_info.ht_operation_mode) is valid.
@@ -455,8 +505,8 @@ struct ieee80211_sub_if_data {
          */
         struct ieee80211_if_ap *bss;
 
-        int force_unicast_rateidx; /* forced TX rateidx for unicast frames */
-        int max_ratectrl_rateidx; /* max TX rateidx for rate control */
+        /* bitmap of allowed (non-MCS) rate indexes for rate control */
+        u32 rc_rateidx_mask[IEEE80211_NUM_BANDS];
 
         union {
                 struct ieee80211_if_ap ap;
@@ -471,74 +521,11 @@ struct ieee80211_sub_if_data {
         } u;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
-        struct dentry *debugfsdir;
-        union {
-                struct {
-                        struct dentry *drop_unencrypted;
-                        struct dentry *bssid;
-                        struct dentry *aid;
-                        struct dentry *capab;
-                        struct dentry *force_unicast_rateidx;
-                        struct dentry *max_ratectrl_rateidx;
-                } sta;
-                struct {
-                        struct dentry *drop_unencrypted;
-                        struct dentry *num_sta_ps;
-                        struct dentry *dtim_count;
-                        struct dentry *force_unicast_rateidx;
-                        struct dentry *max_ratectrl_rateidx;
-                        struct dentry *num_buffered_multicast;
-                } ap;
-                struct {
-                        struct dentry *drop_unencrypted;
-                        struct dentry *peer;
-                        struct dentry *force_unicast_rateidx;
-                        struct dentry *max_ratectrl_rateidx;
-                } wds;
-                struct {
-                        struct dentry *drop_unencrypted;
-                        struct dentry *force_unicast_rateidx;
-                        struct dentry *max_ratectrl_rateidx;
-                } vlan;
-                struct {
-                        struct dentry *mode;
-                } monitor;
-        } debugfs;
         struct {
+                struct dentry *dir;
                 struct dentry *default_key;
                 struct dentry *default_mgmt_key;
-        } common_debugfs;
-
-#ifdef CONFIG_MAC80211_MESH
-        struct dentry *mesh_stats_dir;
-        struct {
-                struct dentry *fwded_mcast;
-                struct dentry *fwded_unicast;
-                struct dentry *fwded_frames;
-                struct dentry *dropped_frames_ttl;
-                struct dentry *dropped_frames_no_route;
-                struct dentry *estab_plinks;
-                struct timer_list mesh_path_timer;
-        } mesh_stats;
-
-        struct dentry *mesh_config_dir;
-        struct {
-                struct dentry *dot11MeshRetryTimeout;
-                struct dentry *dot11MeshConfirmTimeout;
-                struct dentry *dot11MeshHoldingTimeout;
-                struct dentry *dot11MeshMaxRetries;
-                struct dentry *dot11MeshTTL;
-                struct dentry *auto_open_plinks;
-                struct dentry *dot11MeshMaxPeerLinks;
-                struct dentry *dot11MeshHWMPactivePathTimeout;
-                struct dentry *dot11MeshHWMPpreqMinInterval;
-                struct dentry *dot11MeshHWMPnetDiameterTraversalTime;
-                struct dentry *dot11MeshHWMPmaxPREQretries;
-                struct dentry *path_refresh_time;
-                struct dentry *min_discovery_timeout;
-        } mesh_config;
-#endif
-
+        } debugfs;
 #endif
         /* must be last, dynamically sized area in this! */
         struct ieee80211_vif vif;
@@ -625,6 +612,15 @@ struct ieee80211_local {
         const struct ieee80211_ops *ops;
 
         /*
+         * work stuff, potentially off-channel (in the future)
+         */
+        struct mutex work_mtx;
+        struct list_head work_list;
+        struct timer_list work_timer;
+        struct work_struct work_work;
+        struct sk_buff_head work_skb_queue;
+
+        /*
          * private workqueue to mac80211. mac80211 makes this accessible
          * via ieee80211_queue_work()
          */
@@ -639,7 +635,6 @@ struct ieee80211_local {
         /* number of interfaces with corresponding FIF_ flags */
         int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
         unsigned int filter_flags; /* FIF_* */
-        struct iw_statistics wstats;
 
         /* protects the aggregated multicast list and filter calls */
         spinlock_t filter_lock;
@@ -647,6 +642,9 @@ struct ieee80211_local {
         /* used for uploading changed mc list */
         struct work_struct reconfig_filter;
 
+        /* used to reconfigure hardware SM PS */
+        struct work_struct recalc_smps;
+
         /* aggregated multicast list */
         struct dev_addr_list *mc_list;
         int mc_count;
@@ -691,15 +689,18 @@ struct ieee80211_local {
 
         /* Station data */
         /*
-         * The lock only protects the list, hash, timer and counter
-         * against manipulation, reads are done in RCU. Additionally,
-         * the lock protects each BSS's TIM bitmap.
+         * The mutex only protects the list and counter,
+         * reads are done in RCU.
+         * Additionally, the lock protects the hash table,
+         * the pending list and each BSS's TIM bitmap.
          */
+        struct mutex sta_mtx;
         spinlock_t sta_lock;
         unsigned long num_sta;
-        struct list_head sta_list;
+        struct list_head sta_list, sta_pending_list;
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
+        struct work_struct sta_finish_work;
         int sta_generation;
 
         struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
@@ -738,10 +739,9 @@ struct ieee80211_local {
         unsigned long scanning;
         struct cfg80211_ssid scan_ssid;
         struct cfg80211_scan_request *int_scan_req;
-        struct cfg80211_scan_request *scan_req;
+        struct cfg80211_scan_request *scan_req, *hw_scan_req;
         struct ieee80211_channel *scan_channel;
-        const u8 *orig_ies;
-        int orig_ies_len;
+        enum ieee80211_band hw_scan_band;
         int scan_channel_idx;
         int scan_ies_len;
 
@@ -751,6 +751,10 @@ struct ieee80211_local {
         enum nl80211_channel_type oper_channel_type;
         struct ieee80211_channel *oper_channel, *csa_channel;
 
+        /* Temporary remain-on-channel for off-channel operations */
+        struct ieee80211_channel *tmp_channel;
+        enum nl80211_channel_type tmp_channel_type;
+
         /* SNMP counters */
         /* dot11CountersTable */
         u32 dot11TransmittedFragmentCount;
@@ -770,10 +774,6 @@ struct ieee80211_local {
              assoc_led_name[32], radio_led_name[32];
 #endif
 
-#ifdef CONFIG_MAC80211_DEBUGFS
-        struct work_struct sta_debugfs_add;
-#endif
-
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         /* TX/RX handler statistics */
         unsigned int tx_handlers_drop;
@@ -807,7 +807,22 @@ struct ieee80211_local {
         int wifi_wme_noack_test;
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
+        /*
+         * Bitmask of enabled u-apsd queues,
+         * IEEE80211_WMM_IE_STA_QOSINFO_AC_BE & co. Needs a new association
+         * to take effect.
+         */
+        unsigned int uapsd_queues;
+
+        /*
+         * Maximum number of buffered frames AP can deliver during a
+         * service period, IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL or similar.
+         * Needs a new association to take effect.
+         */
+        unsigned int uapsd_max_sp_len;
+
         bool pspolling;
+        bool offchannel_ps_enabled;
         /*
          * PS can only be enabled when we have exactly one managed
          * interface (and monitors) in PS, this then points there.
@@ -821,58 +836,13 @@ struct ieee80211_local {
         int user_power_level; /* in dBm */
         int power_constr_level; /* in dBm */
 
+        enum ieee80211_smps_mode smps_mode;
+
         struct work_struct restart_work;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
                 struct dentry *rcdir;
-                struct dentry *rcname;
-                struct dentry *frequency;
-                struct dentry *total_ps_buffered;
-                struct dentry *wep_iv;
-                struct dentry *tsf;
-                struct dentry *queues;
-                struct dentry *reset;
-                struct dentry *noack;
-                struct dentry *statistics;
-                struct local_debugfsdentries_statsdentries {
-                        struct dentry *transmitted_fragment_count;
-                        struct dentry *multicast_transmitted_frame_count;
-                        struct dentry *failed_count;
-                        struct dentry *retry_count;
-                        struct dentry *multiple_retry_count;
-                        struct dentry *frame_duplicate_count;
-                        struct dentry *received_fragment_count;
-                        struct dentry *multicast_received_frame_count;
-                        struct dentry *transmitted_frame_count;
-                        struct dentry *wep_undecryptable_count;
-                        struct dentry *num_scans;
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-                        struct dentry *tx_handlers_drop;
-                        struct dentry *tx_handlers_queued;
-                        struct dentry *tx_handlers_drop_unencrypted;
-                        struct dentry *tx_handlers_drop_fragment;
-                        struct dentry *tx_handlers_drop_wep;
-                        struct dentry *tx_handlers_drop_not_assoc;
-                        struct dentry *tx_handlers_drop_unauth_port;
-                        struct dentry *rx_handlers_drop;
-                        struct dentry *rx_handlers_queued;
-                        struct dentry *rx_handlers_drop_nullfunc;
-                        struct dentry *rx_handlers_drop_defrag;
-                        struct dentry *rx_handlers_drop_short;
-                        struct dentry *rx_handlers_drop_passive_scan;
-                        struct dentry *tx_expand_skb_head;
-                        struct dentry *tx_expand_skb_head_cloned;
-                        struct dentry *rx_expand_skb_head;
-                        struct dentry *rx_expand_skb_head2;
-                        struct dentry *rx_handlers_fragments;
-                        struct dentry *tx_status_drop;
-#endif
-                        struct dentry *dot11ACKFailureCount;
-                        struct dentry *dot11RTSFailureCount;
-                        struct dentry *dot11FCSErrorCount;
-                        struct dentry *dot11RTSSuccessCount;
-                } stats;
                 struct dentry *stations;
                 struct dentry *keys;
         } debugfs;
@@ -885,8 +855,9 @@ IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
         return netdev_priv(dev);
 }
 
-/* this struct represents 802.11n's RA/TID combination */
+/* this struct represents 802.11n's RA/TID combination along with our vif */
 struct ieee80211_ra_tid {
+        struct ieee80211_vif *vif;
         u8 ra[ETH_ALEN];
         u16 tid;
 };
@@ -913,12 +884,13 @@ struct ieee802_11_elems {
         u8 *wmm_param;
         struct ieee80211_ht_cap *ht_cap_elem;
         struct ieee80211_ht_info *ht_info_elem;
-        u8 *mesh_config;
+        struct ieee80211_meshconf_ie *mesh_config;
         u8 *mesh_id;
         u8 *peer_link;
         u8 *preq;
         u8 *prep;
         u8 *perr;
+        struct ieee80211_rann_ie *rann;
         u8 *ch_switch_elem;
         u8 *country_elem;
         u8 *pwr_constr_elem;
@@ -940,7 +912,6 @@ struct ieee802_11_elems {
         u8 ext_supp_rates_len;
         u8 wmm_info_len;
         u8 wmm_param_len;
-        u8 mesh_config_len;
         u8 mesh_id_len;
         u8 peer_link_len;
         u8 preq_len;
@@ -981,6 +952,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 void ieee80211_configure_filter(struct ieee80211_local *local);
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 
+extern bool ieee80211_disable_40mhz_24ghz;
+
 /* STA code */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
@@ -993,6 +966,10 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_disassoc_request *req,
                            void *cookie);
+int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_channel_type channel_type,
+                         const u8 *buf, size_t len, u64 *cookie);
 ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
                                           struct sk_buff *skb);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
@@ -1012,7 +989,8 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
 ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid, u8 *addr, u32 supp_rates);
+                                        u8 *bssid, u8 *addr, u32 supp_rates,
+                                        gfp_t gfp);
 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_ibss_params *params);
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
@@ -1044,7 +1022,15 @@ ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
 
+/* off-channel helpers */
+void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local);
+void ieee80211_offchannel_stop_station(struct ieee80211_local *local);
+void ieee80211_offchannel_return(struct ieee80211_local *local,
+                                 bool enable_beaconing);
+
 /* interface handling */
+int ieee80211_iface_init(void);
+void ieee80211_iface_exit(void);
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct net_device **new_dev, enum nl80211_iftype type,
                      struct vif_params *params);
@@ -1055,6 +1041,11 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local);
 u32 __ieee80211_recalc_idle(struct ieee80211_local *local);
 void ieee80211_recalc_idle(struct ieee80211_local *local);
 
+static inline bool ieee80211_sdata_running(struct ieee80211_sub_if_data *sdata)
+{
+        return netif_running(sdata->dev);
+}
+
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
@@ -1063,6 +1054,18 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev);
 
+/*
+ * radiotap header for status frames
+ */
+struct ieee80211_tx_status_rtap_hdr {
+        struct ieee80211_radiotap_header hdr;
+        u8 rate;
+        u8 padding_for_rate;
+        __le16 tx_flags;
+        u8 data_retries;
+} __attribute__ ((packed));
+
+
 /* HT */
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
@@ -1071,6 +1074,9 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           const u8 *da, u16 tid,
                           u16 initiator, u16 reason_code);
+int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
+                               enum ieee80211_smps_mode smps, const u8 *da,
+                               const u8 *bssid);
 
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
                                 u16 tid, u16 initiator, u16 reason);
@@ -1132,8 +1138,7 @@ void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int ke
                                      struct ieee80211_hdr *hdr, const u8 *tsc,
                                      gfp_t gfp);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
-void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                      int encrypt);
+void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems);
 u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
@@ -1170,7 +1175,8 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u8 *extra, size_t extra_len, const u8 *bssid,
                          const u8 *key, u8 key_len, u8 key_idx);
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             const u8 *ie, size_t ie_len);
+                             const u8 *ie, size_t ie_len,
+                             enum ieee80211_band band);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len);
@@ -1181,6 +1187,28 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band);
+int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
+                             enum ieee80211_smps_mode smps_mode);
+void ieee80211_recalc_smps(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *forsdata);
+
+size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
+                          const u8 *ids, int n_ids, size_t offset);
+size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
+
+/* internal work items */
+void ieee80211_work_init(struct ieee80211_local *local);
+void ieee80211_add_work(struct ieee80211_work *wk);
+void free_work(struct ieee80211_work *wk);
+void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata);
+ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                           struct sk_buff *skb);
+int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_channel *chan,
+                                   enum nl80211_channel_type channel_type,
+                                   unsigned int duration, u64 *cookie);
+int ieee80211_wk_cancel_remain_on_channel(
+        struct ieee80211_sub_if_data *sdata, u64 cookie);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b8295cbd7e8f..e08fa8eda1b3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -10,17 +10,20 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/if_arp.h>
 #include <linux/netdevice.h>
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
+#include <net/ieee80211_radiotap.h>
 #include "ieee80211_i.h"
 #include "sta_info.h"
 #include "debugfs_netdev.h"
 #include "mesh.h"
 #include "led.h"
 #include "driver-ops.h"
+#include "wme.h"
 
 /**
  * DOC: Interface list locking
@@ -60,6 +63,23 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
+static int ieee80211_change_mac(struct net_device *dev, void *addr)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct sockaddr *sa = addr;
+        int ret;
+
+        if (ieee80211_sdata_running(sdata))
+                return -EBUSY;
+
+        ret = eth_mac_addr(dev, sa);
+
+        if (ret == 0)
+                memcpy(sdata->vif.addr, sa->sa_data, ETH_ALEN);
+
+        return ret;
+}
+
 static inline int identical_mac_addr_allowed(int type1, int type2)
 {
         return type1 == NL80211_IFTYPE_MONITOR ||
@@ -80,7 +100,6 @@ static int ieee80211_open(struct net_device *dev)
         struct ieee80211_sub_if_data *nsdata;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        struct ieee80211_if_init_conf conf;
         u32 changed = 0;
         int res;
         u32 hw_reconf_flags = 0;
@@ -95,7 +114,7 @@ static int ieee80211_open(struct net_device *dev)
         list_for_each_entry(nsdata, &local->interfaces, list) {
                 struct net_device *ndev = nsdata->dev;
 
-                if (ndev != dev && netif_running(ndev)) {
+                if (ndev != dev && ieee80211_sdata_running(nsdata)) {
                         /*
                          * Allow only a single IBSS interface to be up at any
                          * time. This is restricted because beacon distribution
@@ -181,13 +200,15 @@ static int ieee80211_open(struct net_device *dev)
                 struct net_device *ndev = nsdata->dev;
 
                 /*
-                 * No need to check netif_running since we do not allow
+                 * No need to check running since we do not allow
                  * it to start up with this invalid address.
                  */
-                if (compare_ether_addr(null_addr, ndev->dev_addr) == 0)
+                if (compare_ether_addr(null_addr, ndev->dev_addr) == 0) {
                         memcpy(ndev->dev_addr,
                                local->hw.wiphy->perm_addr,
                                ETH_ALEN);
+                        memcpy(ndev->perm_addr, ndev->dev_addr, ETH_ALEN);
+                }
         }
 
         /*
@@ -212,8 +233,8 @@ static int ieee80211_open(struct net_device *dev)
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
                 if (local->monitors == 1) {
-                        local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
-                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_RADIOTAP;
+                        local->hw.conf.flags |= IEEE80211_CONF_MONITOR;
+                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
                 }
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
@@ -230,10 +251,7 @@ static int ieee80211_open(struct net_device *dev)
                 ieee80211_configure_filter(local);
                 break;
         default:
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = dev->dev_addr;
-                res = drv_add_interface(local, &conf);
+                res = drv_add_interface(local, &sdata->vif);
                 if (res)
                         goto err_stop;
 
@@ -316,7 +334,7 @@ static int ieee80211_open(struct net_device *dev)
 
         return 0;
  err_del_interface:
-        drv_remove_interface(local, &conf);
+        drv_remove_interface(local, &sdata->vif);
  err_stop:
         if (!local->open_count)
                 drv_stop(local);
@@ -331,7 +349,6 @@ static int ieee80211_stop(struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
         unsigned long flags;
         struct sk_buff *skb, *tmp;
@@ -344,6 +361,11 @@ static int ieee80211_stop(struct net_device *dev)
         netif_tx_stop_all_queues(dev);
 
         /*
+         * Purge work for this interface.
+         */
+        ieee80211_work_purge(sdata);
+
+        /*
          * Now delete all active aggregation sessions.
          */
         rcu_read_lock();
@@ -433,8 +455,8 @@ static int ieee80211_stop(struct net_device *dev)
 
                 local->monitors--;
                 if (local->monitors == 0) {
-                        local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
-                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_RADIOTAP;
+                        local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
+                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
                 }
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
@@ -510,12 +532,9 @@ static int ieee80211_stop(struct net_device *dev)
                                 BSS_CHANGED_BEACON_ENABLED);
                 }
 
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = dev->dev_addr;
                 /* disable all keys for as long as this netdev is down */
                 ieee80211_disable_keys(sdata);
-                drv_remove_interface(local, &conf);
+                drv_remove_interface(local, &sdata->vif);
         }
 
         sdata->bss = NULL;
@@ -642,6 +661,12 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
         WARN_ON(flushed);
 }
 
+static u16 ieee80211_netdev_select_queue(struct net_device *dev,
+                                         struct sk_buff *skb)
+{
+        return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
+}
+
 static const struct net_device_ops ieee80211_dataif_ops = {
         .ndo_open               = ieee80211_open,
         .ndo_stop               = ieee80211_stop,
@@ -649,9 +674,43 @@ static const struct net_device_ops ieee80211_dataif_ops = {
         .ndo_start_xmit         = ieee80211_subif_start_xmit,
         .ndo_set_multicast_list = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = ieee80211_change_mac,
+        .ndo_select_queue       = ieee80211_netdev_select_queue,
 };
 
+static u16 ieee80211_monitor_select_queue(struct net_device *dev,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_radiotap_header *rtap = (void *)skb->data;
+        u8 *p;
+
+        if (local->hw.queues < 4)
+                return 0;
+
+        if (skb->len < 4 ||
+            skb->len < le16_to_cpu(rtap->it_len) + 2 /* frame control */)
+                return 0; /* doesn't matter, frame will be dropped */
+
+        hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
+
+        if (!ieee80211_is_data(hdr->frame_control)) {
+                skb->priority = 7;
+                return ieee802_1d_to_ac[skb->priority];
+        }
+        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+                skb->priority = 0;
+                return ieee802_1d_to_ac[skb->priority];
+        }
+
+        p = ieee80211_get_qos_ctl(hdr);
+        skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
+
+        return ieee80211_downgrade_queue(local, skb);
+}
+
 static const struct net_device_ops ieee80211_monitorif_ops = {
         .ndo_open               = ieee80211_open,
         .ndo_stop               = ieee80211_stop,
@@ -660,6 +719,7 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
         .ndo_set_multicast_list = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
         .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_select_queue       = ieee80211_monitor_select_queue,
 };
 
 static void ieee80211_if_setup(struct net_device *dev)
@@ -738,7 +798,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
          * and goes into the requested mode.
          */
 
-        if (netif_running(sdata->dev))
+        if (ieee80211_sdata_running(sdata))
                 return -EBUSY;
 
         /* Purge and reset type-dependent state. */
@@ -750,14 +810,12 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                 ieee80211_mandatory_rates(sdata->local,
                         sdata->local->hw.conf.channel->band);
         sdata->drop_unencrypted = 0;
+        if (type == NL80211_IFTYPE_STATION)
+                sdata->u.mgd.use_4addr = false;
 
         return 0;
 }
 
-static struct device_type wiphy_type = {
-        .name   = "wlan",
-};
-
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct net_device **new_dev, enum nl80211_iftype type,
                      struct vif_params *params)
@@ -768,8 +826,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         ASSERT_RTNL();
 
-        ndev = alloc_netdev(sizeof(*sdata) + local->hw.vif_data_size,
-                            name, ieee80211_if_setup);
+        ndev = alloc_netdev_mq(sizeof(*sdata) + local->hw.vif_data_size,
+                               name, ieee80211_if_setup, local->hw.queues);
         if (!ndev)
                 return -ENOMEM;
         dev_net_set(ndev, wiphy_net(local->hw.wiphy));
@@ -788,12 +846,14 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 goto fail;
 
         memcpy(ndev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
+        memcpy(ndev->perm_addr, ndev->dev_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
-        SET_NETDEV_DEVTYPE(ndev, &wiphy_type);
 
         /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
         sdata = netdev_priv(ndev);
         ndev->ieee80211_ptr = &sdata->wdev;
+        memcpy(sdata->vif.addr, ndev->dev_addr, ETH_ALEN);
+        memcpy(sdata->name, ndev->name, IFNAMSIZ);
 
         /* initialise type-independent data */
         sdata->wdev.wiphy = local->hw.wiphy;
@@ -805,12 +865,22 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         INIT_LIST_HEAD(&sdata->key_list);
 
-        sdata->force_unicast_rateidx = -1;
-        sdata->max_ratectrl_rateidx = -1;
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                struct ieee80211_supported_band *sband;
+                sband = local->hw.wiphy->bands[i];
+                sdata->rc_rateidx_mask[i] =
+                        sband ? (1 << sband->n_bitrates) - 1 : 0;
+        }
 
         /* setup type-dependent data */
         ieee80211_setup_sdata(sdata, type);
 
+        if (params) {
+                ndev->ieee80211_ptr->use_4addr = params->use_4addr;
+                if (type == NL80211_IFTYPE_STATION)
+                        sdata->u.mgd.use_4addr = params->use_4addr;
+        }
+
         ret = register_netdevice(ndev);
         if (ret)
                 goto fail;
@@ -854,22 +924,18 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
 void ieee80211_remove_interfaces(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata, *tmp;
+        LIST_HEAD(unreg_list);
 
         ASSERT_RTNL();
 
+        mutex_lock(&local->iflist_mtx);
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
-                /*
-                 * we cannot hold the iflist_mtx across unregister_netdevice,
-                 * but we only need to hold it for list modifications to lock
-                 * out readers since we're under the RTNL here as all other
-                 * writers.
-                 */
-                mutex_lock(&local->iflist_mtx);
                 list_del(&sdata->list);
-                mutex_unlock(&local->iflist_mtx);
 
-                unregister_netdevice(sdata->dev);
+                unregister_netdevice_queue(sdata->dev, &unreg_list);
         }
+        mutex_unlock(&local->iflist_mtx);
+        unregister_netdevice_many(&unreg_list);
 }
 
 static u32 ieee80211_idle_off(struct ieee80211_local *local,
@@ -897,6 +963,8 @@ static u32 ieee80211_idle_on(struct ieee80211_local *local)
                wiphy_name(local->hw.wiphy));
 #endif
 
+        drv_flush(local, false);
+
         local->hw.conf.flags |= IEEE80211_CONF_IDLE;
         return IEEE80211_CONF_CHANGE_IDLE;
 }
@@ -906,16 +974,18 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
         struct ieee80211_sub_if_data *sdata;
         int count = 0;
 
+        if (!list_empty(&local->work_list))
+                return ieee80211_idle_off(local, "working");
+
         if (local->scanning)
                 return ieee80211_idle_off(local, "scanning");
 
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 /* do not count disabled managed interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated &&
-                    list_empty(&sdata->u.mgd.work_list))
+                    !sdata->u.mgd.associated)
                         continue;
                 /* do not count unused IBSS interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
@@ -943,3 +1013,41 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
         if (chg)
                 ieee80211_hw_config(local, chg);
 }
+
+static int netdev_notify(struct notifier_block *nb,
+                         unsigned long state,
+                         void *ndev)
+{
+        struct net_device *dev = ndev;
+        struct ieee80211_sub_if_data *sdata;
+
+        if (state != NETDEV_CHANGENAME)
+                return 0;
+
+        if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
+                return 0;
+
+        if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
+                return 0;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        memcpy(sdata->name, dev->name, IFNAMSIZ);
+
+        ieee80211_debugfs_rename_netdev(sdata);
+        return 0;
+}
+
+static struct notifier_block mac80211_netdev_notifier = {
+        .notifier_call = netdev_notify,
+};
+
+int ieee80211_iface_init(void)
+{
+        return register_netdevice_notifier(&mac80211_netdev_notifier);
+}
+
+void ieee80211_iface_exit(void)
+{
+        unregister_netdevice_notifier(&mac80211_netdev_notifier);
+}
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 659a42d529e3..e8f6e3b252d8 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -14,6 +14,7 @@
 #include <linux/list.h>
 #include <linux/rcupdate.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -139,7 +140,7 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
+        ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
         if (!ret) {
                 spin_lock_bh(&todo_lock);
@@ -181,7 +182,7 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = drv_set_key(key->local, DISABLE_KEY, &sdata->vif,
+        ret = drv_set_key(key->local, DISABLE_KEY, sdata,
                           sta, &key->conf);
 
         if (ret)
@@ -421,7 +422,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                          */
 
                         /* same here, the AP could be using QoS */
-                        ap = sta_info_get(key->local, key->sdata->u.mgd.bssid);
+                        ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
                         if (ap) {
                                 if (test_sta_flags(ap, WLAN_STA_WME))
                                         key->conf.flags |=
@@ -443,7 +444,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
         add_todo(old_key, KEY_FLAG_TODO_DELETE);
 
         add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
-        if (netif_running(sdata->dev))
+        if (ieee80211_sdata_running(sdata))
                 add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
 
         spin_unlock_irqrestore(&sdata->local->key_lock, flags);
@@ -509,7 +510,7 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
         ASSERT_RTNL();
 
-        if (WARN_ON(!netif_running(sdata->dev)))
+        if (WARN_ON(!ieee80211_sdata_running(sdata)))
                 return;
 
         ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 9572e00f532c..bdc2968c2bbe 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -59,11 +59,17 @@ enum ieee80211_internal_key_flags {
         KEY_FLAG_TODO_DEFMGMTKEY        = BIT(6),
 };
 
+enum ieee80211_internal_tkip_state {
+        TKIP_STATE_NOT_INIT,
+        TKIP_STATE_PHASE1_DONE,
+        TKIP_STATE_PHASE1_HW_UPLOADED,
+};
+
 struct tkip_ctx {
         u32 iv32;
         u16 iv16;
         u16 p1k[5];
-        int initialized;
+        enum ieee80211_internal_tkip_state state;
 };
 
 struct ieee80211_key {
@@ -118,18 +124,6 @@ struct ieee80211_key {
         struct {
                 struct dentry *stalink;
                 struct dentry *dir;
-                struct dentry *keylen;
-                struct dentry *flags;
-                struct dentry *keyidx;
-                struct dentry *hw_key_idx;
-                struct dentry *tx_rx_count;
-                struct dentry *algorithm;
-                struct dentry *tx_spec;
-                struct dentry *rx_spec;
-                struct dentry *replays;
-                struct dentry *icverrors;
-                struct dentry *key;
-                struct dentry *ifindex;
                 int cnt;
         } debugfs;
 #endif
diff --git a/net/mac80211/led.c b/net/mac80211/led.c
index 162a643f16b6..063aad944246 100644
--- a/net/mac80211/led.c
+++ b/net/mac80211/led.c
@@ -8,6 +8,7 @@
 
 /* just for IFNAMSIZ */
 #include <linux/if.h>
+#include <linux/slab.h>
 #include "led.h"
 
 void ieee80211_led_rx(struct ieee80211_local *local)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 797f53942e5f..b887e484ae04 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -9,7 +9,6 @@
  */
 
 #include <net/mac80211.h>
-#include <net/ieee80211_radiotap.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
@@ -18,7 +17,6 @@
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
-#include <linux/wireless.h>
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
 #include <linux/pm_qos_params.h>
@@ -30,25 +28,15 @@
 #include "rate.h"
 #include "mesh.h"
 #include "wep.h"
-#include "wme.h"
-#include "aes_ccm.h"
 #include "led.h"
 #include "cfg.h"
 #include "debugfs.h"
-#include "debugfs_netdev.h"
 
-/*
- * For seeing transmitted packets on monitor interfaces
- * we have a radiotap header too.
- */
-struct ieee80211_tx_status_rtap_hdr {
-        struct ieee80211_radiotap_header hdr;
-        u8 rate;
-        u8 padding_for_rate;
-        __le16 tx_flags;
-        u8 data_retries;
-} __attribute__ ((packed));
 
+bool ieee80211_disable_40mhz_24ghz;
+module_param(ieee80211_disable_40mhz_24ghz, bool, 0644);
+MODULE_PARM_DESC(ieee80211_disable_40mhz_24ghz,
+                 "Disable 40MHz support in the 2.4GHz band");
 
 void ieee80211_configure_filter(struct ieee80211_local *local)
 {
@@ -118,6 +106,9 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         if (scan_chan) {
                 chan = scan_chan;
                 channel_type = NL80211_CHAN_NO_HT;
+        } else if (local->tmp_channel) {
+                chan = scan_chan = local->tmp_channel;
+                channel_type = local->tmp_channel_type;
         } else {
                 chan = local->oper_channel;
                 channel_type = local->oper_channel_type;
@@ -130,6 +121,18 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
                 changed |= IEEE80211_CONF_CHANGE_CHANNEL;
         }
 
+        if (!conf_is_ht(&local->hw.conf)) {
+                /*
+                 * mac80211.h documents that this is only valid
+                 * when the channel is set to an HT type, and
+                 * that otherwise STATIC is used.
+                 */
+                local->hw.conf.smps_mode = IEEE80211_SMPS_STATIC;
+        } else if (local->hw.conf.smps_mode != local->smps_mode) {
+                local->hw.conf.smps_mode = local->smps_mode;
+                changed |= IEEE80211_CONF_CHANGE_SMPS;
+        }
+
         if (scan_chan)
                 power = chan->max_power;
         else
@@ -189,7 +192,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
         else if (sdata->vif.type == NL80211_IFTYPE_AP)
-                sdata->vif.bss_conf.bssid = sdata->dev->dev_addr;
+                sdata->vif.bss_conf.bssid = sdata->vif.addr;
         else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 sdata->vif.bss_conf.bssid = zero;
         } else {
@@ -211,7 +214,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         }
 
         if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (local->quiescing || !netif_running(sdata->dev) ||
+                if (local->quiescing || !ieee80211_sdata_running(sdata) ||
                     test_bit(SCAN_SW_SCANNING, &local->scanning)) {
                         sdata->vif.bss_conf.enable_beacon = false;
                 } else {
@@ -222,11 +225,11 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                         switch (sdata->vif.type) {
                         case NL80211_IFTYPE_AP:
                                 sdata->vif.bss_conf.enable_beacon =
-                                        !!rcu_dereference(sdata->u.ap.beacon);
+                                        !!sdata->u.ap.beacon;
                                 break;
                         case NL80211_IFTYPE_ADHOC:
                                 sdata->vif.bss_conf.enable_beacon =
-                                        !!rcu_dereference(sdata->u.ibss.presp);
+                                        !!sdata->u.ibss.presp;
                                 break;
                         case NL80211_IFTYPE_MESH_POINT:
                                 sdata->vif.bss_conf.enable_beacon = true;
@@ -239,8 +242,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        drv_bss_info_changed(local, &sdata->vif,
-                             &sdata->vif.bss_conf, changed);
+        drv_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed);
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
@@ -253,28 +255,6 @@ u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
                BSS_CHANGED_ERP_SLOT;
 }
 
-void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
-                                 struct sk_buff *skb)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int tmp;
-
-        skb->pkt_type = IEEE80211_TX_STATUS_MSG;
-        skb_queue_tail(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS ?
-                       &local->skb_queue : &local->skb_queue_unreliable, skb);
-        tmp = skb_queue_len(&local->skb_queue) +
-                skb_queue_len(&local->skb_queue_unreliable);
-        while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
-               (skb = skb_dequeue(&local->skb_queue_unreliable))) {
-                dev_kfree_skb_irq(skb);
-                tmp--;
-                I802_DEBUG_INC(local->tx_status_drop);
-        }
-        tasklet_schedule(&local->tasklet);
-}
-EXPORT_SYMBOL(ieee80211_tx_status_irqsafe);
-
 static void ieee80211_tasklet_handler(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *) data;
@@ -296,14 +276,14 @@ static void ieee80211_tasklet_handler(unsigned long data)
                         break;
                 case IEEE80211_DELBA_MSG:
                         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-                        ieee80211_stop_tx_ba_cb(local_to_hw(local),
-                                                ra_tid->ra, ra_tid->tid);
+                        ieee80211_stop_tx_ba_cb(ra_tid->vif, ra_tid->ra,
+                                                ra_tid->tid);
                         dev_kfree_skb(skb);
                         break;
                 case IEEE80211_ADDBA_MSG:
                         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-                        ieee80211_start_tx_ba_cb(local_to_hw(local),
-                                                 ra_tid->ra, ra_tid->tid);
+                        ieee80211_start_tx_ba_cb(ra_tid->vif, ra_tid->ra,
+                                                 ra_tid->tid);
                         dev_kfree_skb(skb);
                         break ;
                 default:
@@ -315,299 +295,6 @@ static void ieee80211_tasklet_handler(unsigned long data)
         }
 }
 
-static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
-                                            struct sta_info *sta,
-                                            struct sk_buff *skb)
-{
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-
-        /*
-         * XXX: This is temporary!
-         *
-         *      The problem here is that when we get here, the driver will
-         *      quite likely have pretty much overwritten info->control by
-         *      using info->driver_data or info->rate_driver_data. Thus,
-         *      when passing out the frame to the driver again, we would be
-         *      passing completely bogus data since the driver would then
-         *      expect a properly filled info->control. In mac80211 itself
-         *      the same problem occurs, since we need info->control.vif
-         *      internally.
-         *
-         *      To fix this, we should send the frame through TX processing
-         *      again. However, it's not that simple, since the frame will
-         *      have been software-encrypted (if applicable) already, and
-         *      encrypting it again doesn't do much good. So to properly do
-         *      that, we not only have to skip the actual 'raw' encryption
-         *      (key selection etc. still has to be done!) but also the
-         *      sequence number assignment since that impacts the crypto
-         *      encapsulation, of course.
-         *
-         *      Hence, for now, fix the bug by just dropping the frame.
-         */
-        goto drop;
-
-        sta->tx_filtered_count++;
-
-        /*
-         * Clear the TX filter mask for this STA when sending the next
-         * packet. If the STA went to power save mode, this will happen
-         * when it wakes up for the next time.
-         */
-        set_sta_flags(sta, WLAN_STA_CLEAR_PS_FILT);
-
-        /*
-         * This code races in the following way:
-         *
-         *  (1) STA sends frame indicating it will go to sleep and does so
-         *  (2) hardware/firmware adds STA to filter list, passes frame up
-         *  (3) hardware/firmware processes TX fifo and suppresses a frame
-         *  (4) we get TX status before having processed the frame and
-         *      knowing that the STA has gone to sleep.
-         *
-         * This is actually quite unlikely even when both those events are
-         * processed from interrupts coming in quickly after one another or
-         * even at the same time because we queue both TX status events and
-         * RX frames to be processed by a tasklet and process them in the
-         * same order that they were received or TX status last. Hence, there
-         * is no race as long as the frame RX is processed before the next TX
-         * status, which drivers can ensure, see below.
-         *
-         * Note that this can only happen if the hardware or firmware can
-         * actually add STAs to the filter list, if this is done by the
-         * driver in response to set_tim() (which will only reduce the race
-         * this whole filtering tries to solve, not completely solve it)
-         * this situation cannot happen.
-         *
-         * To completely solve this race drivers need to make sure that they
-         *  (a) don't mix the irq-safe/not irq-safe TX status/RX processing
-         *      functions and
-         *  (b) always process RX events before TX status events if ordering
-         *      can be unknown, for example with different interrupt status
-         *      bits.
-         */
-        if (test_sta_flags(sta, WLAN_STA_PS) &&
-            skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
-                skb_queue_tail(&sta->tx_filtered, skb);
-                return;
-        }
-
-        if (!test_sta_flags(sta, WLAN_STA_PS) &&
-            !(info->flags & IEEE80211_TX_INTFL_RETRIED)) {
-                /* Software retry the packet once */
-                info->flags |= IEEE80211_TX_INTFL_RETRIED;
-                ieee80211_add_pending_skb(local, skb);
-                return;
-        }
-
- drop:
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        if (net_ratelimit())
-                printk(KERN_DEBUG "%s: dropped TX filtered frame, "
-                       "queue_len=%d PS=%d @%lu\n",
-                       wiphy_name(local->hw.wiphy),
-                       skb_queue_len(&sta->tx_filtered),
-                       !!test_sta_flags(sta, WLAN_STA_PS), jiffies);
-#endif
-        dev_kfree_skb(skb);
-}
-
-void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
-{
-        struct sk_buff *skb2;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        u16 frag, type;
-        __le16 fc;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_tx_status_rtap_hdr *rthdr;
-        struct ieee80211_sub_if_data *sdata;
-        struct net_device *prev_dev = NULL;
-        struct sta_info *sta;
-        int retry_count = -1, i;
-
-        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-                /* the HW cannot have attempted that rate */
-                if (i >= hw->max_rates) {
-                        info->status.rates[i].idx = -1;
-                        info->status.rates[i].count = 0;
-                }
-
-                retry_count += info->status.rates[i].count;
-        }
-        if (retry_count < 0)
-                retry_count = 0;
-
-        rcu_read_lock();
-
-        sband = local->hw.wiphy->bands[info->band];
-
-        sta = sta_info_get(local, hdr->addr1);
-
-        if (sta) {
-                if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
-                    test_sta_flags(sta, WLAN_STA_PS)) {
-                        /*
-                         * The STA is in power save mode, so assume
-                         * that this TX packet failed because of that.
-                         */
-                        ieee80211_handle_filtered_frame(local, sta, skb);
-                        rcu_read_unlock();
-                        return;
-                }
-
-                fc = hdr->frame_control;
-
-                if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
-                    (ieee80211_is_data_qos(fc))) {
-                        u16 tid, ssn;
-                        u8 *qc;
-
-                        qc = ieee80211_get_qos_ctl(hdr);
-                        tid = qc[0] & 0xf;
-                        ssn = ((le16_to_cpu(hdr->seq_ctrl) + 0x10)
-                                                & IEEE80211_SCTL_SEQ);
-                        ieee80211_send_bar(sta->sdata, hdr->addr1,
-                                           tid, ssn);
-                }
-
-                if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
-                        ieee80211_handle_filtered_frame(local, sta, skb);
-                        rcu_read_unlock();
-                        return;
-                } else {
-                        if (!(info->flags & IEEE80211_TX_STAT_ACK))
-                                sta->tx_retry_failed++;
-                        sta->tx_retry_count += retry_count;
-                }
-
-                rate_control_tx_status(local, sband, sta, skb);
-                if (ieee80211_vif_is_mesh(&sta->sdata->vif))
-                        ieee80211s_update_metric(local, sta, skb);
-        }
-
-        rcu_read_unlock();
-
-        ieee80211_led_tx(local, 0);
-
-        /* SNMP counters
-         * Fragments are passed to low-level drivers as separate skbs, so these
-         * are actually fragments, not frames. Update frame counters only for
-         * the first fragment of the frame. */
-
-        frag = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
-        type = le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_FTYPE;
-
-        if (info->flags & IEEE80211_TX_STAT_ACK) {
-                if (frag == 0) {
-                        local->dot11TransmittedFrameCount++;
-                        if (is_multicast_ether_addr(hdr->addr1))
-                                local->dot11MulticastTransmittedFrameCount++;
-                        if (retry_count > 0)
-                                local->dot11RetryCount++;
-                        if (retry_count > 1)
-                                local->dot11MultipleRetryCount++;
-                }
-
-                /* This counter shall be incremented for an acknowledged MPDU
-                 * with an individual address in the address 1 field or an MPDU
-                 * with a multicast address in the address 1 field of type Data
-                 * or Management. */
-                if (!is_multicast_ether_addr(hdr->addr1) ||
-                    type == IEEE80211_FTYPE_DATA ||
-                    type == IEEE80211_FTYPE_MGMT)
-                        local->dot11TransmittedFragmentCount++;
-        } else {
-                if (frag == 0)
-                        local->dot11FailedCount++;
-        }
-
-        /* this was a transmitted frame, but now we want to reuse it */
-        skb_orphan(skb);
-
-        /*
-         * This is a bit racy but we can avoid a lot of work
-         * with this test...
-         */
-        if (!local->monitors && !local->cooked_mntrs) {
-                dev_kfree_skb(skb);
-                return;
-        }
-
-        /* send frame to monitor interfaces now */
-
-        if (skb_headroom(skb) < sizeof(*rthdr)) {
-                printk(KERN_ERR "ieee80211_tx_status: headroom too small\n");
-                dev_kfree_skb(skb);
-                return;
-        }
-
-        rthdr = (struct ieee80211_tx_status_rtap_hdr *)
-                                skb_push(skb, sizeof(*rthdr));
-
-        memset(rthdr, 0, sizeof(*rthdr));
-        rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
-        rthdr->hdr.it_present =
-                cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES) |
-                            (1 << IEEE80211_RADIOTAP_RATE));
-
-        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
-            !is_multicast_ether_addr(hdr->addr1))
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
-
-        /*
-         * XXX: Once radiotap gets the bitmap reset thing the vendor
-         *      extensions proposal contains, we can actually report
-         *      the whole set of tries we did.
-         */
-        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
-        if (info->status.rates[0].idx >= 0 &&
-            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
-                rthdr->rate = sband->bitrates[
-                                info->status.rates[0].idx].bitrate / 5;
-
-        /* for now report the total retry_count */
-        rthdr->data_retries = retry_count;
-
-        /* XXX: is this sufficient for BPF? */
-        skb_set_mac_header(skb, 0);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        skb->pkt_type = PACKET_OTHERHOST;
-        skb->protocol = htons(ETH_P_802_2);
-        memset(skb->cb, 0, sizeof(skb->cb));
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
-                        if (!netif_running(sdata->dev))
-                                continue;
-
-                        if (prev_dev) {
-                                skb2 = skb_clone(skb, GFP_ATOMIC);
-                                if (skb2) {
-                                        skb2->dev = prev_dev;
-                                        netif_rx(skb2);
-                                }
-                        }
-
-                        prev_dev = sdata->dev;
-                }
-        }
-        if (prev_dev) {
-                skb->dev = prev_dev;
-                netif_rx(skb);
-                skb = NULL;
-        }
-        rcu_read_unlock();
-        dev_kfree_skb(skb);
-}
-EXPORT_SYMBOL(ieee80211_tx_status);
-
 static void ieee80211_restart_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
@@ -630,6 +317,16 @@ void ieee80211_restart_hw(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_restart_hw);
 
+static void ieee80211_recalc_smps_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, recalc_smps);
+
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_smps(local, NULL);
+        mutex_unlock(&local->iflist_mtx);
+}
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -659,12 +356,12 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         if (!wiphy)
                 return NULL;
 
-        wiphy->netnsok = true;
+        wiphy->flags |= WIPHY_FLAG_NETNS_OK |
+                        WIPHY_FLAG_4ADDR_AP |
+                        WIPHY_FLAG_4ADDR_STATION;
         wiphy->privid = mac80211_wiphy_privid;
 
-        /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
-        wiphy->bss_priv_size = sizeof(struct ieee80211_bss) -
-                               sizeof(struct cfg80211_bss);
+        wiphy->bss_priv_size = sizeof(struct ieee80211_bss);
 
         local = wiphy_priv(wiphy);
 
@@ -687,6 +384,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
         local->user_power_level = -1;
+        local->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+        local->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
 
         INIT_LIST_HEAD(&local->interfaces);
         mutex_init(&local->iflist_mtx);
@@ -698,9 +397,13 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
+        ieee80211_work_init(local);
+
         INIT_WORK(&local->restart_work, ieee80211_restart_work);
 
         INIT_WORK(&local->reconfig_filter, ieee80211_reconfig_filter);
+        INIT_WORK(&local->recalc_smps, ieee80211_recalc_smps_work);
+        local->smps_mode = IEEE80211_SMPS_OFF;
 
         INIT_WORK(&local->dynamic_ps_enable_work,
                   ieee80211_dynamic_ps_enable_work);
@@ -790,6 +493,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
 
+        WARN((local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
+             && (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK),
+             "U-APSD not supported with HW_PS_NULLFUNC_STACK\n");
+
         /*
          * Calculate scan IE length -- we need this to alloc
          * memory and to subtract from the driver limit. It
@@ -844,13 +551,19 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          * and we need some headroom for passing the frame to monitor
          * interfaces, but never both at the same time.
          */
+        BUILD_BUG_ON(IEEE80211_TX_STATUS_HEADROOM !=
+                        sizeof(struct ieee80211_tx_status_rtap_hdr));
         local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
                                    sizeof(struct ieee80211_tx_status_rtap_hdr));
 
         debugfs_hw_add(local);
 
+        /*
+         * if the driver doesn't specify a max listen interval we
+         * use 5 which should be a safe default
+         */
         if (local->hw.max_listen_interval == 0)
-                local->hw.max_listen_interval = 1;
+                local->hw.max_listen_interval = 5;
 
         local->hw.conf.listen_interval = local->hw.max_listen_interval;
 
@@ -901,6 +614,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                         i++;
                 }
         }
+        local->int_scan_req->n_channels = i;
 
         local->network_latency_notifier.notifier_call =
                 ieee80211_max_network_latency;
@@ -923,7 +637,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
  fail_wep:
         sta_info_stop(local);
  fail_sta_info:
-        debugfs_hw_del(local);
         destroy_workqueue(local->workqueue);
  fail_workqueue:
         wiphy_unregister(local->hw.wiphy);
@@ -959,10 +672,9 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         ieee80211_clear_tx_pending(local);
         sta_info_stop(local);
         rate_control_deinitialize(local);
-        debugfs_hw_del(local);
 
-        if (skb_queue_len(&local->skb_queue)
-                        || skb_queue_len(&local->skb_queue_unreliable))
+        if (skb_queue_len(&local->skb_queue) ||
+            skb_queue_len(&local->skb_queue_unreliable))
                 printk(KERN_WARNING "%s: skb_queue not empty\n",
                        wiphy_name(local->hw.wiphy));
         skb_queue_purge(&local->skb_queue);
@@ -1002,11 +714,19 @@ static int __init ieee80211_init(void)
 
         ret = rc80211_pid_init();
         if (ret)
-                return ret;
+                goto err_pid;
 
-        ieee80211_debugfs_netdev_init();
+        ret = ieee80211_iface_init();
+        if (ret)
+                goto err_netdev;
 
         return 0;
+ err_netdev:
+        rc80211_pid_exit();
+ err_pid:
+        rc80211_minstrel_exit();
+
+        return ret;
 }
 
 static void __exit ieee80211_exit(void)
@@ -1023,7 +743,7 @@ static void __exit ieee80211_exit(void)
         if (mesh_allocated)
                 ieee80211s_stop();
 
-        ieee80211_debugfs_netdev_exit();
+        ieee80211_iface_exit();
 }
 
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index f7364e56f1ee..859ee5f3d941 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Authors:    Luis Carlos Cobo <luisca@cozybit.com>
  *             Javier Cardona <javier@cozybit.com>
  *
@@ -8,24 +8,21 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 #include "ieee80211_i.h"
 #include "mesh.h"
 
 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
+#define IEEE80211_MESH_RANN_INTERVAL         (1 * HZ)
 
-#define PP_OFFSET       1               /* Path Selection Protocol */
-#define PM_OFFSET       5               /* Path Selection Metric   */
-#define CC_OFFSET       9               /* Congestion Control Mode */
-#define SP_OFFSET       13              /* Synchronization Protocol */
-#define AUTH_OFFSET     17              /* Authentication Protocol */
-#define CAPAB_OFFSET    22
-#define CAPAB_ACCEPT_PLINKS 0x80
-#define CAPAB_FORWARDING    0x10
+#define MESHCONF_CAPAB_ACCEPT_PLINKS 0x01
+#define MESHCONF_CAPAB_FORWARDING    0x08
 
 #define TMR_RUNNING_HK  0
 #define TMR_RUNNING_MP  1
+#define TMR_RUNNING_MPR 2
 
 int mesh_allocated;
 static struct kmem_cache *rm_cache;
@@ -50,7 +47,7 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
+        set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
 
         if (local->quiescing) {
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
@@ -85,11 +82,11 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
          */
         if (ifmsh->mesh_id_len == ie->mesh_id_len &&
                 memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
-                memcmp(ifmsh->mesh_pp_id, ie->mesh_config + PP_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_pm_id, ie->mesh_config + PM_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_cc_id, ie->mesh_config + CC_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_sp_id, ie->mesh_config + SP_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_auth_id, ie->mesh_config + AUTH_OFFSET, 4) == 0)
+                (ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&
+                (ifmsh->mesh_pm_id == ie->mesh_config->meshconf_pmetric) &&
+                (ifmsh->mesh_cc_id == ie->mesh_config->meshconf_congest) &&
+                (ifmsh->mesh_sp_id == ie->mesh_config->meshconf_synch) &&
+                (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth))
                 return true;
 
         return false;
@@ -102,7 +99,8 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
  */
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
 {
-        return (*(ie->mesh_config + CAPAB_OFFSET) & CAPAB_ACCEPT_PLINKS) != 0;
+        return (ie->mesh_config->meshconf_cap &
+            MESHCONF_CAPAB_ACCEPT_PLINKS) != 0;
 }
 
 /**
@@ -128,18 +126,11 @@ void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
 
 void mesh_ids_set_default(struct ieee80211_if_mesh *sta)
 {
-        u8 oui[3] = {0x00, 0x0F, 0xAC};
-
-        memcpy(sta->mesh_pp_id, oui, sizeof(oui));
-        memcpy(sta->mesh_pm_id, oui, sizeof(oui));
-        memcpy(sta->mesh_cc_id, oui, sizeof(oui));
-        memcpy(sta->mesh_sp_id, oui, sizeof(oui));
-        memcpy(sta->mesh_auth_id, oui, sizeof(oui));
-        sta->mesh_pp_id[sizeof(oui)] = 0;
-        sta->mesh_pm_id[sizeof(oui)] = 0;
-        sta->mesh_cc_id[sizeof(oui)] = 0xff;
-        sta->mesh_sp_id[sizeof(oui)] = 0xff;
-        sta->mesh_auth_id[sizeof(oui)] = 0x0;
+        sta->mesh_pp_id = 0;    /* HWMP */
+        sta->mesh_pm_id = 0;    /* Airtime */
+        sta->mesh_cc_id = 0;    /* Disabled */
+        sta->mesh_sp_id = 0;    /* Neighbor Offset */
+        sta->mesh_auth_id = 0;  /* Disabled */
 }
 
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
@@ -205,8 +196,8 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
                         list_del(&p->list);
                         kmem_cache_free(rm_cache, p);
                         --entries;
-                } else if ((seqnum == p->seqnum)
-                                && (memcmp(sa, p->sa, ETH_ALEN) == 0))
+                } else if ((seqnum == p->seqnum) &&
+                           (memcmp(sa, p->sa, ETH_ALEN) == 0))
                         return -1;
         }
 
@@ -228,6 +219,7 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         struct ieee80211_supported_band *sband;
         u8 *pos;
         int len, i, rate;
+        u8 neighbors;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         len = sband->n_bitrates;
@@ -251,46 +243,49 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
                 }
         }
 
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                pos = skb_put(skb, 2 + 1);
+                *pos++ = WLAN_EID_DS_PARAMS;
+                *pos++ = 1;
+                *pos++ = ieee80211_frequency_to_channel(local->hw.conf.channel->center_freq);
+        }
+
         pos = skb_put(skb, 2 + sdata->u.mesh.mesh_id_len);
         *pos++ = WLAN_EID_MESH_ID;
         *pos++ = sdata->u.mesh.mesh_id_len;
         if (sdata->u.mesh.mesh_id_len)
                 memcpy(pos, sdata->u.mesh.mesh_id, sdata->u.mesh.mesh_id_len);
 
-        pos = skb_put(skb, 2 + IEEE80211_MESH_CONFIG_LEN);
+        pos = skb_put(skb, 2 + sizeof(struct ieee80211_meshconf_ie));
         *pos++ = WLAN_EID_MESH_CONFIG;
-        *pos++ = IEEE80211_MESH_CONFIG_LEN;
-        /* Version */
-        *pos++ = 1;
+        *pos++ = sizeof(struct ieee80211_meshconf_ie);
 
         /* Active path selection protocol ID */
-        memcpy(pos, sdata->u.mesh.mesh_pp_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_pp_id;
 
         /* Active path selection metric ID   */
-        memcpy(pos, sdata->u.mesh.mesh_pm_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_pm_id;
 
         /* Congestion control mode identifier */
-        memcpy(pos, sdata->u.mesh.mesh_cc_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_cc_id;
 
         /* Synchronization protocol identifier */
-        memcpy(pos, sdata->u.mesh.mesh_sp_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_sp_id;
 
         /* Authentication Protocol identifier */
-        memcpy(pos, sdata->u.mesh.mesh_auth_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_auth_id;
 
-        /* Mesh Formation Info */
-        memset(pos, 0x00, 1);
-        pos += 1;
+        /* Mesh Formation Info - number of neighbors */
+        neighbors = atomic_read(&sdata->u.mesh.mshstats.estab_plinks);
+        /* Number of neighbor mesh STAs or 15 whichever is smaller */
+        neighbors = (neighbors > 15) ? 15 : neighbors;
+        *pos++ = neighbors << 1;
 
         /* Mesh capability */
         sdata->u.mesh.accepting_plinks = mesh_plink_availables(sdata);
-        *pos = CAPAB_FORWARDING;
-        *pos++ |= sdata->u.mesh.accepting_plinks ? CAPAB_ACCEPT_PLINKS : 0x00;
+        *pos = MESHCONF_CAPAB_FORWARDING;
+        *pos++ |= sdata->u.mesh.accepting_plinks ?
+            MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
         return;
@@ -355,6 +350,34 @@ static void ieee80211_mesh_path_timer(unsigned long data)
         ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
+static void ieee80211_mesh_path_root_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
+
+        set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
+
+        if (local->quiescing) {
+                set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
+                return;
+        }
+
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
+}
+
+void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
+{
+        if (ifmsh->mshcfg.dot11MeshHWMPRootMode)
+                set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
+        else {
+                clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
+                /* stop running timer */
+                del_timer_sync(&ifmsh->mesh_path_root_timer);
+        }
+}
+
 /**
  * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
  * @hdr:        802.11 frame header
@@ -365,8 +388,9 @@ static void ieee80211_mesh_path_timer(unsigned long data)
  *
  * Return the length of the 802.11 (does not include a mesh control header)
  */
-int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc, char
-                *meshda, char *meshsa) {
+int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
+                                  const u8 *meshda, const u8 *meshsa)
+{
         if (is_multicast_ether_addr(meshda)) {
                 *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA TA SA */
@@ -404,7 +428,7 @@ int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 char *addr5, char *addr6)
 {
         int aelen = 0;
-        memset(meshhdr, 0, sizeof(meshhdr));
+        memset(meshhdr, 0, sizeof(*meshhdr));
         meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
         put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
         sdata->u.mesh.mesh_seqnum++;
@@ -434,7 +458,7 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: running mesh housekeeping\n",
-               sdata->dev->name);
+               sdata->name);
 #endif
 
         ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
@@ -448,6 +472,15 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
 }
 
+static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        mesh_path_tx_root_frame(sdata);
+        mod_timer(&ifmsh->mesh_path_root_timer,
+                  round_jiffies(jiffies + IEEE80211_MESH_RANN_INTERVAL));
+}
+
 #ifdef CONFIG_PM
 void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
 {
@@ -462,6 +495,8 @@ void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
         if (del_timer_sync(&ifmsh->mesh_path_timer))
                 set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
+        if (del_timer_sync(&ifmsh->mesh_path_root_timer))
+                set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
 }
 
 void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
@@ -472,6 +507,9 @@ void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
                 add_timer(&ifmsh->housekeeping_timer);
         if (test_and_clear_bit(TMR_RUNNING_MP, &ifmsh->timers_running))
                 add_timer(&ifmsh->mesh_path_timer);
+        if (test_and_clear_bit(TMR_RUNNING_MPR, &ifmsh->timers_running))
+                add_timer(&ifmsh->mesh_path_root_timer);
+        ieee80211_mesh_root_setup(ifmsh);
 }
 #endif
 
@@ -480,7 +518,8 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
 
-        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
+        set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
+        ieee80211_mesh_root_setup(ifmsh);
         ieee80211_queue_work(&local->hw, &ifmsh->work);
         sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
@@ -491,6 +530,7 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 {
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
+        del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
         /*
          * If the timer fired while we waited for it, it will have
          * requeued the work. Now the work will be running again
@@ -526,7 +566,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
 
         /* ignore ProbeResp to foreign address */
         if (stype == IEEE80211_STYPE_PROBE_RESP &&
-            compare_ether_addr(mgmt->da, sdata->dev->dev_addr))
+            compare_ether_addr(mgmt->da, sdata->vif.addr))
                 return;
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -561,7 +601,7 @@ static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
                                           struct ieee80211_rx_status *rx_status)
 {
         switch (mgmt->u.action.category) {
-        case PLINK_CATEGORY:
+        case MESH_PLINK_CATEGORY:
                 mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
                 break;
         case MESH_PATH_SEL_CATEGORY:
@@ -606,7 +646,7 @@ static void ieee80211_mesh_work(struct work_struct *work)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct sk_buff *skb;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (local->scanning)
@@ -628,6 +668,9 @@ static void ieee80211_mesh_work(struct work_struct *work)
 
         if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
                 ieee80211_mesh_housekeeping(sdata, ifmsh);
+
+        if (test_and_clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags))
+                ieee80211_mesh_rootpath(sdata);
 }
 
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
@@ -673,7 +716,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
                 MESH_MIN_DISCOVERY_TIMEOUT;
         ifmsh->accepting_plinks = true;
         ifmsh->preq_id = 0;
-        ifmsh->dsn = 0;
+        ifmsh->sn = 0;
         atomic_set(&ifmsh->mpaths, 0);
         mesh_rmc_init(sdata);
         ifmsh->last_preq = jiffies;
@@ -684,6 +727,9 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         setup_timer(&ifmsh->mesh_path_timer,
                     ieee80211_mesh_path_timer,
                     (unsigned long) sdata);
+        setup_timer(&ifmsh->mesh_path_root_timer,
+                    ieee80211_mesh_path_root_timer,
+                    (unsigned long) sdata);
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
 }
@@ -704,9 +750,6 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_ACTION:
-                if (skb->len < IEEE80211_MIN_ACTION_SIZE)
-                        return RX_DROP_MONITOR;
-                /* fall through */
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
                 skb_queue_tail(&ifmsh->skb_queue, skb);
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index dd1c19319f0a..85562c59d7d6 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Authors:    Luis Carlos Cobo <luisca@cozybit.com>
  *             Javier Cardona <javier@cozybit.com>
  *
@@ -26,7 +26,7 @@
  *
  * @MESH_PATH_ACTIVE: the mesh path can be used for forwarding
  * @MESH_PATH_RESOLVING: the discovery process is running for this mesh path
- * @MESH_PATH_DSN_VALID: the mesh path contains a valid destination sequence
+ * @MESH_PATH_SN_VALID: the mesh path contains a valid destination sequence
  *      number
  * @MESH_PATH_FIXED: the mesh path has been manually set and should not be
  *      modified
@@ -38,7 +38,7 @@
 enum mesh_path_flags {
         MESH_PATH_ACTIVE =      BIT(0),
         MESH_PATH_RESOLVING =   BIT(1),
-        MESH_PATH_DSN_VALID =   BIT(2),
+        MESH_PATH_SN_VALID =    BIT(2),
         MESH_PATH_FIXED =       BIT(3),
         MESH_PATH_RESOLVED =    BIT(4),
 };
@@ -53,11 +53,13 @@ enum mesh_path_flags {
  * to grow.
  * @MESH_WORK_GROW_MPP_TABLE: the mesh portals table is full and needs to
  * grow
+ * @MESH_WORK_ROOT: the mesh root station needs to send a frame
  */
 enum mesh_deferred_task_flags {
         MESH_WORK_HOUSEKEEPING,
         MESH_WORK_GROW_MPATH_TABLE,
         MESH_WORK_GROW_MPP_TABLE,
+        MESH_WORK_ROOT,
 };
 
 /**
@@ -70,7 +72,7 @@ enum mesh_deferred_task_flags {
  * @timer: mesh path discovery timer
  * @frame_queue: pending queue for frames sent to this destination while the
  *      path is unresolved
- * @dsn: destination sequence number of the destination
+ * @sn: target sequence number
  * @metric: current metric to this destination
  * @hop_count: hops to destination
  * @exp_time: in jiffies, when the path will expire or when it expired
@@ -94,7 +96,7 @@ struct mesh_path {
         struct timer_list timer;
         struct sk_buff_head frame_queue;
         struct rcu_head rcu;
-        u32 dsn;
+        u32 sn;
         u32 metric;
         u8 hop_count;
         unsigned long exp_time;
@@ -174,7 +176,7 @@ struct mesh_rmc {
 #define MESH_CFG_CMP_LEN        (IEEE80211_MESH_CONFIG_LEN - 2)
 
 /* Default values, timeouts in ms */
-#define MESH_TTL                5
+#define MESH_TTL                31
 #define MESH_MAX_RETR           3
 #define MESH_RET_T              100
 #define MESH_CONF_T             100
@@ -186,8 +188,9 @@ struct mesh_rmc {
  */
 #define MESH_PREQ_MIN_INT       10
 #define MESH_DIAM_TRAVERSAL_TIME 50
-/* Paths will be refreshed if they are closer than PATH_REFRESH_TIME to their
- * expiration
+/* A path will be refreshed if it is used PATH_REFRESH_TIME milliseconds before
+ * timing out.  This way it will remain ACTIVE and no data frames will be
+ * unnecesarily held in the pending queue.
  */
 #define MESH_PATH_REFRESH_TIME                  1000
 #define MESH_MIN_DISCOVERY_TIMEOUT (2 * MESH_DIAM_TRAVERSAL_TIME)
@@ -206,13 +209,19 @@ struct mesh_rmc {
 #define MESH_MAX_MPATHS         1024
 
 /* Pending ANA approval */
-#define PLINK_CATEGORY          30
+#define MESH_PLINK_CATEGORY     30
 #define MESH_PATH_SEL_CATEGORY  32
+#define MESH_PATH_SEL_ACTION    0
+
+/* PERR reason codes */
+#define PEER_RCODE_UNSPECIFIED  11
+#define PERR_RCODE_NO_ROUTE     12
+#define PERR_RCODE_DEST_UNREACH 13
 
 /* Public interfaces */
 /* Various */
 int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
-                char *da, char *sa);
+                                  const u8 *da, const u8 *sa);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 struct ieee80211_sub_if_data *sdata, char *addr4,
                 char *addr5, char *addr6);
@@ -234,6 +243,7 @@ ieee80211_rx_result
 ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
 
 /* Mesh paths */
 int mesh_nexthop_lookup(struct sk_buff *skb,
@@ -274,8 +284,8 @@ void mesh_mpp_table_grow(void);
 u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
                 struct mesh_table *tbl);
 /* Mesh paths */
-int mesh_path_error_tx(u8 *dest, __le32 dest_dsn, u8 *ra,
-                struct ieee80211_sub_if_data *sdata);
+int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn, __le16 target_rcode,
+                       const u8 *ra, struct ieee80211_sub_if_data *sdata);
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta);
 void mesh_path_flush_pending(struct mesh_path *mpath);
 void mesh_path_tx_pending(struct mesh_path *mpath);
@@ -288,6 +298,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
 void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
 void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
+void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
 
 extern int mesh_paths_generation;
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 29b82e98effa..fefc45c4b4e8 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Author:     Luis Carlos Cobo <luisca@cozybit.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -7,8 +7,15 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/slab.h>
 #include "mesh.h"
 
+#ifdef CONFIG_MAC80211_VERBOSE_MHWMP_DEBUG
+#define mhwmp_dbg(fmt, args...)   printk(KERN_DEBUG "Mesh HWMP: " fmt, ##args)
+#else
+#define mhwmp_dbg(fmt, args...)   do { (void)(0); } while (0)
+#endif
+
 #define TEST_FRAME_LEN  8192
 #define MAX_METRIC      0xffffffff
 #define ARITH_SHIFT     8
@@ -21,6 +28,12 @@
 #define MP_F_DO 0x1
 /* Reply and forward */
 #define MP_F_RF 0x2
+/* Unknown Sequence Number */
+#define MP_F_USN    0x01
+/* Reason code Present */
+#define MP_F_RCODE  0x02
+
+static void mesh_queue_preq(struct mesh_path *, u8);
 
 static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 {
@@ -29,6 +42,13 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
         return get_unaligned_le32(preq_elem + offset);
 }
 
+static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
+{
+        if (ae)
+                offset += 6;
+        return get_unaligned_le16(preq_elem + offset);
+}
+
 /* HWMP IE processing macros */
 #define AE_F                    (1<<6)
 #define AE_F_SET(x)             (*x & AE_F)
@@ -37,30 +57,33 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 #define PREQ_IE_TTL(x)          (*(x + 2))
 #define PREQ_IE_PREQ_ID(x)      u32_field_get(x, 3, 0)
 #define PREQ_IE_ORIG_ADDR(x)    (x + 7)
-#define PREQ_IE_ORIG_DSN(x)     u32_field_get(x, 13, 0);
+#define PREQ_IE_ORIG_SN(x)      u32_field_get(x, 13, 0);
 #define PREQ_IE_LIFETIME(x)     u32_field_get(x, 17, AE_F_SET(x));
 #define PREQ_IE_METRIC(x)       u32_field_get(x, 21, AE_F_SET(x));
-#define PREQ_IE_DST_F(x)        (*(AE_F_SET(x) ? x + 32 : x + 26))
-#define PREQ_IE_DST_ADDR(x)     (AE_F_SET(x) ? x + 33 : x + 27)
-#define PREQ_IE_DST_DSN(x)      u32_field_get(x, 33, AE_F_SET(x));
+#define PREQ_IE_TARGET_F(x)     (*(AE_F_SET(x) ? x + 32 : x + 26))
+#define PREQ_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 33 : x + 27)
+#define PREQ_IE_TARGET_SN(x)    u32_field_get(x, 33, AE_F_SET(x));
 
 
 #define PREP_IE_FLAGS(x)        PREQ_IE_FLAGS(x)
 #define PREP_IE_HOPCOUNT(x)     PREQ_IE_HOPCOUNT(x)
 #define PREP_IE_TTL(x)          PREQ_IE_TTL(x)
 #define PREP_IE_ORIG_ADDR(x)    (x + 3)
-#define PREP_IE_ORIG_DSN(x)     u32_field_get(x, 9, 0);
+#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 9, 0);
 #define PREP_IE_LIFETIME(x)     u32_field_get(x, 13, AE_F_SET(x));
 #define PREP_IE_METRIC(x)       u32_field_get(x, 17, AE_F_SET(x));
-#define PREP_IE_DST_ADDR(x)     (AE_F_SET(x) ? x + 27 : x + 21)
-#define PREP_IE_DST_DSN(x)      u32_field_get(x, 27, AE_F_SET(x));
+#define PREP_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 27 : x + 21)
+#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 27, AE_F_SET(x));
 
-#define PERR_IE_DST_ADDR(x)     (x + 2)
-#define PERR_IE_DST_DSN(x)      u32_field_get(x, 8, 0);
+#define PERR_IE_TTL(x)          (*(x))
+#define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
+#define PERR_IE_TARGET_ADDR(x)  (x + 3)
+#define PERR_IE_TARGET_SN(x)    u32_field_get(x, 9, 0);
+#define PERR_IE_TARGET_RCODE(x) u16_field_get(x, 13, 0);
 
 #define MSEC_TO_TU(x) (x*1000/1024)
-#define DSN_GT(x, y) ((long) (y) - (long) (x) < 0)
-#define DSN_LT(x, y) ((long) (x) - (long) (y) < 0)
+#define SN_GT(x, y) ((long) (y) - (long) (x) < 0)
+#define SN_LT(x, y) ((long) (x) - (long) (y) < 0)
 
 #define net_traversal_jiffies(s) \
         msecs_to_jiffies(s->u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime)
@@ -75,13 +98,17 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 enum mpath_frame_type {
         MPATH_PREQ = 0,
         MPATH_PREP,
-        MPATH_PERR
+        MPATH_PERR,
+        MPATH_RANN
 };
 
+static const u8 broadcast_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
 static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
-                u8 *orig_addr, __le32 orig_dsn, u8 dst_flags, u8 *dst,
-                __le32 dst_dsn, u8 *da, u8 hop_count, u8 ttl, __le32 lifetime,
-                __le32 metric, __le32 preq_id, struct ieee80211_sub_if_data *sdata)
+                u8 *orig_addr, __le32 orig_sn, u8 target_flags, u8 *target,
+                __le32 target_sn, const u8 *da, u8 hop_count, u8 ttl,
+                __le32 lifetime, __le32 metric, __le32 preq_id,
+                struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -102,22 +129,31 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
                                           IEEE80211_STYPE_ACTION);
 
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        /* BSSID is left zeroed, wildcard value */
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        /* BSSID == SA */
+        memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
-        mgmt->u.action.u.mesh_action.action_code = action;
+        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
 
         switch (action) {
         case MPATH_PREQ:
+                mhwmp_dbg("sending PREQ to %pM\n", target);
                 ie_len = 37;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREQ;
                 break;
         case MPATH_PREP:
+                mhwmp_dbg("sending PREP to %pM\n", target);
                 ie_len = 31;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREP;
                 break;
+        case MPATH_RANN:
+                mhwmp_dbg("sending RANN from %pM\n", orig_addr);
+                ie_len = sizeof(struct ieee80211_rann_ie);
+                pos = skb_put(skb, 2 + ie_len);
+                *pos++ = WLAN_EID_RANN;
+                break;
         default:
                 kfree_skb(skb);
                 return -ENOTSUPP;
@@ -133,34 +169,40 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         }
         memcpy(pos, orig_addr, ETH_ALEN);
         pos += ETH_ALEN;
-        memcpy(pos, &orig_dsn, 4);
-        pos += 4;
-        memcpy(pos, &lifetime, 4);
+        memcpy(pos, &orig_sn, 4);
         pos += 4;
+        if (action != MPATH_RANN) {
+                memcpy(pos, &lifetime, 4);
+                pos += 4;
+        }
         memcpy(pos, &metric, 4);
         pos += 4;
         if (action == MPATH_PREQ) {
                 /* destination count */
                 *pos++ = 1;
-                *pos++ = dst_flags;
+                *pos++ = target_flags;
+        }
+        if (action != MPATH_RANN) {
+                memcpy(pos, target, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &target_sn, 4);
         }
-        memcpy(pos, dst, ETH_ALEN);
-        pos += ETH_ALEN;
-        memcpy(pos, &dst_dsn, 4);
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
         return 0;
 }
 
 /**
  * mesh_send_path error - Sends a PERR mesh management frame
  *
- * @dst: broken destination
- * @dst_dsn: dsn of the broken destination
+ * @target: broken destination
+ * @target_sn: SN of the broken destination
+ * @target_rcode: reason code for this PERR
  * @ra: node this frame is addressed to
  */
-int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
-                struct ieee80211_sub_if_data *sdata)
+int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
+                       __le16 target_rcode, const u8 *ra,
+                       struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -181,23 +223,35 @@ int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
                                           IEEE80211_STYPE_ACTION);
 
         memcpy(mgmt->da, ra, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
-        mgmt->u.action.u.mesh_action.action_code = MPATH_PERR;
-        ie_len = 12;
+        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
+        ie_len = 15;
         pos = skb_put(skb, 2 + ie_len);
         *pos++ = WLAN_EID_PERR;
         *pos++ = ie_len;
-        /* mode flags, reserved */
-        *pos++ = 0;
+        /* ttl */
+        *pos++ = MESH_TTL;
         /* number of destinations */
         *pos++ = 1;
-        memcpy(pos, dst, ETH_ALEN);
+        /*
+         * flags bit, bit 1 is unset if we know the sequence number and
+         * bit 2 is set if we have a reason code
+         */
+        *pos = 0;
+        if (!target_sn)
+                *pos |= MP_F_USN;
+        if (target_rcode)
+                *pos |= MP_F_RCODE;
+        pos++;
+        memcpy(pos, target, ETH_ALEN);
         pos += ETH_ALEN;
-        memcpy(pos, &dst_dsn, 4);
+        memcpy(pos, &target_sn, 4);
+        pos += 4;
+        memcpy(pos, &target_rcode, 2);
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
         return 0;
 }
 
@@ -269,21 +323,20 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  */
 static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_mgmt *mgmt,
-                            u8 *hwmp_ie)
+                            u8 *hwmp_ie, enum mpath_frame_type action)
 {
         struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath;
         struct sta_info *sta;
         bool fresh_info;
         u8 *orig_addr, *ta;
-        u32 orig_dsn, orig_metric;
+        u32 orig_sn, orig_metric;
         unsigned long orig_lifetime, exp_time;
         u32 last_hop_metric, new_metric;
         bool process = true;
-        u8 action = mgmt->u.action.u.mesh_action.action_code;
 
         rcu_read_lock();
-        sta = sta_info_get(local, mgmt->sa);
+        sta = sta_info_get(sdata, mgmt->sa);
         if (!sta) {
                 rcu_read_unlock();
                 return 0;
@@ -296,7 +349,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
         switch (action) {
         case MPATH_PREQ:
                 orig_addr = PREQ_IE_ORIG_ADDR(hwmp_ie);
-                orig_dsn = PREQ_IE_ORIG_DSN(hwmp_ie);
+                orig_sn = PREQ_IE_ORIG_SN(hwmp_ie);
                 orig_lifetime = PREQ_IE_LIFETIME(hwmp_ie);
                 orig_metric = PREQ_IE_METRIC(hwmp_ie);
                 break;
@@ -309,7 +362,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                  * information from both PREQ and PREP frames.
                  */
                 orig_addr = PREP_IE_ORIG_ADDR(hwmp_ie);
-                orig_dsn = PREP_IE_ORIG_DSN(hwmp_ie);
+                orig_sn = PREP_IE_ORIG_SN(hwmp_ie);
                 orig_lifetime = PREP_IE_LIFETIME(hwmp_ie);
                 orig_metric = PREP_IE_METRIC(hwmp_ie);
                 break;
@@ -322,7 +375,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                 new_metric = MAX_METRIC;
         exp_time = TU_TO_EXP_TIME(orig_lifetime);
 
-        if (memcmp(orig_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
+        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0) {
                 /* This MP is the originator, we are not interested in this
                  * frame, except for updating transmitter's path info.
                  */
@@ -335,11 +388,11 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                         if (mpath->flags & MESH_PATH_FIXED)
                                 fresh_info = false;
                         else if ((mpath->flags & MESH_PATH_ACTIVE) &&
-                            (mpath->flags & MESH_PATH_DSN_VALID)) {
-                                if (DSN_GT(mpath->dsn, orig_dsn) ||
-                                    (mpath->dsn == orig_dsn &&
+                            (mpath->flags & MESH_PATH_SN_VALID)) {
+                                if (SN_GT(mpath->sn, orig_sn) ||
+                                    (mpath->sn == orig_sn &&
                                      action == MPATH_PREQ &&
-                                     new_metric > mpath->metric)) {
+                                     new_metric >= mpath->metric)) {
                                         process = false;
                                         fresh_info = false;
                                 }
@@ -356,9 +409,9 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
                 if (fresh_info) {
                         mesh_path_assign_nexthop(mpath, sta);
-                        mpath->flags |= MESH_PATH_DSN_VALID;
+                        mpath->flags |= MESH_PATH_SN_VALID;
                         mpath->metric = new_metric;
-                        mpath->dsn = orig_dsn;
+                        mpath->sn = orig_sn;
                         mpath->exp_time = time_after(mpath->exp_time, exp_time)
                                           ?  mpath->exp_time : exp_time;
                         mesh_path_activate(mpath);
@@ -397,7 +450,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
                 if (fresh_info) {
                         mesh_path_assign_nexthop(mpath, sta);
-                        mpath->flags &= ~MESH_PATH_DSN_VALID;
+                        mpath->flags &= ~MESH_PATH_SN_VALID;
                         mpath->metric = last_hop_metric;
                         mpath->exp_time = time_after(mpath->exp_time, exp_time)
                                           ?  mpath->exp_time : exp_time;
@@ -419,44 +472,47 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
-        u8 *dst_addr, *orig_addr;
-        u8 dst_flags, ttl;
-        u32 orig_dsn, dst_dsn, lifetime;
+        u8 *target_addr, *orig_addr;
+        u8 target_flags, ttl;
+        u32 orig_sn, target_sn, lifetime;
         bool reply = false;
         bool forward = true;
 
-        /* Update destination DSN, if present */
-        dst_addr = PREQ_IE_DST_ADDR(preq_elem);
+        /* Update target SN, if present */
+        target_addr = PREQ_IE_TARGET_ADDR(preq_elem);
         orig_addr = PREQ_IE_ORIG_ADDR(preq_elem);
-        dst_dsn = PREQ_IE_DST_DSN(preq_elem);
-        orig_dsn = PREQ_IE_ORIG_DSN(preq_elem);
-        dst_flags = PREQ_IE_DST_F(preq_elem);
+        target_sn = PREQ_IE_TARGET_SN(preq_elem);
+        orig_sn = PREQ_IE_ORIG_SN(preq_elem);
+        target_flags = PREQ_IE_TARGET_F(preq_elem);
 
-        if (memcmp(dst_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
+        mhwmp_dbg("received PREQ from %pM\n", orig_addr);
+
+        if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0) {
+                mhwmp_dbg("PREQ is for us\n");
                 forward = false;
                 reply = true;
                 metric = 0;
-                if (time_after(jiffies, ifmsh->last_dsn_update +
+                if (time_after(jiffies, ifmsh->last_sn_update +
                                         net_traversal_jiffies(sdata)) ||
-                    time_before(jiffies, ifmsh->last_dsn_update)) {
-                        dst_dsn = ++ifmsh->dsn;
-                        ifmsh->last_dsn_update = jiffies;
+                    time_before(jiffies, ifmsh->last_sn_update)) {
+                        target_sn = ++ifmsh->sn;
+                        ifmsh->last_sn_update = jiffies;
                 }
         } else {
                 rcu_read_lock();
-                mpath = mesh_path_lookup(dst_addr, sdata);
+                mpath = mesh_path_lookup(target_addr, sdata);
                 if (mpath) {
-                        if ((!(mpath->flags & MESH_PATH_DSN_VALID)) ||
-                                        DSN_LT(mpath->dsn, dst_dsn)) {
-                                mpath->dsn = dst_dsn;
-                                mpath->flags |= MESH_PATH_DSN_VALID;
-                        } else if ((!(dst_flags & MP_F_DO)) &&
+                        if ((!(mpath->flags & MESH_PATH_SN_VALID)) ||
+                                        SN_LT(mpath->sn, target_sn)) {
+                                mpath->sn = target_sn;
+                                mpath->flags |= MESH_PATH_SN_VALID;
+                        } else if ((!(target_flags & MP_F_DO)) &&
                                         (mpath->flags & MESH_PATH_ACTIVE)) {
                                 reply = true;
                                 metric = mpath->metric;
-                                dst_dsn = mpath->dsn;
-                                if (dst_flags & MP_F_RF)
-                                        dst_flags |= MP_F_DO;
+                                target_sn = mpath->sn;
+                                if (target_flags & MP_F_RF)
+                                        target_flags |= MP_F_DO;
                                 else
                                         forward = false;
                         }
@@ -467,13 +523,14 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
         if (reply) {
                 lifetime = PREQ_IE_LIFETIME(preq_elem);
                 ttl = ifmsh->mshcfg.dot11MeshTTL;
-                if (ttl != 0)
-                        mesh_path_sel_frame_tx(MPATH_PREP, 0, dst_addr,
-                                cpu_to_le32(dst_dsn), 0, orig_addr,
-                                cpu_to_le32(orig_dsn), mgmt->sa, 0, ttl,
+                if (ttl != 0) {
+                        mhwmp_dbg("replying to the PREQ\n");
+                        mesh_path_sel_frame_tx(MPATH_PREP, 0, target_addr,
+                                cpu_to_le32(target_sn), 0, orig_addr,
+                                cpu_to_le32(orig_sn), mgmt->sa, 0, ttl,
                                 cpu_to_le32(lifetime), cpu_to_le32(metric),
                                 0, sdata);
-                else
+                } else
                         ifmsh->mshstats.dropped_frames_ttl++;
         }
 
@@ -487,13 +544,14 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         ifmsh->mshstats.dropped_frames_ttl++;
                         return;
                 }
+                mhwmp_dbg("forwarding the PREQ from %pM\n", orig_addr);
                 --ttl;
                 flags = PREQ_IE_FLAGS(preq_elem);
                 preq_id = PREQ_IE_PREQ_ID(preq_elem);
                 hopcount = PREQ_IE_HOPCOUNT(preq_elem) + 1;
                 mesh_path_sel_frame_tx(MPATH_PREQ, flags, orig_addr,
-                                cpu_to_le32(orig_dsn), dst_flags, dst_addr,
-                                cpu_to_le32(dst_dsn), sdata->dev->broadcast,
+                                cpu_to_le32(orig_sn), target_flags, target_addr,
+                                cpu_to_le32(target_sn), broadcast_addr,
                                 hopcount, ttl, cpu_to_le32(lifetime),
                                 cpu_to_le32(metric), cpu_to_le32(preq_id),
                                 sdata);
@@ -508,10 +566,12 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                                     u8 *prep_elem, u32 metric)
 {
         struct mesh_path *mpath;
-        u8 *dst_addr, *orig_addr;
+        u8 *target_addr, *orig_addr;
         u8 ttl, hopcount, flags;
         u8 next_hop[ETH_ALEN];
-        u32 dst_dsn, orig_dsn, lifetime;
+        u32 target_sn, orig_sn, lifetime;
+
+        mhwmp_dbg("received PREP from %pM\n", PREP_IE_ORIG_ADDR(prep_elem));
 
         /* Note that we divert from the draft nomenclature and denominate
          * destination to what the draft refers to as origininator. So in this
@@ -519,8 +579,8 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
          * which corresponds with the originator of the PREQ which this PREP
          * replies
          */
-        dst_addr = PREP_IE_DST_ADDR(prep_elem);
-        if (memcmp(dst_addr, sdata->dev->dev_addr, ETH_ALEN) == 0)
+        target_addr = PREP_IE_TARGET_ADDR(prep_elem);
+        if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0)
                 /* destination, no forwarding required */
                 return;
 
@@ -531,7 +591,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         }
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, sdata);
+        mpath = mesh_path_lookup(target_addr, sdata);
         if (mpath)
                 spin_lock_bh(&mpath->state_lock);
         else
@@ -547,13 +607,13 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         lifetime = PREP_IE_LIFETIME(prep_elem);
         hopcount = PREP_IE_HOPCOUNT(prep_elem) + 1;
         orig_addr = PREP_IE_ORIG_ADDR(prep_elem);
-        dst_dsn = PREP_IE_DST_DSN(prep_elem);
-        orig_dsn = PREP_IE_ORIG_DSN(prep_elem);
+        target_sn = PREP_IE_TARGET_SN(prep_elem);
+        orig_sn = PREP_IE_ORIG_SN(prep_elem);
 
         mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr,
-                cpu_to_le32(orig_dsn), 0, dst_addr,
-                cpu_to_le32(dst_dsn), mpath->next_hop->sta.addr, hopcount, ttl,
-                cpu_to_le32(lifetime), cpu_to_le32(metric),
+                cpu_to_le32(orig_sn), 0, target_addr,
+                cpu_to_le32(target_sn), next_hop, hopcount,
+                ttl, cpu_to_le32(lifetime), cpu_to_le32(metric),
                 0, sdata);
         rcu_read_unlock();
 
@@ -570,32 +630,96 @@ fail:
 static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_mgmt *mgmt, u8 *perr_elem)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
-        u8 *ta, *dst_addr;
-        u32 dst_dsn;
+        u8 ttl;
+        u8 *ta, *target_addr;
+        u8 target_flags;
+        u32 target_sn;
+        u16 target_rcode;
 
         ta = mgmt->sa;
-        dst_addr = PERR_IE_DST_ADDR(perr_elem);
-        dst_dsn = PERR_IE_DST_DSN(perr_elem);
+        ttl = PERR_IE_TTL(perr_elem);
+        if (ttl <= 1) {
+                ifmsh->mshstats.dropped_frames_ttl++;
+                return;
+        }
+        ttl--;
+        target_flags = PERR_IE_TARGET_FLAGS(perr_elem);
+        target_addr = PERR_IE_TARGET_ADDR(perr_elem);
+        target_sn = PERR_IE_TARGET_SN(perr_elem);
+        target_rcode = PERR_IE_TARGET_RCODE(perr_elem);
+
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, sdata);
+        mpath = mesh_path_lookup(target_addr, sdata);
         if (mpath) {
                 spin_lock_bh(&mpath->state_lock);
                 if (mpath->flags & MESH_PATH_ACTIVE &&
                     memcmp(ta, mpath->next_hop->sta.addr, ETH_ALEN) == 0 &&
-                    (!(mpath->flags & MESH_PATH_DSN_VALID) ||
-                    DSN_GT(dst_dsn, mpath->dsn))) {
+                    (!(mpath->flags & MESH_PATH_SN_VALID) ||
+                    SN_GT(target_sn, mpath->sn))) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
-                        mpath->dsn = dst_dsn;
+                        mpath->sn = target_sn;
                         spin_unlock_bh(&mpath->state_lock);
-                        mesh_path_error_tx(dst_addr, cpu_to_le32(dst_dsn),
-                                           sdata->dev->broadcast, sdata);
+                        mesh_path_error_tx(ttl, target_addr, cpu_to_le32(target_sn),
+                                           cpu_to_le16(target_rcode),
+                                           broadcast_addr, sdata);
                 } else
                         spin_unlock_bh(&mpath->state_lock);
         }
         rcu_read_unlock();
 }
 
+static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
+                                struct ieee80211_mgmt *mgmt,
+                                struct ieee80211_rann_ie *rann)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct mesh_path *mpath;
+        u8 *ta;
+        u8 ttl, flags, hopcount;
+        u8 *orig_addr;
+        u32 orig_sn, metric;
+
+        ta = mgmt->sa;
+        ttl = rann->rann_ttl;
+        if (ttl <= 1) {
+                ifmsh->mshstats.dropped_frames_ttl++;
+                return;
+        }
+        ttl--;
+        flags = rann->rann_flags;
+        orig_addr = rann->rann_addr;
+        orig_sn = rann->rann_seq;
+        hopcount = rann->rann_hopcount;
+        hopcount++;
+        metric = rann->rann_metric;
+        mhwmp_dbg("received RANN from %pM\n", orig_addr);
+
+        rcu_read_lock();
+        mpath = mesh_path_lookup(orig_addr, sdata);
+        if (!mpath) {
+                mesh_path_add(orig_addr, sdata);
+                mpath = mesh_path_lookup(orig_addr, sdata);
+                if (!mpath) {
+                        rcu_read_unlock();
+                        sdata->u.mesh.mshstats.dropped_frames_no_route++;
+                        return;
+                }
+                mesh_queue_preq(mpath,
+                                PREQ_Q_F_START | PREQ_Q_F_REFRESH);
+        }
+        if (mpath->sn < orig_sn) {
+                mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr,
+                                       cpu_to_le32(orig_sn),
+                                       0, NULL, 0, broadcast_addr,
+                                       hopcount, ttl, 0,
+                                       cpu_to_le32(metric + mpath->metric),
+                                       0, sdata);
+                mpath->sn = orig_sn;
+        }
+        rcu_read_unlock();
+}
 
 
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
@@ -614,34 +738,34 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
                         len - baselen, &elems);
 
-        switch (mgmt->u.action.u.mesh_action.action_code) {
-        case MPATH_PREQ:
-                if (!elems.preq || elems.preq_len != 37)
+        if (elems.preq) {
+                if (elems.preq_len != 37)
                         /* Right now we support just 1 destination and no AE */
                         return;
-                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.preq);
-                if (!last_hop_metric)
-                        return;
-                hwmp_preq_frame_process(sdata, mgmt, elems.preq, last_hop_metric);
-                break;
-        case MPATH_PREP:
-                if (!elems.prep || elems.prep_len != 31)
+                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.preq,
+                                                      MPATH_PREQ);
+                if (last_hop_metric)
+                        hwmp_preq_frame_process(sdata, mgmt, elems.preq,
+                                                last_hop_metric);
+        }
+        if (elems.prep) {
+                if (elems.prep_len != 31)
                         /* Right now we support no AE */
                         return;
-                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.prep);
-                if (!last_hop_metric)
-                        return;
-                hwmp_prep_frame_process(sdata, mgmt, elems.prep, last_hop_metric);
-                break;
-        case MPATH_PERR:
-                if (!elems.perr || elems.perr_len != 12)
+                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.prep,
+                                                      MPATH_PREP);
+                if (last_hop_metric)
+                        hwmp_prep_frame_process(sdata, mgmt, elems.prep,
+                                                last_hop_metric);
+        }
+        if (elems.perr) {
+                if (elems.perr_len != 15)
                         /* Right now we support only one destination per PERR */
                         return;
                 hwmp_perr_frame_process(sdata, mgmt, elems.perr);
-        default:
-                return;
         }
-
+        if (elems.rann)
+                hwmp_rann_frame_process(sdata, mgmt, elems.rann);
 }
 
 /**
@@ -661,7 +785,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
 
         preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_ATOMIC);
         if (!preq_node) {
-                printk(KERN_DEBUG "Mesh HWMP: could not allocate PREQ node\n");
+                mhwmp_dbg("could not allocate PREQ node\n");
                 return;
         }
 
@@ -670,7 +794,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
                 spin_unlock(&ifmsh->mesh_preq_queue_lock);
                 kfree(preq_node);
                 if (printk_ratelimit())
-                        printk(KERN_DEBUG "Mesh HWMP: PREQ node queue full\n");
+                        mhwmp_dbg("PREQ node queue full\n");
                 return;
         }
 
@@ -705,7 +829,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_preq_queue *preq_node;
         struct mesh_path *mpath;
-        u8 ttl, dst_flags;
+        u8 ttl, target_flags;
         u32 lifetime;
 
         spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
@@ -747,11 +871,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
 
         ifmsh->last_preq = jiffies;
 
-        if (time_after(jiffies, ifmsh->last_dsn_update +
+        if (time_after(jiffies, ifmsh->last_sn_update +
                                 net_traversal_jiffies(sdata)) ||
-            time_before(jiffies, ifmsh->last_dsn_update)) {
-                ++ifmsh->dsn;
-                sdata->u.mesh.last_dsn_update = jiffies;
+            time_before(jiffies, ifmsh->last_sn_update)) {
+                ++ifmsh->sn;
+                sdata->u.mesh.last_sn_update = jiffies;
         }
         lifetime = default_lifetime(sdata);
         ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
@@ -762,14 +886,14 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
         }
 
         if (preq_node->flags & PREQ_Q_F_REFRESH)
-                dst_flags = MP_F_DO;
+                target_flags = MP_F_DO;
         else
-                dst_flags = MP_F_RF;
+                target_flags = MP_F_RF;
 
         spin_unlock_bh(&mpath->state_lock);
-        mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->dev->dev_addr,
-                        cpu_to_le32(ifmsh->dsn), dst_flags, mpath->dst,
-                        cpu_to_le32(mpath->dsn), sdata->dev->broadcast, 0,
+        mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr,
+                        cpu_to_le32(ifmsh->sn), target_flags, mpath->dst,
+                        cpu_to_le32(mpath->sn), broadcast_addr, 0,
                         ttl, cpu_to_le32(lifetime), 0,
                         cpu_to_le32(ifmsh->preq_id++), sdata);
         mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
@@ -796,15 +920,15 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         struct sk_buff *skb_to_free = NULL;
         struct mesh_path *mpath;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u8 *dst_addr = hdr->addr3;
+        u8 *target_addr = hdr->addr3;
         int err = 0;
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, sdata);
+        mpath = mesh_path_lookup(target_addr, sdata);
 
         if (!mpath) {
-                mesh_path_add(dst_addr, sdata);
-                mpath = mesh_path_lookup(dst_addr, sdata);
+                mesh_path_add(target_addr, sdata);
+                mpath = mesh_path_lookup(target_addr, sdata);
                 if (!mpath) {
                         sdata->u.mesh.mshstats.dropped_frames_no_route++;
                         err = -ENOSPC;
@@ -813,17 +937,16 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         }
 
         if (mpath->flags & MESH_PATH_ACTIVE) {
-                if (time_after(jiffies, mpath->exp_time +
-                        msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time))
-                                && !memcmp(sdata->dev->dev_addr, hdr->addr4,
-                                           ETH_ALEN)
-                                && !(mpath->flags & MESH_PATH_RESOLVING)
-                                && !(mpath->flags & MESH_PATH_FIXED)) {
+                if (time_after(jiffies,
+                               mpath->exp_time -
+                               msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
+                    !memcmp(sdata->vif.addr, hdr->addr4, ETH_ALEN) &&
+                    !(mpath->flags & MESH_PATH_RESOLVING) &&
+                    !(mpath->flags & MESH_PATH_FIXED)) {
                         mesh_queue_preq(mpath,
                                         PREQ_Q_F_START | PREQ_Q_F_REFRESH);
                 }
-                memcpy(hdr->addr1, mpath->next_hop->sta.addr,
-                                ETH_ALEN);
+                memcpy(hdr->addr1, mpath->next_hop->sta.addr, ETH_ALEN);
         } else {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                 if (!(mpath->flags & MESH_PATH_RESOLVING)) {
@@ -882,3 +1005,14 @@ void mesh_path_timer(unsigned long data)
 endmpathtimer:
         rcu_read_unlock();
 }
+
+void
+mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        mesh_path_sel_frame_tx(MPATH_RANN, 0, sdata->vif.addr,
+                               cpu_to_le32(++ifmsh->sn),
+                               0, NULL, 0, broadcast_addr,
+                               0, MESH_TTL, 0, 0, 0, sdata);
+}
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 751c4d0e2b36..181ffd6efd81 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Author:     Luis Carlos Cobo <luisca@cozybit.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -10,6 +10,7 @@
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
 #include <net/mac80211.h>
@@ -244,7 +245,7 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
  * @addr: destination address of the path (ETH_ALEN length)
  * @sdata: local subif
  *
- * Returns: 0 on sucess
+ * Returns: 0 on success
  *
  * State: the initial state of the new path is set to 0
  */
@@ -260,7 +261,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
+        if (memcmp(dst, sdata->vif.addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
 
@@ -377,7 +378,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
+        if (memcmp(dst, sdata->vif.addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
 
@@ -449,6 +450,7 @@ err_path_alloc:
  */
 void mesh_plink_broken(struct sta_info *sta)
 {
+        static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_node *p;
@@ -463,11 +465,12 @@ void mesh_plink_broken(struct sta_info *sta)
                     mpath->flags & MESH_PATH_ACTIVE &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
-                        ++mpath->dsn;
+                        ++mpath->sn;
                         spin_unlock_bh(&mpath->state_lock);
-                        mesh_path_error_tx(mpath->dst,
-                                        cpu_to_le32(mpath->dsn),
-                                        sdata->dev->broadcast, sdata);
+                        mesh_path_error_tx(MESH_TTL, mpath->dst,
+                                        cpu_to_le32(mpath->sn),
+                                        cpu_to_le16(PERR_RCODE_DEST_UNREACH),
+                                        bcast, sdata);
                 } else
                 spin_unlock_bh(&mpath->state_lock);
         }
@@ -530,7 +533,7 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
  * @addr: dst address (ETH_ALEN length)
  * @sdata: local subif
  *
- * Returns: 0 if succesful
+ * Returns: 0 if successful
  */
 int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
 {
@@ -601,17 +604,18 @@ void mesh_path_discard_frame(struct sk_buff *skb,
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct mesh_path *mpath;
-        u32 dsn = 0;
+        u32 sn = 0;
 
-        if (memcmp(hdr->addr4, sdata->dev->dev_addr, ETH_ALEN) != 0) {
+        if (memcmp(hdr->addr4, sdata->vif.addr, ETH_ALEN) != 0) {
                 u8 *ra, *da;
 
                 da = hdr->addr3;
                 ra = hdr->addr1;
                 mpath = mesh_path_lookup(da, sdata);
                 if (mpath)
-                        dsn = ++mpath->dsn;
-                mesh_path_error_tx(skb->data, cpu_to_le32(dsn), ra, sdata);
+                        sn = ++mpath->sn;
+                mesh_path_error_tx(MESH_TTL, skb->data, cpu_to_le32(sn),
+                                   cpu_to_le16(PERR_RCODE_NO_ROUTE), ra, sdata);
         }
 
         kfree_skb(skb);
@@ -646,7 +650,7 @@ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop)
 {
         spin_lock_bh(&mpath->state_lock);
         mesh_path_assign_nexthop(mpath, next_hop);
-        mpath->dsn = 0xffff;
+        mpath->sn = 0xffff;
         mpath->metric = 0;
         mpath->hop_count = 0;
         mpath->exp_time = 0;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index ffcbad75e09b..7b7080e2b49f 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -1,11 +1,12 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Author:     Luis Carlos Cobo <luisca@cozybit.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/gfp.h>
 #include <linux/kernel.h>
 #include <linux/random.h>
 #include "ieee80211_i.h"
@@ -18,9 +19,8 @@
 #define mpl_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
 
-#define PLINK_GET_FRAME_SUBTYPE(p) (p)
-#define PLINK_GET_LLID(p) (p + 1)
-#define PLINK_GET_PLID(p) (p + 3)
+#define PLINK_GET_LLID(p) (p + 4)
+#define PLINK_GET_PLID(p) (p + 6)
 
 #define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
                                 jiffies + HZ * t / 1000))
@@ -65,6 +65,7 @@ void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 static inline
@@ -72,12 +73,13 @@ void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 /**
  * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
  *
- * @sta: mes peer link to restart
+ * @sta: mesh peer link to restart
  *
  * Locking: this function must be called holding sta->lock
  */
@@ -101,7 +103,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
         if (local->num_sta >= MESH_MAX_PLINKS)
                 return NULL;
 
-        sta = sta_info_alloc(sdata, hw_addr, GFP_ATOMIC);
+        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
         if (!sta)
                 return NULL;
 
@@ -152,6 +154,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
+        static const u8 meshpeeringproto[] = { 0x00, 0x0F, 0xAC, 0x2A };
         u8 *pos;
         int ie_len;
 
@@ -167,9 +170,9 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
-        mgmt->u.action.category = PLINK_CATEGORY;
+        mgmt->u.action.category = MESH_PLINK_CATEGORY;
         mgmt->u.action.u.plink_action.action_code = action;
 
         if (action == PLINK_CLOSE)
@@ -179,7 +182,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 if (action == PLINK_CONFIRM) {
                         pos = skb_put(skb, 4);
                         /* two-byte status code followed by two-byte AID */
-                        memset(pos, 0, 4);
+                        memset(pos, 0, 2);
+                        memcpy(pos + 2, &plid, 2);
                 }
                 mesh_mgmt_ies_add(skb, sdata);
         }
@@ -187,18 +191,18 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         /* Add Peer Link Management element */
         switch (action) {
         case PLINK_OPEN:
-                ie_len = 3;
+                ie_len = 6;
                 break;
         case PLINK_CONFIRM:
-                ie_len = 5;
+                ie_len = 8;
                 include_plid = true;
                 break;
         case PLINK_CLOSE:
         default:
                 if (!plid)
-                        ie_len = 5;
+                        ie_len = 8;
                 else {
-                        ie_len = 7;
+                        ie_len = 10;
                         include_plid = true;
                 }
                 break;
@@ -207,7 +211,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         pos = skb_put(skb, 2 + ie_len);
         *pos++ = WLAN_EID_PEER_LINK;
         *pos++ = ie_len;
-        *pos++ = action;
+        memcpy(pos, meshpeeringproto, sizeof(meshpeeringproto));
+        pos += 4;
         memcpy(pos, &llid, 2);
         if (include_plid) {
                 pos += 2;
@@ -218,7 +223,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &reason, 2);
         }
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
         return 0;
 }
 
@@ -230,14 +235,14 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, hw_addr);
+        sta = sta_info_get(sdata, hw_addr);
         if (!sta) {
+                rcu_read_unlock();
+
                 sta = mesh_plink_alloc(sdata, hw_addr, rates);
-                if (!sta) {
-                        rcu_read_unlock();
+                if (!sta)
                         return;
-                }
-                if (sta_info_insert(sta)) {
+                if (sta_info_insert_rcu(sta)) {
                         rcu_read_unlock();
                         return;
                 }
@@ -395,6 +400,17 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         u8 ie_len;
         u8 *baseaddr;
         __le16 plid, llid, reason;
+#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
+        static const char *mplstates[] = {
+                [PLINK_LISTEN] = "LISTEN",
+                [PLINK_OPN_SNT] = "OPN-SNT",
+                [PLINK_OPN_RCVD] = "OPN-RCVD",
+                [PLINK_CNF_RCVD] = "CNF_RCVD",
+                [PLINK_ESTAB] = "ESTAB",
+                [PLINK_HOLDING] = "HOLDING",
+                [PLINK_BLOCKED] = "BLOCKED"
+        };
+#endif
 
         /* need action_code, aux */
         if (len < IEEE80211_MIN_ACTION_SIZE + 3)
@@ -417,12 +433,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
-        ftype = *((u8 *)PLINK_GET_FRAME_SUBTYPE(elems.peer_link));
+        ftype = mgmt->u.action.u.plink_action.action_code;
         ie_len = elems.peer_link_len;
-        if ((ftype == PLINK_OPEN && ie_len != 3) ||
-            (ftype == PLINK_CONFIRM && ie_len != 5) ||
-            (ftype == PLINK_CLOSE && ie_len != 5 && ie_len != 7)) {
-                mpl_dbg("Mesh plink: incorrect plink ie length\n");
+        if ((ftype == PLINK_OPEN && ie_len != 6) ||
+            (ftype == PLINK_CONFIRM && ie_len != 8) ||
+            (ftype == PLINK_CLOSE && ie_len != 8 && ie_len != 10)) {
+                mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
+                    ftype, ie_len);
                 return;
         }
 
@@ -434,12 +451,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
          * from the point of view of this host.
          */
         memcpy(&plid, PLINK_GET_LLID(elems.peer_link), 2);
-        if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 7))
+        if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10))
                 memcpy(&llid, PLINK_GET_PLID(elems.peer_link), 2);
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, mgmt->sa);
+        sta = sta_info_get(sdata, mgmt->sa);
         if (!sta && ftype != PLINK_OPEN) {
                 mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
                 rcu_read_unlock();
@@ -469,9 +486,11 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         } else if (!sta) {
                 /* ftype == PLINK_OPEN */
                 u32 rates;
+
+                rcu_read_unlock();
+
                 if (!mesh_plink_free_count(sdata)) {
                         mpl_dbg("Mesh plink error: no more free plinks\n");
-                        rcu_read_unlock();
                         return;
                 }
 
@@ -479,10 +498,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 sta = mesh_plink_alloc(sdata, mgmt->sa, rates);
                 if (!sta) {
                         mpl_dbg("Mesh plink error: plink table full\n");
-                        rcu_read_unlock();
                         return;
                 }
-                if (sta_info_insert(sta)) {
+                if (sta_info_insert_rcu(sta)) {
                         rcu_read_unlock();
                         return;
                 }
@@ -532,8 +550,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
         }
 
-        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %d %d %d %d\n",
-                mgmt->sa, sta->plink_state,
+        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
+                mgmt->sa, mplstates[sta->plink_state],
                 le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
                 event);
         reason = 0;
@@ -727,7 +745,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 break;
         default:
                 /* should not get here, PLINK_BLOCKED is dealt with at the
-                 * beggining of the function
+                 * beginning of the function
                  */
                 spin_unlock_bh(&sta->lock);
                 break;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index dc5049d58c51..875c8dec940a 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -19,6 +19,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/pm_qos_params.h>
 #include <linux/crc32.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 
@@ -27,10 +28,6 @@
 #include "rate.h"
 #include "led.h"
 
-#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
-#define IEEE80211_AUTH_MAX_TRIES 3
-#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
-#define IEEE80211_ASSOC_MAX_TRIES 3
 #define IEEE80211_MAX_PROBE_TRIES 5
 
 /*
@@ -75,11 +72,8 @@ enum rx_mgmt_action {
         /* caller must call cfg80211_send_disassoc() */
         RX_MGMT_CFG80211_DISASSOC,
 
-        /* caller must call cfg80211_auth_timeout() & free work */
-        RX_MGMT_CFG80211_AUTH_TO,
-
-        /* caller must call cfg80211_assoc_timeout() & free work */
-        RX_MGMT_CFG80211_ASSOC_TO,
+        /* caller must tell cfg80211 about internal error */
+        RX_MGMT_CFG80211_ASSOC_ERROR,
 };
 
 /* utils */
@@ -122,27 +116,6 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
-                                      struct ieee80211_supported_band *sband,
-                                      u32 *rates)
-{
-        int i, j, count;
-        *rates = 0;
-        count = 0;
-        for (i = 0; i < bss->supp_rates_len; i++) {
-                int rate = (bss->supp_rates[i] & 0x7F) * 5;
-
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == rate) {
-                                *rates |= BIT(j);
-                                count++;
-                                break;
-                        }
-        }
-
-        return count;
-}
-
 /*
  * ieee80211_enable_ht should be called only after the operating band
  * has been determined as ht configuration depends on the hw's
@@ -195,6 +168,8 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
                      channel_type != local->hw.conf.channel_type;
 
+        if (local->tmp_channel)
+                local->tmp_channel_type = channel_type;
         local->oper_channel_type = channel_type;
 
         if (ht_changed) {
@@ -202,10 +177,11 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 ieee80211_hw_config(local, 0);
 
                 rcu_read_lock();
-                sta = sta_info_get(local, bssid);
+                sta = sta_info_get(sdata, bssid);
                 if (sta)
                         rate_control_rate_update(local, sband, sta,
-                                                 IEEE80211_RC_HT_CHANGED);
+                                                 IEEE80211_RC_HT_CHANGED,
+                                                 local->oper_channel_type);
                 rcu_read_unlock();
         }
 
@@ -228,208 +204,6 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 
 /* frame sending functions */
 
-static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-        const u8 *ies, *ht_ie;
-        int i, len, count, rates_len, supp_rates_len;
-        u16 capab;
-        int wmm = 0;
-        struct ieee80211_supported_band *sband;
-        u32 rates = 0;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 200 + wk->ie_len +
-                            wk->ssid_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
-                       "frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        capab = ifmgd->capab;
-
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
-                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
-                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
-                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
-                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
-        }
-
-        if (wk->bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
-                capab |= WLAN_CAPABILITY_PRIVACY;
-        if (wk->bss->wmm_used)
-                wmm = 1;
-
-        /* get all rates supported by the device and the AP as
-         * some APs don't like getting a superset of their rates
-         * in the association request (e.g. D-Link DAP 1353 in
-         * b-only mode) */
-        rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
-
-        if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
-            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
-                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
-
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, wk->bss->cbss.bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, wk->bss->cbss.bssid, ETH_ALEN);
-
-        if (!is_zero_ether_addr(wk->prev_bssid)) {
-                skb_put(skb, 10);
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_REASSOC_REQ);
-                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.reassoc_req.listen_interval =
-                                cpu_to_le16(local->hw.conf.listen_interval);
-                memcpy(mgmt->u.reassoc_req.current_ap, wk->prev_bssid,
-                       ETH_ALEN);
-        } else {
-                skb_put(skb, 4);
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_ASSOC_REQ);
-                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.assoc_req.listen_interval =
-                                cpu_to_le16(local->hw.conf.listen_interval);
-        }
-
-        /* SSID */
-        ies = pos = skb_put(skb, 2 + wk->ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = wk->ssid_len;
-        memcpy(pos, wk->ssid, wk->ssid_len);
-
-        /* add all rates which were marked to be used above */
-        supp_rates_len = rates_len;
-        if (supp_rates_len > 8)
-                supp_rates_len = 8;
-
-        len = sband->n_bitrates;
-        pos = skb_put(skb, supp_rates_len + 2);
-        *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = supp_rates_len;
-
-        count = 0;
-        for (i = 0; i < sband->n_bitrates; i++) {
-                if (BIT(i) & rates) {
-                        int rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
-                        if (++count == 8)
-                                break;
-                }
-        }
-
-        if (rates_len > count) {
-                pos = skb_put(skb, rates_len - count + 2);
-                *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = rates_len - count;
-
-                for (i++; i < sband->n_bitrates; i++) {
-                        if (BIT(i) & rates) {
-                                int rate = sband->bitrates[i].bitrate;
-                                *pos++ = (u8) (rate / 5);
-                        }
-                }
-        }
-
-        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
-                /* 1. power capabilities */
-                pos = skb_put(skb, 4);
-                *pos++ = WLAN_EID_PWR_CAPABILITY;
-                *pos++ = 2;
-                *pos++ = 0; /* min tx power */
-                *pos++ = local->hw.conf.channel->max_power; /* max tx power */
-
-                /* 2. supported channels */
-                /* TODO: get this in reg domain format */
-                pos = skb_put(skb, 2 * sband->n_channels + 2);
-                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
-                *pos++ = 2 * sband->n_channels;
-                for (i = 0; i < sband->n_channels; i++) {
-                        *pos++ = ieee80211_frequency_to_channel(
-                                        sband->channels[i].center_freq);
-                        *pos++ = 1; /* one channel in the subband*/
-                }
-        }
-
-        if (wk->ie_len && wk->ie) {
-                pos = skb_put(skb, wk->ie_len);
-                memcpy(pos, wk->ie, wk->ie_len);
-        }
-
-        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED)) {
-                pos = skb_put(skb, 9);
-                *pos++ = WLAN_EID_VENDOR_SPECIFIC;
-                *pos++ = 7; /* len */
-                *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
-                *pos++ = 0x50;
-                *pos++ = 0xf2;
-                *pos++ = 2; /* WME */
-                *pos++ = 0; /* WME info */
-                *pos++ = 1; /* WME ver */
-                *pos++ = 0;
-        }
-
-        /* wmm support is a must to HT */
-        /*
-         * IEEE802.11n does not allow TKIP/WEP as pairwise
-         * ciphers in HT mode. We still associate in non-ht
-         * mode (11a/b/g) if any one of these ciphers is
-         * configured as pairwise.
-         */
-        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
-            sband->ht_cap.ht_supported &&
-            (ht_ie = ieee80211_bss_get_ie(&wk->bss->cbss, WLAN_EID_HT_INFORMATION)) &&
-            ht_ie[1] >= sizeof(struct ieee80211_ht_info) &&
-            (!(ifmgd->flags & IEEE80211_STA_DISABLE_11N))) {
-                struct ieee80211_ht_info *ht_info =
-                        (struct ieee80211_ht_info *)(ht_ie + 2);
-                u16 cap = sband->ht_cap.cap;
-                __le16 tmp;
-                u32 flags = local->hw.conf.channel->flags;
-
-                switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                        if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                                cap &= ~IEEE80211_HT_CAP_SGI_40;
-                        }
-                        break;
-                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                        if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                                cap &= ~IEEE80211_HT_CAP_SGI_40;
-                        }
-                        break;
-                }
-
-                tmp = cpu_to_le16(cap);
-                pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
-                *pos++ = WLAN_EID_HT_CAPABILITY;
-                *pos++ = sizeof(struct ieee80211_ht_cap);
-                memset(pos, 0, sizeof(struct ieee80211_ht_cap));
-                memcpy(pos, &tmp, sizeof(u16));
-                pos += sizeof(u16);
-                /* TODO: needs a define here for << 2 */
-                *pos++ = sband->ht_cap.ampdu_factor |
-                         (sband->ht_cap.ampdu_density << 2);
-                memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
-        }
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-
 static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                            const u8 *bssid, u16 stype, u16 reason,
                                            void *cookie)
@@ -442,7 +216,7 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for "
-                       "deauth/disassoc frame\n", sdata->dev->name);
+                       "deauth/disassoc frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -450,7 +224,7 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
         skb_put(skb, 2);
@@ -458,41 +232,35 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
         if (stype == IEEE80211_STYPE_DEAUTH)
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len, cookie);
+                if (cookie)
+                        __cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
+                else
+                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
         else
-                cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len, cookie);
-        ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
+                if (cookie)
+                        __cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
+                else
+                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
+        if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
+                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_pspoll *pspoll;
         struct sk_buff *skb;
-        u16 fc;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for "
-                       "pspoll frame\n", sdata->dev->name);
+        skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
+        if (!skb)
                 return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
-        memset(pspoll, 0, sizeof(*pspoll));
-        fc = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL | IEEE80211_FCTL_PM;
-        pspoll->frame_control = cpu_to_le16(fc);
-        pspoll->aid = cpu_to_le16(ifmgd->aid);
 
-        /* aid in PS-Poll has its two MSBs each set to 1 */
-        pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
+        pspoll = (struct ieee80211_pspoll *) skb->data;
+        pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 
-        memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
-        memcpy(pspoll->ta, sdata->dev->dev_addr, ETH_ALEN);
-
-        ieee80211_tx_skb(sdata, skb, 0);
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_send_nullfunc(struct ieee80211_local *local,
@@ -500,32 +268,50 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
                              int powersave)
 {
         struct sk_buff *skb;
+        struct ieee80211_hdr_3addr *nullfunc;
+
+        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
+        if (!skb)
+                return;
+
+        nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
+        if (powersave)
+                nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
+
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
+}
+
+static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
+                                          struct ieee80211_sub_if_data *sdata)
+{
+        struct sk_buff *skb;
         struct ieee80211_hdr *nullfunc;
         __le16 fc;
 
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
         if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "frame\n", sdata->dev->name);
+                printk(KERN_DEBUG "%s: failed to allocate buffer for 4addr "
+                       "nullfunc frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
-        memset(nullfunc, 0, 24);
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
+        memset(nullfunc, 0, 30);
         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-                         IEEE80211_FCTL_TODS);
-        if (powersave)
-                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+                         IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
         nullfunc->frame_control = fc;
         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
-        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
+        memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
 }
 
 /* spectrum management related things */
@@ -535,7 +321,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         mutex_lock(&ifmgd->mtx);
@@ -546,7 +332,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         /* XXX: shouldn't really modify cfg80211-owned data! */
-        ifmgd->associated->cbss.channel = sdata->local->oper_channel;
+        ifmgd->associated->channel = sdata->local->oper_channel;
 
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -573,6 +359,8 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                       struct ieee80211_channel_sw_ie *sw_elem,
                                       struct ieee80211_bss *bss)
 {
+        struct cfg80211_bss *cbss =
+                container_of((void *)bss, struct cfg80211_bss, priv);
         struct ieee80211_channel *new_ch;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
@@ -606,7 +394,7 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 mod_timer(&ifmgd->chswitch_timer,
                           jiffies +
                           msecs_to_jiffies(sw_elem->count *
-                                           bss->cbss.beacon_interval));
+                                           cbss->beacon_interval));
         }
 }
 
@@ -650,6 +438,11 @@ static void ieee80211_enable_ps(struct ieee80211_local *local,
         } else {
                 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
                         ieee80211_send_nullfunc(local, sdata, 1);
+
+                if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
+                    (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
+                        return;
+
                 conf->flags |= IEEE80211_CONF_PS;
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
@@ -680,8 +473,13 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 return;
         }
 
+        if (!list_empty(&local->work_list)) {
+                local->ps_sdata = NULL;
+                goto change;
+        }
+
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         continue;
@@ -690,7 +488,8 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         }
 
         if (count == 1 && found->u.mgd.powersave &&
-            found->u.mgd.associated && list_empty(&found->u.mgd.work_list) &&
+            found->u.mgd.associated &&
+            found->u.mgd.associated->beacon_ies &&
             !(found->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
                                     IEEE80211_STA_CONNECTION_POLL))) {
                 s32 beaconint_us;
@@ -704,20 +503,29 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
                 } else {
-                        u8 dtimper = found->vif.bss_conf.dtim_period;
+                        struct ieee80211_bss *bss;
                         int maxslp = 1;
+                        u8 dtimper;
+
+                        bss = (void *)found->u.mgd.associated->priv;
+                        dtimper = bss->dtim_period;
 
-                        if (dtimper > 1)
+                        /* If the TIM IE is invalid, pretend the value is 1 */
+                        if (!dtimper)
+                                dtimper = 1;
+                        else if (dtimper > 1)
                                 maxslp = min_t(int, dtimper,
                                                     latency / beaconint_us);
 
                         local->hw.conf.max_sleep_period = maxslp;
+                        local->hw.conf.ps_dtim_period = dtimper;
                         local->ps_sdata = found;
                 }
         } else {
                 local->ps_sdata = NULL;
         }
 
+ change:
         ieee80211_change_ps(local);
 }
 
@@ -742,6 +550,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
                 container_of(work, struct ieee80211_local,
                              dynamic_ps_enable_work);
         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         /* can only happen when PS was just disabled anyway */
         if (!sdata)
@@ -750,11 +559,17 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         if (local->hw.conf.flags & IEEE80211_CONF_PS)
                 return;
 
-        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+        if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
+            (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)))
                 ieee80211_send_nullfunc(local, sdata, 1);
 
-        local->hw.conf.flags |= IEEE80211_CONF_PS;
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
+              (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
+            (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
+                ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
+                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
 }
 
 void ieee80211_dynamic_ps_timer(unsigned long data)
@@ -775,9 +590,9 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         struct ieee80211_tx_queue_params params;
         size_t left;
         int count;
-        u8 *pos;
+        u8 *pos, uapsd_queues = 0;
 
-        if (!(ifmgd->flags & IEEE80211_STA_WMM_ENABLED))
+        if (local->hw.queues < 4)
                 return;
 
         if (!wmm_param)
@@ -785,6 +600,10 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 
         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
                 return;
+
+        if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
+                uapsd_queues = local->uapsd_queues;
+
         count = wmm_param[6] & 0x0f;
         if (count == ifmgd->wmm_last_param_set)
                 return;
@@ -799,6 +618,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         for (; left >= 4; left -= 4, pos += 4) {
                 int aci = (pos[0] >> 5) & 0x03;
                 int acm = (pos[0] >> 4) & 0x01;
+                bool uapsd = false;
                 int queue;
 
                 switch (aci) {
@@ -806,22 +626,30 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                         queue = 3;
                         if (acm)
                                 local->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
+                                uapsd = true;
                         break;
                 case 2: /* AC_VI */
                         queue = 1;
                         if (acm)
                                 local->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
+                                uapsd = true;
                         break;
                 case 3: /* AC_VO */
                         queue = 0;
                         if (acm)
                                 local->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
+                                uapsd = true;
                         break;
                 case 0: /* AC_BE */
                 default:
                         queue = 2;
                         if (acm)
                                 local->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
+                                uapsd = true;
                         break;
                 }
 
@@ -829,11 +657,14 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
                 params.cw_min = ecw2cw(pos[1] & 0x0f);
                 params.txop = get_unaligned_le16(pos + 2);
+                params.uapsd = uapsd;
+
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
-                       "cWmin=%d cWmax=%d txop=%d\n",
+                       "cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
                        wiphy_name(local->hw.wiphy), queue, aci, acm,
-                       params.aifs, params.cw_min, params.cw_max, params.txop);
+                       params.aifs, params.cw_min, params.cw_max, params.txop,
+                       params.uapsd);
 #endif
                 if (drv_conf_tx(local, queue, &params) && local->ops->conf_tx)
                         printk(KERN_DEBUG "%s: failed to set TX queue "
@@ -860,6 +691,8 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         }
 
         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
+        if (sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
+                use_short_slot = true;
 
         if (use_protection != bss_conf->use_cts_prot) {
                 bss_conf->use_cts_prot = use_protection;
@@ -880,30 +713,36 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgd_work *wk,
+                                     struct cfg80211_bss *cbss,
                                      u32 bss_info_changed)
 {
+        struct ieee80211_bss *bss = (void *)cbss->priv;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss = wk->bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
         /* set timing information */
-        sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
-        sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
-        sdata->vif.bss_conf.dtim_period = bss->dtim_period;
+        sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
+        sdata->vif.bss_conf.timestamp = cbss->tsf;
 
         bss_info_changed |= BSS_CHANGED_BEACON_INT;
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
-                bss->cbss.capability, bss->has_erp_value, bss->erp_value);
+                cbss->capability, bss->has_erp_value, bss->erp_value);
 
-        sdata->u.mgd.associated = bss;
-        sdata->u.mgd.old_associate_work = wk;
-        memcpy(sdata->u.mgd.bssid, bss->cbss.bssid, ETH_ALEN);
+        sdata->u.mgd.associated = cbss;
+        memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
 
         /* just to be sure */
         sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
                                 IEEE80211_STA_BEACON_POLL);
 
+        /*
+         * Always handle WMM once after association regardless
+         * of the first value the AP uses. Setting -1 here has
+         * that effect because the AP values is an unsigned
+         * 4-bit value.
+         */
+        sdata->u.mgd.wmm_last_param_set = -1;
+
         ieee80211_led_assoc(local, 1);
 
         sdata->vif.bss_conf.assoc = 1;
@@ -921,99 +760,14 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         mutex_lock(&local->iflist_mtx);
         ieee80211_recalc_ps(local, -1);
+        ieee80211_recalc_smps(local, sdata);
         mutex_unlock(&local->iflist_mtx);
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
 }
 
-static enum rx_mgmt_action __must_check
-ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        wk->tries++;
-        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
-                       sdata->dev->name, wk->bss->cbss.bssid);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
-
-                /*
-                 * We might have a pending scan which had no chance to run yet
-                 * due to work needing to be done. Hence, queue the STAs work
-                 * again for that.
-                 */
-                ieee80211_queue_work(&local->hw, &ifmgd->work);
-                return RX_MGMT_CFG80211_AUTH_TO;
-        }
-
-        printk(KERN_DEBUG "%s: direct probe to AP %pM (try %d)\n",
-                        sdata->dev->name, wk->bss->cbss.bssid,
-                        wk->tries);
-
-        /*
-         * Direct probe is sent to broadcast address as some APs
-         * will not answer to direct packet in unassociated state.
-         */
-        ieee80211_send_probe_req(sdata, NULL, wk->ssid, wk->ssid_len, NULL, 0);
-
-        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(ifmgd, wk->timeout);
-
-        return RX_MGMT_NONE;
-}
-
-
-static enum rx_mgmt_action __must_check
-ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        wk->tries++;
-        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: authentication with AP %pM"
-                       " timed out\n",
-                       sdata->dev->name, wk->bss->cbss.bssid);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
-
-                /*
-                 * We might have a pending scan which had no chance to run yet
-                 * due to work needing to be done. Hence, queue the STAs work
-                 * again for that.
-                 */
-                ieee80211_queue_work(&local->hw, &ifmgd->work);
-                return RX_MGMT_CFG80211_AUTH_TO;
-        }
-
-        printk(KERN_DEBUG "%s: authenticate with AP %pM (try %d)\n",
-               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
-
-        ieee80211_send_auth(sdata, 1, wk->auth_alg, wk->ie, wk->ie_len,
-                            wk->bss->cbss.bssid, NULL, 0, 0);
-        wk->auth_transaction = 2;
-
-        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(ifmgd, wk->timeout);
-
-        return RX_MGMT_NONE;
-}
-
-static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
-                                   bool deauth)
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
@@ -1026,21 +780,11 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!ifmgd->associated))
                 return;
 
-        memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
 
         ifmgd->associated = NULL;
         memset(ifmgd->bssid, 0, ETH_ALEN);
 
-        if (deauth) {
-                kfree(ifmgd->old_associate_work);
-                ifmgd->old_associate_work = NULL;
-        } else {
-                struct ieee80211_mgd_work *wk = ifmgd->old_associate_work;
-
-                wk->state = IEEE80211_MGD_STATE_IDLE;
-                list_add(&wk->list, &ifmgd->work_list);
-        }
-
         /*
          * we need to commit the associated = NULL change because the
          * scan code uses that to determine whether this iface should
@@ -1059,9 +803,11 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_carrier_off(sdata->dev);
 
         rcu_read_lock();
-        sta = sta_info_get(local, bssid);
-        if (sta)
+        sta = sta_info_get(sdata, bssid);
+        if (sta) {
+                set_sta_flags(sta, WLAN_STA_DISASSOC);
                 ieee80211_sta_tear_down_BA_sessions(sta);
+        }
         rcu_read_unlock();
 
         changed |= ieee80211_reset_erp_info(sdata);
@@ -1072,8 +818,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_wmm_default(sdata);
 
-        ieee80211_recalc_idle(local);
-
         /* channel(_type) changes are handled by ieee80211_hw_config */
         local->oper_channel_type = NL80211_CHAN_NO_HT;
 
@@ -1096,57 +840,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         changed |= BSS_CHANGED_BSSID;
         ieee80211_bss_info_change_notify(sdata, changed);
 
-        rcu_read_lock();
-
-        sta = sta_info_get(local, bssid);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        sta_info_unlink(&sta);
-
-        rcu_read_unlock();
-
-        sta_info_destroy(sta);
-}
-
-static enum rx_mgmt_action __must_check
-ieee80211_associate(struct ieee80211_sub_if_data *sdata,
-                    struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        wk->tries++;
-        if (wk->tries > IEEE80211_ASSOC_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: association with AP %pM"
-                       " timed out\n",
-                       sdata->dev->name, wk->bss->cbss.bssid);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
-
-                /*
-                 * We might have a pending scan which had no chance to run yet
-                 * due to work needing to be done. Hence, queue the STAs work
-                 * again for that.
-                 */
-                ieee80211_queue_work(&local->hw, &ifmgd->work);
-                return RX_MGMT_CFG80211_ASSOC_TO;
-        }
-
-        printk(KERN_DEBUG "%s: associate with AP %pM (try %d)\n",
-               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
-        ieee80211_send_assoc(sdata, wk);
-
-        wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
-        run_again(ifmgd, wk->timeout);
-
-        return RX_MGMT_NONE;
+        sta_info_destroy_addr(sdata, bssid);
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -1172,8 +866,8 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *ssid;
 
-        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
-        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
+        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+        ieee80211_send_probe_req(sdata, ifmgd->associated->bssid,
                                  ssid + 2, ssid[1], NULL, 0);
 
         ifmgd->probe_send_count++;
@@ -1187,12 +881,15 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         bool already = false;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (sdata->local->scanning)
                 return;
 
+        if (sdata->local->tmp_channel)
+                return;
+
         mutex_lock(&ifmgd->mtx);
 
         if (!ifmgd->associated)
@@ -1201,7 +898,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         if (beacon && net_ratelimit())
                 printk(KERN_DEBUG "%s: detected beacon loss from AP "
-                       "- sending probe request\n", sdata->dev->name);
+                       "- sending probe request\n", sdata->name);
 #endif
 
         /*
@@ -1254,88 +951,8 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
 
-static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgd_work *wk)
-{
-        wk->state = IEEE80211_MGD_STATE_IDLE;
-        printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
-}
-
-
-static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgd_work *wk,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
-{
-        u8 *pos;
-        struct ieee802_11_elems elems;
-
-        pos = mgmt->u.auth.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-        if (!elems.challenge)
-                return;
-        ieee80211_send_auth(sdata, 3, wk->auth_alg,
-                            elems.challenge - 2, elems.challenge_len + 2,
-                            wk->bss->cbss.bssid,
-                            wk->key, wk->key_len, wk->key_idx);
-        wk->auth_transaction = 4;
-}
-
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgd_work *wk,
-                       struct ieee80211_mgmt *mgmt, size_t len)
-{
-        u16 auth_alg, auth_transaction, status_code;
-
-        if (wk->state != IEEE80211_MGD_STATE_AUTH)
-                return RX_MGMT_NONE;
-
-        if (len < 24 + 6)
-                return RX_MGMT_NONE;
-
-        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
-                return RX_MGMT_NONE;
-
-        if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
-                return RX_MGMT_NONE;
-
-        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
-        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
-        status_code = le16_to_cpu(mgmt->u.auth.status_code);
-
-        if (auth_alg != wk->auth_alg ||
-            auth_transaction != wk->auth_transaction)
-                return RX_MGMT_NONE;
-
-        if (status_code != WLAN_STATUS_SUCCESS) {
-                list_del(&wk->list);
-                kfree(wk);
-                return RX_MGMT_CFG80211_AUTH;
-        }
-
-        switch (wk->auth_alg) {
-        case WLAN_AUTH_OPEN:
-        case WLAN_AUTH_LEAP:
-        case WLAN_AUTH_FT:
-                ieee80211_auth_completed(sdata, wk);
-                return RX_MGMT_CFG80211_AUTH;
-        case WLAN_AUTH_SHARED_KEY:
-                if (wk->auth_transaction == 4) {
-                        ieee80211_auth_completed(sdata, wk);
-                        return RX_MGMT_CFG80211_AUTH;
-                } else
-                        ieee80211_auth_challenge(sdata, wk, mgmt, len);
-                break;
-        }
-
-        return RX_MGMT_NONE;
-}
-
-
 static enum rx_mgmt_action __must_check
 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_mgd_work *wk,
                          struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -1347,22 +964,15 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         ASSERT_MGD_MTX(ifmgd);
 
-        if (wk)
-                bssid = wk->bss->cbss.bssid;
-        else
-                bssid = ifmgd->associated->cbss.bssid;
+        bssid = ifmgd->associated->bssid;
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
         printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
-                        sdata->dev->name, bssid, reason_code);
+                        sdata->name, bssid, reason_code);
 
-        if (!wk) {
-                ieee80211_set_disassoc(sdata, true);
-        } else {
-                list_del(&wk->list);
-                kfree(wk);
-        }
+        ieee80211_set_disassoc(sdata);
+        ieee80211_recalc_idle(sdata->local);
 
         return RX_MGMT_CFG80211_DEAUTH;
 }
@@ -1383,122 +993,72 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!ifmgd->associated))
                 return RX_MGMT_NONE;
 
-        if (WARN_ON(memcmp(ifmgd->associated->cbss.bssid, mgmt->sa, ETH_ALEN)))
+        if (WARN_ON(memcmp(ifmgd->associated->bssid, mgmt->sa, ETH_ALEN)))
                 return RX_MGMT_NONE;
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
         printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
-                        sdata->dev->name, mgmt->sa, reason_code);
+                        sdata->name, mgmt->sa, reason_code);
 
-        ieee80211_set_disassoc(sdata, false);
+        ieee80211_set_disassoc(sdata);
+        ieee80211_recalc_idle(sdata->local);
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_mgd_work *wk,
-                             struct ieee80211_mgmt *mgmt, size_t len,
-                             bool reassoc)
+static bool ieee80211_assoc_success(struct ieee80211_work *wk,
+                                    struct ieee80211_mgmt *mgmt, size_t len)
 {
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
+        struct cfg80211_bss *cbss = wk->assoc.bss;
+        u8 *pos;
         u32 rates, basic_rates;
-        u16 capab_info, status_code, aid;
+        u16 capab_info, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
-        u8 *pos;
         u32 changed = 0;
-        int i, j;
-        bool have_higher_than_11mbit = false, newsta = false;
+        int i, j, err;
+        bool have_higher_than_11mbit = false;
         u16 ap_ht_cap_flags;
 
-        /*
-         * AssocResp and ReassocResp have identical structure, so process both
-         * of them in this function.
-         */
-
-        if (len < 24 + 6)
-                return RX_MGMT_NONE;
-
-        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
-                return RX_MGMT_NONE;
+        /* AssocResp and ReassocResp have identical structure */
 
-        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
-        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
-
-        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
-               "status=%d aid=%d)\n",
-               sdata->dev->name, reassoc ? "Rea" : "A", mgmt->sa,
-               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
-
-        pos = mgmt->u.assoc_resp.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-
-        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
-            elems.timeout_int && elems.timeout_int_len == 5 &&
-            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
-                u32 tu, ms;
-                tu = get_unaligned_le32(elems.timeout_int + 1);
-                ms = tu * 1024 / 1000;
-                printk(KERN_DEBUG "%s: AP rejected association temporarily; "
-                       "comeback duration %u TU (%u ms)\n",
-                       sdata->dev->name, tu, ms);
-                wk->timeout = jiffies + msecs_to_jiffies(ms);
-                if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        run_again(ifmgd, jiffies + msecs_to_jiffies(ms));
-                return RX_MGMT_NONE;
-        }
-
-        if (status_code != WLAN_STATUS_SUCCESS) {
-                printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
-                       sdata->dev->name, status_code);
-                wk->state = IEEE80211_MGD_STATE_IDLE;
-                return RX_MGMT_CFG80211_ASSOC;
-        }
+        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->dev->name, aid);
+                       "set\n", sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        pos = mgmt->u.assoc_resp.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
         if (!elems.supp_rates) {
                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
-                       sdata->dev->name);
-                return RX_MGMT_NONE;
+                       sdata->name);
+                return false;
         }
 
-        printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
         ifmgd->aid = aid;
 
-        rcu_read_lock();
-
-        /* Add STA entry for the AP */
-        sta = sta_info_get(local, wk->bss->cbss.bssid);
+        sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
         if (!sta) {
-                newsta = true;
-
-                rcu_read_unlock();
-
-                sta = sta_info_alloc(sdata, wk->bss->cbss.bssid, GFP_KERNEL);
-                if (!sta) {
-                        printk(KERN_DEBUG "%s: failed to alloc STA entry for"
-                               " the AP\n", sdata->dev->name);
-                        return RX_MGMT_NONE;
-                }
-
-                set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
-                                   WLAN_STA_ASSOC_AP);
-                if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
-                        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
-
-                rcu_read_lock();
+                printk(KERN_DEBUG "%s: failed to alloc STA entry for"
+                       " the AP\n", sdata->name);
+                return false;
         }
 
+        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
+                           WLAN_STA_ASSOC_AP);
+        if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
+                set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+
         rates = 0;
         basic_rates = 0;
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
@@ -1561,40 +1121,40 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (elems.wmm_param)
                 set_sta_flags(sta, WLAN_STA_WME);
 
-        if (newsta) {
-                int err = sta_info_insert(sta);
-                if (err) {
-                        printk(KERN_DEBUG "%s: failed to insert STA entry for"
-                               " the AP (error %d)\n", sdata->dev->name, err);
-                        rcu_read_unlock();
-                        return RX_MGMT_NONE;
-                }
+        err = sta_info_insert(sta);
+        sta = NULL;
+        if (err) {
+                printk(KERN_DEBUG "%s: failed to insert STA entry for"
+                       " the AP (error %d)\n", sdata->name, err);
+                return false;
         }
 
-        rcu_read_unlock();
-
         if (elems.wmm_param)
                 ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                          elems.wmm_param_len);
         else
                 ieee80211_set_wmm_default(sdata);
 
+        local->oper_channel = wk->chan;
+
         if (elems.ht_info_elem && elems.wmm_param &&
-            (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
+            (sdata->local->hw.queues >= 4) &&
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               wk->bss->cbss.bssid,
-                                               ap_ht_cap_flags);
-
-        /* delete work item -- must be before set_associated for PS */
-        list_del(&wk->list);
+                                               cbss->bssid, ap_ht_cap_flags);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        /* this will take ownership of wk */
-        ieee80211_set_associated(sdata, wk, changed);
+        ieee80211_set_associated(sdata, cbss, changed);
+
+        /*
+         * If we're using 4-addr mode, let the AP know that we're
+         * doing so, so that it can create the STA VLAN on its side
+         */
+        if (ifmgd->use_4addr)
+                ieee80211_send_4addr_nullfunc(local, sdata);
 
         /*
          * Start timer to probe the connection to the AP now.
@@ -1603,7 +1163,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
         mod_beacon_timer(sdata);
 
-        return RX_MGMT_CFG80211_ASSOC;
+        return true;
 }
 
 
@@ -1618,6 +1178,13 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         int freq;
         struct ieee80211_bss *bss;
         struct ieee80211_channel *channel;
+        bool need_ps = false;
+
+        if (sdata->u.mgd.associated) {
+                bss = (void *)sdata->u.mgd.associated->priv;
+                /* not previously set so we may need to recalc */
+                need_ps = !bss->dtim_period;
+        }
 
         if (elems->ds_params && elems->ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
@@ -1637,8 +1204,14 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         if (!sdata->u.mgd.associated)
                 return;
 
+        if (need_ps) {
+                mutex_lock(&local->iflist_mtx);
+                ieee80211_recalc_ps(local, -1);
+                mutex_unlock(&local->iflist_mtx);
+        }
+
         if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
-            (memcmp(mgmt->bssid, sdata->u.mgd.associated->cbss.bssid,
+            (memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid,
                                                         ETH_ALEN) == 0)) {
                 struct ieee80211_channel_sw_ie *sw_elem =
                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
@@ -1648,19 +1221,19 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
 
 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_mgd_work *wk,
-                                         struct ieee80211_mgmt *mgmt, size_t len,
-                                         struct ieee80211_rx_status *rx_status)
+                                         struct sk_buff *skb)
 {
+        struct ieee80211_mgmt *mgmt = (void *)skb->data;
         struct ieee80211_if_managed *ifmgd;
-        size_t baselen;
+        struct ieee80211_rx_status *rx_status = (void *) skb->cb;
+        size_t baselen, len = skb->len;
         struct ieee802_11_elems elems;
 
         ifmgd = &sdata->u.mgd;
 
         ASSERT_MGD_MTX(ifmgd);
 
-        if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+        if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -1672,17 +1245,8 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
-        /* direct probe may be part of the association flow */
-        if (wk && wk->state == IEEE80211_MGD_STATE_PROBE) {
-                printk(KERN_DEBUG "%s: direct probe responded\n",
-                       sdata->dev->name);
-                wk->tries = 0;
-                wk->state = IEEE80211_MGD_STATE_AUTH;
-                WARN_ON(ieee80211_authenticate(sdata, wk) != RX_MGMT_NONE);
-        }
-
         if (ifmgd->associated &&
-            memcmp(mgmt->bssid, ifmgd->associated->cbss.bssid, ETH_ALEN) == 0 &&
+            memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0 &&
             ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL)) {
                 ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
@@ -1755,7 +1319,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (!ifmgd->associated)
                 return;
 
-        bssid = ifmgd->associated->cbss.bssid;
+        bssid = ifmgd->associated->bssid;
 
         /*
          * And in theory even frames from a different AP we were just
@@ -1768,7 +1332,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: cancelling probereq poll due "
-                               "to a received beacon\n", sdata->dev->name);
+                               "to a received beacon\n", sdata->name);
                 }
 #endif
                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
@@ -1846,7 +1410,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, bssid);
+                sta = sta_info_get(sdata, bssid);
                 if (WARN_ON(!sta)) {
                         rcu_read_unlock();
                         return;
@@ -1892,12 +1456,8 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
         fc = le16_to_cpu(mgmt->frame_control);
 
         switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-        case IEEE80211_STYPE_AUTH:
-        case IEEE80211_STYPE_ASSOC_RESP:
-        case IEEE80211_STYPE_REASSOC_RESP:
         case IEEE80211_STYPE_DEAUTH:
         case IEEE80211_STYPE_DISASSOC:
         case IEEE80211_STYPE_ACTION:
@@ -1915,7 +1475,6 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
-        struct ieee80211_mgd_work *wk;
         enum rx_mgmt_action rma = RX_MGMT_NONE;
         u16 fc;
 
@@ -1926,29 +1485,28 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mutex_lock(&ifmgd->mtx);
 
         if (ifmgd->associated &&
-            memcmp(ifmgd->associated->cbss.bssid, mgmt->bssid,
-                                                        ETH_ALEN) == 0) {
+            memcmp(ifmgd->associated->bssid, mgmt->bssid, ETH_ALEN) == 0) {
                 switch (fc & IEEE80211_FCTL_STYPE) {
                 case IEEE80211_STYPE_BEACON:
                         ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
                                                  rx_status);
                         break;
                 case IEEE80211_STYPE_PROBE_RESP:
-                        ieee80211_rx_mgmt_probe_resp(sdata, NULL, mgmt,
-                                                     skb->len, rx_status);
+                        ieee80211_rx_mgmt_probe_resp(sdata, skb);
                         break;
                 case IEEE80211_STYPE_DEAUTH:
-                        rma = ieee80211_rx_mgmt_deauth(sdata, NULL,
-                                                       mgmt, skb->len);
+                        rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
                         break;
                 case IEEE80211_STYPE_DISASSOC:
                         rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                         break;
                 case IEEE80211_STYPE_ACTION:
-                        /* XXX: differentiate, can only happen for CSA now! */
+                        if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
+                                break;
+
                         ieee80211_sta_process_chanswitch(sdata,
                                         &mgmt->u.action.u.chan_switch.sw_elem,
-                                        ifmgd->associated);
+                                        (void *)ifmgd->associated->priv);
                         break;
                 }
                 mutex_unlock(&ifmgd->mtx);
@@ -1958,12 +1516,10 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                         /* no action */
                         break;
                 case RX_MGMT_CFG80211_DEAUTH:
-                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len,
-                                             NULL);
+                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
                         break;
                 case RX_MGMT_CFG80211_DISASSOC:
-                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len,
-                                               NULL);
+                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
                         break;
                 default:
                         WARN(1, "unexpected: %d", rma);
@@ -1971,58 +1527,11 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
-        list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
-                        continue;
-
-                switch (fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_PROBE_RESP:
-                        ieee80211_rx_mgmt_probe_resp(sdata, wk, mgmt, skb->len,
-                                                     rx_status);
-                        break;
-                case IEEE80211_STYPE_AUTH:
-                        rma = ieee80211_rx_mgmt_auth(sdata, wk, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_ASSOC_RESP:
-                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
-                                                           skb->len, false);
-                        break;
-                case IEEE80211_STYPE_REASSOC_RESP:
-                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
-                                                           skb->len, true);
-                        break;
-                case IEEE80211_STYPE_DEAUTH:
-                        rma = ieee80211_rx_mgmt_deauth(sdata, wk, mgmt,
-                                                       skb->len);
-                        break;
-                }
-                /*
-                 * We've processed this frame for that work, so it can't
-                 * belong to another work struct.
-                 * NB: this is also required for correctness because the
-                 * called functions can free 'wk', and for 'rma'!
-                 */
-                break;
-        }
-
         mutex_unlock(&ifmgd->mtx);
 
-        switch (rma) {
-        case RX_MGMT_NONE:
-                /* no action */
-                break;
-        case RX_MGMT_CFG80211_AUTH:
-                cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_ASSOC:
-                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_DEAUTH:
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len, NULL);
-                break;
-        default:
-                WARN(1, "unexpected: %d", rma);
-        }
+        if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
+            (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH)
+                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
 
  out:
         kfree_skb(skb);
@@ -2050,12 +1559,8 @@ static void ieee80211_sta_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd;
         struct sk_buff *skb;
-        struct ieee80211_mgd_work *wk, *tmp;
-        LIST_HEAD(free_work);
-        enum rx_mgmt_action rma;
-        bool anybusy = false;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (local->scanning)
@@ -2086,7 +1591,7 @@ static void ieee80211_sta_work(struct work_struct *work)
             ifmgd->associated) {
                 u8 bssid[ETH_ALEN];
 
-                memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+                memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
                 if (time_is_after_jiffies(ifmgd->probe_timeout))
                         run_again(ifmgd, ifmgd->probe_timeout);
 
@@ -2108,7 +1613,8 @@ static void ieee80211_sta_work(struct work_struct *work)
                         printk(KERN_DEBUG "No probe response from AP %pM"
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
-                        ieee80211_set_disassoc(sdata, true);
+                        ieee80211_set_disassoc(sdata);
+                        ieee80211_recalc_idle(local);
                         mutex_unlock(&ifmgd->mtx);
                         /*
                          * must be outside lock due to cfg80211,
@@ -2122,87 +1628,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                 }
         }
 
-
-        ieee80211_recalc_idle(local);
-
-        list_for_each_entry_safe(wk, tmp, &ifmgd->work_list, list) {
-                if (time_is_after_jiffies(wk->timeout)) {
-                        /*
-                         * This work item isn't supposed to be worked on
-                         * right now, but take care to adjust the timer
-                         * properly.
-                         */
-                        run_again(ifmgd, wk->timeout);
-                        continue;
-                }
-
-                switch (wk->state) {
-                default:
-                        WARN_ON(1);
-                        /* fall through */
-                case IEEE80211_MGD_STATE_IDLE:
-                        /* nothing */
-                        rma = RX_MGMT_NONE;
-                        break;
-                case IEEE80211_MGD_STATE_PROBE:
-                        rma = ieee80211_direct_probe(sdata, wk);
-                        break;
-                case IEEE80211_MGD_STATE_AUTH:
-                        rma = ieee80211_authenticate(sdata, wk);
-                        break;
-                case IEEE80211_MGD_STATE_ASSOC:
-                        rma = ieee80211_associate(sdata, wk);
-                        break;
-                }
-
-                switch (rma) {
-                case RX_MGMT_NONE:
-                        /* no action required */
-                        break;
-                case RX_MGMT_CFG80211_AUTH_TO:
-                case RX_MGMT_CFG80211_ASSOC_TO:
-                        list_del(&wk->list);
-                        list_add(&wk->list, &free_work);
-                        wk->tries = rma; /* small abuse but only local */
-                        break;
-                default:
-                        WARN(1, "unexpected: %d", rma);
-                }
-        }
-
-        list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (wk->state != IEEE80211_MGD_STATE_IDLE) {
-                        anybusy = true;
-                        break;
-                }
-        }
-        if (!anybusy &&
-            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
-                ieee80211_queue_delayed_work(&local->hw,
-                                             &local->scan_work,
-                                             round_jiffies_relative(0));
-
         mutex_unlock(&ifmgd->mtx);
-
-        list_for_each_entry_safe(wk, tmp, &free_work, list) {
-                switch (wk->tries) {
-                case RX_MGMT_CFG80211_AUTH_TO:
-                        cfg80211_send_auth_timeout(sdata->dev,
-                                                   wk->bss->cbss.bssid);
-                        break;
-                case RX_MGMT_CFG80211_ASSOC_TO:
-                        cfg80211_send_assoc_timeout(sdata->dev,
-                                                    wk->bss->cbss.bssid);
-                        break;
-                default:
-                        WARN(1, "unexpected: %d", wk->tries);
-                }
-
-                list_del(&wk->list);
-                kfree(wk);
-        }
-
-        ieee80211_recalc_idle(local);
 }
 
 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
@@ -2311,14 +1737,14 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         skb_queue_head_init(&ifmgd->skb_queue);
 
-        INIT_LIST_HEAD(&ifmgd->work_list);
-
-        ifmgd->capab = WLAN_CAPABILITY_ESS;
         ifmgd->flags = 0;
-        if (sdata->local->hw.queues >= 4)
-                ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
 
         mutex_init(&ifmgd->mtx);
+
+        if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
+                ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
+        else
+                ifmgd->req_smps = IEEE80211_SMPS_OFF;
 }
 
 /* scan finished notification */
@@ -2349,12 +1775,34 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
 }
 
 /* config hooks */
+static enum work_done_result
+ieee80211_probe_auth_done(struct ieee80211_work *wk,
+                          struct sk_buff *skb)
+{
+        if (!skb) {
+                cfg80211_send_auth_timeout(wk->sdata->dev, wk->filter_ta);
+                return WORK_DONE_DESTROY;
+        }
+
+        if (wk->type == IEEE80211_WORK_AUTH) {
+                cfg80211_send_rx_auth(wk->sdata->dev, skb->data, skb->len);
+                return WORK_DONE_DESTROY;
+        }
+
+        mutex_lock(&wk->sdata->u.mgd.mtx);
+        ieee80211_rx_mgmt_probe_resp(wk->sdata, skb);
+        mutex_unlock(&wk->sdata->u.mgd.mtx);
+
+        wk->type = IEEE80211_WORK_AUTH;
+        wk->probe_auth.tries = 0;
+        return WORK_DONE_REQUEUE;
+}
+
 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
                        struct cfg80211_auth_request *req)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *ssid;
-        struct ieee80211_mgd_work *wk;
+        struct ieee80211_work *wk;
         u16 auth_alg;
 
         switch (req->auth_type) {
@@ -2378,7 +1826,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         if (!wk)
                 return -ENOMEM;
 
-        wk->bss = (void *)req->bss;
+        memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
 
         if (req->ie && req->ie_len) {
                 memcpy(wk->ie, req->ie, req->ie_len);
@@ -2386,68 +1834,95 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         }
 
         if (req->key && req->key_len) {
-                wk->key_len = req->key_len;
-                wk->key_idx = req->key_idx;
-                memcpy(wk->key, req->key, req->key_len);
+                wk->probe_auth.key_len = req->key_len;
+                wk->probe_auth.key_idx = req->key_idx;
+                memcpy(wk->probe_auth.key, req->key, req->key_len);
         }
 
         ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
-        memcpy(wk->ssid, ssid + 2, ssid[1]);
-        wk->ssid_len = ssid[1];
+        memcpy(wk->probe_auth.ssid, ssid + 2, ssid[1]);
+        wk->probe_auth.ssid_len = ssid[1];
 
-        wk->state = IEEE80211_MGD_STATE_PROBE;
-        wk->auth_alg = auth_alg;
-        wk->timeout = jiffies; /* run right away */
+        wk->probe_auth.algorithm = auth_alg;
+        wk->probe_auth.privacy = req->bss->capability & WLAN_CAPABILITY_PRIVACY;
 
-        /*
-         * XXX: if still associated need to tell AP that we're going
-         *      to sleep and then change channel etc.
-         */
-        sdata->local->oper_channel = req->bss->channel;
-        ieee80211_hw_config(sdata->local, 0);
-
-        mutex_lock(&ifmgd->mtx);
-        list_add(&wk->list, &sdata->u.mgd.work_list);
-        mutex_unlock(&ifmgd->mtx);
+        /* if we already have a probe, don't probe again */
+        if (req->bss->proberesp_ies)
+                wk->type = IEEE80211_WORK_AUTH;
+        else
+                wk->type = IEEE80211_WORK_DIRECT_PROBE;
+        wk->chan = req->bss->channel;
+        wk->sdata = sdata;
+        wk->done = ieee80211_probe_auth_done;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
+        ieee80211_add_work(wk);
         return 0;
 }
 
-int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
-                        struct cfg80211_assoc_request *req)
+static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
+                                                  struct sk_buff *skb)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_mgd_work *wk, *found = NULL;
-        int i, err;
+        struct ieee80211_mgmt *mgmt;
+        u16 status;
 
-        mutex_lock(&ifmgd->mtx);
+        if (!skb) {
+                cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
+                return WORK_DONE_DESTROY;
+        }
 
-        list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (&wk->bss->cbss == req->bss &&
-                    wk->state == IEEE80211_MGD_STATE_IDLE) {
-                        found = wk;
-                        break;
+        mgmt = (void *)skb->data;
+        status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+
+        if (status == WLAN_STATUS_SUCCESS) {
+                mutex_lock(&wk->sdata->u.mgd.mtx);
+                if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
+                        mutex_unlock(&wk->sdata->u.mgd.mtx);
+                        /* oops -- internal error -- send timeout for now */
+                        cfg80211_send_assoc_timeout(wk->sdata->dev,
+                                                    wk->filter_ta);
+                        return WORK_DONE_DESTROY;
                 }
+                mutex_unlock(&wk->sdata->u.mgd.mtx);
         }
 
-        if (!found) {
-                err = -ENOLINK;
-                goto out;
-        }
+        cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
+        return WORK_DONE_DESTROY;
+}
 
-        list_del(&found->list);
+int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_assoc_request *req)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_bss *bss = (void *)req->bss->priv;
+        struct ieee80211_work *wk;
+        const u8 *ssid;
+        int i;
 
-        wk = krealloc(found, sizeof(*wk) + req->ie_len, GFP_KERNEL);
-        if (!wk) {
-                list_add(&found->list, &ifmgd->work_list);
-                err = -ENOMEM;
-                goto out;
+        mutex_lock(&ifmgd->mtx);
+        if (ifmgd->associated) {
+                if (!req->prev_bssid ||
+                    memcmp(req->prev_bssid, ifmgd->associated->bssid,
+                           ETH_ALEN)) {
+                        /*
+                         * We are already associated and the request was not a
+                         * reassociation request from the current BSS, so
+                         * reject it.
+                         */
+                        mutex_unlock(&ifmgd->mtx);
+                        return -EALREADY;
+                }
+
+                /* Trying to reassociate - clear previous association state */
+                ieee80211_set_disassoc(sdata);
         }
+        mutex_unlock(&ifmgd->mtx);
 
-        list_add(&wk->list, &ifmgd->work_list);
+        wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
+        if (!wk)
+                return -ENOMEM;
 
         ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
+        ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
 
         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
@@ -2455,8 +1930,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
 
-        sdata->local->oper_channel = req->bss->channel;
-        ieee80211_hw_config(sdata->local, 0);
 
         if (req->ie && req->ie_len) {
                 memcpy(wk->ie, req->ie, req->ie_len);
@@ -2464,12 +1937,55 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         } else
                 wk->ie_len = 0;
 
+        wk->assoc.bss = req->bss;
+
+        memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
+
+        /* new association always uses requested smps mode */
+        if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
+                if (ifmgd->powersave)
+                        ifmgd->ap_smps = IEEE80211_SMPS_DYNAMIC;
+                else
+                        ifmgd->ap_smps = IEEE80211_SMPS_OFF;
+        } else
+                ifmgd->ap_smps = ifmgd->req_smps;
+
+        wk->assoc.smps = ifmgd->ap_smps;
+        /*
+         * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
+         * We still associate in non-HT mode (11a/b/g) if any one of these
+         * ciphers is configured as pairwise.
+         * We can set this to true for non-11n hardware, that'll be checked
+         * separately along with the peer capabilities.
+         */
+        wk->assoc.use_11n = !(ifmgd->flags & IEEE80211_STA_DISABLE_11N);
+        wk->assoc.capability = req->bss->capability;
+        wk->assoc.wmm_used = bss->wmm_used;
+        wk->assoc.supp_rates = bss->supp_rates;
+        wk->assoc.supp_rates_len = bss->supp_rates_len;
+        wk->assoc.ht_information_ie =
+                ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_INFORMATION);
+
+        if (bss->wmm_used && bss->uapsd_supported &&
+            (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
+                wk->assoc.uapsd_used = true;
+                ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
+        } else {
+                wk->assoc.uapsd_used = false;
+                ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
+        }
+
+        ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+        memcpy(wk->assoc.ssid, ssid + 2, ssid[1]);
+        wk->assoc.ssid_len = ssid[1];
+
         if (req->prev_bssid)
-                memcpy(wk->prev_bssid, req->prev_bssid, ETH_ALEN);
+                memcpy(wk->assoc.prev_bssid, req->prev_bssid, ETH_ALEN);
 
-        wk->state = IEEE80211_MGD_STATE_ASSOC;
-        wk->tries = 0;
-        wk->timeout = jiffies; /* run right away */
+        wk->type = IEEE80211_WORK_ASSOC;
+        wk->chan = req->bss->channel;
+        wk->sdata = sdata;
+        wk->done = ieee80211_assoc_done;
 
         if (req->use_mfp) {
                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
@@ -2484,57 +2000,73 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         else
                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
-
-        err = 0;
-
- out:
-        mutex_unlock(&ifmgd->mtx);
-        return err;
+        ieee80211_add_work(wk);
+        return 0;
 }
 
 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                          struct cfg80211_deauth_request *req,
                          void *cookie)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_mgd_work *wk;
-        const u8 *bssid = NULL;
+        struct ieee80211_work *wk;
+        const u8 *bssid = req->bss->bssid;
 
         mutex_lock(&ifmgd->mtx);
 
-        if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
+        if (ifmgd->associated == req->bss) {
                 bssid = req->bss->bssid;
-                ieee80211_set_disassoc(sdata, true);
-        } else list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (&wk->bss->cbss == req->bss) {
-                        bssid = req->bss->bssid;
-                        list_del(&wk->list);
-                        kfree(wk);
+                ieee80211_set_disassoc(sdata);
+                mutex_unlock(&ifmgd->mtx);
+        } else {
+                bool not_auth_yet = false;
+
+                mutex_unlock(&ifmgd->mtx);
+
+                mutex_lock(&local->work_mtx);
+                list_for_each_entry(wk, &local->work_list, list) {
+                        if (wk->sdata != sdata)
+                                continue;
+
+                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
+                            wk->type != IEEE80211_WORK_AUTH &&
+                            wk->type != IEEE80211_WORK_ASSOC)
+                                continue;
+
+                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
+                                continue;
+
+                        not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
+                        list_del_rcu(&wk->list);
+                        free_work(wk);
                         break;
                 }
-        }
+                mutex_unlock(&local->work_mtx);
 
-        /*
-         * cfg80211 should catch this ... but it's racy since
-         * we can receive a deauth frame, process it, hand it
-         * to cfg80211 while that's in a locked section already
-         * trying to tell us that the user wants to disconnect.
-         */
-        if (!bssid) {
-                mutex_unlock(&ifmgd->mtx);
-                return -ENOLINK;
+                /*
+                 * If somebody requests authentication and we haven't
+                 * sent out an auth frame yet there's no need to send
+                 * out a deauth frame either. If the state was PROBE,
+                 * then this is the case. If it's AUTH we have sent a
+                 * frame, and if it's IDLE we have completed the auth
+                 * process already.
+                 */
+                if (not_auth_yet) {
+                        __cfg80211_auth_canceled(sdata->dev, bssid);
+                        return 0;
+                }
         }
 
-        mutex_unlock(&ifmgd->mtx);
-
         printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
-               sdata->dev->name, bssid, req->reason_code);
+               sdata->name, bssid, req->reason_code);
 
         ieee80211_send_deauth_disassoc(sdata, bssid,
                         IEEE80211_STYPE_DEAUTH, req->reason_code,
                         cookie);
 
+        ieee80211_recalc_idle(sdata->local);
+
         return 0;
 }
 
@@ -2552,20 +2084,58 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
          * to cfg80211 while that's in a locked section already
          * trying to tell us that the user wants to disconnect.
          */
-        if (&ifmgd->associated->cbss != req->bss) {
+        if (ifmgd->associated != req->bss) {
                 mutex_unlock(&ifmgd->mtx);
                 return -ENOLINK;
         }
 
         printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
-               sdata->dev->name, req->bss->bssid, req->reason_code);
+               sdata->name, req->bss->bssid, req->reason_code);
 
-        ieee80211_set_disassoc(sdata, false);
+        ieee80211_set_disassoc(sdata);
 
         mutex_unlock(&ifmgd->mtx);
 
         ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
                         IEEE80211_STYPE_DISASSOC, req->reason_code,
                         cookie);
+
+        ieee80211_recalc_idle(sdata->local);
+
+        return 0;
+}
+
+int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_channel_type channel_type,
+                         const u8 *buf, size_t len, u64 *cookie)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct sk_buff *skb;
+
+        /* Check that we are on the requested channel for transmission */
+        if ((chan != local->tmp_channel ||
+             channel_type != local->tmp_channel_type) &&
+            (chan != local->oper_channel ||
+             channel_type != local->oper_channel_type))
+                return -EBUSY;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + len);
+        if (!skb)
+                return -ENOMEM;
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        memcpy(skb_put(skb, len), buf, len);
+
+        if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
+                IEEE80211_SKB_CB(skb)->flags |=
+                        IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX |
+                IEEE80211_TX_CTL_REQ_TX_STATUS;
+        skb->dev = sdata->dev;
+        ieee80211_tx_skb(sdata, skb);
+
+        *cookie = (unsigned long) skb;
         return 0;
 }
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
new file mode 100644
index 000000000000..c36b1911987a
--- /dev/null
+++ b/net/mac80211/offchannel.c
@@ -0,0 +1,170 @@
+/*
+ * Off-channel operation helpers
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+/*
+ * inform AP that we will go to sleep so that it will buffer the frames
+ * while we scan
+ */
+static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        local->offchannel_ps_enabled = false;
+
+        /* FIXME: what to do when local->pspolling is true? */
+
+        del_timer_sync(&local->dynamic_ps_timer);
+        cancel_work_sync(&local->dynamic_ps_enable_work);
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                local->offchannel_ps_enabled = true;
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+
+        if (!(local->offchannel_ps_enabled) ||
+            !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+                /*
+                 * If power save was enabled, no need to send a nullfunc
+                 * frame because AP knows that we are sleeping. But if the
+                 * hardware is creating the nullfunc frame for power save
+                 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
+                 * enabled) and power save was enabled, the firmware just
+                 * sent a null frame with power save disabled. So we need
+                 * to send a new nullfunc frame to inform the AP that we
+                 * are again sleeping.
+                 */
+                ieee80211_send_nullfunc(local, sdata, 1);
+}
+
+/* inform AP that we are awake again, unless power save is enabled */
+static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        if (!local->ps_sdata)
+                ieee80211_send_nullfunc(local, sdata, 0);
+        else if (local->offchannel_ps_enabled) {
+                /*
+                 * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
+                 * will send a nullfunc frame with the powersave bit set
+                 * even though the AP already knows that we are sleeping.
+                 * This could be avoided by sending a null frame with power
+                 * save bit disabled before enabling the power save, but
+                 * this doesn't gain anything.
+                 *
+                 * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
+                 * to send a nullfunc frame because AP already knows that
+                 * we are sleeping, let's just enable power save mode in
+                 * hardware.
+                 */
+                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        } else if (local->hw.conf.dynamic_ps_timeout > 0) {
+                /*
+                 * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
+                 * had been running before leaving the operating channel,
+                 * restart the timer now and send a nullfunc frame to inform
+                 * the AP that we are awake.
+                 */
+                ieee80211_send_nullfunc(local, sdata, 0);
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+        }
+}
+
+void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                /* disable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
+
+                /*
+                 * only handle non-STA interfaces here, STA interfaces
+                 * are handled in ieee80211_offchannel_stop_station(),
+                 * e.g., from the background scan state machine.
+                 *
+                 * In addition, do not stop monitor interface to allow it to be
+                 * used from user space controlled off-channel operations.
+                 */
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        netif_tx_stop_all_queues(sdata->dev);
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
+
+void ieee80211_offchannel_stop_station(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        /*
+         * notify the AP about us leaving the channel and stop all STA interfaces
+         */
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        netif_tx_stop_all_queues(sdata->dev);
+                        if (sdata->u.mgd.associated)
+                                ieee80211_offchannel_ps_enable(sdata);
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
+
+void ieee80211_offchannel_return(struct ieee80211_local *local,
+                                 bool enable_beaconing)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                /* Tell AP we're back */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.mgd.associated)
+                                ieee80211_offchannel_ps_disable(sdata);
+                }
+
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        netif_tx_wake_all_queues(sdata->dev);
+
+                /* re-enable beaconing */
+                if (enable_beaconing &&
+                    (sdata->vif.type == NL80211_IFTYPE_AP ||
+                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT))
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index e535f1c988fe..0e64484e861c 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -10,9 +10,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
-        unsigned long flags;
 
         ieee80211_scan_cancel(local);
 
@@ -56,22 +54,21 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         rcu_read_unlock();
 
         /* remove STAs */
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list) {
-                if (local->ops->sta_notify) {
+                if (sta->uploaded) {
                         sdata = sta->sdata;
                         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                                 sdata = container_of(sdata->bss,
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
-                                       &sta->sta);
+                        drv_sta_remove(local, sdata, &sta->sta);
                 }
 
                 mesh_plink_quiesce(sta);
         }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        mutex_unlock(&local->sta_mtx);
 
         /* remove all interfaces */
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -93,17 +90,14 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                         break;
                 }
 
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
 
                 /* disable beaconing */
                 ieee80211_bss_info_change_notify(sdata,
                         BSS_CHANGED_BEACON_ENABLED);
 
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = sdata->dev->dev_addr;
-                drv_remove_interface(local, &conf);
+                drv_remove_interface(local, &sdata->vif);
         }
 
         /* stop hardware - this must stop RX */
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index b33efc4fc267..6d0bd198af19 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -10,6 +10,7 @@
 
 #include <linux/kernel.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include "rate.h"
 #include "ieee80211_i.h"
 #include "debugfs.h"
@@ -145,7 +146,7 @@ static const struct file_operations rcname_ops = {
 };
 #endif
 
-struct rate_control_ref *rate_control_alloc(const char *name,
+static struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local)
 {
         struct dentry *debugfsdir = NULL;
@@ -163,8 +164,7 @@ struct rate_control_ref *rate_control_alloc(const char *name,
 #ifdef CONFIG_MAC80211_DEBUGFS
         debugfsdir = debugfs_create_dir("rc", local->hw.wiphy->debugfsdir);
         local->debugfs.rcdir = debugfsdir;
-        local->debugfs.rcname = debugfs_create_file("name", 0400, debugfsdir,
-                                                    ref, &rcname_ops);
+        debugfs_create_file("name", 0400, debugfsdir, ref, &rcname_ops);
 #endif
 
         ref->priv = ref->ops->alloc(&local->hw, debugfsdir);
@@ -188,9 +188,7 @@ static void rate_control_release(struct kref *kref)
         ctrl_ref->ops->free(ctrl_ref->priv);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
-        debugfs_remove(ctrl_ref->local->debugfs.rcname);
-        ctrl_ref->local->debugfs.rcname = NULL;
-        debugfs_remove(ctrl_ref->local->debugfs.rcdir);
+        debugfs_remove_recursive(ctrl_ref->local->debugfs.rcdir);
         ctrl_ref->local->debugfs.rcdir = NULL;
 #endif
 
@@ -210,6 +208,27 @@ static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
         return ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc));
 }
 
+static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
+{
+        u8 i;
+
+        if (basic_rates == 0)
+                return; /* assume basic rates unknown and accept rate */
+        if (*idx < 0)
+                return;
+        if (basic_rates & (1 << *idx))
+                return; /* selected rate is a basic rate */
+
+        for (i = *idx + 1; i <= max_rate_idx; i++) {
+                if (basic_rates & (1 << i)) {
+                        *idx = i;
+                        return;
+                }
+        }
+
+        /* could not find a basic rate; use original selection */
+}
+
 bool rate_control_send_low(struct ieee80211_sta *sta,
                            void *priv_sta,
                            struct ieee80211_tx_rate_control *txrc)
@@ -221,12 +240,48 @@ bool rate_control_send_low(struct ieee80211_sta *sta,
                 info->control.rates[0].count =
                         (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
                         1 : txrc->hw->max_rate_tries;
+                if (!sta && txrc->ap)
+                        rc_send_low_broadcast(&info->control.rates[0].idx,
+                                              txrc->bss_conf->basic_rates,
+                                              txrc->sband->n_bitrates);
                 return true;
         }
         return false;
 }
 EXPORT_SYMBOL(rate_control_send_low);
 
+static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
+                                int n_bitrates, u32 mask)
+{
+        int j;
+
+        /* See whether the selected rate or anything below it is allowed. */
+        for (j = rate->idx; j >= 0; j--) {
+                if (mask & (1 << j)) {
+                        /* Okay, found a suitable rate. Use it. */
+                        rate->idx = j;
+                        return;
+                }
+        }
+
+        /* Try to find a higher rate that would be allowed */
+        for (j = rate->idx + 1; j < n_bitrates; j++) {
+                if (mask & (1 << j)) {
+                        /* Okay, found a suitable rate. Use it. */
+                        rate->idx = j;
+                        return;
+                }
+        }
+
+        /*
+         * Uh.. No suitable rate exists. This should not really happen with
+         * sane TX rate mask configurations. However, should someone manage to
+         * configure supported rates and TX rate mask in incompatible way,
+         * allow the frame to be transmitted with whatever the rate control
+         * selected.
+         */
+}
+
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct sta_info *sta,
                            struct ieee80211_tx_rate_control *txrc)
@@ -236,6 +291,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_sta *ista = NULL;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         int i;
+        u32 mask;
 
         if (sta) {
                 ista = &sta->sta;
@@ -248,23 +304,34 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                 info->control.rates[i].count = 1;
         }
 
-        if (sta && sdata->force_unicast_rateidx > -1) {
-                info->control.rates[0].idx = sdata->force_unicast_rateidx;
-        } else {
-                ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
-                info->flags |= IEEE80211_TX_INTFL_RCALGO;
-        }
+        if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                return;
+
+        ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
 
         /*
-         * try to enforce the maximum rate the user wanted
+         * Try to enforce the rateidx mask the user wanted. skip this if the
+         * default mask (allow all rates) is used to save some processing for
+         * the common case.
          */
-        if (sdata->max_ratectrl_rateidx > -1)
+        mask = sdata->rc_rateidx_mask[info->band];
+        if (mask != (1 << txrc->sband->n_bitrates) - 1) {
+                if (sta) {
+                        /* Filter out rates that the STA does not support */
+                        mask &= sta->sta.supp_rates[info->band];
+                }
+                /*
+                 * Make sure the rate index selected for each TX rate is
+                 * included in the configured mask and change the rate indexes
+                 * if needed.
+                 */
                 for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                        /* Rate masking supports only legacy rates for now */
                         if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS)
                                 continue;
-                        info->control.rates[i].idx =
-                                min_t(s8, info->control.rates[i].idx,
-                                      sdata->max_ratectrl_rateidx);
+                        rate_idx_match_mask(&info->control.rates[i],
+                                            txrc->sband->n_bitrates, mask);
+                }
         }
 
         BUG_ON(info->control.rates[0].idx < 0);
@@ -287,9 +354,16 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
         struct rate_control_ref *ref, *old;
 
         ASSERT_RTNL();
+
         if (local->open_count)
                 return -EBUSY;
 
+        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
+                if (WARN_ON(!local->ops->set_rts_threshold))
+                        return -EINVAL;
+                return 0;
+        }
+
         ref = rate_control_alloc(name, local);
         if (!ref) {
                 printk(KERN_WARNING "%s: Failed to select rate control "
@@ -308,7 +382,6 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
                "algorithm '%s'\n", wiphy_name(local->hw.wiphy),
                ref->ops->name);
 
-
         return 0;
 }
 
@@ -317,6 +390,10 @@ void rate_control_deinitialize(struct ieee80211_local *local)
         struct rate_control_ref *ref;
 
         ref = local->rate_ctrl;
+
+        if (!ref)
+                return;
+
         local->rate_ctrl = NULL;
         rate_control_put(ref);
 }
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 2ab5ad9e71ce..065a96190e32 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -26,10 +26,6 @@ struct rate_control_ref {
         struct kref kref;
 };
 
-/* Get a reference to the rate control algorithm. If `name' is NULL, get the
- * first available algorithm. */
-struct rate_control_ref *rate_control_alloc(const char *name,
-                                            struct ieee80211_local *local);
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct sta_info *sta,
                            struct ieee80211_tx_rate_control *txrc);
@@ -44,10 +40,11 @@ static inline void rate_control_tx_status(struct ieee80211_local *local,
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        if (likely(info->flags & IEEE80211_TX_INTFL_RCALGO))
-                ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
+        if (!ref)
+                return;
+
+        ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
 }
 
 
@@ -59,6 +56,9 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         void *priv_sta = sta->rate_ctrl_priv;
         struct ieee80211_supported_band *sband;
 
+        if (!ref)
+                return;
+
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
@@ -66,15 +66,16 @@ static inline void rate_control_rate_init(struct sta_info *sta)
 
 static inline void rate_control_rate_update(struct ieee80211_local *local,
                                     struct ieee80211_supported_band *sband,
-                                    struct sta_info *sta, u32 changed)
+                                    struct sta_info *sta, u32 changed,
+                                    enum nl80211_channel_type oper_chan_type)
 {
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
 
-        if (ref->ops->rate_update)
+        if (ref && ref->ops->rate_update)
                 ref->ops->rate_update(ref->priv, sband, ista,
-                                      priv_sta, changed);
+                                      priv_sta, changed, oper_chan_type);
 }
 
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
@@ -97,7 +98,7 @@ static inline void rate_control_add_sta_debugfs(struct sta_info *sta)
 {
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct rate_control_ref *ref = sta->rate_ctrl;
-        if (sta->debugfs.dir && ref->ops->add_sta_debugfs)
+        if (ref && sta->debugfs.dir && ref->ops->add_sta_debugfs)
                 ref->ops->add_sta_debugfs(ref->priv, sta->rate_ctrl_priv,
                                           sta->debugfs.dir);
 #endif
@@ -107,12 +108,13 @@ static inline void rate_control_remove_sta_debugfs(struct sta_info *sta)
 {
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct rate_control_ref *ref = sta->rate_ctrl;
-        if (ref->ops->remove_sta_debugfs)
+        if (ref && ref->ops->remove_sta_debugfs)
                 ref->ops->remove_sta_debugfs(ref->priv, sta->rate_ctrl_priv);
 #endif
 }
 
-/* functions for rate control related to a device */
+/* Get a reference to the rate control algorithm. If `name' is NULL, get the
+ * first available algorithm. */
 int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
                                  const char *name);
 void rate_control_deinitialize(struct ieee80211_local *local);
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 6e5d68b4e427..818abfae9007 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -50,6 +50,7 @@
 #include <linux/debugfs.h>
 #include <linux/random.h>
 #include <linux/ieee80211.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include "rate.h"
 #include "rc80211_minstrel.h"
diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index a715d9454f64..0e1f12b1b6dd 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -49,6 +49,7 @@
 #include <linux/skbuff.h>
 #include <linux/debugfs.h>
 #include <linux/ieee80211.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include "rc80211_minstrel.h"
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 699d3ed869c4..aeda65466f3e 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -13,6 +13,7 @@
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/debugfs.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include "rate.h"
 #include "mesh.h"
@@ -157,9 +158,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
 
         /* In case nothing happened during the previous control interval, turn
          * the sharpening factor on. */
-        period = (HZ * pinfo->sampling_period + 500) / 1000;
-        if (!period)
-                period = 1;
+        period = msecs_to_jiffies(pinfo->sampling_period);
         if (jiffies - spinfo->last_sample > 2 * period)
                 spinfo->sharp_cnt = pinfo->sharpen_duration;
 
@@ -190,7 +189,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         rate_control_pid_normalize(pinfo, sband->n_bitrates);
 
         /* Compute the proportional, integral and derivative errors. */
-        err_prop = (pinfo->target << RC_PID_ARITH_SHIFT) - pf;
+        err_prop = (pinfo->target - pf) << RC_PID_ARITH_SHIFT;
 
         err_avg = spinfo->err_avg_sc >> pinfo->smoothing_shift;
         spinfo->err_avg_sc = spinfo->err_avg_sc - err_avg + err_prop;
@@ -252,9 +251,7 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
         }
 
         /* Update PID controller state. */
-        period = (HZ * pinfo->sampling_period + 500) / 1000;
-        if (!period)
-                period = 1;
+        period = msecs_to_jiffies(pinfo->sampling_period);
         if (time_after(jiffies, spinfo->last_sample + period))
                 rate_control_pid_sample(pinfo, sband, sta, spinfo);
 }
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index 45667054a5f3..47438b4a9af5 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -12,6 +12,7 @@
 #include <linux/netdevice.h>
 #include <linux/types.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 
 #include <net/mac80211.h>
 #include "rate.h"
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7170bf4565a8..04ea07f0e78a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2,7 +2,7 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
- * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2007-2010  Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -10,6 +10,7 @@
  */
 
 #include <linux/jiffies.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -27,11 +28,6 @@
 #include "tkip.h"
 #include "wme.h"
 
-static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                                           struct tid_ampdu_rx *tid_agg_rx,
-                                           struct sk_buff *skb,
-                                           u16 mpdu_seq_num,
-                                           int bar_req);
 /*
  * monitor mode reception
  *
@@ -39,11 +35,8 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  * only useful for monitoring.
  */
 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
-                                           struct sk_buff *skb,
-                                           int rtap_len)
+                                           struct sk_buff *skb)
 {
-        skb_pull(skb, rtap_len);
-
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
                 if (likely(skb->len > FCS_LEN))
                         skb_trim(skb, skb->len - FCS_LEN);
@@ -59,15 +52,14 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
 }
 
 static inline int should_drop_frame(struct sk_buff *skb,
-                                    int present_fcs_len,
-                                    int radiotap_len)
+                                    int present_fcs_len)
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
                 return 1;
-        if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
+        if (unlikely(skb->len < 16 + present_fcs_len))
                 return 1;
         if (ieee80211_is_ctl(hdr->frame_control) &&
             !ieee80211_is_pspoll(hdr->frame_control) &&
@@ -95,10 +87,6 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
         if (len & 1) /* padding for RX_FLAGS if necessary */
                 len++;
 
-        /* make sure radiotap starts at a naturally aligned address */
-        if (len % 8)
-                len = roundup(len, 8);
-
         return len;
 }
 
@@ -116,6 +104,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_radiotap_header *rthdr;
         unsigned char *pos;
+        u16 rx_flags = 0;
 
         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
         memset(rthdr, 0, rtap_len);
@@ -134,7 +123,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
         /* IEEE80211_RADIOTAP_TSFT */
         if (status->flag & RX_FLAG_TSFT) {
-                *(__le64 *)pos = cpu_to_le64(status->mactime);
+                put_unaligned_le64(status->mactime, pos);
                 rthdr->it_present |=
                         cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
                 pos += 8;
@@ -166,17 +155,20 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos++;
 
         /* IEEE80211_RADIOTAP_CHANNEL */
-        *(__le16 *)pos = cpu_to_le16(status->freq);
+        put_unaligned_le16(status->freq, pos);
         pos += 2;
         if (status->band == IEEE80211_BAND_5GHZ)
-                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
-                                             IEEE80211_CHAN_5GHZ);
+                put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
+                                   pos);
+        else if (status->flag & RX_FLAG_HT)
+                put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
+                                   pos);
         else if (rate->flags & IEEE80211_RATE_ERP_G)
-                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
-                                             IEEE80211_CHAN_2GHZ);
+                put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
+                                   pos);
         else
-                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
-                                             IEEE80211_CHAN_2GHZ);
+                put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
+                                   pos);
         pos += 2;
 
         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
@@ -205,10 +197,11 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
         /* IEEE80211_RADIOTAP_RX_FLAGS */
         /* ensure 2 byte alignment for the 2 byte field as required */
-        if ((pos - (unsigned char *)rthdr) & 1)
+        if ((pos - (u8 *)rthdr) & 1)
                 pos++;
         if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
-                *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADPLCP);
+                rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
+        put_unaligned_le16(rx_flags, pos);
         pos += 2;
 }
 
@@ -227,7 +220,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         struct sk_buff *skb, *skb2;
         struct net_device *prev_dev = NULL;
         int present_fcs_len = 0;
-        int rtap_len = 0;
 
         /*
          * First, we may need to make a copy of the skb because
@@ -237,25 +229,23 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
          * We don't need to, of course, if we aren't going to return
          * the SKB because it has a bad FCS/PLCP checksum.
          */
-        if (status->flag & RX_FLAG_RADIOTAP)
-                rtap_len = ieee80211_get_radiotap_len(origskb->data);
-        else
-                /* room for the radiotap header based on driver features */
-                needed_headroom = ieee80211_rx_radiotap_len(local, status);
+
+        /* room for the radiotap header based on driver features */
+        needed_headroom = ieee80211_rx_radiotap_len(local, status);
 
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                 present_fcs_len = FCS_LEN;
 
         if (!local->monitors) {
-                if (should_drop_frame(origskb, present_fcs_len, rtap_len)) {
+                if (should_drop_frame(origskb, present_fcs_len)) {
                         dev_kfree_skb(origskb);
                         return NULL;
                 }
 
-                return remove_monitor_info(local, origskb, rtap_len);
+                return remove_monitor_info(local, origskb);
         }
 
-        if (should_drop_frame(origskb, present_fcs_len, rtap_len)) {
+        if (should_drop_frame(origskb, present_fcs_len)) {
                 /* only need to expand headroom if necessary */
                 skb = origskb;
                 origskb = NULL;
@@ -279,16 +269,14 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                  */
                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
 
-                origskb = remove_monitor_info(local, origskb, rtap_len);
+                origskb = remove_monitor_info(local, origskb);
 
                 if (!skb)
                         return origskb;
         }
 
-        /* if necessary, prepend radiotap information */
-        if (!(status->flag & RX_FLAG_RADIOTAP))
-                ieee80211_add_rx_radiotap_header(local, skb, rate,
-                                                 needed_headroom);
+        /* prepend radiotap information */
+        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
 
         skb_reset_mac_header(skb);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -296,15 +284,15 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         skb->protocol = htons(ETH_P_802_2);
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
                         continue;
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
                         continue;
 
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
                 if (prev_dev) {
                         skb2 = skb_clone(skb, GFP_ATOMIC);
                         if (skb2) {
@@ -374,7 +362,9 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
  * boundary. In the case of regular frames, this simply means aligning the
  * payload to a four-byte boundary (because either the IP header is directly
  * contained, or IV/RFC1042 headers that have a length divisible by four are
- * in front of it).
+ * in front of it).  If the payload data is not properly aligned and the
+ * architecture doesn't support efficient unaligned operations, mac80211
+ * will align the data.
  *
  * With A-MSDU frames, however, the payload data address must yield two modulo
  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
@@ -388,25 +378,10 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
  */
 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
-        int hdrlen;
-
-#ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
-        return;
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        WARN_ONCE((unsigned long)rx->skb->data & 1,
+                  "unaligned packet at 0x%p\n", rx->skb->data);
 #endif
-
-        if (WARN_ONCE((unsigned long)rx->skb->data & 1,
-                      "unaligned packet at 0x%p\n", rx->skb->data))
-                return;
-
-        if (!ieee80211_is_data_present(hdr->frame_control))
-                return;
-
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (rx->flags & IEEE80211_RX_AMSDU)
-                hdrlen += ETH_HLEN;
-        WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
-                  "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
 }
 
 
@@ -489,7 +464,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        char *dev_addr = rx->dev->dev_addr;
+        char *dev_addr = rx->sdata->vif.addr;
 
         if (ieee80211_is_data(hdr->frame_control)) {
                 if (is_multicast_ether_addr(hdr->addr1)) {
@@ -518,7 +493,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
                 if (ieee80211_is_action(hdr->frame_control)) {
                         mgmt = (struct ieee80211_mgmt *)hdr;
-                        if (mgmt->u.action.category != PLINK_CATEGORY)
+                        if (mgmt->u.action.category != MESH_PLINK_CATEGORY)
                                 return RX_DROP_MONITOR;
                         return RX_CONTINUE;
                 }
@@ -543,6 +518,242 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
+#define SEQ_MODULO 0x1000
+#define SEQ_MASK   0xfff
+
+static inline int seq_less(u16 sq1, u16 sq2)
+{
+        return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
+}
+
+static inline u16 seq_inc(u16 sq)
+{
+        return (sq + 1) & SEQ_MASK;
+}
+
+static inline u16 seq_sub(u16 sq1, u16 sq2)
+{
+        return (sq1 - sq2) & SEQ_MASK;
+}
+
+
+static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
+                                            struct tid_ampdu_rx *tid_agg_rx,
+                                            int index,
+                                            struct sk_buff_head *frames)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate = NULL;
+        struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
+        struct ieee80211_rx_status *status;
+
+        if (!skb)
+                goto no_frame;
+
+        status = IEEE80211_SKB_RXCB(skb);
+
+        /* release the reordered frames to stack */
+        sband = hw->wiphy->bands[status->band];
+        if (!(status->flag & RX_FLAG_HT))
+                rate = &sband->bitrates[status->rate_idx];
+        tid_agg_rx->stored_mpdu_num--;
+        tid_agg_rx->reorder_buf[index] = NULL;
+        __skb_queue_tail(frames, skb);
+
+no_frame:
+        tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+}
+
+static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
+                                             struct tid_ampdu_rx *tid_agg_rx,
+                                             u16 head_seq_num,
+                                             struct sk_buff_head *frames)
+{
+        int index;
+
+        while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
+                index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                                        tid_agg_rx->buf_size;
+                ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
+        }
+}
+
+/*
+ * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
+ * the skb was added to the buffer longer than this time ago, the earlier
+ * frames that have not yet been received are assumed to be lost and the skb
+ * can be released for processing. This may also release other skb's from the
+ * reorder buffer if there are no additional gaps between the frames.
+ */
+#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
+
+/*
+ * As this function belongs to the RX path it must be under
+ * rcu_read_lock protection. It returns false if the frame
+ * can be processed immediately, true if it was consumed.
+ */
+static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                             struct tid_ampdu_rx *tid_agg_rx,
+                                             struct sk_buff *skb,
+                                             struct sk_buff_head *frames)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        u16 sc = le16_to_cpu(hdr->seq_ctrl);
+        u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
+        u16 head_seq_num, buf_size;
+        int index;
+
+        buf_size = tid_agg_rx->buf_size;
+        head_seq_num = tid_agg_rx->head_seq_num;
+
+        /* frame with out of date sequence number */
+        if (seq_less(mpdu_seq_num, head_seq_num)) {
+                dev_kfree_skb(skb);
+                return true;
+        }
+
+        /*
+         * If frame the sequence number exceeds our buffering window
+         * size release some previous frames to make room for this one.
+         */
+        if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
+                head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
+                /* release stored frames up to new head to stack */
+                ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num,
+                                                 frames);
+        }
+
+        /* Now the new frame is always in the range of the reordering buffer */
+
+        index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
+
+        /* check if we already stored this frame */
+        if (tid_agg_rx->reorder_buf[index]) {
+                dev_kfree_skb(skb);
+                return true;
+        }
+
+        /*
+         * If the current MPDU is in the right order and nothing else
+         * is stored we can process it directly, no need to buffer it.
+         */
+        if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
+            tid_agg_rx->stored_mpdu_num == 0) {
+                tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+                return false;
+        }
+
+        /* put the frame in the reordering buffer */
+        tid_agg_rx->reorder_buf[index] = skb;
+        tid_agg_rx->reorder_time[index] = jiffies;
+        tid_agg_rx->stored_mpdu_num++;
+        /* release the buffer until next missing frame */
+        index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                                tid_agg_rx->buf_size;
+        if (!tid_agg_rx->reorder_buf[index] &&
+            tid_agg_rx->stored_mpdu_num > 1) {
+                /*
+                 * No buffers ready to be released, but check whether any
+                 * frames in the reorder buffer have timed out.
+                 */
+                int j;
+                int skipped = 1;
+                for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
+                     j = (j + 1) % tid_agg_rx->buf_size) {
+                        if (!tid_agg_rx->reorder_buf[j]) {
+                                skipped++;
+                                continue;
+                        }
+                        if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
+                                        HT_RX_REORDER_BUF_TIMEOUT))
+                                break;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "%s: release an RX reorder "
+                                       "frame due to timeout on earlier "
+                                       "frames\n",
+                                       wiphy_name(hw->wiphy));
+#endif
+                        ieee80211_release_reorder_frame(hw, tid_agg_rx,
+                                                        j, frames);
+
+                        /*
+                         * Increment the head seq# also for the skipped slots.
+                         */
+                        tid_agg_rx->head_seq_num =
+                                (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
+                        skipped = 0;
+                }
+        } else while (tid_agg_rx->reorder_buf[index]) {
+                ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
+                index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                                        tid_agg_rx->buf_size;
+        }
+
+        return true;
+}
+
+/*
+ * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
+ * true if the MPDU was buffered, false if it should be processed.
+ */
+static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
+                                       struct sk_buff_head *frames)
+{
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_local *local = rx->local;
+        struct ieee80211_hw *hw = &local->hw;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct sta_info *sta = rx->sta;
+        struct tid_ampdu_rx *tid_agg_rx;
+        u16 sc;
+        int tid;
+
+        if (!ieee80211_is_data_qos(hdr->frame_control))
+                goto dont_reorder;
+
+        /*
+         * filter the QoS data rx stream according to
+         * STA/TID and check if this STA/TID is on aggregation
+         */
+
+        if (!sta)
+                goto dont_reorder;
+
+        tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+
+        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
+                goto dont_reorder;
+
+        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+
+        /* qos null data frames are excluded */
+        if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
+                goto dont_reorder;
+
+        /* new, potentially un-ordered, ampdu frame - process it */
+
+        /* reset session timer */
+        if (tid_agg_rx->timeout)
+                mod_timer(&tid_agg_rx->session_timer,
+                          TU_TO_EXP_TIME(tid_agg_rx->timeout));
+
+        /* if this mpdu is fragmented - terminate rx aggregation session */
+        sc = le16_to_cpu(hdr->seq_ctrl);
+        if (sc & IEEE80211_SCTL_FRAG) {
+                ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
+                        tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
+                dev_kfree_skb(skb);
+                return;
+        }
+
+        if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
+                return;
+
+ dont_reorder:
+        __skb_queue_tail(frames, skb);
+}
 
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
@@ -603,7 +814,9 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int keyidx;
         int hdrlen;
         ieee80211_rx_result result = RX_DROP_UNUSABLE;
@@ -644,6 +857,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_CONTINUE;
 
+        /* start without a key */
+        rx->key = NULL;
+
         if (rx->sta)
                 stakey = rcu_dereference(rx->sta->key);
 
@@ -657,8 +873,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                         return RX_CONTINUE;
         } else if (mmie_keyidx >= 0) {
                 /* Broadcast/multicast robust management frame / BIP */
-                if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
-                    (rx->status->flag & RX_FLAG_IV_STRIPPED))
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
                         return RX_CONTINUE;
 
                 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
@@ -690,8 +906,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                  * we somehow allow the driver to tell us which key
                  * the hardware used if this flag is set?
                  */
-                if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
-                    (rx->status->flag & RX_FLAG_IV_STRIPPED))
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
                         return RX_CONTINUE;
 
                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -727,8 +943,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         /* Check for weak IVs if possible */
         if (rx->sta && rx->key->conf.alg == ALG_WEP &&
             ieee80211_is_data(hdr->frame_control) &&
-            (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
-             !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
+            (!(status->flag & RX_FLAG_IV_STRIPPED) ||
+             !(status->flag & RX_FLAG_DECRYPTED)) &&
             ieee80211_wep_is_weak_iv(rx->skb, rx->key))
                 rx->sta->wep_weak_iv_count++;
 
@@ -748,7 +964,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         }
 
         /* either the frame has been decrypted or will be dropped */
-        rx->status->flag |= RX_FLAG_DECRYPTED;
+        status->flag |= RX_FLAG_DECRYPTED;
 
         return result;
 }
@@ -792,53 +1008,45 @@ static void ap_sta_ps_start(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
 
         atomic_inc(&sdata->bss->num_sta_ps);
-        set_sta_flags(sta, WLAN_STA_PS);
-        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
+        set_sta_flags(sta, WLAN_STA_PS_STA);
+        drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
-               sdata->dev->name, sta->sta.addr, sta->sta.aid);
+               sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
-static int ap_sta_ps_end(struct sta_info *sta)
+static void ap_sta_ps_end(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        struct ieee80211_local *local = sdata->local;
-        int sent, buffered;
 
         atomic_dec(&sdata->bss->num_sta_ps);
 
-        clear_sta_flags(sta, WLAN_STA_PS);
-        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_AWAKE, &sta->sta);
-
-        if (!skb_queue_empty(&sta->ps_tx_buf))
-                sta_info_clear_tim_bit(sta);
+        clear_sta_flags(sta, WLAN_STA_PS_STA);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
-               sdata->dev->name, sta->sta.addr, sta->sta.aid);
+               sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
-        /* Send all buffered frames to the station */
-        sent = ieee80211_add_pending_skbs(local, &sta->tx_filtered);
-        buffered = ieee80211_add_pending_skbs(local, &sta->ps_tx_buf);
-        sent += buffered;
-        local->total_ps_buffered -= buffered;
-
+        if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %pM aid %d sending %d filtered/%d PS frames "
-               "since STA not sleeping anymore\n", sdata->dev->name,
-               sta->sta.addr, sta->sta.aid, sent - buffered, buffered);
+                printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
+                       sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+                return;
+        }
 
-        return sent;
+        ieee80211_sta_ps_deliver_wakeup(sta);
 }
 
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
         struct sta_info *sta = rx->sta;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         if (!sta)
                 return RX_CONTINUE;
@@ -869,9 +1077,8 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
-        sta->last_signal = rx->status->signal;
-        sta->last_qual = rx->status->qual;
-        sta->last_noise = rx->status->noise;
+        sta->last_signal = status->signal;
+        sta->last_noise = status->noise;
 
         /*
          * Change STA power saving mode only at the end of a frame
@@ -880,7 +1087,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (!ieee80211_has_morefrags(hdr->frame_control) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
-                if (test_sta_flags(sta, WLAN_STA_PS)) {
+                if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
                         /*
                          * Ignore doze->wake transitions that are
                          * indicated by non-data frames, the standard
@@ -891,19 +1098,36 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                          */
                         if (ieee80211_is_data(hdr->frame_control) &&
                             !ieee80211_has_pm(hdr->frame_control))
-                                rx->sent_ps_buffered += ap_sta_ps_end(sta);
+                                ap_sta_ps_end(sta);
                 } else {
                         if (ieee80211_has_pm(hdr->frame_control))
                                 ap_sta_ps_start(sta);
                 }
         }
 
-        /* Drop data::nullfunc frames silently, since they are used only to
-         * control station power saving mode. */
-        if (ieee80211_is_nullfunc(hdr->frame_control)) {
+        /*
+         * Drop (qos-)data::nullfunc frames silently, since they
+         * are used only to control station power saving mode.
+         */
+        if (ieee80211_is_nullfunc(hdr->frame_control) ||
+            ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
-                /* Update counter and free packet here to avoid counting this
-                 * as a dropped packed. */
+
+                /*
+                 * If we receive a 4-addr nullfunc frame from a STA
+                 * that was not moved to a 4-addr STA vlan yet, drop
+                 * the frame to the monitor interface, to make sure
+                 * that hostapd sees it
+                 */
+                if (ieee80211_has_a4(hdr->frame_control) &&
+                    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
+                     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+                      !rx->sdata->u.vlan.sta)))
+                        return RX_DROP_MONITOR;
+                /*
+                 * Update counter and free packet here to avoid
+                 * counting this as a dropped packed.
+                 */
                 sta->rx_packets++;
                 dev_kfree_skb(rx->skb);
                 return RX_QUEUED;
@@ -932,7 +1156,7 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
                        "addr1=%pM addr2=%pM\n",
-                       sdata->dev->name, idx,
+                       sdata->name, idx,
                        jiffies - entry->first_frag_time, entry->seq,
                        entry->last_frag, hdr->addr1, hdr->addr2);
 #endif
@@ -1103,9 +1327,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
-        struct sk_buff *skb;
-        int no_pending_pkts;
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
         __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
 
         if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
@@ -1116,56 +1338,10 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
                 return RX_DROP_UNUSABLE;
 
-        skb = skb_dequeue(&rx->sta->tx_filtered);
-        if (!skb) {
-                skb = skb_dequeue(&rx->sta->ps_tx_buf);
-                if (skb)
-                        rx->local->total_ps_buffered--;
-        }
-        no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
-                skb_queue_empty(&rx->sta->ps_tx_buf);
-
-        if (skb) {
-                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-                struct ieee80211_hdr *hdr =
-                        (struct ieee80211_hdr *) skb->data;
-
-                /*
-                 * Tell TX path to send this frame even though the STA may
-                 * still remain is PS mode after this frame exchange.
-                 */
-                info->flags |= IEEE80211_TX_CTL_PSPOLL_RESPONSE;
-
-#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
-                       rx->sta->sta.addr, rx->sta->sta.aid,
-                       skb_queue_len(&rx->sta->ps_tx_buf));
-#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-
-                /* Use MoreData flag to indicate whether there are more
-                 * buffered frames for this STA */
-                if (no_pending_pkts)
-                        hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
-                else
-                        hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
-
-                ieee80211_add_pending_skb(rx->local, skb);
-
-                if (no_pending_pkts)
-                        sta_info_clear_tim_bit(rx->sta);
-#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        } else if (!rx->sent_ps_buffered) {
-                /*
-                 * FIXME: This can be the result of a race condition between
-                 *        us expiring a frame and the station polling for it.
-                 *        Should we send it a null-func frame indicating we
-                 *        have nothing buffered for it?
-                 */
-                printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
-                       "though there are no buffered frames for it\n",
-                       rx->dev->name, rx->sta->sta.addr);
-#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        }
+        if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
+                ieee80211_sta_ps_deliver_poll_response(rx->sta);
+        else
+                set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
 
         /* Free PS Poll skb here instead of returning RX_DROP that would
          * count as an dropped frame. */
@@ -1206,11 +1382,14 @@ ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 static int
 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
 {
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+
         /*
          * Pass through unencrypted frames if the hardware has
          * decrypted them already.
          */
-        if (rx->status->flag & RX_FLAG_DECRYPTED)
+        if (status->flag & RX_FLAG_DECRYPTED)
                 return 0;
 
         /* Drop unencrypted frames if key is set. */
@@ -1219,13 +1398,28 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
                      ieee80211_is_data(fc) &&
                      (rx->key || rx->sdata->drop_unencrypted)))
                 return -EACCES;
+
+        return 0;
+}
+
+static int
+ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        __le16 fc = hdr->frame_control;
+        int res;
+
+        res = ieee80211_drop_unencrypted(rx, fc);
+        if (unlikely(res))
+                return res;
+
         if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
                 if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
                              rx->key))
                         return -EACCES;
                 /* BIP does not use Protected field, so need to check MMIE */
-                if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb)
-                             && ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
+                if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
+                             ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
                              rx->key))
                         return -EACCES;
                 /*
@@ -1244,10 +1438,19 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
 static int
 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 {
-        struct net_device *dev = rx->dev;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+
+        if (ieee80211_has_a4(hdr->frame_control) &&
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
+                return -1;
 
-        return ieee80211_data_to_8023(rx->skb, dev->dev_addr, sdata->vif.type);
+        if (is_multicast_ether_addr(hdr->addr1) &&
+            ((sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) ||
+             (sdata->vif.type == NL80211_IFTYPE_STATION && sdata->u.mgd.use_4addr)))
+                return -1;
+
+        return ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
 }
 
 /*
@@ -1264,7 +1467,7 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
          * of whether the frame was encrypted or not.
          */
         if (ehdr->h_proto == htons(ETH_P_PAE) &&
-            (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
+            (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
                 return true;
 
@@ -1281,10 +1484,9 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
 static void
 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 {
-        struct net_device *dev = rx->dev;
-        struct ieee80211_local *local = rx->local;
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
+        struct net_device *dev = sdata->dev;
         struct sk_buff *skb, *xmit_skb;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
         struct sta_info *dsta;
 
@@ -1294,7 +1496,8 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
-            (rx->flags & IEEE80211_RX_RA_MATCH)) {
+            (rx->flags & IEEE80211_RX_RA_MATCH) &&
+            (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
                 if (is_multicast_ether_addr(ehdr->h_dest)) {
                         /*
                          * send multicast frames both to higher layers in
@@ -1305,8 +1508,8 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                                 printk(KERN_DEBUG "%s: failed to clone "
                                        "multicast frame\n", dev->name);
                 } else {
-                        dsta = sta_info_get(local, skb->data);
-                        if (dsta && dsta->sdata->dev == dev) {
+                        dsta = sta_info_get(sdata, skb->data);
+                        if (dsta) {
                                 /*
                                  * The destination station is associated to
                                  * this AP (in this VLAN), so send the frame
@@ -1322,7 +1525,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         if (skb) {
                 int align __maybe_unused;
 
-#if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
                 /*
                  * 'align' will only take the values 0 or 2 here
                  * since all frames are required to be aligned
@@ -1337,10 +1540,10 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                                 skb = NULL;
                         } else {
                                 u8 *data = skb->data;
-                                size_t len = skb->len;
-                                u8 *new = __skb_push(skb, align);
-                                memmove(new, data, len);
-                                __skb_trim(skb, len);
+                                size_t len = skb_headlen(skb);
+                                skb->data -= align;
+                                memmove(skb->data, data, len);
+                                skb_set_tail_pointer(skb, len);
                         }
                 }
 #endif
@@ -1365,17 +1568,11 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 {
-        struct net_device *dev = rx->dev;
-        struct ieee80211_local *local = rx->local;
-        u16 ethertype;
-        u8 *payload;
-        struct sk_buff *skb = rx->skb, *frame = NULL;
+        struct net_device *dev = rx->sdata->dev;
+        struct sk_buff *skb = rx->skb;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         __le16 fc = hdr->frame_control;
-        const struct ethhdr *eth;
-        int remaining, err;
-        u8 dst[ETH_ALEN];
-        u8 src[ETH_ALEN];
+        struct sk_buff_head frame_list;
 
         if (unlikely(!ieee80211_is_data(fc)))
                 return RX_CONTINUE;
@@ -1386,94 +1583,34 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_AMSDU))
                 return RX_CONTINUE;
 
-        err = __ieee80211_data_to_8023(rx);
-        if (unlikely(err))
+        if (ieee80211_has_a4(hdr->frame_control) &&
+            rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+            !rx->sdata->u.vlan.sta)
                 return RX_DROP_UNUSABLE;
 
-        skb->dev = dev;
-
-        dev->stats.rx_packets++;
-        dev->stats.rx_bytes += skb->len;
-
-        /* skip the wrapping header */
-        eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
-        if (!eth)
+        if (is_multicast_ether_addr(hdr->addr1) &&
+            ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+              rx->sdata->u.vlan.sta) ||
+             (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
+              rx->sdata->u.mgd.use_4addr)))
                 return RX_DROP_UNUSABLE;
 
-        while (skb != frame) {
-                u8 padding;
-                __be16 len = eth->h_proto;
-                unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
-
-                remaining = skb->len;
-                memcpy(dst, eth->h_dest, ETH_ALEN);
-                memcpy(src, eth->h_source, ETH_ALEN);
-
-                padding = ((4 - subframe_len) & 0x3);
-                /* the last MSDU has no padding */
-                if (subframe_len > remaining)
-                        return RX_DROP_UNUSABLE;
+        skb->dev = dev;
+        __skb_queue_head_init(&frame_list);
 
-                skb_pull(skb, sizeof(struct ethhdr));
-                /* if last subframe reuse skb */
-                if (remaining <= subframe_len + padding)
-                        frame = skb;
-                else {
-                        /*
-                         * Allocate and reserve two bytes more for payload
-                         * alignment since sizeof(struct ethhdr) is 14.
-                         */
-                        frame = dev_alloc_skb(
-                                ALIGN(local->hw.extra_tx_headroom, 4) +
-                                subframe_len + 2);
-
-                        if (frame == NULL)
-                                return RX_DROP_UNUSABLE;
-
-                        skb_reserve(frame,
-                                    ALIGN(local->hw.extra_tx_headroom, 4) +
-                                    sizeof(struct ethhdr) + 2);
-                        memcpy(skb_put(frame, ntohs(len)), skb->data,
-                                ntohs(len));
-
-                        eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
-                                                        padding);
-                        if (!eth) {
-                                dev_kfree_skb(frame);
-                                return RX_DROP_UNUSABLE;
-                        }
-                }
+        ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+                                 rx->sdata->vif.type,
+                                 rx->local->hw.extra_tx_headroom);
 
-                skb_reset_network_header(frame);
-                frame->dev = dev;
-                frame->priority = skb->priority;
-                rx->skb = frame;
-
-                payload = frame->data;
-                ethertype = (payload[6] << 8) | payload[7];
-
-                if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
-                            ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-                           compare_ether_addr(payload,
-                                              bridge_tunnel_header) == 0)) {
-                        /* remove RFC1042 or Bridge-Tunnel
-                         * encapsulation and replace EtherType */
-                        skb_pull(frame, 6);
-                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
-                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
-                } else {
-                        memcpy(skb_push(frame, sizeof(__be16)),
-                               &len, sizeof(__be16));
-                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
-                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
-                }
+        while (!skb_queue_empty(&frame_list)) {
+                rx->skb = __skb_dequeue(&frame_list);
 
                 if (!ieee80211_frame_allowed(rx, fc)) {
-                        if (skb == frame) /* last frame */
-                                return RX_DROP_UNUSABLE;
-                        dev_kfree_skb(frame);
+                        dev_kfree_skb(rx->skb);
                         continue;
                 }
+                dev->stats.rx_packets++;
+                dev->stats.rx_bytes += rx->skb->len;
 
                 ieee80211_deliver_skb(rx);
         }
@@ -1490,12 +1627,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         unsigned int hdrlen;
         struct sk_buff *skb = rx->skb, *fwd_skb;
         struct ieee80211_local *local = rx->local;
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
 
         hdr = (struct ieee80211_hdr *) skb->data;
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
-        sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 
         if (!ieee80211_is_data(hdr->frame_control))
                 return RX_CONTINUE;
@@ -1504,19 +1640,27 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 /* illegal frame */
                 return RX_DROP_MONITOR;
 
-        if (!is_multicast_ether_addr(hdr->addr1) &&
-                        (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6)) {
+        if (mesh_hdr->flags & MESH_FLAGS_AE) {
                 struct mesh_path *mppath;
+                char *proxied_addr;
+                char *mpp_addr;
+
+                if (is_multicast_ether_addr(hdr->addr1)) {
+                        mpp_addr = hdr->addr3;
+                        proxied_addr = mesh_hdr->eaddr1;
+                } else {
+                        mpp_addr = hdr->addr4;
+                        proxied_addr = mesh_hdr->eaddr2;
+                }
 
                 rcu_read_lock();
-                mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
+                mppath = mpp_path_lookup(proxied_addr, sdata);
                 if (!mppath) {
-                        mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
+                        mpp_path_add(proxied_addr, mpp_addr, sdata);
                 } else {
                         spin_lock_bh(&mppath->state_lock);
-                        mppath->exp_time = jiffies;
-                        if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
-                                memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
+                        if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
+                                memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
                         spin_unlock_bh(&mppath->state_lock);
                 }
                 rcu_read_unlock();
@@ -1524,7 +1668,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
         /* Frame has reached destination.  Don't forward */
         if (!is_multicast_ether_addr(hdr->addr1) &&
-                        compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
+            compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
                 return RX_CONTINUE;
 
         mesh_hdr->ttl--;
@@ -1541,15 +1685,17 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
                         if (!fwd_skb && net_ratelimit())
                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
-                                                   rx->dev->name);
+                                                   sdata->name);
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
-                        memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
+                        memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
                         info = IEEE80211_SKB_CB(fwd_skb);
                         memset(info, 0, sizeof(*info));
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         info->control.vif = &rx->sdata->vif;
-                        ieee80211_select_queue(local, fwd_skb);
+                        skb_set_queue_mapping(skb,
+                                ieee80211_select_queue(rx->sdata, fwd_skb));
+                        ieee80211_set_qos_hdr(local, skb);
                         if (is_multicast_ether_addr(fwd_hdr->addr1))
                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
                                                                 fwded_mcast);
@@ -1578,7 +1724,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         }
 
         if (is_multicast_ether_addr(hdr->addr1) ||
-            rx->dev->flags & IFF_PROMISC)
+            sdata->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;
         else
                 return RX_DROP_MONITOR;
@@ -1588,7 +1734,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
-        struct net_device *dev = rx->dev;
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
+        struct ieee80211_local *local = rx->local;
+        struct net_device *dev = sdata->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         __le16 fc = hdr->frame_control;
         int err;
@@ -1599,6 +1747,14 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                 return RX_DROP_MONITOR;
 
+        /*
+         * Allow the cooked monitor interface of an AP to see 4-addr frames so
+         * that a 4-addr station can be detected and moved into a separate VLAN
+         */
+        if (ieee80211_has_a4(hdr->frame_control) &&
+            sdata->vif.type == NL80211_IFTYPE_AP)
+                return RX_DROP_MONITOR;
+
         err = __ieee80211_data_to_8023(rx);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
@@ -1611,13 +1767,20 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += rx->skb->len;
 
+        if (ieee80211_is_data(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1) &&
+            local->hw.conf.dynamic_ps_timeout > 0 && local->ps_sdata) {
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                         msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+        }
+
         ieee80211_deliver_skb(rx);
 
         return RX_QUEUED;
 }
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
+ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
 {
         struct ieee80211_local *local = rx->local;
         struct ieee80211_hw *hw = &local->hw;
@@ -1632,11 +1795,11 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
 
         if (ieee80211_is_back_req(bar->frame_control)) {
                 if (!rx->sta)
-                        return RX_CONTINUE;
+                        return RX_DROP_MONITOR;
                 tid = le16_to_cpu(bar->control) >> 12;
                 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
                                         != HT_AGG_STATE_OPERATIONAL)
-                        return RX_CONTINUE;
+                        return RX_DROP_MONITOR;
                 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
 
                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
@@ -1646,13 +1809,11 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                         mod_timer(&tid_agg_rx->session_timer,
                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
-                /* manage reordering buffer according to requested */
-                /* sequence number */
-                rcu_read_lock();
-                ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
-                                                 start_seq_num, 1);
-                rcu_read_unlock();
-                return RX_DROP_UNUSABLE;
+                /* release stored frames up to start of BAR */
+                ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
+                                                 frames);
+                kfree_skb(skb);
+                return RX_QUEUED;
         }
 
         return RX_CONTINUE;
@@ -1666,7 +1827,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
 
-        if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
+        if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
                 /* Not to own unicast address */
                 return;
         }
@@ -1690,7 +1851,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
         resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(resp, 0, 24);
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
-        memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
@@ -1701,32 +1862,34 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
                mgmt->u.action.u.sa_query.trans_id,
                WLAN_SA_QUERY_TR_ID_LEN);
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
 }
 
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+        struct sk_buff *nskb;
+        struct ieee80211_rx_status *status;
         int len = rx->skb->len;
 
         if (!ieee80211_is_action(mgmt->frame_control))
                 return RX_CONTINUE;
 
-        if (!rx->sta)
-                return RX_DROP_MONITOR;
+        /* drop too small frames */
+        if (len < IEEE80211_MIN_ACTION_SIZE)
+                return RX_DROP_UNUSABLE;
 
-        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
-                return RX_DROP_MONITOR;
+        if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
+                return RX_DROP_UNUSABLE;
 
-        if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
-                return RX_DROP_MONITOR;
+        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
+                return RX_DROP_UNUSABLE;
 
-        /* all categories we currently handle have action_code */
-        if (len < IEEE80211_MIN_ACTION_SIZE + 1)
-                return RX_DROP_MONITOR;
+        if (ieee80211_drop_unencrypted_mgmt(rx))
+                return RX_DROP_UNUSABLE;
 
         switch (mgmt->u.action.category) {
         case WLAN_CATEGORY_BACK:
@@ -1739,7 +1902,11 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
                     sdata->vif.type != NL80211_IFTYPE_AP)
-                        return RX_DROP_MONITOR;
+                        break;
+
+                /* verify action_code is present */
+                if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                        break;
 
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
@@ -1747,45 +1914,49 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                    sizeof(mgmt->u.action.u.addba_req)))
                                 return RX_DROP_MONITOR;
                         ieee80211_process_addba_request(local, rx->sta, mgmt, len);
-                        break;
+                        goto handled;
                 case WLAN_ACTION_ADDBA_RESP:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.addba_resp)))
-                                return RX_DROP_MONITOR;
+                                break;
                         ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
-                        break;
+                        goto handled;
                 case WLAN_ACTION_DELBA:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.delba)))
-                                return RX_DROP_MONITOR;
+                                break;
                         ieee80211_process_delba(sdata, rx->sta, mgmt, len);
-                        break;
+                        goto handled;
                 }
                 break;
         case WLAN_CATEGORY_SPECTRUM_MGMT:
                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
-                        return RX_DROP_MONITOR;
+                        break;
 
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        return RX_DROP_MONITOR;
+                        break;
+
+                /* verify action_code is present */
+                if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                        break;
 
                 switch (mgmt->u.action.u.measurement.action_code) {
                 case WLAN_ACTION_SPCT_MSR_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.measurement)))
-                                return RX_DROP_MONITOR;
+                                break;
                         ieee80211_process_measurement_req(sdata, mgmt, len);
-                        break;
+                        goto handled;
                 case WLAN_ACTION_SPCT_CHL_SWITCH:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.chan_switch)))
-                                return RX_DROP_MONITOR;
+                                break;
 
                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                                return RX_DROP_MONITOR;
+                                break;
 
                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
-                                return RX_DROP_MONITOR;
+                                break;
 
                         return ieee80211_sta_rx_mgmt(sdata, rx->skb);
                 }
@@ -1793,26 +1964,69 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         case WLAN_CATEGORY_SA_QUERY:
                 if (len < (IEEE80211_MIN_ACTION_SIZE +
                            sizeof(mgmt->u.action.u.sa_query)))
-                        return RX_DROP_MONITOR;
+                        break;
+
                 switch (mgmt->u.action.u.sa_query.action) {
                 case WLAN_ACTION_SA_QUERY_REQUEST:
                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                                return RX_DROP_MONITOR;
+                                break;
                         ieee80211_process_sa_query_req(sdata, mgmt, len);
-                        break;
-                case WLAN_ACTION_SA_QUERY_RESPONSE:
-                        /*
-                         * SA Query response is currently only used in AP mode
-                         * and it is processed in user space.
-                         */
-                        return RX_CONTINUE;
+                        goto handled;
                 }
                 break;
-        default:
-                return RX_CONTINUE;
+        case MESH_PLINK_CATEGORY:
+        case MESH_PATH_SEL_CATEGORY:
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
+                break;
         }
 
-        rx->sta->rx_packets++;
+        /*
+         * For AP mode, hostapd is responsible for handling any action
+         * frames that we didn't handle, including returning unknown
+         * ones. For all other modes we will return them to the sender,
+         * setting the 0x80 bit in the action category, as required by
+         * 802.11-2007 7.3.1.11.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                return RX_DROP_MONITOR;
+
+        /*
+         * Getting here means the kernel doesn't know how to handle
+         * it, but maybe userspace does ... include returned frames
+         * so userspace can register for those to know whether ones
+         * it transmitted were processed or returned.
+         */
+        status = IEEE80211_SKB_RXCB(rx->skb);
+
+        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+            cfg80211_rx_action(rx->sdata->dev, status->freq,
+                               rx->skb->data, rx->skb->len,
+                               GFP_ATOMIC))
+                goto handled;
+
+        /* do not return rejected action frames */
+        if (mgmt->u.action.category & 0x80)
+                return RX_DROP_UNUSABLE;
+
+        nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
+                               GFP_ATOMIC);
+        if (nskb) {
+                struct ieee80211_mgmt *mgmt = (void *)nskb->data;
+
+                mgmt->u.action.category |= 0x80;
+                memcpy(mgmt->da, mgmt->sa, ETH_ALEN);
+                memcpy(mgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
+
+                memset(nskb->cb, 0, sizeof(nskb->cb));
+
+                ieee80211_tx_skb(rx->sdata, nskb);
+        }
+
+ handled:
+        if (rx->sta)
+                rx->sta->rx_packets++;
         dev_kfree_skb(rx->skb);
         return RX_QUEUED;
 }
@@ -1820,14 +2034,18 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
-        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
+        ieee80211_rx_result rxs;
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
-        if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
-                return RX_DROP_MONITOR;
+        if (ieee80211_drop_unencrypted_mgmt(rx))
+                return RX_DROP_UNUSABLE;
+
+        rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
+        if (rxs != RX_CONTINUE)
+                return rxs;
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
@@ -1858,11 +2076,11 @@ static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
                  * Some hardware seem to generate incorrect Michael MIC
                  * reports; ignore them to avoid triggering countermeasures.
                  */
-                goto ignore;
+                return;
         }
 
         if (!ieee80211_has_protected(hdr->frame_control))
-                goto ignore;
+                return;
 
         if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
                 /*
@@ -1871,37 +2089,35 @@ static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
                  * group keys and only the AP is sending real multicast
                  * frames in the BSS.
                  */
-                goto ignore;
+                return;
         }
 
         if (!ieee80211_is_data(hdr->frame_control) &&
             !ieee80211_is_auth(hdr->frame_control))
-                goto ignore;
+                return;
 
         mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
                                         GFP_ATOMIC);
- ignore:
-        dev_kfree_skb(rx->skb);
-        rx->skb = NULL;
 }
 
 /* TODO: use IEEE80211_RX_FRAGMENTED */
-static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
+static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
+                                        struct ieee80211_rate *rate)
 {
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_local *local = rx->local;
         struct ieee80211_rtap_hdr {
                 struct ieee80211_radiotap_header hdr;
                 u8 flags;
-                u8 rate;
+                u8 rate_or_pad;
                 __le16 chan_freq;
                 __le16 chan_flags;
         } __attribute__ ((packed)) *rthdr;
         struct sk_buff *skb = rx->skb, *skb2;
         struct net_device *prev_dev = NULL;
-        struct ieee80211_rx_status *status = rx->status;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-        if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
+        if (status->flag & RX_FLAG_INTERNAL_CMTR)
                 goto out_free_skb;
 
         if (skb_headroom(skb) < sizeof(*rthdr) &&
@@ -1913,10 +2129,13 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
         rthdr->hdr.it_present =
                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_RATE) |
                             (1 << IEEE80211_RADIOTAP_CHANNEL));
 
-        rthdr->rate = rx->rate->bitrate / 5;
+        if (rate) {
+                rthdr->rate_or_pad = rate->bitrate / 5;
+                rthdr->hdr.it_present |=
+                        cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
+        }
         rthdr->chan_freq = cpu_to_le16(status->freq);
 
         if (status->band == IEEE80211_BAND_5GHZ)
@@ -1932,7 +2151,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
         skb->protocol = htons(ETH_P_802_2);
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
@@ -1959,7 +2178,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
         } else
                 goto out_free_skb;
 
-        rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
+        status->flag |= RX_FLAG_INTERNAL_CMTR;
         return;
 
  out_free_skb:
@@ -1969,62 +2188,87 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
 
 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
                                          struct ieee80211_rx_data *rx,
-                                         struct sk_buff *skb)
+                                         struct sk_buff *skb,
+                                         struct ieee80211_rate *rate)
 {
+        struct sk_buff_head reorder_release;
         ieee80211_rx_result res = RX_DROP_MONITOR;
 
+        __skb_queue_head_init(&reorder_release);
+
         rx->skb = skb;
         rx->sdata = sdata;
-        rx->dev = sdata->dev;
 
 #define CALL_RXH(rxh)                   \
         do {                            \
                 res = rxh(rx);          \
                 if (res != RX_CONTINUE) \
-                        goto rxh_done;  \
+                        goto rxh_next;  \
         } while (0);
 
+        /*
+         * NB: the rxh_next label works even if we jump
+         *     to it from here because then the list will
+         *     be empty, which is a trivial check
+         */
         CALL_RXH(ieee80211_rx_h_passive_scan)
         CALL_RXH(ieee80211_rx_h_check)
-        CALL_RXH(ieee80211_rx_h_decrypt)
-        CALL_RXH(ieee80211_rx_h_check_more_data)
-        CALL_RXH(ieee80211_rx_h_sta_process)
-        CALL_RXH(ieee80211_rx_h_defragment)
-        CALL_RXH(ieee80211_rx_h_ps_poll)
-        CALL_RXH(ieee80211_rx_h_michael_mic_verify)
-        /* must be after MMIC verify so header is counted in MPDU mic */
-        CALL_RXH(ieee80211_rx_h_remove_qos_control)
-        CALL_RXH(ieee80211_rx_h_amsdu)
+
+        ieee80211_rx_reorder_ampdu(rx, &reorder_release);
+
+        while ((skb = __skb_dequeue(&reorder_release))) {
+                /*
+                 * all the other fields are valid across frames
+                 * that belong to an aMPDU since they are on the
+                 * same TID from the same station
+                 */
+                rx->skb = skb;
+
+                CALL_RXH(ieee80211_rx_h_decrypt)
+                CALL_RXH(ieee80211_rx_h_check_more_data)
+                CALL_RXH(ieee80211_rx_h_sta_process)
+                CALL_RXH(ieee80211_rx_h_defragment)
+                CALL_RXH(ieee80211_rx_h_ps_poll)
+                CALL_RXH(ieee80211_rx_h_michael_mic_verify)
+                /* must be after MMIC verify so header is counted in MPDU mic */
+                CALL_RXH(ieee80211_rx_h_remove_qos_control)
+                CALL_RXH(ieee80211_rx_h_amsdu)
 #ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sdata->vif))
-                CALL_RXH(ieee80211_rx_h_mesh_fwding);
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
-        CALL_RXH(ieee80211_rx_h_data)
-        CALL_RXH(ieee80211_rx_h_ctrl)
-        CALL_RXH(ieee80211_rx_h_action)
-        CALL_RXH(ieee80211_rx_h_mgmt)
+                CALL_RXH(ieee80211_rx_h_data)
+
+                /* special treatment -- needs the queue */
+                res = ieee80211_rx_h_ctrl(rx, &reorder_release);
+                if (res != RX_CONTINUE)
+                        goto rxh_next;
+
+                CALL_RXH(ieee80211_rx_h_action)
+                CALL_RXH(ieee80211_rx_h_mgmt)
 
 #undef CALL_RXH
 
- rxh_done:
-        switch (res) {
-        case RX_DROP_MONITOR:
-                I802_DEBUG_INC(sdata->local->rx_handlers_drop);
-                if (rx->sta)
-                        rx->sta->rx_dropped++;
-                /* fall through */
-        case RX_CONTINUE:
-                ieee80211_rx_cooked_monitor(rx);
-                break;
-        case RX_DROP_UNUSABLE:
-                I802_DEBUG_INC(sdata->local->rx_handlers_drop);
-                if (rx->sta)
-                        rx->sta->rx_dropped++;
-                dev_kfree_skb(rx->skb);
-                break;
-        case RX_QUEUED:
-                I802_DEBUG_INC(sdata->local->rx_handlers_queued);
-                break;
+ rxh_next:
+                switch (res) {
+                case RX_DROP_MONITOR:
+                        I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                        if (rx->sta)
+                                rx->sta->rx_dropped++;
+                        /* fall through */
+                case RX_CONTINUE:
+                        ieee80211_rx_cooked_monitor(rx, rate);
+                        break;
+                case RX_DROP_UNUSABLE:
+                        I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                        if (rx->sta)
+                                rx->sta->rx_dropped++;
+                        dev_kfree_skb(rx->skb);
+                        break;
+                case RX_QUEUED:
+                        I802_DEBUG_INC(sdata->local->rx_handlers_queued);
+                        break;
+                }
         }
 }
 
@@ -2034,15 +2278,17 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                                 struct ieee80211_rx_data *rx,
                                 struct ieee80211_hdr *hdr)
 {
-        u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
         int multicast = is_multicast_ether_addr(hdr->addr1);
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_STATION:
-                if (!bssid)
+                if (!bssid && !sdata->u.mgd.use_4addr)
                         return 0;
                 if (!multicast &&
-                    compare_ether_addr(sdata->dev->dev_addr, hdr->addr1) != 0) {
+                    compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2059,24 +2305,24 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 } else if (!multicast &&
-                           compare_ether_addr(sdata->dev->dev_addr,
+                           compare_ether_addr(sdata->vif.addr,
                                               hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 } else if (!rx->sta) {
                         int rate_idx;
-                        if (rx->status->flag & RX_FLAG_HT)
+                        if (status->flag & RX_FLAG_HT)
                                 rate_idx = 0; /* TODO: HT rates */
                         else
-                                rate_idx = rx->status->rate_idx;
-                        rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
-                                BIT(rate_idx));
+                                rate_idx = status->rate_idx;
+                        rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
+                                        hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
                 }
                 break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (!multicast &&
-                    compare_ether_addr(sdata->dev->dev_addr,
+                    compare_ether_addr(sdata->vif.addr,
                                        hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
@@ -2087,11 +2333,11 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_AP:
                 if (!bssid) {
-                        if (compare_ether_addr(sdata->dev->dev_addr,
+                        if (compare_ether_addr(sdata->vif.addr,
                                                hdr->addr1))
                                 return 0;
                 } else if (!ieee80211_bssid_match(bssid,
-                                        sdata->dev->dev_addr)) {
+                                        sdata->vif.addr)) {
                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2104,8 +2350,6 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                         return 0;
                 break;
         case NL80211_IFTYPE_MONITOR:
-                /* take everything */
-                break;
         case NL80211_IFTYPE_UNSPECIFIED:
         case __NL80211_IFTYPE_AFTER_LAST:
                 /* should never get here */
@@ -2132,29 +2376,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         int prepares;
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
+        struct sta_info *sta, *tmp;
+        bool found_sta = false;
 
         hdr = (struct ieee80211_hdr *)skb->data;
         memset(&rx, 0, sizeof(rx));
         rx.skb = skb;
         rx.local = local;
 
-        rx.status = status;
-        rx.rate = rate;
-
         if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
                 local->dot11ReceivedFragmentCount++;
 
-        rx.sta = sta_info_get(local, hdr->addr2);
-        if (rx.sta) {
-                rx.sdata = rx.sta->sdata;
-                rx.dev = rx.sta->sdata->dev;
-        }
-
-        if ((status->flag & RX_FLAG_MMIC_ERROR)) {
-                ieee80211_rx_michael_mic_report(hdr, &rx);
-                return;
-        }
-
         if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
                      test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
                 rx.flags |= IEEE80211_RX_IN_SCAN;
@@ -2162,284 +2394,92 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         ieee80211_parse_qos(&rx);
         ieee80211_verify_alignment(&rx);
 
-        skb = rx.skb;
-
-        if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
-                rx.flags |= IEEE80211_RX_RA_MATCH;
-                prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
-                if (prepares)
-                        prev = rx.sdata;
-        } else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        continue;
-
-                rx.flags |= IEEE80211_RX_RA_MATCH;
-                prepares = prepare_for_handlers(sdata, &rx, hdr);
-
-                if (!prepares)
-                        continue;
-
-                /*
-                 * frame is destined for this interface, but if it's not
-                 * also for the previous one we handle that after the
-                 * loop to avoid copying the SKB once too much
-                 */
-
-                if (!prev) {
-                        prev = sdata;
-                        continue;
-                }
-
-                /*
-                 * frame was destined for the previous interface
-                 * so invoke RX handlers for it
-                 */
-
-                skb_new = skb_copy(skb, GFP_ATOMIC);
-                if (!skb_new) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: failed to copy "
-                                       "multicast frame for %s\n",
-                                       wiphy_name(local->hw.wiphy),
-                                       prev->dev->name);
-                        continue;
-                }
-                ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
-                prev = sdata;
-        }
-        if (prev)
-                ieee80211_invoke_rx_handlers(prev, &rx, skb);
-        else
-                dev_kfree_skb(skb);
-}
-
-#define SEQ_MODULO 0x1000
-#define SEQ_MASK   0xfff
-
-static inline int seq_less(u16 sq1, u16 sq2)
-{
-        return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
-}
-
-static inline u16 seq_inc(u16 sq)
-{
-        return (sq + 1) & SEQ_MASK;
-}
-
-static inline u16 seq_sub(u16 sq1, u16 sq2)
-{
-        return (sq1 - sq2) & SEQ_MASK;
-}
-
-
-static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
-                                            struct tid_ampdu_rx *tid_agg_rx,
-                                            int index)
-{
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *rate;
-        struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
-        struct ieee80211_rx_status *status;
-
-        if (!skb)
-                goto no_frame;
-
-        status = IEEE80211_SKB_RXCB(skb);
-
-        /* release the reordered frames to stack */
-        sband = hw->wiphy->bands[status->band];
-        if (status->flag & RX_FLAG_HT)
-                rate = sband->bitrates; /* TODO: HT rates */
-        else
-                rate = &sband->bitrates[status->rate_idx];
-        __ieee80211_rx_handle_packet(hw, skb, rate);
-        tid_agg_rx->stored_mpdu_num--;
-        tid_agg_rx->reorder_buf[index] = NULL;
-
-no_frame:
-        tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
-}
-
-
-/*
- * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
- * the skb was added to the buffer longer than this time ago, the earlier
- * frames that have not yet been received are assumed to be lost and the skb
- * can be released for processing. This may also release other skb's from the
- * reorder buffer if there are no additional gaps between the frames.
- */
-#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
-
-/*
- * As it function blongs to Rx path it must be called with
- * the proper rcu_read_lock protection for its flow.
- */
-static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                                           struct tid_ampdu_rx *tid_agg_rx,
-                                           struct sk_buff *skb,
-                                           u16 mpdu_seq_num,
-                                           int bar_req)
-{
-        u16 head_seq_num, buf_size;
-        int index;
-
-        buf_size = tid_agg_rx->buf_size;
-        head_seq_num = tid_agg_rx->head_seq_num;
-
-        /* frame with out of date sequence number */
-        if (seq_less(mpdu_seq_num, head_seq_num)) {
-                dev_kfree_skb(skb);
-                return 1;
-        }
-
-        /* if frame sequence number exceeds our buffering window size or
-         * block Ack Request arrived - release stored frames */
-        if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
-                /* new head to the ordering buffer */
-                if (bar_req)
-                        head_seq_num = mpdu_seq_num;
-                else
-                        head_seq_num =
-                                seq_inc(seq_sub(mpdu_seq_num, buf_size));
-                /* release stored frames up to new head to stack */
-                while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
-                        index = seq_sub(tid_agg_rx->head_seq_num,
-                                tid_agg_rx->ssn)
-                                % tid_agg_rx->buf_size;
-                        ieee80211_release_reorder_frame(hw, tid_agg_rx,
-                                                        index);
+        if (ieee80211_is_data(hdr->frame_control)) {
+                for_each_sta_info(local, hdr->addr2, sta, tmp) {
+                        rx.sta = sta;
+                        found_sta = true;
+                        rx.sdata = sta->sdata;
+
+                        rx.flags |= IEEE80211_RX_RA_MATCH;
+                        prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
+                        if (prepares) {
+                                if (status->flag & RX_FLAG_MMIC_ERROR) {
+                                        if (rx.flags & IEEE80211_RX_RA_MATCH)
+                                                ieee80211_rx_michael_mic_report(hdr, &rx);
+                                } else
+                                        prev = rx.sdata;
+                        }
                 }
-                if (bar_req)
-                        return 1;
-        }
-
-        /* now the new frame is always in the range of the reordering */
-        /* buffer window */
-        index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
-                                % tid_agg_rx->buf_size;
-        /* check if we already stored this frame */
-        if (tid_agg_rx->reorder_buf[index]) {
-                dev_kfree_skb(skb);
-                return 1;
         }
-
-        /* if arrived mpdu is in the right order and nothing else stored */
-        /* release it immediately */
-        if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
-                        tid_agg_rx->stored_mpdu_num == 0) {
-                tid_agg_rx->head_seq_num =
-                        seq_inc(tid_agg_rx->head_seq_num);
-                return 0;
-        }
-
-        /* put the frame in the reordering buffer */
-        tid_agg_rx->reorder_buf[index] = skb;
-        tid_agg_rx->reorder_time[index] = jiffies;
-        tid_agg_rx->stored_mpdu_num++;
-        /* release the buffer until next missing frame */
-        index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
-                                                % tid_agg_rx->buf_size;
-        if (!tid_agg_rx->reorder_buf[index] &&
-            tid_agg_rx->stored_mpdu_num > 1) {
-                /*
-                 * No buffers ready to be released, but check whether any
-                 * frames in the reorder buffer have timed out.
-                 */
-                int j;
-                int skipped = 1;
-                for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
-                     j = (j + 1) % tid_agg_rx->buf_size) {
-                        if (tid_agg_rx->reorder_buf[j] == NULL) {
-                                skipped++;
+        if (!found_sta) {
+                list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                        if (!ieee80211_sdata_running(sdata))
                                 continue;
-                        }
-                        if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
-                                        HZ / 10))
-                                break;
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: release an RX reorder "
-                                       "frame due to timeout on earlier "
-                                       "frames\n",
-                                       wiphy_name(hw->wiphy));
-#endif
-                        ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
+                        if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                continue;
 
                         /*
-                         * Increment the head seq# also for the skipped slots.
+                         * frame is destined for this interface, but if it's
+                         * not also for the previous one we handle that after
+                         * the loop to avoid copying the SKB once too much
                          */
-                        tid_agg_rx->head_seq_num =
-                                (tid_agg_rx->head_seq_num + skipped) &
-                                SEQ_MASK;
-                        skipped = 0;
-                }
-        } else while (tid_agg_rx->reorder_buf[index]) {
-                ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
-                index = seq_sub(tid_agg_rx->head_seq_num,
-                        tid_agg_rx->ssn) % tid_agg_rx->buf_size;
-        }
-        return 1;
-}
 
-static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
-                                     struct sk_buff *skb)
-{
-        struct ieee80211_hw *hw = &local->hw;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct sta_info *sta;
-        struct tid_ampdu_rx *tid_agg_rx;
-        u16 sc;
-        u16 mpdu_seq_num;
-        u8 ret = 0;
-        int tid;
+                        if (!prev) {
+                                prev = sdata;
+                                continue;
+                        }
 
-        sta = sta_info_get(local, hdr->addr2);
-        if (!sta)
-                return ret;
+                        rx.sta = sta_info_get_bss(prev, hdr->addr2);
 
-        /* filter the QoS data rx stream according to
-         * STA/TID and check if this STA/TID is on aggregation */
-        if (!ieee80211_is_data_qos(hdr->frame_control))
-                goto end_reorder;
+                        rx.flags |= IEEE80211_RX_RA_MATCH;
+                        prepares = prepare_for_handlers(prev, &rx, hdr);
 
-        tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+                        if (!prepares)
+                                goto next;
 
-        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
-                goto end_reorder;
+                        if (status->flag & RX_FLAG_MMIC_ERROR) {
+                                rx.sdata = prev;
+                                if (rx.flags & IEEE80211_RX_RA_MATCH)
+                                        ieee80211_rx_michael_mic_report(hdr,
+                                                                        &rx);
+                                goto next;
+                        }
 
-        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+                        /*
+                         * frame was destined for the previous interface
+                         * so invoke RX handlers for it
+                         */
 
-        /* qos null data frames are excluded */
-        if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
-                goto end_reorder;
+                        skb_new = skb_copy(skb, GFP_ATOMIC);
+                        if (!skb_new) {
+                                if (net_ratelimit())
+                                        printk(KERN_DEBUG "%s: failed to copy "
+                                               "multicast frame for %s\n",
+                                               wiphy_name(local->hw.wiphy),
+                                               prev->name);
+                                goto next;
+                        }
+                        ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
+next:
+                        prev = sdata;
+                }
 
-        /* new un-ordered ampdu frame - process it */
+                if (prev) {
+                        rx.sta = sta_info_get_bss(prev, hdr->addr2);
 
-        /* reset session timer */
-        if (tid_agg_rx->timeout)
-                mod_timer(&tid_agg_rx->session_timer,
-                          TU_TO_EXP_TIME(tid_agg_rx->timeout));
+                        rx.flags |= IEEE80211_RX_RA_MATCH;
+                        prepares = prepare_for_handlers(prev, &rx, hdr);
 
-        /* if this mpdu is fragmented - terminate rx aggregation session */
-        sc = le16_to_cpu(hdr->seq_ctrl);
-        if (sc & IEEE80211_SCTL_FRAG) {
-                ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
-                        tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
-                ret = 1;
-                goto end_reorder;
+                        if (!prepares)
+                                prev = NULL;
+                }
         }
-
-        /* according to mpdu sequence number deal with reordering buffer */
-        mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
-        ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
-                                                mpdu_seq_num, 0);
- end_reorder:
-        return ret;
+        if (prev)
+                ieee80211_invoke_rx_handlers(prev, &rx, skb, rate);
+        else
+                dev_kfree_skb(skb);
 }
 
 /*
@@ -2481,14 +2521,22 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 goto drop;
 
         if (status->flag & RX_FLAG_HT) {
-                /* rate_idx is MCS index */
-                if (WARN_ON(status->rate_idx < 0 ||
-                            status->rate_idx >= 76))
+                /*
+                 * rate_idx is MCS index, which can be [0-76] as documented on:
+                 *
+                 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
+                 *
+                 * Anything else would be some sort of driver or hardware error.
+                 * The driver should catch hardware errors.
+                 */
+                if (WARN((status->rate_idx < 0 ||
+                         status->rate_idx > 76),
+                         "Rate marked as an HT rate but passed "
+                         "status->rate_idx is not "
+                         "an MCS index [0-76]: %d (0x%02x)\n",
+                         status->rate_idx,
+                         status->rate_idx))
                         goto drop;
-                /* HT rates are not in the table - use the highest legacy rate
-                 * for now since other parts of mac80211 may not yet be fully
-                 * MCS aware. */
-                rate = &sband->bitrates[sband->n_bitrates - 1];
         } else {
                 if (WARN_ON(status->rate_idx < 0 ||
                             status->rate_idx >= sband->n_bitrates))
@@ -2515,20 +2563,7 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
         }
 
-        /*
-         * In theory, the block ack reordering should happen after duplicate
-         * removal (ieee80211_rx_h_check(), which is an RX handler). As such,
-         * the call to ieee80211_rx_reorder_ampdu() should really be moved to
-         * happen as a new RX handler between ieee80211_rx_h_check and
-         * ieee80211_rx_h_decrypt. This cleanup may eventually happen, but for
-         * the time being, the call can be here since RX reorder buf processing
-         * will implicitly skip duplicates. We could, in theory at least,
-         * process frames that ieee80211_rx_h_passive_scan would drop (e.g.,
-         * frames from other than operational channel), but that should not
-         * happen in normal networks.
-         */
-        if (!ieee80211_rx_reorder_ampdu(local, skb))
-                __ieee80211_rx_handle_packet(hw, skb, rate);
+        __ieee80211_rx_handle_packet(hw, skb, rate);
 
         rcu_read_unlock();
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 71e10cabf811..85507bd9e341 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -12,11 +12,9 @@
  * published by the Free Software Foundation.
  */
 
-/* TODO: figure out how to avoid that the "current BSS" expires */
-
-#include <linux/wireless.h>
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 
 #include "ieee80211_i.h"
@@ -31,16 +29,19 @@ struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
-        return (void *)cfg80211_get_bss(local->hw.wiphy,
-                                        ieee80211_get_channel(local->hw.wiphy,
-                                                              freq),
-                                        bssid, ssid, ssid_len,
-                                        0, 0);
+        struct cfg80211_bss *cbss;
+
+        cbss = cfg80211_get_bss(local->hw.wiphy,
+                                ieee80211_get_channel(local->hw.wiphy, freq),
+                                bssid, ssid, ssid_len, 0, 0);
+        if (!cbss)
+                return NULL;
+        return (void *)cbss->priv;
 }
 
 static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
 {
-        struct ieee80211_bss *bss = (void *)cbss;
+        struct ieee80211_bss *bss = (void *)cbss->priv;
 
         kfree(bss_mesh_id(bss));
         kfree(bss_mesh_cfg(bss));
@@ -49,7 +50,26 @@ static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss)
 {
-        cfg80211_put_bss((struct cfg80211_bss *)bss);
+        if (!bss)
+                return;
+        cfg80211_put_bss(container_of((void *)bss, struct cfg80211_bss, priv));
+}
+
+static bool is_uapsd_supported(struct ieee802_11_elems *elems)
+{
+        u8 qos_info;
+
+        if (elems->wmm_info && elems->wmm_info_len == 7
+            && elems->wmm_info[5] == 1)
+                qos_info = elems->wmm_info[6];
+        else if (elems->wmm_param && elems->wmm_param_len == 24
+                 && elems->wmm_param[5] == 1)
+                qos_info = elems->wmm_param[6];
+        else
+                /* no valid wmm information or parameter element found */
+                return false;
+
+        return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD;
 }
 
 struct ieee80211_bss *
@@ -61,6 +81,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_channel *channel,
                           bool beacon)
 {
+        struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         int clen;
         s32 signal = 0;
@@ -70,13 +91,14 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 signal = (rx_status->signal * 100) / local->hw.max_signal;
 
-        bss = (void *)cfg80211_inform_bss_frame(local->hw.wiphy, channel,
-                                                mgmt, len, signal, GFP_ATOMIC);
+        cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
+                                         mgmt, len, signal, GFP_ATOMIC);
 
-        if (!bss)
+        if (!cbss)
                 return NULL;
 
-        bss->cbss.free_priv = ieee80211_rx_bss_free;
+        cbss->free_priv = ieee80211_rx_bss_free;
+        bss = (void *)cbss->priv;
 
         /* save the ERP value so that it is available at association time */
         if (elems->erp_info && elems->erp_info_len >= 1) {
@@ -90,10 +112,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->dtim_period = tim_ie->dtim_period;
         }
 
-        /* set default value for buggy AP/no TIM element */
-        if (bss->dtim_period == 0)
-                bss->dtim_period = 1;
-
         bss->supp_rates_len = 0;
         if (elems->supp_rates) {
                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
@@ -113,6 +131,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         }
 
         bss->wmm_used = elems->wmm_param || elems->wmm_info;
+        bss->uapsd_supported = is_uapsd_supported(elems);
 
         if (!beacon)
                 bss->last_probe_resp = jiffies;
@@ -149,7 +168,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         presp = ieee80211_is_probe_resp(fc);
         if (presp) {
                 /* ignore ProbeResp to foreign address */
-                if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+                if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
                         return RX_DROP_MONITOR;
 
                 presp = true;
@@ -189,100 +208,76 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         return RX_QUEUED;
 }
 
-/*
- * inform AP that we will go to sleep so that it will buffer the frames
- * while we scan
- */
-static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata)
+/* return false if no more work */
+static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local = sdata->local;
-        bool ps = false;
+        struct cfg80211_scan_request *req = local->scan_req;
+        enum ieee80211_band band;
+        int i, ielen, n_chans;
 
-        /* FIXME: what to do when local->pspolling is true? */
+        do {
+                if (local->hw_scan_band == IEEE80211_NUM_BANDS)
+                        return false;
+
+                band = local->hw_scan_band;
+                n_chans = 0;
+                for (i = 0; i < req->n_channels; i++) {
+                        if (req->channels[i]->band == band) {
+                                local->hw_scan_req->channels[n_chans] =
+                                                        req->channels[i];
+                                n_chans++;
+                        }
+                }
 
-        del_timer_sync(&local->dynamic_ps_timer);
-        cancel_work_sync(&local->dynamic_ps_enable_work);
+                local->hw_scan_band++;
+        } while (!n_chans);
 
-        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                ps = true;
-                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-        }
+        local->hw_scan_req->n_channels = n_chans;
 
-        if (!ps || !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
-                /*
-                 * If power save was enabled, no need to send a nullfunc
-                 * frame because AP knows that we are sleeping. But if the
-                 * hardware is creating the nullfunc frame for power save
-                 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
-                 * enabled) and power save was enabled, the firmware just
-                 * sent a null frame with power save disabled. So we need
-                 * to send a new nullfunc frame to inform the AP that we
-                 * are again sleeping.
-                 */
-                ieee80211_send_nullfunc(local, sdata, 1);
-}
-
-/* inform AP that we are awake again, unless power save is enabled */
-static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-
-        if (!local->ps_sdata)
-                ieee80211_send_nullfunc(local, sdata, 0);
-        else {
-                /*
-                 * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
-                 * will send a nullfunc frame with the powersave bit set
-                 * even though the AP already knows that we are sleeping.
-                 * This could be avoided by sending a null frame with power
-                 * save bit disabled before enabling the power save, but
-                 * this doesn't gain anything.
-                 *
-                 * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
-                 * to send a nullfunc frame because AP already knows that
-                 * we are sleeping, let's just enable power save mode in
-                 * hardware.
-                 */
-                local->hw.conf.flags |= IEEE80211_CONF_PS;
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-        }
-}
+        ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
+                                         req->ie, req->ie_len, band);
+        local->hw_scan_req->ie_len = ielen;
 
-static void ieee80211_restore_scan_ies(struct ieee80211_local *local)
-{
-        kfree(local->scan_req->ie);
-        local->scan_req->ie = local->orig_ies;
-        local->scan_req->ie_len = local->orig_ies_len;
+        return true;
 }
 
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
         bool was_hw_scan;
 
         mutex_lock(&local->scan_mtx);
 
-        if (WARN_ON(!local->scanning)) {
+        /*
+         * It's ok to abort a not-yet-running scan (that
+         * we have one at all will be verified by checking
+         * local->scan_req next), but not to complete it
+         * successfully.
+         */
+        if (WARN_ON(!local->scanning && !aborted))
+                aborted = true;
+
+        if (WARN_ON(!local->scan_req)) {
                 mutex_unlock(&local->scan_mtx);
                 return;
         }
 
-        if (WARN_ON(!local->scan_req)) {
+        was_hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
+        if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
+                ieee80211_queue_delayed_work(&local->hw,
+                                             &local->scan_work, 0);
                 mutex_unlock(&local->scan_mtx);
                 return;
         }
 
-        if (test_bit(SCAN_HW_SCANNING, &local->scanning))
-                ieee80211_restore_scan_ies(local);
+        kfree(local->hw_scan_req);
+        local->hw_scan_req = NULL;
 
         if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
         local->scan_sdata = NULL;
 
-        was_hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
         local->scanning = 0;
         local->scan_channel = NULL;
 
@@ -297,41 +292,19 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
         drv_sw_scan_complete(local);
 
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                /* Tell AP we're back */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.associated) {
-                                ieee80211_scan_ps_disable(sdata);
-                                netif_tx_wake_all_queues(sdata->dev);
-                        }
-                } else
-                        netif_tx_wake_all_queues(sdata->dev);
-
-                /* re-enable beaconing */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_bss_info_change_notify(
-                                sdata, BSS_CHANGED_BEACON_ENABLED);
-        }
-        mutex_unlock(&local->iflist_mtx);
+        ieee80211_offchannel_return(local, true);
 
  done:
         ieee80211_recalc_idle(local);
         ieee80211_mlme_notify_scan_completed(local);
         ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
+        ieee80211_queue_work(&local->hw, &local->work_work);
 }
 EXPORT_SYMBOL(ieee80211_scan_completed);
 
 static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 {
-        struct ieee80211_sub_if_data *sdata;
-
         /*
          * Hardware/driver doesn't support hw_scan, so use software
          * scanning instead. First send a nullfunc frame with power save
@@ -347,33 +320,15 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
          */
         drv_sw_scan_start(local);
 
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                /* disable beaconing */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_bss_info_change_notify(
-                                sdata, BSS_CHANGED_BEACON_ENABLED);
-
-                /*
-                 * only handle non-STA interfaces here, STA interfaces
-                 * are handled in the scan state machine
-                 */
-                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        netif_tx_stop_all_queues(sdata->dev);
-        }
-        mutex_unlock(&local->iflist_mtx);
+        ieee80211_offchannel_stop_beaconing(local);
 
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
+        drv_flush(local, false);
+
         ieee80211_configure_filter(local);
 
-        /* TODO: start scan as soon as all nullfunc frames are ACKed */
         ieee80211_queue_delayed_work(&local->hw,
                                      &local->scan_work,
                                      IEEE80211_CHANNEL_TIME);
@@ -386,68 +341,80 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                                   struct cfg80211_scan_request *req)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         int rc;
 
         if (local->scan_req)
                 return -EBUSY;
 
+        if (!list_empty(&local->work_list)) {
+                /* wait for the work to finish/time out */
+                local->scan_req = req;
+                local->scan_sdata = sdata;
+                return 0;
+        }
+
         if (local->ops->hw_scan) {
                 u8 *ies;
-                int ielen;
 
-                ies = kmalloc(2 + IEEE80211_MAX_SSID_LEN +
-                              local->scan_ies_len + req->ie_len, GFP_KERNEL);
-                if (!ies)
+                local->hw_scan_req = kmalloc(
+                                sizeof(*local->hw_scan_req) +
+                                req->n_channels * sizeof(req->channels[0]) +
+                                2 + IEEE80211_MAX_SSID_LEN + local->scan_ies_len +
+                                req->ie_len, GFP_KERNEL);
+                if (!local->hw_scan_req)
                         return -ENOMEM;
 
-                ielen = ieee80211_build_preq_ies(local, ies,
-                                                 req->ie, req->ie_len);
-                local->orig_ies = req->ie;
-                local->orig_ies_len = req->ie_len;
-                req->ie = ies;
-                req->ie_len = ielen;
+                local->hw_scan_req->ssids = req->ssids;
+                local->hw_scan_req->n_ssids = req->n_ssids;
+                ies = (u8 *)local->hw_scan_req +
+                        sizeof(*local->hw_scan_req) +
+                        req->n_channels * sizeof(req->channels[0]);
+                local->hw_scan_req->ie = ies;
+
+                local->hw_scan_band = 0;
+
+                /*
+                 * After allocating local->hw_scan_req, we must
+                 * go through until ieee80211_prep_hw_scan(), so
+                 * anything that might be changed here and leave
+                 * this function early must not go after this
+                 * allocation.
+                 */
         }
 
         local->scan_req = req;
         local->scan_sdata = sdata;
 
-        if (req != local->int_scan_req &&
-            sdata->vif.type == NL80211_IFTYPE_STATION &&
-            !list_empty(&ifmgd->work_list)) {
-                /* actually wait for the work it's doing to finish/time out */
-                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
-                return 0;
-        }
-
         if (local->ops->hw_scan)
                 __set_bit(SCAN_HW_SCANNING, &local->scanning);
         else
                 __set_bit(SCAN_SW_SCANNING, &local->scanning);
+
         /*
          * Kicking off the scan need not be protected,
          * only the scan variable stuff, since now
          * local->scan_req is assigned and other callers
          * will abort their scan attempts.
          *
-         * This avoids getting a scan_mtx -> iflist_mtx
-         * dependency, so that the scan completed calls
-         * have more locking freedom.
+         * This avoids too many locking dependencies
+         * so that the scan completed calls have more
+         * locking freedom.
          */
 
         ieee80211_recalc_idle(local);
         mutex_unlock(&local->scan_mtx);
 
-        if (local->ops->hw_scan)
-                rc = drv_hw_scan(local, local->scan_req);
-        else
+        if (local->ops->hw_scan) {
+                WARN_ON(!ieee80211_prep_hw_scan(local));
+                rc = drv_hw_scan(local, local->hw_scan_req);
+        } else
                 rc = ieee80211_start_sw_scan(local);
 
         mutex_lock(&local->scan_mtx);
 
         if (rc) {
-                if (local->ops->hw_scan)
-                        ieee80211_restore_scan_ies(local);
+                kfree(local->hw_scan_req);
+                local->hw_scan_req = NULL;
                 local->scanning = 0;
 
                 ieee80211_recalc_idle(local);
@@ -474,7 +441,7 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
         /* check if at least one STA interface is associated */
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
@@ -512,56 +479,35 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
 static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
                                                     unsigned long *next_delay)
 {
-        struct ieee80211_sub_if_data *sdata;
+        ieee80211_offchannel_stop_station(local);
+
+        __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
 
         /*
-         * notify the AP about us leaving the channel and stop all STA interfaces
+         * What if the nullfunc frames didn't arrive?
          */
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        netif_tx_stop_all_queues(sdata->dev);
-                        if (sdata->u.mgd.associated)
-                                ieee80211_scan_ps_enable(sdata);
-                }
-        }
-        mutex_unlock(&local->iflist_mtx);
-
-        __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
+        drv_flush(local, false);
+        if (local->ops->flush)
+                *next_delay = 0;
+        else
+                *next_delay = HZ / 10;
 
         /* advance to the next channel to be scanned */
-        *next_delay = HZ / 10;
         local->next_scan_state = SCAN_SET_CHANNEL;
 }
 
 static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *local,
                                                     unsigned long *next_delay)
 {
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-
         /* switch back to the operating channel */
         local->scan_channel = NULL;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         /*
-         * notify the AP about us being back and restart all STA interfaces
+         * Only re-enable station mode interface now; beaconing will be
+         * re-enabled once the full scan has been completed.
          */
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                /* Tell AP we're back */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.associated)
-                                ieee80211_scan_ps_disable(sdata);
-                        netif_tx_wake_all_queues(sdata->dev);
-                }
-        }
-        mutex_unlock(&local->iflist_mtx);
+        ieee80211_offchannel_return(local, false);
 
         __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
 
@@ -574,23 +520,14 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
 {
         int skip;
         struct ieee80211_channel *chan;
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
 
         skip = 0;
         chan = local->scan_req->channels[local->scan_channel_idx];
 
-        if (chan->flags & IEEE80211_CHAN_DISABLED ||
-            (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-             chan->flags & IEEE80211_CHAN_NO_IBSS))
+        local->scan_channel = chan;
+        if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
                 skip = 1;
 
-        if (!skip) {
-                local->scan_channel = chan;
-                if (ieee80211_hw_config(local,
-                                        IEEE80211_CONF_CHANGE_CHANNEL))
-                        skip = 1;
-        }
-
         /* advance state machine to next channel/band */
         local->scan_channel_idx++;
 
@@ -656,6 +593,14 @@ void ieee80211_scan_work(struct work_struct *work)
                 return;
         }
 
+        if (local->hw_scan_req) {
+                int rc = drv_hw_scan(local, local->hw_scan_req);
+                mutex_unlock(&local->scan_mtx);
+                if (rc)
+                        ieee80211_scan_completed(&local->hw, true);
+                return;
+        }
+
         if (local->scan_req && !local->scanning) {
                 struct cfg80211_scan_request *req = local->scan_req;
                 int rc;
@@ -676,7 +621,7 @@ void ieee80211_scan_work(struct work_struct *work)
         /*
          * Avoid re-scheduling when the sdata is going away.
          */
-        if (!netif_running(sdata->dev)) {
+        if (!ieee80211_sdata_running(sdata)) {
                 ieee80211_scan_completed(&local->hw, true);
                 return;
         }
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 68953033403d..7733f66ee2c4 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -35,7 +35,7 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer for "
-                                "measurement report frame\n", sdata->dev->name);
+                                "measurement report frame\n", sdata->name);
                 return;
         }
 
@@ -43,7 +43,7 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
         msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
         memset(msr_report, 0, 24);
         memcpy(msr_report->da, da, ETH_ALEN);
-        memcpy(msr_report->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(msr_report->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(msr_report->bssid, bssid, ETH_ALEN);
         msr_report->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                 IEEE80211_STYPE_ACTION);
@@ -65,7 +65,7 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
                         IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
         msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
 
-        ieee80211_tx_skb(sdata, skb, 1);
+        ieee80211_tx_skb(sdata, skb);
 }
 
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 594f2318c3d8..fb12cec4d333 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -32,49 +32,33 @@
  * for faster lookup and a list for iteration. They are managed using
  * RCU, i.e. access to the list and hash table is protected by RCU.
  *
- * Upon allocating a STA info structure with sta_info_alloc(), the caller owns
- * that structure. It must then either destroy it using sta_info_destroy()
- * (which is pretty useless) or insert it into the hash table using
- * sta_info_insert() which demotes the reference from ownership to a regular
- * RCU-protected reference; if the function is called without protection by an
- * RCU critical section the reference is instantly invalidated. Note that the
- * caller may not do much with the STA info before inserting it, in particular,
- * it may not start any mesh peer link management or add encryption keys.
+ * Upon allocating a STA info structure with sta_info_alloc(), the caller
+ * owns that structure. It must then insert it into the hash table using
+ * either sta_info_insert() or sta_info_insert_rcu(); only in the latter
+ * case (which acquires an rcu read section but must not be called from
+ * within one) will the pointer still be valid after the call. Note that
+ * the caller may not do much with the STA info before inserting it, in
+ * particular, it may not start any mesh peer link management or add
+ * encryption keys.
  *
  * When the insertion fails (sta_info_insert()) returns non-zero), the
  * structure will have been freed by sta_info_insert()!
  *
- * sta entries are added by mac80211 when you establish a link with a
+ * Station entries are added by mac80211 when you establish a link with a
  * peer. This means different things for the different type of interfaces
  * we support. For a regular station this mean we add the AP sta when we
  * receive an assocation response from the AP. For IBSS this occurs when
- * we receive a probe response or a beacon from target IBSS network. For
- * WDS we add the sta for the peer imediately upon device open. When using
- * AP mode we add stations for each respective station upon request from
- * userspace through nl80211.
+ * get to know about a peer on the same IBSS. For WDS we add the sta for
+ * the peer imediately upon device open. When using AP mode we add stations
+ * for each respective station upon request from userspace through nl80211.
  *
- * Because there are debugfs entries for each station, and adding those
- * must be able to sleep, it is also possible to "pin" a station entry,
- * that means it can be removed from the hash table but not be freed.
- * See the comment in __sta_info_unlink() for more information, this is
- * an internal capability only.
+ * In order to remove a STA info structure, various sta_info_destroy_*()
+ * calls are available.
  *
- * In order to remove a STA info structure, the caller needs to first
- * unlink it (sta_info_unlink()) from the list and hash tables and
- * then destroy it; sta_info_destroy() will wait for an RCU grace period
- * to elapse before actually freeing it. Due to the pinning and the
- * possibility of multiple callers trying to remove the same STA info at
- * the same time, sta_info_unlink() can clear the STA info pointer it is
- * passed to indicate that the STA info is owned by somebody else now.
- *
- * If sta_info_unlink() did not clear the pointer then the caller owns
- * the STA info structure now and is responsible of destroying it with
- * a call to sta_info_destroy().
- *
- * In all other cases, there is no concept of ownership on a STA entry,
- * each structure is owned by the global hash table/list until it is
- * removed. All users of the structure need to be RCU protected so that
- * the structure won't be freed before they are done using it.
+ * There is no concept of ownership on a STA entry, each structure is
+ * owned by the global hash table/list until it is removed. All users of
+ * the structure need to be RCU protected so that the structure won't be
+ * freed before they are done using it.
  */
 
 /* Caller must hold local->sta_lock */
@@ -103,27 +87,64 @@ static int sta_info_hash_del(struct ieee80211_local *local,
 }
 
 /* protected by RCU */
-struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr)
+struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr)
 {
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
+                                    rcu_read_lock_held() ||
+                                    lockdep_is_held(&local->sta_lock) ||
+                                    lockdep_is_held(&local->sta_mtx));
+        while (sta) {
+                if (sta->sdata == sdata &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                        break;
+                sta = rcu_dereference_check(sta->hnext,
+                                            rcu_read_lock_held() ||
+                                            lockdep_is_held(&local->sta_lock) ||
+                                            lockdep_is_held(&local->sta_mtx));
+        }
+        return sta;
+}
+
+/*
+ * Get sta info either from the specified interface
+ * or from one of its vlans
+ */
+struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr)
+{
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
 
-        sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
+        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
+                                    rcu_read_lock_held() ||
+                                    lockdep_is_held(&local->sta_lock) ||
+                                    lockdep_is_held(&local->sta_mtx));
         while (sta) {
-                if (memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                if ((sta->sdata == sdata ||
+                     sta->sdata->bss == sdata->bss) &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
-                sta = rcu_dereference(sta->hnext);
+                sta = rcu_dereference_check(sta->hnext,
+                                            rcu_read_lock_held() ||
+                                            lockdep_is_held(&local->sta_lock) ||
+                                            lockdep_is_held(&local->sta_mtx));
         }
         return sta;
 }
 
-struct sta_info *sta_info_get_by_idx(struct ieee80211_local *local, int idx,
-                                     struct net_device *dev)
+struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
+                                     int idx)
 {
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int i = 0;
 
         list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (dev && dev != sta->sdata->dev)
+                if (sdata != sta->sdata)
                         continue;
                 if (i < idx) {
                         ++i;
@@ -147,8 +168,10 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_local *local, int idx,
 static void __sta_info_free(struct ieee80211_local *local,
                             struct sta_info *sta)
 {
-        rate_control_free_sta(sta);
-        rate_control_put(sta->rate_ctrl);
+        if (sta->rate_ctrl) {
+                rate_control_free_sta(sta);
+                rate_control_put(sta->rate_ctrl);
+        }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Destroyed STA %pM\n",
@@ -158,105 +181,44 @@ static void __sta_info_free(struct ieee80211_local *local,
         kfree(sta);
 }
 
-void sta_info_destroy(struct sta_info *sta)
+/* Caller must hold local->sta_lock */
+static void sta_info_hash_add(struct ieee80211_local *local,
+                              struct sta_info *sta)
 {
-        struct ieee80211_local *local;
-        struct sk_buff *skb;
-        int i;
-
-        might_sleep();
-
-        if (!sta)
-                return;
-
-        local = sta->local;
-
-        rate_control_remove_sta_debugfs(sta);
-        ieee80211_sta_debugfs_remove(sta);
-
-#ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sta->sdata->vif))
-                mesh_plink_deactivate(sta);
-#endif
-
-        /*
-         * We have only unlinked the key, and actually destroying it
-         * may mean it is removed from hardware which requires that
-         * the key->sta pointer is still valid, so flush the key todo
-         * list here.
-         *
-         * ieee80211_key_todo() will synchronize_rcu() so after this
-         * nothing can reference this sta struct any more.
-         */
-        ieee80211_key_todo();
-
-#ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sta->sdata->vif))
-                del_timer_sync(&sta->plink_timer);
-#endif
-
-        while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-                local->total_ps_buffered--;
-                dev_kfree_skb_any(skb);
-        }
+        sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
+        rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
+}
 
-        while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL)
-                dev_kfree_skb_any(skb);
+static void sta_unblock(struct work_struct *wk)
+{
+        struct sta_info *sta;
 
-        for (i = 0; i <  STA_TID_NUM; i++) {
-                struct tid_ampdu_rx *tid_rx;
-                struct tid_ampdu_tx *tid_tx;
+        sta = container_of(wk, struct sta_info, drv_unblock_wk);
 
-                spin_lock_bh(&sta->lock);
-                tid_rx = sta->ampdu_mlme.tid_rx[i];
-                /* Make sure timer won't free the tid_rx struct, see below */
-                if (tid_rx)
-                        tid_rx->shutdown = true;
+        if (sta->dead)
+                return;
 
-                spin_unlock_bh(&sta->lock);
+        if (!test_sta_flags(sta, WLAN_STA_PS_STA))
+                ieee80211_sta_ps_deliver_wakeup(sta);
+        else if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL))
+                ieee80211_sta_ps_deliver_poll_response(sta);
+}
 
-                /*
-                 * Outside spinlock - shutdown is true now so that the timer
-                 * won't free tid_rx, we have to do that now. Can't let the
-                 * timer do it because we have to sync the timer outside the
-                 * lock that it takes itself.
-                 */
-                if (tid_rx) {
-                        del_timer_sync(&tid_rx->session_timer);
-                        kfree(tid_rx);
-                }
+static int sta_prepare_rate_control(struct ieee80211_local *local,
+                                    struct sta_info *sta, gfp_t gfp)
+{
+        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                return 0;
 
-                /*
-                 * No need to do such complications for TX agg sessions, the
-                 * path leading to freeing the tid_tx struct goes via a call
-                 * from the driver, and thus needs to look up the sta struct
-                 * again, which cannot be found when we get here. Hence, we
-                 * just need to delete the timer and free the aggregation
-                 * info; we won't be telling the peer about it then but that
-                 * doesn't matter if we're not talking to it again anyway.
-                 */
-                tid_tx = sta->ampdu_mlme.tid_tx[i];
-                if (tid_tx) {
-                        del_timer_sync(&tid_tx->addba_resp_timer);
-                        /*
-                         * STA removed while aggregation session being
-                         * started? Bit odd, but purge frames anyway.
-                         */
-                        skb_queue_purge(&tid_tx->pending);
-                        kfree(tid_tx);
-                }
+        sta->rate_ctrl = rate_control_get(local->rate_ctrl);
+        sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
+                                                     &sta->sta, gfp);
+        if (!sta->rate_ctrl_priv) {
+                rate_control_put(sta->rate_ctrl);
+                return -ENOMEM;
         }
 
-        __sta_info_free(local, sta);
-}
-
-
-/* Caller must hold local->sta_lock */
-static void sta_info_hash_add(struct ieee80211_local *local,
-                              struct sta_info *sta)
-{
-        sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
-        rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
+        return 0;
 }
 
 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
@@ -272,16 +234,13 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
         spin_lock_init(&sta->lock);
         spin_lock_init(&sta->flaglock);
+        INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
 
         memcpy(sta->sta.addr, addr, ETH_ALEN);
         sta->local = local;
         sta->sdata = sdata;
 
-        sta->rate_ctrl = rate_control_get(local->rate_ctrl);
-        sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
-                                                     &sta->sta, gfp);
-        if (!sta->rate_ctrl_priv) {
-                rate_control_put(sta->rate_ctrl);
+        if (sta_prepare_rate_control(local, sta, gfp)) {
                 kfree(sta);
                 return NULL;
         }
@@ -318,7 +277,93 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         return sta;
 }
 
-int sta_info_insert(struct sta_info *sta)
+static int sta_info_finish_insert(struct sta_info *sta, bool async)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct station_info sinfo;
+        unsigned long flags;
+        int err = 0;
+
+        WARN_ON(!mutex_is_locked(&local->sta_mtx));
+
+        /* notify driver */
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data,
+                                     u.ap);
+        err = drv_sta_add(local, sdata, &sta->sta);
+        if (err) {
+                if (!async)
+                        return err;
+                printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to driver (%d)"
+                                  " - keeping it anyway.\n",
+                       sdata->name, sta->sta.addr, err);
+        } else {
+                sta->uploaded = true;
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (async)
+                        printk(KERN_DEBUG "%s: Finished adding IBSS STA %pM\n",
+                               wiphy_name(local->hw.wiphy), sta->sta.addr);
+#endif
+        }
+
+        sdata = sta->sdata;
+
+        if (!async) {
+                local->num_sta++;
+                local->sta_generation++;
+                smp_mb();
+
+                /* make the station visible */
+                spin_lock_irqsave(&local->sta_lock, flags);
+                sta_info_hash_add(local, sta);
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+        }
+
+        list_add(&sta->list, &local->sta_list);
+
+        ieee80211_sta_debugfs_add(sta);
+        rate_control_add_sta_debugfs(sta);
+
+        sinfo.filled = 0;
+        sinfo.generation = local->sta_generation;
+        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
+
+
+        return 0;
+}
+
+static void sta_info_finish_pending(struct ieee80211_local *local)
+{
+        struct sta_info *sta;
+        unsigned long flags;
+
+        spin_lock_irqsave(&local->sta_lock, flags);
+        while (!list_empty(&local->sta_pending_list)) {
+                sta = list_first_entry(&local->sta_pending_list,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+
+                sta_info_finish_insert(sta, true);
+
+                spin_lock_irqsave(&local->sta_lock, flags);
+        }
+        spin_unlock_irqrestore(&local->sta_lock, flags);
+}
+
+static void sta_info_finish_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, sta_finish_work);
+
+        mutex_lock(&local->sta_mtx);
+        sta_info_finish_pending(local);
+        mutex_unlock(&local->sta_mtx);
+}
+
+int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 {
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -330,38 +375,90 @@ int sta_info_insert(struct sta_info *sta)
          * something inserts a STA (on one CPU) without holding the RTNL
          * and another CPU turns off the net device.
          */
-        if (unlikely(!netif_running(sdata->dev))) {
+        if (unlikely(!ieee80211_sdata_running(sdata))) {
                 err = -ENETDOWN;
+                rcu_read_lock();
                 goto out_free;
         }
 
-        if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->dev->dev_addr) == 0 ||
+        if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->vif.addr) == 0 ||
                     is_multicast_ether_addr(sta->sta.addr))) {
                 err = -EINVAL;
+                rcu_read_lock();
                 goto out_free;
         }
 
+        /*
+         * In ad-hoc mode, we sometimes need to insert stations
+         * from tasklet context from the RX path. To avoid races,
+         * always do so in that case -- see the comment below.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                spin_lock_irqsave(&local->sta_lock, flags);
+                /* check if STA exists already */
+                if (sta_info_get_bss(sdata, sta->sta.addr)) {
+                        spin_unlock_irqrestore(&local->sta_lock, flags);
+                        rcu_read_lock();
+                        err = -EEXIST;
+                        goto out_free;
+                }
+
+                local->num_sta++;
+                local->sta_generation++;
+                smp_mb();
+                sta_info_hash_add(local, sta);
+
+                list_add_tail(&sta->list, &local->sta_pending_list);
+
+                rcu_read_lock();
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                printk(KERN_DEBUG "%s: Added IBSS STA %pM\n",
+                       wiphy_name(local->hw.wiphy), sta->sta.addr);
+#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+
+                ieee80211_queue_work(&local->hw, &local->sta_finish_work);
+
+                return 0;
+        }
+
+        /*
+         * On first glance, this will look racy, because the code
+         * below this point, which inserts a station with sleeping,
+         * unlocks the sta_lock between checking existence in the
+         * hash table and inserting into it.
+         *
+         * However, it is not racy against itself because it keeps
+         * the mutex locked. It still seems to race against the
+         * above code that atomically inserts the station... That,
+         * however, is not true because the above code can only
+         * be invoked for IBSS interfaces, and the below code will
+         * not be -- and the two do not race against each other as
+         * the hash table also keys off the interface.
+         */
+
+        might_sleep();
+
+        mutex_lock(&local->sta_mtx);
+
         spin_lock_irqsave(&local->sta_lock, flags);
         /* check if STA exists already */
-        if (sta_info_get(local, sta->sta.addr)) {
+        if (sta_info_get_bss(sdata, sta->sta.addr)) {
                 spin_unlock_irqrestore(&local->sta_lock, flags);
+                mutex_unlock(&local->sta_mtx);
+                rcu_read_lock();
                 err = -EEXIST;
                 goto out_free;
         }
-        list_add(&sta->list, &local->sta_list);
-        local->sta_generation++;
-        local->num_sta++;
-        sta_info_hash_add(local, sta);
 
-        /* notify driver */
-        if (local->ops->sta_notify) {
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
+        spin_unlock_irqrestore(&local->sta_lock, flags);
 
-                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
-                sdata = sta->sdata;
+        err = sta_info_finish_insert(sta, false);
+        if (err) {
+                mutex_unlock(&local->sta_mtx);
+                rcu_read_lock();
+                goto out_free;
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -369,18 +466,9 @@ int sta_info_insert(struct sta_info *sta)
                wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-
-#ifdef CONFIG_MAC80211_DEBUGFS
-        /*
-         * Debugfs entry adding might sleep, so schedule process
-         * context task for adding entry for STAs that do not yet
-         * have one.
-         * NOTE: due to auto-freeing semantics this may only be done
-         *       if the insertion is successful!
-         */
-        schedule_work(&local->sta_debugfs_add);
-#endif
+        /* move reference to rcu-protected */
+        rcu_read_lock();
+        mutex_unlock(&local->sta_mtx);
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 mesh_accept_plinks_update(sdata);
@@ -392,6 +480,15 @@ int sta_info_insert(struct sta_info *sta)
         return err;
 }
 
+int sta_info_insert(struct sta_info *sta)
+{
+        int err = sta_info_insert_rcu(sta);
+
+        rcu_read_unlock();
+
+        return err;
+}
+
 static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
 {
         /*
@@ -460,103 +557,6 @@ void sta_info_clear_tim_bit(struct sta_info *sta)
         spin_unlock_irqrestore(&sta->local->sta_lock, flags);
 }
 
-static void __sta_info_unlink(struct sta_info **sta)
-{
-        struct ieee80211_local *local = (*sta)->local;
-        struct ieee80211_sub_if_data *sdata = (*sta)->sdata;
-        /*
-         * pull caller's reference if we're already gone.
-         */
-        if (sta_info_hash_del(local, *sta)) {
-                *sta = NULL;
-                return;
-        }
-
-        if ((*sta)->key) {
-                ieee80211_key_free((*sta)->key);
-                WARN_ON((*sta)->key);
-        }
-
-        list_del(&(*sta)->list);
-
-        if (test_and_clear_sta_flags(*sta, WLAN_STA_PS)) {
-                BUG_ON(!sdata->bss);
-
-                atomic_dec(&sdata->bss->num_sta_ps);
-                __sta_info_clear_tim_bit(sdata->bss, *sta);
-        }
-
-        local->num_sta--;
-        local->sta_generation++;
-
-        if (local->ops->sta_notify) {
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
-
-                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
-                               &(*sta)->sta);
-                sdata = (*sta)->sdata;
-        }
-
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                mesh_accept_plinks_update(sdata);
-#ifdef CONFIG_MAC80211_MESH
-                del_timer(&(*sta)->plink_timer);
-#endif
-        }
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Removed STA %pM\n",
-               wiphy_name(local->hw.wiphy), (*sta)->sta.addr);
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
-
-        /*
-         * Finally, pull caller's reference if the STA is pinned by the
-         * task that is adding the debugfs entries. In that case, we
-         * leave the STA "to be freed".
-         *
-         * The rules are not trivial, but not too complex either:
-         *  (1) pin_status is only modified under the sta_lock
-         *  (2) STAs may only be pinned under the RTNL so that
-         *      sta_info_flush() is guaranteed to actually destroy
-         *      all STAs that are active for a given interface, this
-         *      is required for correctness because otherwise we
-         *      could notify a driver that an interface is going
-         *      away and only after that (!) notify it about a STA
-         *      on that interface going away.
-         *  (3) sta_info_debugfs_add_work() will set the status
-         *      to PINNED when it found an item that needs a new
-         *      debugfs directory created. In that case, that item
-         *      must not be freed although all *RCU* users are done
-         *      with it. Hence, we tell the caller of _unlink()
-         *      that the item is already gone (as can happen when
-         *      two tasks try to unlink/destroy at the same time)
-         *  (4) We set the pin_status to DESTROY here when we
-         *      find such an item.
-         *  (5) sta_info_debugfs_add_work() will reset the pin_status
-         *      from PINNED to NORMAL when it is done with the item,
-         *      but will check for DESTROY before resetting it in
-         *      which case it will free the item.
-         */
-        if ((*sta)->pin_status == STA_INFO_PIN_STAT_PINNED) {
-                (*sta)->pin_status = STA_INFO_PIN_STAT_DESTROY;
-                *sta = NULL;
-                return;
-        }
-}
-
-void sta_info_unlink(struct sta_info **sta)
-{
-        struct ieee80211_local *local = (*sta)->local;
-        unsigned long flags;
-
-        spin_lock_irqsave(&local->sta_lock, flags);
-        __sta_info_unlink(sta);
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-}
-
 static int sta_info_buffer_expired(struct sta_info *sta,
                                    struct sk_buff *skb)
 {
@@ -613,109 +613,209 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         }
 }
 
-
-static void sta_info_cleanup(unsigned long data)
+static int __must_check __sta_info_destroy(struct sta_info *sta)
 {
-        struct ieee80211_local *local = (struct ieee80211_local *) data;
-        struct sta_info *sta;
+        struct ieee80211_local *local;
+        struct ieee80211_sub_if_data *sdata;
+        struct sk_buff *skb;
+        unsigned long flags;
+        int ret, i;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(sta, &local->sta_list, list)
-                sta_info_cleanup_expire_buffered(local, sta);
-        rcu_read_unlock();
+        might_sleep();
 
-        if (local->quiescing)
-                return;
+        if (!sta)
+                return -ENOENT;
 
-        local->sta_cleanup.expires =
-                round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
-        add_timer(&local->sta_cleanup);
-}
+        local = sta->local;
+        sdata = sta->sdata;
 
-#ifdef CONFIG_MAC80211_DEBUGFS
-/*
- * See comment in __sta_info_unlink,
- * caller must hold local->sta_lock.
- */
-static void __sta_info_pin(struct sta_info *sta)
-{
-        WARN_ON(sta->pin_status != STA_INFO_PIN_STAT_NORMAL);
-        sta->pin_status = STA_INFO_PIN_STAT_PINNED;
+        spin_lock_irqsave(&local->sta_lock, flags);
+        ret = sta_info_hash_del(local, sta);
+        /* this might still be the pending list ... which is fine */
+        if (!ret)
+                list_del(&sta->list);
+        spin_unlock_irqrestore(&local->sta_lock, flags);
+        if (ret)
+                return ret;
+
+        if (sta->key) {
+                ieee80211_key_free(sta->key);
+                /*
+                 * We have only unlinked the key, and actually destroying it
+                 * may mean it is removed from hardware which requires that
+                 * the key->sta pointer is still valid, so flush the key todo
+                 * list here.
+                 *
+                 * ieee80211_key_todo() will synchronize_rcu() so after this
+                 * nothing can reference this sta struct any more.
+                 */
+                ieee80211_key_todo();
+
+                WARN_ON(sta->key);
+        }
+
+        sta->dead = true;
+
+        if (test_and_clear_sta_flags(sta,
+                                WLAN_STA_PS_STA | WLAN_STA_PS_DRIVER)) {
+                BUG_ON(!sdata->bss);
+
+                atomic_dec(&sdata->bss->num_sta_ps);
+                __sta_info_clear_tim_bit(sdata->bss, sta);
+        }
+
+        local->num_sta--;
+        local->sta_generation++;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                rcu_assign_pointer(sdata->u.vlan.sta, NULL);
+
+        if (sta->uploaded) {
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+                drv_sta_remove(local, sdata, &sta->sta);
+                sdata = sta->sdata;
+        }
+
+#ifdef CONFIG_MAC80211_MESH
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                mesh_accept_plinks_update(sdata);
+                del_timer(&sta->plink_timer);
+        }
+#endif
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: Removed STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
+#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        cancel_work_sync(&sta->drv_unblock_wk);
+
+        rate_control_remove_sta_debugfs(sta);
+        ieee80211_sta_debugfs_remove(sta);
+
+#ifdef CONFIG_MAC80211_MESH
+        if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
+                mesh_plink_deactivate(sta);
+                del_timer_sync(&sta->plink_timer);
+        }
+#endif
+
+        while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
+                local->total_ps_buffered--;
+                dev_kfree_skb_any(skb);
+        }
+
+        while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL)
+                dev_kfree_skb_any(skb);
+
+        for (i = 0; i <  STA_TID_NUM; i++) {
+                struct tid_ampdu_rx *tid_rx;
+                struct tid_ampdu_tx *tid_tx;
+
+                spin_lock_bh(&sta->lock);
+                tid_rx = sta->ampdu_mlme.tid_rx[i];
+                /* Make sure timer won't free the tid_rx struct, see below */
+                if (tid_rx)
+                        tid_rx->shutdown = true;
+
+                spin_unlock_bh(&sta->lock);
+
+                /*
+                 * Outside spinlock - shutdown is true now so that the timer
+                 * won't free tid_rx, we have to do that now. Can't let the
+                 * timer do it because we have to sync the timer outside the
+                 * lock that it takes itself.
+                 */
+                if (tid_rx) {
+                        del_timer_sync(&tid_rx->session_timer);
+                        kfree(tid_rx);
+                }
+
+                /*
+                 * No need to do such complications for TX agg sessions, the
+                 * path leading to freeing the tid_tx struct goes via a call
+                 * from the driver, and thus needs to look up the sta struct
+                 * again, which cannot be found when we get here. Hence, we
+                 * just need to delete the timer and free the aggregation
+                 * info; we won't be telling the peer about it then but that
+                 * doesn't matter if we're not talking to it again anyway.
+                 */
+                tid_tx = sta->ampdu_mlme.tid_tx[i];
+                if (tid_tx) {
+                        del_timer_sync(&tid_tx->addba_resp_timer);
+                        /*
+                         * STA removed while aggregation session being
+                         * started? Bit odd, but purge frames anyway.
+                         */
+                        skb_queue_purge(&tid_tx->pending);
+                        kfree(tid_tx);
+                }
+        }
+
+        __sta_info_free(local, sta);
+
+        return 0;
 }
 
-/*
- * See comment in __sta_info_unlink, returns sta if it
- * needs to be destroyed.
- */
-static struct sta_info *__sta_info_unpin(struct sta_info *sta)
+int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
 {
-        struct sta_info *ret = NULL;
-        unsigned long flags;
+        struct sta_info *sta;
+        int ret;
 
-        spin_lock_irqsave(&sta->local->sta_lock, flags);
-        WARN_ON(sta->pin_status != STA_INFO_PIN_STAT_DESTROY &&
-                sta->pin_status != STA_INFO_PIN_STAT_PINNED);
-        if (sta->pin_status == STA_INFO_PIN_STAT_DESTROY)
-                ret = sta;
-        sta->pin_status = STA_INFO_PIN_STAT_NORMAL;
-        spin_unlock_irqrestore(&sta->local->sta_lock, flags);
+        mutex_lock(&sdata->local->sta_mtx);
+        sta = sta_info_get(sdata, addr);
+        ret = __sta_info_destroy(sta);
+        mutex_unlock(&sdata->local->sta_mtx);
 
         return ret;
 }
 
-static void sta_info_debugfs_add_work(struct work_struct *work)
+int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr)
 {
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local, sta_debugfs_add);
-        struct sta_info *sta, *tmp;
-        unsigned long flags;
+        struct sta_info *sta;
+        int ret;
 
-        /* We need to keep the RTNL across the whole pinned status. */
-        rtnl_lock();
-        while (1) {
-                sta = NULL;
+        mutex_lock(&sdata->local->sta_mtx);
+        sta = sta_info_get_bss(sdata, addr);
+        ret = __sta_info_destroy(sta);
+        mutex_unlock(&sdata->local->sta_mtx);
 
-                spin_lock_irqsave(&local->sta_lock, flags);
-                list_for_each_entry(tmp, &local->sta_list, list) {
-                        /*
-                         * debugfs.add_has_run will be set by
-                         * ieee80211_sta_debugfs_add regardless
-                         * of what else it does.
-                         */
-                        if (!tmp->debugfs.add_has_run) {
-                                sta = tmp;
-                                __sta_info_pin(sta);
-                                break;
-                        }
-                }
-                spin_unlock_irqrestore(&local->sta_lock, flags);
+        return ret;
+}
 
-                if (!sta)
-                        break;
+static void sta_info_cleanup(unsigned long data)
+{
+        struct ieee80211_local *local = (struct ieee80211_local *) data;
+        struct sta_info *sta;
 
-                ieee80211_sta_debugfs_add(sta);
-                rate_control_add_sta_debugfs(sta);
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &local->sta_list, list)
+                sta_info_cleanup_expire_buffered(local, sta);
+        rcu_read_unlock();
 
-                sta = __sta_info_unpin(sta);
-                sta_info_destroy(sta);
-        }
-        rtnl_unlock();
+        if (local->quiescing)
+                return;
+
+        local->sta_cleanup.expires =
+                round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
+        add_timer(&local->sta_cleanup);
 }
-#endif
 
 void sta_info_init(struct ieee80211_local *local)
 {
         spin_lock_init(&local->sta_lock);
+        mutex_init(&local->sta_mtx);
         INIT_LIST_HEAD(&local->sta_list);
+        INIT_LIST_HEAD(&local->sta_pending_list);
+        INIT_WORK(&local->sta_finish_work, sta_info_finish_work);
 
         setup_timer(&local->sta_cleanup, sta_info_cleanup,
                     (unsigned long)local);
         local->sta_cleanup.expires =
                 round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
-
-#ifdef CONFIG_MAC80211_DEBUGFS
-        INIT_WORK(&local->sta_debugfs_add, sta_info_debugfs_add_work);
-#endif
 }
 
 int sta_info_start(struct ieee80211_local *local)
@@ -727,16 +827,6 @@ int sta_info_start(struct ieee80211_local *local)
 void sta_info_stop(struct ieee80211_local *local)
 {
         del_timer(&local->sta_cleanup);
-#ifdef CONFIG_MAC80211_DEBUGFS
-        /*
-         * Make sure the debugfs adding work isn't pending after this
-         * because we're about to be destroyed. It doesn't matter
-         * whether it ran or not since we're going to flush all STAs
-         * anyway.
-         */
-        cancel_work_sync(&local->sta_debugfs_add);
-#endif
-
         sta_info_flush(local, NULL);
 }
 
@@ -752,26 +842,19 @@ int sta_info_flush(struct ieee80211_local *local,
                    struct ieee80211_sub_if_data *sdata)
 {
         struct sta_info *sta, *tmp;
-        LIST_HEAD(tmp_list);
         int ret = 0;
-        unsigned long flags;
 
         might_sleep();
 
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
+
+        sta_info_finish_pending(local);
+
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
-                if (!sdata || sdata == sta->sdata) {
-                        __sta_info_unlink(&sta);
-                        if (sta) {
-                                list_add_tail(&sta->list, &tmp_list);
-                                ret++;
-                        }
-                }
+                if (!sdata || sdata == sta->sdata)
+                        WARN_ON(__sta_info_destroy(sta));
         }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-
-        list_for_each_entry_safe(sta, tmp, &tmp_list, list)
-                sta_info_destroy(sta);
+        mutex_unlock(&local->sta_mtx);
 
         return ret;
 }
@@ -781,33 +864,137 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta, *tmp;
-        LIST_HEAD(tmp_list);
-        unsigned long flags;
 
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: expiring inactive STA %pM\n",
-                               sdata->dev->name, sta->sta.addr);
+                               sdata->name, sta->sta.addr);
 #endif
-                        __sta_info_unlink(&sta);
-                        if (sta)
-                                list_add(&sta->list, &tmp_list);
+                        WARN_ON(__sta_info_destroy(sta));
                 }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        mutex_unlock(&local->sta_mtx);
+}
+
+struct ieee80211_sta *ieee80211_find_sta_by_hw(struct ieee80211_hw *hw,
+                                               const u8 *addr)
+{
+        struct sta_info *sta, *nxt;
 
-        list_for_each_entry_safe(sta, tmp, &tmp_list, list)
-                sta_info_destroy(sta);
+        /* Just return a random station ... first in list ... */
+        for_each_sta_info(hw_to_local(hw), addr, sta, nxt)
+                return &sta->sta;
+        return NULL;
 }
+EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_hw);
 
-struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
+struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
                                          const u8 *addr)
 {
-        struct sta_info *sta = sta_info_get(hw_to_local(hw), addr);
+        struct ieee80211_sub_if_data *sdata;
 
-        if (!sta)
+        if (!vif)
                 return NULL;
-        return &sta->sta;
+
+        sdata = vif_to_sdata(vif);
+
+        return ieee80211_find_sta_by_hw(&sdata->local->hw, addr);
 }
 EXPORT_SYMBOL(ieee80211_find_sta);
+
+/* powersave support code */
+void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        int sent, buffered;
+
+        drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
+
+        if (!skb_queue_empty(&sta->ps_tx_buf))
+                sta_info_clear_tim_bit(sta);
+
+        /* Send all buffered frames to the station */
+        sent = ieee80211_add_pending_skbs(local, &sta->tx_filtered);
+        buffered = ieee80211_add_pending_skbs(local, &sta->ps_tx_buf);
+        sent += buffered;
+        local->total_ps_buffered -= buffered;
+
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+        printk(KERN_DEBUG "%s: STA %pM aid %d sending %d filtered/%d PS frames "
+               "since STA not sleeping anymore\n", sdata->name,
+               sta->sta.addr, sta->sta.aid, sent - buffered, buffered);
+#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+}
+
+void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        int no_pending_pkts;
+
+        skb = skb_dequeue(&sta->tx_filtered);
+        if (!skb) {
+                skb = skb_dequeue(&sta->ps_tx_buf);
+                if (skb)
+                        local->total_ps_buffered--;
+        }
+        no_pending_pkts = skb_queue_empty(&sta->tx_filtered) &&
+                skb_queue_empty(&sta->ps_tx_buf);
+
+        if (skb) {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                struct ieee80211_hdr *hdr =
+                        (struct ieee80211_hdr *) skb->data;
+
+                /*
+                 * Tell TX path to send this frame even though the STA may
+                 * still remain is PS mode after this frame exchange.
+                 */
+                info->flags |= IEEE80211_TX_CTL_PSPOLL_RESPONSE;
+
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+                printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
+                       sta->sta.addr, sta->sta.aid,
+                       skb_queue_len(&sta->ps_tx_buf));
+#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+
+                /* Use MoreData flag to indicate whether there are more
+                 * buffered frames for this STA */
+                if (no_pending_pkts)
+                        hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
+                else
+                        hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+
+                ieee80211_add_pending_skb(local, skb);
+
+                if (no_pending_pkts)
+                        sta_info_clear_tim_bit(sta);
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+        } else {
+                /*
+                 * FIXME: This can be the result of a race condition between
+                 *        us expiring a frame and the station polling for it.
+                 *        Should we send it a null-func frame indicating we
+                 *        have nothing buffered for it?
+                 */
+                printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
+                       "though there are no buffered frames for it\n",
+                       sdata->name, sta->sta.addr);
+#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+        }
+}
+
+void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
+                               struct ieee80211_sta *pubsta, bool block)
+{
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+
+        if (block)
+                set_sta_flags(sta, WLAN_STA_PS_DRIVER);
+        else
+                ieee80211_queue_work(hw, &sta->drv_unblock_wk);
+}
+EXPORT_SYMBOL(ieee80211_sta_block_awake);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index ccc3adf962c7..822d84522937 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -12,6 +12,7 @@
 #include <linux/list.h>
 #include <linux/types.h>
 #include <linux/if_ether.h>
+#include <linux/workqueue.h>
 #include "key.h"
 
 /**
@@ -21,7 +22,7 @@
  *
  * @WLAN_STA_AUTH: Station is authenticated.
  * @WLAN_STA_ASSOC: Station is associated.
- * @WLAN_STA_PS: Station is in power-save mode
+ * @WLAN_STA_PS_STA: Station is in power-save mode
  * @WLAN_STA_AUTHORIZED: Station is authorized to send/receive traffic.
  *      This bit is always checked so needs to be enabled for all stations
  *      when virtual port control is not in use.
@@ -36,11 +37,19 @@
  * @WLAN_STA_MFP: Management frame protection is used with this STA.
  * @WLAN_STA_SUSPEND: Set/cleared during a suspend/resume cycle.
  *      Used to deny ADDBA requests (both TX and RX).
+ * @WLAN_STA_PS_DRIVER: driver requires keeping this station in
+ *      power-save mode logically to flush frames that might still
+ *      be in the queues
+ * @WLAN_STA_PSPOLL: Station sent PS-poll while driver was keeping
+ *      station in power-save mode, reply when the driver unblocks.
+ * @WLAN_STA_DISASSOC: Disassociation in progress.
+ *      This is used to reject TX BA session requests when disassociation
+ *      is in progress.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH           = 1<<0,
         WLAN_STA_ASSOC          = 1<<1,
-        WLAN_STA_PS             = 1<<2,
+        WLAN_STA_PS_STA         = 1<<2,
         WLAN_STA_AUTHORIZED     = 1<<3,
         WLAN_STA_SHORT_PREAMBLE = 1<<4,
         WLAN_STA_ASSOC_AP       = 1<<5,
@@ -48,7 +57,10 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_WDS            = 1<<7,
         WLAN_STA_CLEAR_PS_FILT  = 1<<9,
         WLAN_STA_MFP            = 1<<10,
-        WLAN_STA_SUSPEND        = 1<<11
+        WLAN_STA_SUSPEND        = 1<<11,
+        WLAN_STA_PS_DRIVER      = 1<<12,
+        WLAN_STA_PSPOLL         = 1<<13,
+        WLAN_STA_DISASSOC       = 1<<14,
 };
 
 #define STA_TID_NUM 16
@@ -154,11 +166,6 @@ struct sta_ampdu_mlme {
 };
 
 
-/* see __sta_info_unlink */
-#define STA_INFO_PIN_STAT_NORMAL        0
-#define STA_INFO_PIN_STAT_PINNED        1
-#define STA_INFO_PIN_STAT_DESTROY       2
-
 /**
  * struct sta_info - STA information
  *
@@ -177,8 +184,8 @@ struct sta_ampdu_mlme {
  * @lock: used for locking all fields that require locking, see comments
  *      in the header file.
  * @flaglock: spinlock for flags accesses
+ * @drv_unblock_wk: used for driver PS unblocking
  * @listen_interval: listen interval of this station, when we're acting as AP
- * @pin_status: used internally for pinning a STA struct into memory
  * @flags: STA flags, see &enum ieee80211_sta_info_flags
  * @ps_tx_buf: buffer of frames to transmit to this station
  *      when it leaves power saving state
@@ -193,7 +200,6 @@ struct sta_ampdu_mlme {
  * @rx_fragments: number of received MPDUs
  * @rx_dropped: number of dropped MPDUs from this STA
  * @last_signal: signal of last received frame from this STA
- * @last_qual: qual of last received frame from this STA
  * @last_noise: noise of last received frame from this STA
  * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
  * @tx_filtered_count: number of frames the hardware filtered for this STA
@@ -217,6 +223,8 @@ struct sta_ampdu_mlme {
  * @plink_timer_was_running: used by suspend/resume to restore timers
  * @debugfs: debug filesystem info
  * @sta: station information we share with the driver
+ * @dead: set to true when sta is unlinked
+ * @uploaded: set to true when sta is uploaded to the driver
  */
 struct sta_info {
         /* General information, mostly static */
@@ -230,13 +238,13 @@ struct sta_info {
         spinlock_t lock;
         spinlock_t flaglock;
 
+        struct work_struct drv_unblock_wk;
+
         u16 listen_interval;
 
-        /*
-         * for use by the internal lifetime management,
-         * see __sta_info_unlink
-         */
-        u8 pin_status;
+        bool dead;
+
+        bool uploaded;
 
         /*
          * frequently updated, locked with own spinlock (flaglock),
@@ -259,7 +267,6 @@ struct sta_info {
         unsigned long rx_fragments;
         unsigned long rx_dropped;
         int last_signal;
-        int last_qual;
         int last_noise;
         __le16 last_seq_ctrl[NUM_RX_DATA_QUEUES];
 
@@ -301,28 +308,6 @@ struct sta_info {
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct sta_info_debugfsdentries {
                 struct dentry *dir;
-                struct dentry *flags;
-                struct dentry *num_ps_buf_frames;
-                struct dentry *inactive_ms;
-                struct dentry *last_seq_ctrl;
-                struct dentry *agg_status;
-                struct dentry *aid;
-                struct dentry *dev;
-                struct dentry *rx_packets;
-                struct dentry *tx_packets;
-                struct dentry *rx_bytes;
-                struct dentry *tx_bytes;
-                struct dentry *rx_duplicates;
-                struct dentry *rx_fragments;
-                struct dentry *rx_dropped;
-                struct dentry *tx_fragments;
-                struct dentry *tx_filtered;
-                struct dentry *tx_retry_failed;
-                struct dentry *tx_retry_count;
-                struct dentry *last_signal;
-                struct dentry *last_qual;
-                struct dentry *last_noise;
-                struct dentry *wep_weak_iv_count;
                 bool add_has_run;
         } debugfs;
 #endif
@@ -413,14 +398,42 @@ static inline u32 get_sta_flags(struct sta_info *sta)
 #define STA_INFO_CLEANUP_INTERVAL (10 * HZ)
 
 /*
- * Get a STA info, must have be under RCU read lock.
+ * Get a STA info, must be under RCU read lock.
  */
-struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr);
+struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr);
+
+struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr);
+
+static inline
+void for_each_sta_info_type_check(struct ieee80211_local *local,
+                                  const u8 *addr,
+                                  struct sta_info *sta,
+                                  struct sta_info *nxt)
+{
+}
+
+#define for_each_sta_info(local, _addr, sta, nxt)                       \
+        for (   /* initialise loop */                                   \
+                sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
+                nxt = sta ? rcu_dereference(sta->hnext) : NULL;         \
+                /* typecheck */                                         \
+                for_each_sta_info_type_check(local, (_addr), sta, nxt), \
+                /* continue condition */                                \
+                sta;                                                    \
+                /* advance loop */                                      \
+                sta = nxt,                                              \
+                nxt = sta ? rcu_dereference(sta->hnext) : NULL          \
+             )                                                          \
+        /* compare address and run code only if it matches */           \
+        if (memcmp(sta->sta.addr, (_addr), ETH_ALEN) == 0)
+
 /*
  * Get STA info by index, BROKEN!
  */
-struct sta_info *sta_info_get_by_idx(struct ieee80211_local *local, int idx,
-                                      struct net_device *dev);
+struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
+                                     int idx);
 /*
  * Create a new STA info, caller owns returned structure
  * until sta_info_insert().
@@ -431,18 +444,19 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
  * Insert STA info into hash table/list, returns zero or a
  * -EEXIST if (if the same MAC address is already present).
  *
- * Calling this without RCU protection makes the caller
- * relinquish its reference to @sta.
+ * Calling the non-rcu version makes the caller relinquish,
+ * the _rcu version calls read_lock_rcu() and must be called
+ * without it held.
  */
 int sta_info_insert(struct sta_info *sta);
-/*
- * Unlink a STA info from the hash table/list.
- * This can NULL the STA pointer if somebody else
- * has already unlinked it.
- */
-void sta_info_unlink(struct sta_info **sta);
+int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU);
+int sta_info_insert_atomic(struct sta_info *sta);
+
+int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata,
+                          const u8 *addr);
+int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr);
 
-void sta_info_destroy(struct sta_info *sta);
 void sta_info_set_tim_bit(struct sta_info *sta);
 void sta_info_clear_tim_bit(struct sta_info *sta);
 
@@ -454,4 +468,7 @@ int sta_info_flush(struct ieee80211_local *local,
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                           unsigned long exp_time);
 
+void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta);
+void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta);
+
 #endif /* STA_INFO_H */
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
new file mode 100644
index 000000000000..56d5b9a6ec5b
--- /dev/null
+++ b/net/mac80211/status.c
@@ -0,0 +1,388 @@
+/*
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2008-2010  Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+#include "rate.h"
+#include "mesh.h"
+#include "led.h"
+
+
+void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
+                                 struct sk_buff *skb)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int tmp;
+
+        skb->pkt_type = IEEE80211_TX_STATUS_MSG;
+        skb_queue_tail(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS ?
+                       &local->skb_queue : &local->skb_queue_unreliable, skb);
+        tmp = skb_queue_len(&local->skb_queue) +
+                skb_queue_len(&local->skb_queue_unreliable);
+        while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
+               (skb = skb_dequeue(&local->skb_queue_unreliable))) {
+                dev_kfree_skb_irq(skb);
+                tmp--;
+                I802_DEBUG_INC(local->tx_status_drop);
+        }
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_tx_status_irqsafe);
+
+static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
+                                            struct sta_info *sta,
+                                            struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        /*
+         * This skb 'survived' a round-trip through the driver, and
+         * hopefully the driver didn't mangle it too badly. However,
+         * we can definitely not rely on the the control information
+         * being correct. Clear it so we don't get junk there, and
+         * indicate that it needs new processing, but must not be
+         * modified/encrypted again.
+         */
+        memset(&info->control, 0, sizeof(info->control));
+
+        info->control.jiffies = jiffies;
+        info->control.vif = &sta->sdata->vif;
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING |
+                       IEEE80211_TX_INTFL_RETRANSMISSION;
+
+        sta->tx_filtered_count++;
+
+        /*
+         * Clear the TX filter mask for this STA when sending the next
+         * packet. If the STA went to power save mode, this will happen
+         * when it wakes up for the next time.
+         */
+        set_sta_flags(sta, WLAN_STA_CLEAR_PS_FILT);
+
+        /*
+         * This code races in the following way:
+         *
+         *  (1) STA sends frame indicating it will go to sleep and does so
+         *  (2) hardware/firmware adds STA to filter list, passes frame up
+         *  (3) hardware/firmware processes TX fifo and suppresses a frame
+         *  (4) we get TX status before having processed the frame and
+         *      knowing that the STA has gone to sleep.
+         *
+         * This is actually quite unlikely even when both those events are
+         * processed from interrupts coming in quickly after one another or
+         * even at the same time because we queue both TX status events and
+         * RX frames to be processed by a tasklet and process them in the
+         * same order that they were received or TX status last. Hence, there
+         * is no race as long as the frame RX is processed before the next TX
+         * status, which drivers can ensure, see below.
+         *
+         * Note that this can only happen if the hardware or firmware can
+         * actually add STAs to the filter list, if this is done by the
+         * driver in response to set_tim() (which will only reduce the race
+         * this whole filtering tries to solve, not completely solve it)
+         * this situation cannot happen.
+         *
+         * To completely solve this race drivers need to make sure that they
+         *  (a) don't mix the irq-safe/not irq-safe TX status/RX processing
+         *      functions and
+         *  (b) always process RX events before TX status events if ordering
+         *      can be unknown, for example with different interrupt status
+         *      bits.
+         */
+        if (test_sta_flags(sta, WLAN_STA_PS_STA) &&
+            skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
+                skb_queue_tail(&sta->tx_filtered, skb);
+                return;
+        }
+
+        if (!test_sta_flags(sta, WLAN_STA_PS_STA) &&
+            !(info->flags & IEEE80211_TX_INTFL_RETRIED)) {
+                /* Software retry the packet once */
+                info->flags |= IEEE80211_TX_INTFL_RETRIED;
+                ieee80211_add_pending_skb(local, skb);
+                return;
+        }
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        if (net_ratelimit())
+                printk(KERN_DEBUG "%s: dropped TX filtered frame, "
+                       "queue_len=%d PS=%d @%lu\n",
+                       wiphy_name(local->hw.wiphy),
+                       skb_queue_len(&sta->tx_filtered),
+                       !!test_sta_flags(sta, WLAN_STA_PS_STA), jiffies);
+#endif
+        dev_kfree_skb(skb);
+}
+
+static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
+{
+        struct ieee80211_mgmt *mgmt = (void *) skb->data;
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+
+        if (ieee80211_is_action(mgmt->frame_control) &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            mgmt->u.action.category == WLAN_CATEGORY_HT &&
+            mgmt->u.action.u.ht_smps.action == WLAN_HT_ACTION_SMPS) {
+                /*
+                 * This update looks racy, but isn't -- if we come
+                 * here we've definitely got a station that we're
+                 * talking to, and on a managed interface that can
+                 * only be the AP. And the only other place updating
+                 * this variable is before we're associated.
+                 */
+                switch (mgmt->u.action.u.ht_smps.smps_control) {
+                case WLAN_HT_SMPS_CONTROL_DYNAMIC:
+                        sta->sdata->u.mgd.ap_smps = IEEE80211_SMPS_DYNAMIC;
+                        break;
+                case WLAN_HT_SMPS_CONTROL_STATIC:
+                        sta->sdata->u.mgd.ap_smps = IEEE80211_SMPS_STATIC;
+                        break;
+                case WLAN_HT_SMPS_CONTROL_DISABLED:
+                default: /* shouldn't happen since we don't send that */
+                        sta->sdata->u.mgd.ap_smps = IEEE80211_SMPS_OFF;
+                        break;
+                }
+
+                ieee80211_queue_work(&local->hw, &local->recalc_smps);
+        }
+}
+
+void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct sk_buff *skb2;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        u16 frag, type;
+        __le16 fc;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_tx_status_rtap_hdr *rthdr;
+        struct ieee80211_sub_if_data *sdata;
+        struct net_device *prev_dev = NULL;
+        struct sta_info *sta, *tmp;
+        int retry_count = -1, i;
+        bool injected;
+
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                /* the HW cannot have attempted that rate */
+                if (i >= hw->max_rates) {
+                        info->status.rates[i].idx = -1;
+                        info->status.rates[i].count = 0;
+                }
+
+                retry_count += info->status.rates[i].count;
+        }
+        if (retry_count < 0)
+                retry_count = 0;
+
+        rcu_read_lock();
+
+        sband = local->hw.wiphy->bands[info->band];
+        fc = hdr->frame_control;
+
+        for_each_sta_info(local, hdr->addr1, sta, tmp) {
+                /* skip wrong virtual interface */
+                if (memcmp(hdr->addr2, sta->sdata->vif.addr, ETH_ALEN))
+                        continue;
+
+                if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
+                    test_sta_flags(sta, WLAN_STA_PS_STA)) {
+                        /*
+                         * The STA is in power save mode, so assume
+                         * that this TX packet failed because of that.
+                         */
+                        ieee80211_handle_filtered_frame(local, sta, skb);
+                        rcu_read_unlock();
+                        return;
+                }
+
+                if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
+                    (ieee80211_is_data_qos(fc))) {
+                        u16 tid, ssn;
+                        u8 *qc;
+
+                        qc = ieee80211_get_qos_ctl(hdr);
+                        tid = qc[0] & 0xf;
+                        ssn = ((le16_to_cpu(hdr->seq_ctrl) + 0x10)
+                                                & IEEE80211_SCTL_SEQ);
+                        ieee80211_send_bar(sta->sdata, hdr->addr1,
+                                           tid, ssn);
+                }
+
+                if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
+                        ieee80211_handle_filtered_frame(local, sta, skb);
+                        rcu_read_unlock();
+                        return;
+                } else {
+                        if (!(info->flags & IEEE80211_TX_STAT_ACK))
+                                sta->tx_retry_failed++;
+                        sta->tx_retry_count += retry_count;
+                }
+
+                rate_control_tx_status(local, sband, sta, skb);
+                if (ieee80211_vif_is_mesh(&sta->sdata->vif))
+                        ieee80211s_update_metric(local, sta, skb);
+
+                if (!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+                    (info->flags & IEEE80211_TX_STAT_ACK))
+                        ieee80211_frame_acked(sta, skb);
+        }
+
+        rcu_read_unlock();
+
+        ieee80211_led_tx(local, 0);
+
+        /* SNMP counters
+         * Fragments are passed to low-level drivers as separate skbs, so these
+         * are actually fragments, not frames. Update frame counters only for
+         * the first fragment of the frame. */
+
+        frag = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
+        type = le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_FTYPE;
+
+        if (info->flags & IEEE80211_TX_STAT_ACK) {
+                if (frag == 0) {
+                        local->dot11TransmittedFrameCount++;
+                        if (is_multicast_ether_addr(hdr->addr1))
+                                local->dot11MulticastTransmittedFrameCount++;
+                        if (retry_count > 0)
+                                local->dot11RetryCount++;
+                        if (retry_count > 1)
+                                local->dot11MultipleRetryCount++;
+                }
+
+                /* This counter shall be incremented for an acknowledged MPDU
+                 * with an individual address in the address 1 field or an MPDU
+                 * with a multicast address in the address 1 field of type Data
+                 * or Management. */
+                if (!is_multicast_ether_addr(hdr->addr1) ||
+                    type == IEEE80211_FTYPE_DATA ||
+                    type == IEEE80211_FTYPE_MGMT)
+                        local->dot11TransmittedFragmentCount++;
+        } else {
+                if (frag == 0)
+                        local->dot11FailedCount++;
+        }
+
+        if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) &&
+            (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
+            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+            local->ps_sdata && !(local->scanning)) {
+                if (info->flags & IEEE80211_TX_STAT_ACK) {
+                        local->ps_sdata->u.mgd.flags |=
+                                        IEEE80211_STA_NULLFUNC_ACKED;
+                        ieee80211_queue_work(&local->hw,
+                                        &local->dynamic_ps_enable_work);
+                } else
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                        msecs_to_jiffies(10));
+        }
+
+        if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX)
+                cfg80211_action_tx_status(
+                        skb->dev, (unsigned long) skb, skb->data, skb->len,
+                        !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
+
+        /* this was a transmitted frame, but now we want to reuse it */
+        skb_orphan(skb);
+
+        /*
+         * This is a bit racy but we can avoid a lot of work
+         * with this test...
+         */
+        if (!local->monitors && !local->cooked_mntrs) {
+                dev_kfree_skb(skb);
+                return;
+        }
+
+        /* send frame to monitor interfaces now */
+
+        if (skb_headroom(skb) < sizeof(*rthdr)) {
+                printk(KERN_ERR "ieee80211_tx_status: headroom too small\n");
+                dev_kfree_skb(skb);
+                return;
+        }
+
+        rthdr = (struct ieee80211_tx_status_rtap_hdr *)
+                                skb_push(skb, sizeof(*rthdr));
+
+        memset(rthdr, 0, sizeof(*rthdr));
+        rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
+        rthdr->hdr.it_present =
+                cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
+                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES) |
+                            (1 << IEEE80211_RADIOTAP_RATE));
+
+        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
+            !is_multicast_ether_addr(hdr->addr1))
+                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
+
+        /*
+         * XXX: Once radiotap gets the bitmap reset thing the vendor
+         *      extensions proposal contains, we can actually report
+         *      the whole set of tries we did.
+         */
+        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
+        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
+                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+                rthdr->rate = sband->bitrates[
+                                info->status.rates[0].idx].bitrate / 5;
+
+        /* for now report the total retry_count */
+        rthdr->data_retries = retry_count;
+
+        /* Need to make a copy before skb->cb gets cleared */
+        injected = !!(info->flags & IEEE80211_TX_CTL_INJECTED);
+
+        /* XXX: is this sufficient for BPF? */
+        skb_set_mac_header(skb, 0);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+        memset(skb->cb, 0, sizeof(skb->cb));
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
+                        if (!ieee80211_sdata_running(sdata))
+                                continue;
+
+                        if ((sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) &&
+                            !injected &&
+                            (type == IEEE80211_FTYPE_DATA))
+                                continue;
+
+                        if (prev_dev) {
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (skb2) {
+                                        skb2->dev = prev_dev;
+                                        netif_rx(skb2);
+                                }
+                        }
+
+                        prev_dev = sdata->dev;
+                }
+        }
+        if (prev_dev) {
+                skb->dev = prev_dev;
+                netif_rx(skb);
+                skb = NULL;
+        }
+        rcu_read_unlock();
+        dev_kfree_skb(skb);
+}
+EXPORT_SYMBOL(ieee80211_tx_status);
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 964b7faa7f17..7ef491e9d66d 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -100,7 +100,7 @@ static void tkip_mixing_phase1(const u8 *tk, struct tkip_ctx *ctx,
                 p1k[3] += tkipS(p1k[2] ^ get_unaligned_le16(tk + 12 + j));
                 p1k[4] += tkipS(p1k[3] ^ get_unaligned_le16(tk + 0 + j)) + i;
         }
-        ctx->initialized = 1;
+        ctx->state = TKIP_STATE_PHASE1_DONE;
 }
 
 static void tkip_mixing_phase2(const u8 *tk, struct tkip_ctx *ctx,
@@ -183,7 +183,7 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
         /* Update the p1k only when the iv16 in the packet wraps around, this
          * might occur after the wrap around of iv16 in the key in case of
          * fragmented packets. */
-        if (iv16 == 0 || !ctx->initialized)
+        if (iv16 == 0 || ctx->state == TKIP_STATE_NOT_INIT)
                 tkip_mixing_phase1(tk, ctx, hdr->addr2, iv32);
 
         if (type == IEEE80211_TKIP_P1_KEY) {
@@ -195,11 +195,13 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_key);
 
-/* Encrypt packet payload with TKIP using @key. @pos is a pointer to the
+/*
+ * Encrypt packet payload with TKIP using @key. @pos is a pointer to the
  * beginning of the buffer containing payload. This payload must include
- * headroom of eight octets for IV and Ext. IV and taildroom of four octets
- * for ICV. @payload_len is the length of payload (_not_ including extra
- * headroom and tailroom). @ta is the transmitter addresses. */
+ * the IV/Ext.IV and space for (taildroom) four octets for ICV.
+ * @payload_len is the length of payload (_not_ including IV/ICV length).
+ * @ta is the transmitter addresses.
+ */
 void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
                                  struct ieee80211_key *key,
                                  u8 *pos, size_t payload_len, u8 *ta)
@@ -209,12 +211,11 @@ void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
         const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
 
         /* Calculate per-packet key */
-        if (ctx->iv16 == 0 || !ctx->initialized)
+        if (ctx->iv16 == 0 || ctx->state == TKIP_STATE_NOT_INIT)
                 tkip_mixing_phase1(tk, ctx, ta, ctx->iv32);
 
         tkip_mixing_phase2(tk, ctx, ctx->iv16, rc4key);
 
-        pos = ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
         ieee80211_wep_encrypt_data(tfm, rc4key, 16, pos, payload_len);
 }
 
@@ -259,7 +260,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         if ((keyid >> 6) != key->conf.keyidx)
                 return TKIP_DECRYPT_INVALID_KEYIDX;
 
-        if (key->u.tkip.rx[queue].initialized &&
+        if (key->u.tkip.rx[queue].state != TKIP_STATE_NOT_INIT &&
             (iv32 < key->u.tkip.rx[queue].iv32 ||
              (iv32 == key->u.tkip.rx[queue].iv32 &&
               iv16 <= key->u.tkip.rx[queue].iv16))) {
@@ -275,11 +276,11 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
 
         if (only_iv) {
                 res = TKIP_DECRYPT_OK;
-                key->u.tkip.rx[queue].initialized = 1;
+                key->u.tkip.rx[queue].state = TKIP_STATE_PHASE1_HW_UPLOADED;
                 goto done;
         }
 
-        if (!key->u.tkip.rx[queue].initialized ||
+        if (key->u.tkip.rx[queue].state == TKIP_STATE_NOT_INIT ||
             key->u.tkip.rx[queue].iv32 != iv32) {
                 /* IV16 wrapped around - perform TKIP phase 1 */
                 tkip_mixing_phase1(tk, &key->u.tkip.rx[queue], ta, iv32);
@@ -299,18 +300,18 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         printk("\n");
                 }
 #endif
-                if (key->local->ops->update_tkip_key &&
-                        key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
-                        u8 bcast[ETH_ALEN] =
-                                {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-                        u8 *sta_addr = key->sta->sta.addr;
-
-                        if (is_multicast_ether_addr(ra))
-                                sta_addr = bcast;
-
-                        drv_update_tkip_key(key->local, &key->conf, sta_addr,
-                                            iv32, key->u.tkip.rx[queue].p1k);
-                }
+        }
+        if (key->local->ops->update_tkip_key &&
+            key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
+            key->u.tkip.rx[queue].state != TKIP_STATE_PHASE1_HW_UPLOADED) {
+                struct ieee80211_sub_if_data *sdata = key->sdata;
+
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        sdata = container_of(key->sdata->bss,
+                                        struct ieee80211_sub_if_data, u.ap);
+                drv_update_tkip_key(key->local, sdata, &key->conf, key->sta,
+                                iv32, key->u.tkip.rx[queue].p1k);
+                key->u.tkip.rx[queue].state = TKIP_STATE_PHASE1_HW_UPLOADED;
         }
 
         tkip_mixing_phase2(tk, &key->u.tkip.rx[queue], iv16, rc4key);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index eaa4118de988..cfc473e1b050 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -180,6 +180,71 @@ static int inline is_ieee80211_device(struct ieee80211_local *local,
 }
 
 /* tx handlers */
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_local *local = tx->local;
+        struct ieee80211_if_managed *ifmgd;
+
+        /* driver doesn't support power save */
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
+                return TX_CONTINUE;
+
+        /* hardware does dynamic power save */
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
+                return TX_CONTINUE;
+
+        /* dynamic power save disabled */
+        if (local->hw.conf.dynamic_ps_timeout <= 0)
+                return TX_CONTINUE;
+
+        /* we are scanning, don't enable power save */
+        if (local->scanning)
+                return TX_CONTINUE;
+
+        if (!local->ps_sdata)
+                return TX_CONTINUE;
+
+        /* No point if we're going to suspend */
+        if (local->quiescing)
+                return TX_CONTINUE;
+
+        /* dynamic ps is supported only in managed mode */
+        if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
+                return TX_CONTINUE;
+
+        ifmgd = &tx->sdata->u.mgd;
+
+        /*
+         * Don't wakeup from power save if u-apsd is enabled, voip ac has
+         * u-apsd enabled and the frame is in voip class. This effectively
+         * means that even if all access categories have u-apsd enabled, in
+         * practise u-apsd is only used with the voip ac. This is a
+         * workaround for the case when received voip class packets do not
+         * have correct qos tag for some reason, due the network or the
+         * peer application.
+         *
+         * Note: local->uapsd_queues access is racy here. If the value is
+         * changed via debugfs, user needs to reassociate manually to have
+         * everything in sync.
+         */
+        if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
+            && (local->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
+            && skb_get_queue_mapping(tx->skb) == 0)
+                return TX_CONTINUE;
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                ieee80211_stop_queues_by_reason(&local->hw,
+                                                IEEE80211_QUEUE_STOP_REASON_PS);
+                ieee80211_queue_work(&local->hw,
+                                     &local->dynamic_ps_disable_work);
+        }
+
+        mod_timer(&local->dynamic_ps_timer, jiffies +
+                  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+
+        return TX_CONTINUE;
+}
 
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
@@ -223,7 +288,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                         printk(KERN_DEBUG "%s: dropped data frame to not "
                                "associated station %pM\n",
-                               tx->dev->name, hdr->addr1);
+                               tx->sdata->name, hdr->addr1);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
                         return TX_DROP;
@@ -317,12 +382,11 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (!atomic_read(&tx->sdata->bss->num_sta_ps))
                 return TX_CONTINUE;
 
-        /* buffered in hardware */
-        if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)) {
-                info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+        info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
 
+        /* device releases frame after DTIM beacon */
+        if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
                 return TX_CONTINUE;
-        }
 
         /* buffered in mac80211 */
         if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
@@ -332,7 +396,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "%s: BC TX buffer full - dropping the oldest frame\n",
-                               tx->dev->name);
+                               tx->sdata->name);
 #endif
                 dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
         } else
@@ -367,15 +431,16 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         u32 staflags;
 
-        if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)
-                        || ieee80211_is_auth(hdr->frame_control)
-                        || ieee80211_is_assoc_resp(hdr->frame_control)
-                        || ieee80211_is_reassoc_resp(hdr->frame_control)))
+        if (unlikely(!sta ||
+                     ieee80211_is_probe_resp(hdr->frame_control) ||
+                     ieee80211_is_auth(hdr->frame_control) ||
+                     ieee80211_is_assoc_resp(hdr->frame_control) ||
+                     ieee80211_is_reassoc_resp(hdr->frame_control)))
                 return TX_CONTINUE;
 
         staflags = get_sta_flags(sta);
 
-        if (unlikely((staflags & WLAN_STA_PS) &&
+        if (unlikely((staflags & (WLAN_STA_PS_STA | WLAN_STA_PS_DRIVER)) &&
                      !(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
@@ -391,15 +456,20 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: STA %pM TX "
                                        "buffer full - dropping oldest frame\n",
-                                       tx->dev->name, sta->sta.addr);
+                                       tx->sdata->name, sta->sta.addr);
                         }
 #endif
                         dev_kfree_skb(old);
                 } else
                         tx->local->total_ps_buffered++;
 
-                /* Queue frame to be sent after STA sends an PS Poll frame */
-                if (skb_queue_empty(&sta->ps_tx_buf))
+                /*
+                 * Queue frame to be sent after STA wakes up/polls,
+                 * but don't set the TIM bit if the driver is blocking
+                 * wakeup or poll response transmissions anyway.
+                 */
+                if (skb_queue_empty(&sta->ps_tx_buf) &&
+                    !(staflags & WLAN_STA_PS_DRIVER))
                         sta_info_set_tim_bit(sta);
 
                 info->control.jiffies = jiffies;
@@ -409,9 +479,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 return TX_QUEUED;
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) {
+        else if (unlikely(staflags & WLAN_STA_PS_STA)) {
                 printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
-                       "set -> send frame\n", tx->dev->name,
+                       "set -> send frame\n", tx->sdata->name,
                        sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
@@ -459,6 +529,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 tx->key = NULL;
 
         if (tx->key) {
+                bool skip_hw = false;
+
                 tx->key->tx_rx_count++;
                 /* TODO: add threshold stuff again */
 
@@ -475,16 +547,32 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                             !ieee80211_use_mfp(hdr->frame_control, tx->sta,
                                                tx->skb))
                                 tx->key = NULL;
+                        else
+                                skip_hw = (tx->key->conf.flags &
+                                           IEEE80211_KEY_FLAG_SW_MGMT) &&
+                                        ieee80211_is_mgmt(hdr->frame_control);
                         break;
                 case ALG_AES_CMAC:
                         if (!ieee80211_is_mgmt(hdr->frame_control))
                                 tx->key = NULL;
                         break;
                 }
+
+                if (!skip_hw && tx->key &&
+                    tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+                        info->control.hw_key = &tx->key->conf;
         }
 
-        if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_sta(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+        if (tx->sta && tx->sta->uploaded)
+                info->control.sta = &tx->sta->sta;
 
         return TX_CONTINUE;
 }
@@ -514,7 +602,12 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         txrc.bss_conf = &tx->sdata->vif.bss_conf;
         txrc.skb = tx->skb;
         txrc.reported_rate.idx = -1;
-        txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
+        txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[tx->channel->band];
+        if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
+                txrc.max_rate_idx = -1;
+        else
+                txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+        txrc.ap = tx->sdata->vif.type == NL80211_IFTYPE_AP;
 
         /* set up RTS protection if desired */
         if (len > tx->local->hw.wiphy->rts_threshold) {
@@ -544,7 +637,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
                  "%s: Dropped data frame as no usable bitrate found while "
                  "scanning and associated. Target station: "
                  "%pM on %d GHz band\n",
-                 tx->dev->name, hdr->addr1,
+                 tx->sdata->name, hdr->addr1,
                  tx->channel->band ? 5 : 2))
                 return TX_DROP;
 
@@ -659,17 +752,6 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-
-        if (tx->sta)
-                info->control.sta = &tx->sta->sta;
-
-        return TX_CONTINUE;
-}
-
-static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
@@ -928,7 +1010,8 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
+        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
+                                                   NULL);
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
@@ -964,7 +1047,7 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                  * because it will be recomputed and added
                                  * on transmission
                                  */
-                                if (skb->len < (iterator.max_length + FCS_LEN))
+                                if (skb->len < (iterator._max_length + FCS_LEN))
                                         return false;
 
                                 skb_trim(skb, skb->len - FCS_LEN);
@@ -991,10 +1074,10 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
 
         /*
          * remove the radiotap header
-         * iterator->max_length was sanity-checked against
+         * iterator->_max_length was sanity-checked against
          * skb->len by iterator init
          */
-        skb_pull(skb, iterator.max_length);
+        skb_pull(skb, iterator._max_length);
 
         return true;
 }
@@ -1016,7 +1099,6 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
-        tx->dev = sdata->dev; /* use original interface */
         tx->local = local;
         tx->sdata = sdata;
         tx->channel = local->hw.conf.channel;
@@ -1027,7 +1109,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         tx->flags |= IEEE80211_TX_FRAGMENTED;
 
         /* process and remove the injection radiotap header */
-        if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_HAS_RADIOTAP)) {
                 if (!__ieee80211_parse_tx_radiotap(tx, skb))
                         return TX_DROP;
 
@@ -1036,6 +1118,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                  * the radiotap header that was present and pre-filled
                  * 'tx' with tx control information.
                  */
+                info->flags &= ~IEEE80211_TX_INTFL_HAS_RADIOTAP;
         }
 
         /*
@@ -1047,7 +1130,15 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         hdr = (struct ieee80211_hdr *) skb->data;
 
-        tx->sta = sta_info_get(local, hdr->addr1);
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                tx->sta = rcu_dereference(sdata->u.vlan.sta);
+                if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
+                        return TX_DROP;
+        } else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+                tx->sta = sta_info_get_bss(sdata, hdr->addr1);
+        }
+        if (!tx->sta)
+                tx->sta = sta_info_get(sdata, hdr->addr1);
 
         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
             (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
@@ -1199,25 +1290,34 @@ static int __ieee80211_tx(struct ieee80211_local *local,
 static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         ieee80211_tx_result res = TX_DROP;
 
-#define CALL_TXH(txh)           \
-        res = txh(tx);          \
-        if (res != TX_CONTINUE) \
+#define CALL_TXH(txh) \
+        do {                            \
+                res = txh(tx);          \
+                if (res != TX_CONTINUE) \
+                        goto txh_done;  \
+        } while (0)
+
+        CALL_TXH(ieee80211_tx_h_dynamic_ps);
+        CALL_TXH(ieee80211_tx_h_check_assoc);
+        CALL_TXH(ieee80211_tx_h_ps_buf);
+        CALL_TXH(ieee80211_tx_h_select_key);
+        CALL_TXH(ieee80211_tx_h_sta);
+        if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
+                CALL_TXH(ieee80211_tx_h_rate_ctrl);
+
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION))
                 goto txh_done;
 
-        CALL_TXH(ieee80211_tx_h_check_assoc)
-        CALL_TXH(ieee80211_tx_h_ps_buf)
-        CALL_TXH(ieee80211_tx_h_select_key)
-        CALL_TXH(ieee80211_tx_h_michael_mic_add)
-        CALL_TXH(ieee80211_tx_h_rate_ctrl)
-        CALL_TXH(ieee80211_tx_h_misc)
-        CALL_TXH(ieee80211_tx_h_sequence)
-        CALL_TXH(ieee80211_tx_h_fragment)
+        CALL_TXH(ieee80211_tx_h_michael_mic_add);
+        CALL_TXH(ieee80211_tx_h_sequence);
+        CALL_TXH(ieee80211_tx_h_fragment);
         /* handlers after fragment must be aware of tx info fragmentation! */
-        CALL_TXH(ieee80211_tx_h_stats)
-        CALL_TXH(ieee80211_tx_h_encrypt)
-        CALL_TXH(ieee80211_tx_h_calculate_duration)
+        CALL_TXH(ieee80211_tx_h_stats);
+        CALL_TXH(ieee80211_tx_h_encrypt);
+        CALL_TXH(ieee80211_tx_h_calculate_duration);
 #undef CALL_TXH
 
  txh_done:
@@ -1397,29 +1497,14 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
         int headroom;
         bool may_encrypt;
 
-        dev_hold(sdata->dev);
-
-        if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
-            local->hw.conf.dynamic_ps_timeout > 0 &&
-            !(local->scanning) && local->ps_sdata) {
-                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                        ieee80211_stop_queues_by_reason(&local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_PS);
-                        ieee80211_queue_work(&local->hw,
-                                        &local->dynamic_ps_disable_work);
-                }
-
-                mod_timer(&local->dynamic_ps_timer, jiffies +
-                        msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
-        }
-
-        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        rcu_read_lock();
 
         if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
                 int hdrlen;
                 u16 len_rthdr;
 
-                info->flags |= IEEE80211_TX_CTL_INJECTED;
+                info->flags |= IEEE80211_TX_CTL_INJECTED |
+                               IEEE80211_TX_INTFL_HAS_RADIOTAP;
 
                 len_rthdr = ieee80211_get_radiotap_len(skb->data);
                 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
@@ -1437,22 +1522,18 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                          * support we will need a different mechanism.
                          */
 
-                        rcu_read_lock();
                         list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
                                                 list) {
-                                if (!netif_running(tmp_sdata->dev))
+                                if (!ieee80211_sdata_running(tmp_sdata))
                                         continue;
                                 if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
                                         continue;
-                                if (compare_ether_addr(tmp_sdata->dev->dev_addr,
+                                if (compare_ether_addr(tmp_sdata->vif.addr,
                                                        hdr->addr2) == 0) {
-                                        dev_hold(tmp_sdata->dev);
-                                        dev_put(sdata->dev);
                                         sdata = tmp_sdata;
                                         break;
                                 }
                         }
-                        rcu_read_unlock();
                 }
         }
 
@@ -1466,7 +1547,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
         if (ieee80211_skb_resize(local, skb, headroom, may_encrypt)) {
                 dev_kfree_skb(skb);
-                dev_put(sdata->dev);
+                rcu_read_unlock();
                 return;
         }
 
@@ -1477,13 +1558,13 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                 !is_multicast_ether_addr(hdr->addr1))
                         if (mesh_nexthop_lookup(skb, sdata)) {
                                 /* skb queued: don't free */
-                                dev_put(sdata->dev);
+                                rcu_read_unlock();
                                 return;
                         }
 
-        ieee80211_select_queue(local, skb);
+        ieee80211_set_qos_hdr(local, skb);
         ieee80211_tx(sdata, skb, false);
-        dev_put(sdata->dev);
+        rcu_read_unlock();
 }
 
 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
@@ -1547,6 +1628,8 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
 
         memset(info, 0, sizeof(*info));
 
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+
         /* pass the radiotap header up to xmit */
         ieee80211_xmit(IEEE80211_DEV_TO_SUB_IF(dev), skb);
         return NETDEV_TX_OK;
@@ -1585,7 +1668,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         const u8 *encaps_data;
         int encaps_len, skip_header_bytes;
         int nh_pos, h_pos;
-        struct sta_info *sta;
+        struct sta_info *sta = NULL;
         u32 sta_flags = 0;
 
         if (unlikely(skb->len < ETH_HLEN)) {
@@ -1602,12 +1685,28 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
 
         switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
+                rcu_read_lock();
+                sta = rcu_dereference(sdata->u.vlan.sta);
+                if (sta) {
+                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
+                        /* RA TA DA SA */
+                        memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
+                        memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
+                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
+                        hdrlen = 30;
+                        sta_flags = get_sta_flags(sta);
+                }
+                rcu_read_unlock();
+                if (sta)
+                        break;
+                /* fall through */
+        case NL80211_IFTYPE_AP:
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
-                memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 24;
                 break;
@@ -1615,7 +1714,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
-                memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 30;
@@ -1629,8 +1728,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         goto fail;
                 }
 
-                if (compare_ether_addr(dev->dev_addr,
-                                          skb->data + ETH_ALEN) == 0) {
+                if (compare_ether_addr(sdata->vif.addr,
+                                       skb->data + ETH_ALEN) == 0) {
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                         skb->data, skb->data + ETH_ALEN);
                         meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
@@ -1639,24 +1738,28 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         /* packet from other interface */
                         struct mesh_path *mppath;
                         int is_mesh_mcast = 1;
-                        char *mesh_da;
+                        const u8 *mesh_da;
 
                         rcu_read_lock();
                         if (is_multicast_ether_addr(skb->data))
                                 /* DA TA mSA AE:SA */
                                 mesh_da = skb->data;
                         else {
+                                static const u8 bcast[ETH_ALEN] =
+                                        { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
                                 mppath = mpp_path_lookup(skb->data, sdata);
                                 if (mppath) {
                                         /* RA TA mDA mSA AE:DA SA */
                                         mesh_da = mppath->mpp;
                                         is_mesh_mcast = 0;
-                                } else
+                                } else {
                                         /* DA TA mSA AE:SA */
-                                        mesh_da = dev->broadcast;
+                                        mesh_da = bcast;
+                                }
                         }
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
-                                        mesh_da, dev->dev_addr);
+                                        mesh_da, sdata->vif.addr);
                         rcu_read_unlock();
                         if (is_mesh_mcast)
                                 meshhdrlen =
@@ -1677,12 +1780,21 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
-                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
-                /* BSSID SA DA */
                 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
-                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-                memcpy(hdr.addr3, skb->data, ETH_ALEN);
-                hdrlen = 24;
+                if (sdata->u.mgd.use_4addr && ethertype != ETH_P_PAE) {
+                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
+                        /* RA TA DA SA */
+                        memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
+                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
+                        hdrlen = 30;
+                } else {
+                        fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
+                        /* BSSID SA DA */
+                        memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        hdrlen = 24;
+                }
                 break;
         case NL80211_IFTYPE_ADHOC:
                 /* DA SA BSSID */
@@ -1703,9 +1815,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          */
         if (!is_multicast_ether_addr(hdr.addr1)) {
                 rcu_read_lock();
-                sta = sta_info_get(local, hdr.addr1);
-                /* XXX: in the future, use sdata to look up the sta */
-                if (sta && sta->sdata == sdata)
+                sta = sta_info_get(sdata, hdr.addr1);
+                if (sta)
                         sta_flags = get_sta_flags(sta);
                 rcu_read_unlock();
         }
@@ -1724,7 +1835,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 unlikely(!is_multicast_ether_addr(hdr.addr1) &&
                       !(sta_flags & WLAN_STA_AUTHORIZED) &&
                       !(ethertype == ETH_P_PAE &&
-                       compare_ether_addr(dev->dev_addr,
+                       compare_ether_addr(sdata->vif.addr,
                                           skb->data + ETH_ALEN) == 0))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit())
@@ -1864,7 +1975,7 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
                 ieee80211_tx(sdata, skb, true);
         } else {
                 hdr = (struct ieee80211_hdr *)skb->data;
-                sta = sta_info_get(local, hdr->addr1);
+                sta = sta_info_get(sdata, hdr->addr1);
 
                 ret = __ieee80211_tx(local, &skb, sta, true);
                 if (ret != IEEE80211_TX_OK)
@@ -1880,6 +1991,7 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
 void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
+        struct ieee80211_sub_if_data *sdata;
         unsigned long flags;
         int i;
         bool txok;
@@ -1907,12 +2019,10 @@ void ieee80211_tx_pending(unsigned long data)
                         }
 
                         sdata = vif_to_sdata(info->control.vif);
-                        dev_hold(sdata->dev);
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                 flags);
 
                         txok = ieee80211_tx_pending_skb(local, skb);
-                        dev_put(sdata->dev);
                         if (!txok)
                                 __skb_queue_head(&local->pending[i], skb);
                         spin_lock_irqsave(&local->queue_stop_reason_lock,
@@ -1920,6 +2030,11 @@ void ieee80211_tx_pending(unsigned long data)
                         if (!txok)
                                 break;
                 }
+
+                if (skb_queue_empty(&local->pending[i]))
+                        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                                netif_tx_wake_queue(
+                                        netdev_get_tx_queue(sdata->dev, i));
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
@@ -1990,8 +2105,9 @@ static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
         }
 }
 
-struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif)
+struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif,
+                                         u16 *tim_offset, u16 *tim_length)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb = NULL;
@@ -2001,6 +2117,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band = local->hw.conf.channel->band;
+        struct ieee80211_tx_rate_control txrc;
 
         sband = local->hw.wiphy->bands[band];
 
@@ -2008,6 +2125,11 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 
         sdata = vif_to_sdata(vif);
 
+        if (tim_offset)
+                *tim_offset = 0;
+        if (tim_length)
+                *tim_length = 0;
+
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 ap = &sdata->u.ap;
                 beacon = rcu_dereference(ap->beacon);
@@ -2043,6 +2165,11 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                                 spin_unlock_irqrestore(&local->sta_lock, flags);
                         }
 
+                        if (tim_offset)
+                                *tim_offset = beacon->head_len;
+                        if (tim_length)
+                                *tim_length = skb->len - beacon->head_len;
+
                         if (beacon->tail)
                                 memcpy(skb_put(skb, beacon->tail_len),
                                        beacon->tail, beacon->tail_len);
@@ -2079,8 +2206,8 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 mgmt->frame_control =
                     cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
                 memset(mgmt->da, 0xff, ETH_ALEN);
-                memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-                /* BSSID is left zeroed, wildcard value */
+                memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
                         cpu_to_le16(sdata->vif.bss_conf.beacon_int);
                 mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
@@ -2098,28 +2225,160 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         info = IEEE80211_SKB_CB(skb);
 
         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_NO_ACK;
         info->band = band;
-        /*
-         * XXX: For now, always use the lowest rate
-         */
-        info->control.rates[0].idx = 0;
-        info->control.rates[0].count = 1;
-        info->control.rates[1].idx = -1;
-        info->control.rates[2].idx = -1;
-        info->control.rates[3].idx = -1;
-        info->control.rates[4].idx = -1;
-        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
+
+        memset(&txrc, 0, sizeof(txrc));
+        txrc.hw = hw;
+        txrc.sband = sband;
+        txrc.bss_conf = &sdata->vif.bss_conf;
+        txrc.skb = skb;
+        txrc.reported_rate.idx = -1;
+        txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
+        if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
+                txrc.max_rate_idx = -1;
+        else
+                txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+        txrc.ap = true;
+        rate_control_get_rate(sdata, NULL, &txrc);
 
         info->control.vif = vif;
 
-        info->flags |= IEEE80211_TX_CTL_NO_ACK;
         info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
  out:
         rcu_read_unlock();
         return skb;
 }
-EXPORT_SYMBOL(ieee80211_beacon_get);
+EXPORT_SYMBOL(ieee80211_beacon_get_tim);
+
+struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_pspoll *pspoll;
+        struct ieee80211_local *local;
+        struct sk_buff *skb;
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
+                return NULL;
+
+        sdata = vif_to_sdata(vif);
+        ifmgd = &sdata->u.mgd;
+        local = sdata->local;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for "
+                       "pspoll template\n", sdata->name);
+                return NULL;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
+        memset(pspoll, 0, sizeof(*pspoll));
+        pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                            IEEE80211_STYPE_PSPOLL);
+        pspoll->aid = cpu_to_le16(ifmgd->aid);
+
+        /* aid in PS-Poll has its two MSBs each set to 1 */
+        pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
+
+        memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
+        memcpy(pspoll->ta, vif->addr, ETH_ALEN);
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_pspoll_get);
+
+struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
+{
+        struct ieee80211_hdr_3addr *nullfunc;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_local *local;
+        struct sk_buff *skb;
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
+                return NULL;
+
+        sdata = vif_to_sdata(vif);
+        ifmgd = &sdata->u.mgd;
+        local = sdata->local;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
+                       "template\n", sdata->name);
+                return NULL;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
+                                                          sizeof(*nullfunc));
+        memset(nullfunc, 0, sizeof(*nullfunc));
+        nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                              IEEE80211_STYPE_NULLFUNC |
+                                              IEEE80211_FCTL_TODS);
+        memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
+        memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_nullfunc_get);
+
+struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       const u8 *ssid, size_t ssid_len,
+                                       const u8 *ie, size_t ie_len)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_local *local;
+        struct ieee80211_hdr_3addr *hdr;
+        struct sk_buff *skb;
+        size_t ie_ssid_len;
+        u8 *pos;
+
+        sdata = vif_to_sdata(vif);
+        local = sdata->local;
+        ie_ssid_len = 2 + ssid_len;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
+                            ie_ssid_len + ie_len);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "request template\n", sdata->name);
+                return NULL;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr));
+        memset(hdr, 0, sizeof(*hdr));
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                         IEEE80211_STYPE_PROBE_REQ);
+        memset(hdr->addr1, 0xff, ETH_ALEN);
+        memcpy(hdr->addr2, vif->addr, ETH_ALEN);
+        memset(hdr->addr3, 0xff, ETH_ALEN);
+
+        pos = skb_put(skb, ie_ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ssid_len;
+        if (ssid)
+                memcpy(pos, ssid, ssid_len);
+        pos += ssid_len;
+
+        if (ie) {
+                pos = skb_put(skb, ie_len);
+                memcpy(pos, ie, ie_len);
+        }
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_probereq_get);
 
 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        const void *frame, size_t frame_len,
@@ -2214,16 +2473,14 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
 
-void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                      int encrypt)
+void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         skb_set_mac_header(skb, 0);
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        if (!encrypt)
-                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        /* send all internal mgmt frames on VO */
+        skb_set_queue_mapping(skb, 0);
 
         /*
          * The other path calling ieee80211_xmit is from the tasklet,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index e6c08da8da26..53af57047435 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -18,7 +18,6 @@
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
-#include <linux/wireless.h>
 #include <linux/bitmap.h>
 #include <linux/crc32.h>
 #include <net/net_namespace.h>
@@ -269,6 +268,7 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
                                    enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
 
         if (WARN_ON(queue >= hw->queues))
                 return;
@@ -279,7 +279,12 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
                 /* someone still has this queue stopped */
                 return;
 
-        if (!skb_queue_empty(&local->pending[queue]))
+        if (skb_queue_empty(&local->pending[queue])) {
+                rcu_read_lock();
+                list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                        netif_tx_wake_queue(netdev_get_tx_queue(sdata->dev, queue));
+                rcu_read_unlock();
+        } else
                 tasklet_schedule(&local->tx_pending_tasklet);
 }
 
@@ -305,11 +310,17 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
                                    enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
 
         if (WARN_ON(queue >= hw->queues))
                 return;
 
         __set_bit(reason, &local->queue_stop_reasons[queue]);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                netif_tx_stop_queue(netdev_get_tx_queue(sdata->dev, queue));
+        rcu_read_unlock();
 }
 
 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
@@ -468,8 +479,8 @@ void ieee80211_iterate_active_interfaces(
                 case NL80211_IFTYPE_MESH_POINT:
                         break;
                 }
-                if (netif_running(sdata->dev))
-                        iterator(data, sdata->dev->dev_addr,
+                if (ieee80211_sdata_running(sdata))
+                        iterator(data, sdata->vif.addr,
                                  &sdata->vif);
         }
 
@@ -502,8 +513,8 @@ void ieee80211_iterate_active_interfaces_atomic(
                 case NL80211_IFTYPE_MESH_POINT:
                         break;
                 }
-                if (netif_running(sdata->dev))
-                        iterator(data, sdata->dev->dev_addr,
+                if (ieee80211_sdata_running(sdata))
+                        iterator(data, sdata->vif.addr,
                                  &sdata->vif);
         }
 
@@ -579,7 +590,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 if (elen > left)
                         break;
 
-                if (calc_crc && id < 64 && (filter & BIT(id)))
+                if (calc_crc && id < 64 && (filter & (1ULL << id)))
                         crc = crc32_be(crc, pos - 2, elen + 2);
 
                 switch (id) {
@@ -666,8 +677,8 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         elems->mesh_id_len = elen;
                         break;
                 case WLAN_EID_MESH_CONFIG:
-                        elems->mesh_config = pos;
-                        elems->mesh_config_len = elen;
+                        if (elen >= sizeof(struct ieee80211_meshconf_ie))
+                                elems->mesh_config = (void *)pos;
                         break;
                 case WLAN_EID_PEER_LINK:
                         elems->peer_link = pos;
@@ -685,6 +696,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         elems->perr = pos;
                         elems->perr_len = elen;
                         break;
+                case WLAN_EID_RANN:
+                        if (elen >= sizeof(struct ieee80211_rann_ie))
+                                elems->rann = (void *)pos;
+                        break;
                 case WLAN_EID_CHANNEL_SWITCH:
                         elems->ch_switch_elem = pos;
                         elems->ch_switch_elem_len = elen;
@@ -777,6 +792,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
                         break;
                 }
 
+                qparam.uapsd = false;
+
                 drv_conf_tx(local, queue, &qparam);
         }
 }
@@ -844,7 +861,7 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                             sizeof(*mgmt) + 6 + extra_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
-                       "frame\n", sdata->dev->name);
+                       "frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -854,7 +871,7 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_AUTH);
         memcpy(mgmt->da, bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
         mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
@@ -868,50 +885,96 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                 WARN_ON(err);
         }
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
 }
 
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             const u8 *ie, size_t ie_len)
+                             const u8 *ie, size_t ie_len,
+                             enum ieee80211_band band)
 {
         struct ieee80211_supported_band *sband;
-        u8 *pos, *supp_rates_len, *esupp_rates_len = NULL;
-        int i;
+        u8 *pos;
+        size_t offset = 0, noffset;
+        int supp_rates_len, i;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[band];
 
         pos = buffer;
 
+        supp_rates_len = min_t(int, sband->n_bitrates, 8);
+
         *pos++ = WLAN_EID_SUPP_RATES;
-        supp_rates_len = pos;
-        *pos++ = 0;
-
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-
-                if (esupp_rates_len) {
-                        *esupp_rates_len += 1;
-                } else if (*supp_rates_len == 8) {
-                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates_len = pos;
-                        *pos++ = 1;
-                } else
-                        *supp_rates_len += 1;
+        *pos++ = supp_rates_len;
 
-                *pos++ = rate->bitrate / 5;
+        for (i = 0; i < supp_rates_len; i++) {
+                int rate = sband->bitrates[i].bitrate;
+                *pos++ = (u8) (rate / 5);
+        }
+
+        /* insert "request information" if in custom IEs */
+        if (ie && ie_len) {
+                static const u8 before_extrates[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_REQUEST,
+                };
+                noffset = ieee80211_ie_split(ie, ie_len,
+                                             before_extrates,
+                                             ARRAY_SIZE(before_extrates),
+                                             offset);
+                memcpy(pos, ie + offset, noffset - offset);
+                pos += noffset - offset;
+                offset = noffset;
+        }
+
+        if (sband->n_bitrates > i) {
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = sband->n_bitrates - i;
+
+                for (; i < sband->n_bitrates; i++) {
+                        int rate = sband->bitrates[i].bitrate;
+                        *pos++ = (u8) (rate / 5);
+                }
+        }
+
+        /* insert custom IEs that go before HT */
+        if (ie && ie_len) {
+                static const u8 before_ht[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_REQUEST,
+                        WLAN_EID_EXT_SUPP_RATES,
+                        WLAN_EID_DS_PARAMS,
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                };
+                noffset = ieee80211_ie_split(ie, ie_len,
+                                             before_ht, ARRAY_SIZE(before_ht),
+                                             offset);
+                memcpy(pos, ie + offset, noffset - offset);
+                pos += noffset - offset;
+                offset = noffset;
         }
 
         if (sband->ht_cap.ht_supported) {
-                __le16 tmp = cpu_to_le16(sband->ht_cap.cap);
+                u16 cap = sband->ht_cap.cap;
+                __le16 tmp;
+
+                if (ieee80211_disable_40mhz_24ghz &&
+                    sband->band == IEEE80211_BAND_2GHZ) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
 
                 *pos++ = WLAN_EID_HT_CAPABILITY;
                 *pos++ = sizeof(struct ieee80211_ht_cap);
                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
+                tmp = cpu_to_le16(cap);
                 memcpy(pos, &tmp, sizeof(u16));
                 pos += sizeof(u16);
-                /* TODO: needs a define here for << 2 */
                 *pos++ = sband->ht_cap.ampdu_factor |
-                         (sband->ht_cap.ampdu_density << 2);
+                         (sband->ht_cap.ampdu_density <<
+                                IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
                 memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
                 pos += sizeof(sband->ht_cap.mcs);
                 pos += 2 + 4 + 1; /* ext info, BF cap, antsel */
@@ -922,9 +985,11 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
          * that calculates local->scan_ies_len.
          */
 
-        if (ie) {
-                memcpy(pos, ie, ie_len);
-                pos += ie_len;
+        /* add any remaining custom IEs */
+        if (ie && ie_len) {
+                noffset = ie_len;
+                memcpy(pos, ie + offset, noffset - offset);
+                pos += noffset - offset;
         }
 
         return pos - buffer;
@@ -937,38 +1002,33 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
-                            ie_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "request\n", sdata->dev->name);
+        size_t buf_len;
+        u8 *buf;
+
+        /* FIXME: come up with a proper value */
+        buf = kmalloc(200 + ie_len, GFP_KERNEL);
+        if (!buf) {
+                printk(KERN_DEBUG "%s: failed to allocate temporary IE "
+                       "buffer\n", sdata->name);
                 return;
         }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_PROBE_REQ);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len,
+                                           local->hw.conf.channel->band);
+
+        skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
+                                     ssid, ssid_len,
+                                     buf, buf_len);
+
         if (dst) {
+                mgmt = (struct ieee80211_mgmt *) skb->data;
                 memcpy(mgmt->da, dst, ETH_ALEN);
                 memcpy(mgmt->bssid, dst, ETH_ALEN);
-        } else {
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memset(mgmt->bssid, 0xff, ETH_ALEN);
         }
-        pos = skb_put(skb, 2 + ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = ssid_len;
-        memcpy(pos, ssid, ssid_len);
-        pos += ssid_len;
 
-        skb_put(skb, ieee80211_build_preq_ies(local, pos, ie, ie_len));
-
-        ieee80211_tx_skb(sdata, skb, 0);
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
+        kfree(buf);
 }
 
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
@@ -1012,18 +1072,16 @@ void ieee80211_stop_device(struct ieee80211_local *local)
         ieee80211_led_radio(local, false);
 
         cancel_work_sync(&local->reconfig_filter);
-        drv_stop(local);
 
         flush_workqueue(local->workqueue);
+        drv_stop(local);
 }
 
 int ieee80211_reconfig(struct ieee80211_local *local)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
-        unsigned long flags;
         int res;
 
         if (local->suspended)
@@ -1031,7 +1089,19 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
         /* restart hardware */
         if (local->open_count) {
+                /*
+                 * Upon resume hardware can sometimes be goofy due to
+                 * various platform / driver / bus issues, so restarting
+                 * the device may at times not work immediately. Propagate
+                 * the error.
+                 */
                 res = drv_start(local);
+                if (res) {
+                        WARN(local->suspended, "Hardware became unavailable "
+                             "upon resume. This could be a software issue "
+                             "prior to suspend or a hardware issue.\n");
+                        return res;
+                }
 
                 ieee80211_led_radio(local, true);
         }
@@ -1040,29 +1110,24 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
                     sdata->vif.type != NL80211_IFTYPE_MONITOR &&
-                    netif_running(sdata->dev)) {
-                        conf.vif = &sdata->vif;
-                        conf.type = sdata->vif.type;
-                        conf.mac_addr = sdata->dev->dev_addr;
-                        res = drv_add_interface(local, &conf);
-                }
+                    ieee80211_sdata_running(sdata))
+                        res = drv_add_interface(local, &sdata->vif);
         }
 
         /* add STAs back */
-        if (local->ops->sta_notify) {
-                spin_lock_irqsave(&local->sta_lock, flags);
-                list_for_each_entry(sta, &local->sta_list, list) {
+        mutex_lock(&local->sta_mtx);
+        list_for_each_entry(sta, &local->sta_list, list) {
+                if (sta->uploaded) {
                         sdata = sta->sdata;
                         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                                 sdata = container_of(sdata->bss,
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD,
-                                       &sta->sta);
+                        WARN_ON(drv_sta_add(local, sdata, &sta->sta));
                 }
-                spin_unlock_irqrestore(&local->sta_lock, flags);
         }
+        mutex_unlock(&local->sta_mtx);
 
         /* Clear Suspend state so that ADDBA requests can be processed */
 
@@ -1087,7 +1152,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         /* Finally also reconfigure all the BSS information */
         list_for_each_entry(sdata, &local->interfaces, list) {
                 u32 changed = ~0;
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
@@ -1113,9 +1178,17 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 }
         }
 
+        rcu_read_lock();
+        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
+                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                        ieee80211_sta_tear_down_BA_sessions(sta);
+                }
+        }
+        rcu_read_unlock();
+
         /* add back keys */
         list_for_each_entry(sdata, &local->interfaces, list)
-                if (netif_running(sdata->dev))
+                if (ieee80211_sdata_running(sdata))
                         ieee80211_enable_keys(sdata);
 
         ieee80211_wake_queues_by_reason(hw,
@@ -1152,13 +1225,143 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
         add_timer(&local->sta_cleanup);
 
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list)
                 mesh_plink_restart(sta);
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        mutex_unlock(&local->sta_mtx);
 #else
         WARN_ON(1);
 #endif
         return 0;
 }
 
+static int check_mgd_smps(struct ieee80211_if_managed *ifmgd,
+                          enum ieee80211_smps_mode *smps_mode)
+{
+        if (ifmgd->associated) {
+                *smps_mode = ifmgd->ap_smps;
+
+                if (*smps_mode == IEEE80211_SMPS_AUTOMATIC) {
+                        if (ifmgd->powersave)
+                                *smps_mode = IEEE80211_SMPS_DYNAMIC;
+                        else
+                                *smps_mode = IEEE80211_SMPS_OFF;
+                }
+
+                return 1;
+        }
+
+        return 0;
+}
+
+/* must hold iflist_mtx */
+void ieee80211_recalc_smps(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *forsdata)
+{
+        struct ieee80211_sub_if_data *sdata;
+        enum ieee80211_smps_mode smps_mode = IEEE80211_SMPS_OFF;
+        int count = 0;
+
+        if (forsdata)
+                WARN_ON(!mutex_is_locked(&forsdata->u.mgd.mtx));
+
+        WARN_ON(!mutex_is_locked(&local->iflist_mtx));
+
+        /*
+         * This function could be improved to handle multiple
+         * interfaces better, but right now it makes any
+         * non-station interfaces force SM PS to be turned
+         * off. If there are multiple station interfaces it
+         * could also use the best possible mode, e.g. if
+         * one is in static and the other in dynamic then
+         * dynamic is ok.
+         */
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        goto set;
+                if (sdata != forsdata) {
+                        /*
+                         * This nested is ok -- we are holding the iflist_mtx
+                         * so can't get here twice or so. But it's required
+                         * since normally we acquire it first and then the
+                         * iflist_mtx.
+                         */
+                        mutex_lock_nested(&sdata->u.mgd.mtx, SINGLE_DEPTH_NESTING);
+                        count += check_mgd_smps(&sdata->u.mgd, &smps_mode);
+                        mutex_unlock(&sdata->u.mgd.mtx);
+                } else
+                        count += check_mgd_smps(&sdata->u.mgd, &smps_mode);
+
+                if (count > 1) {
+                        smps_mode = IEEE80211_SMPS_OFF;
+                        break;
+                }
+        }
+
+        if (smps_mode == local->smps_mode)
+                return;
+
+ set:
+        local->smps_mode = smps_mode;
+        /* changed flag is auto-detected for this */
+        ieee80211_hw_config(local, 0);
+}
+
+static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id)
+{
+        int i;
+
+        for (i = 0; i < n_ids; i++)
+                if (ids[i] == id)
+                        return true;
+        return false;
+}
+
+/**
+ * ieee80211_ie_split - split an IE buffer according to ordering
+ *
+ * @ies: the IE buffer
+ * @ielen: the length of the IE buffer
+ * @ids: an array with element IDs that are allowed before
+ *      the split
+ * @n_ids: the size of the element ID array
+ * @offset: offset where to start splitting in the buffer
+ *
+ * This function splits an IE buffer by updating the @offset
+ * variable to point to the location where the buffer should be
+ * split.
+ *
+ * It assumes that the given IE buffer is well-formed, this
+ * has to be guaranteed by the caller!
+ *
+ * It also assumes that the IEs in the buffer are ordered
+ * correctly, if not the result of using this function will not
+ * be ordered correctly either, i.e. it does no reordering.
+ *
+ * The function returns the offset where the next part of the
+ * buffer starts, which may be @ielen if the entire (remainder)
+ * of the buffer should be used.
+ */
+size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
+                          const u8 *ids, int n_ids, size_t offset)
+{
+        size_t pos = offset;
+
+        while (pos < ielen && ieee80211_id_in_list(ids, n_ids, ies[pos]))
+                pos += 2 + ies[pos + 1];
+
+        return pos;
+}
+
+size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset)
+{
+        size_t pos = offset;
+
+        while (pos < ielen && ies[pos] != WLAN_EID_VENDOR_SPECIFIC)
+                pos += 2 + ies[pos + 1];
+
+        return pos;
+}
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 8a980f136941..5f3a4113bda1 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -17,6 +17,7 @@
 #include <linux/err.h>
 #include <linux/mm.h>
 #include <linux/scatterlist.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 
 #include <net/mac80211.h>
@@ -281,16 +282,18 @@ bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
 ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         if (!ieee80211_is_data(hdr->frame_control) &&
             !ieee80211_is_auth(hdr->frame_control))
                 return RX_CONTINUE;
 
-        if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
+        if (!(status->flag & RX_FLAG_DECRYPTED)) {
                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
                         return RX_DROP_UNUSABLE;
-        } else if (!(rx->status->flag & RX_FLAG_IV_STRIPPED)) {
+        } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
                 /* remove ICV */
                 skb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN);
@@ -303,20 +306,19 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
+        if (!info->control.hw_key) {
                 if (ieee80211_wep_encrypt(tx->local, skb, tx->key->conf.key,
                                           tx->key->conf.keylen,
                                           tx->key->conf.keyidx))
                         return -1;
-        } else {
-                info->control.hw_key = &tx->key->conf;
-                if (tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) {
-                        if (!ieee80211_wep_add_iv(tx->local, skb,
-                                                  tx->key->conf.keylen,
-                                                  tx->key->conf.keyidx))
-                                return -1;
-                }
+        } else if (info->control.hw_key->flags &
+                        IEEE80211_KEY_FLAG_GENERATE_IV) {
+                if (!ieee80211_wep_add_iv(tx->local, skb,
+                                          tx->key->conf.keylen,
+                                          tx->key->conf.keyidx))
+                        return -1;
         }
+
         return 0;
 }
 
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index b19b7696f3a2..34e6d02da779 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -44,22 +44,69 @@ static int wme_downgrade_ac(struct sk_buff *skb)
 }
 
 
-/* Indicate which queue to use.  */
-static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
+/* Indicate which queue to use. */
+u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+                           struct sk_buff *skb)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta = NULL;
+        u32 sta_flags = 0;
+        const u8 *ra = NULL;
+        bool qos = false;
 
-        if (!ieee80211_is_data(hdr->frame_control)) {
-                /* management frames go on AC_VO queue, but are sent
-                * without QoS control fields */
-                return 0;
+        if (local->hw.queues < 4 || skb->len < 6) {
+                skb->priority = 0; /* required for correct WPA/11i MIC */
+                return min_t(u16, local->hw.queues - 1,
+                             ieee802_1d_to_ac[skb->priority]);
+        }
+
+        rcu_read_lock();
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP_VLAN:
+                rcu_read_lock();
+                sta = rcu_dereference(sdata->u.vlan.sta);
+                if (sta)
+                        sta_flags = get_sta_flags(sta);
+                rcu_read_unlock();
+                if (sta)
+                        break;
+        case NL80211_IFTYPE_AP:
+                ra = skb->data;
+                break;
+        case NL80211_IFTYPE_WDS:
+                ra = sdata->u.wds.remote_addr;
+                break;
+#ifdef CONFIG_MAC80211_MESH
+        case NL80211_IFTYPE_MESH_POINT:
+                /*
+                 * XXX: This is clearly broken ... but already was before,
+                 * because ieee80211_fill_mesh_addresses() would clear A1
+                 * except for multicast addresses.
+                 */
+                break;
+#endif
+        case NL80211_IFTYPE_STATION:
+                ra = sdata->u.mgd.bssid;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ra = skb->data;
+                break;
+        default:
+                break;
         }
 
-        if (0 /* injected */) {
-                /* use AC from radiotap */
+        if (!sta && ra && !is_multicast_ether_addr(ra)) {
+                sta = sta_info_get(sdata, ra);
+                if (sta)
+                        sta_flags = get_sta_flags(sta);
         }
 
-        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+        if (sta_flags & WLAN_STA_WME)
+                qos = true;
+
+        rcu_read_unlock();
+
+        if (!qos) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
                 return ieee802_1d_to_ac[skb->priority];
         }
@@ -68,6 +115,12 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
          * data frame has */
         skb->priority = cfg80211_classify8021d(skb);
 
+        return ieee80211_downgrade_queue(local, skb);
+}
+
+u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
+                              struct sk_buff *skb)
+{
         /* in case we are a client verify acm is not set for this ac */
         while (unlikely(local->wmm_acm & BIT(skb->priority))) {
                 if (wme_downgrade_ac(skb)) {
@@ -85,24 +138,17 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
         return ieee802_1d_to_ac[skb->priority];
 }
 
-void ieee80211_select_queue(struct ieee80211_local *local, struct sk_buff *skb)
+void ieee80211_set_qos_hdr(struct ieee80211_local *local, struct sk_buff *skb)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 queue;
-        u8 tid;
-
-        queue = classify80211(local, skb);
-        if (unlikely(queue >= local->hw.queues))
-                queue = local->hw.queues - 1;
-
-        /*
-         * Now we know the 1d priority, fill in the QoS header if
-         * there is one (and we haven't done this before).
-         */
+        struct ieee80211_hdr *hdr = (void *)skb->data;
+
+        /* Fill in the QoS header if there is one. */
         if (ieee80211_is_data_qos(hdr->frame_control)) {
                 u8 *p = ieee80211_get_qos_ctl(hdr);
-                u8 ack_policy = 0;
+                u8 ack_policy = 0, tid;
+
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+
                 if (unlikely(local->wifi_wme_noack_test))
                         ack_policy |= QOS_CONTROL_ACK_POLICY_NOACK <<
                                         QOS_CONTROL_ACK_POLICY_SHIFT;
@@ -110,6 +156,4 @@ void ieee80211_select_queue(struct ieee80211_local *local, struct sk_buff *skb)
                 *p++ = ack_policy | tid;
                 *p = 0;
         }
-
-        skb_set_queue_mapping(skb, queue);
 }
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index d4fd87ca5118..6053b1c9feee 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -20,7 +20,11 @@
 
 extern const int ieee802_1d_to_ac[8];
 
-void ieee80211_select_queue(struct ieee80211_local *local,
-                            struct sk_buff *skb);
+u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+                           struct sk_buff *skb);
+void ieee80211_set_qos_hdr(struct ieee80211_local *local, struct sk_buff *skb);
+u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
+                              struct sk_buff *skb);
+
 
 #endif /* _WME_H */
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
new file mode 100644
index 000000000000..15e1ba931b87
--- /dev/null
+++ b/net/mac80211/work.c
@@ -0,0 +1,1101 @@
+/*
+ * mac80211 work implementation
+ *
+ * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+#include <linux/slab.h>
+#include <net/mac80211.h>
+#include <asm/unaligned.h>
+
+#include "ieee80211_i.h"
+#include "rate.h"
+
+#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
+#define IEEE80211_AUTH_MAX_TRIES 3
+#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
+#define IEEE80211_ASSOC_MAX_TRIES 3
+#define IEEE80211_MAX_PROBE_TRIES 5
+
+enum work_action {
+        WORK_ACT_NONE,
+        WORK_ACT_TIMEOUT,
+        WORK_ACT_DONE,
+};
+
+
+/* utils */
+static inline void ASSERT_WORK_MTX(struct ieee80211_local *local)
+{
+        WARN_ON(!mutex_is_locked(&local->work_mtx));
+}
+
+/*
+ * We can have multiple work items (and connection probing)
+ * scheduling this timer, but we need to take care to only
+ * reschedule it when it should fire _earlier_ than it was
+ * asked for before, or if it's not pending right now. This
+ * function ensures that. Note that it then is required to
+ * run this function for all timeouts after the first one
+ * has happened -- the work that runs from this timer will
+ * do that.
+ */
+static void run_again(struct ieee80211_local *local,
+                      unsigned long timeout)
+{
+        ASSERT_WORK_MTX(local);
+
+        if (!timer_pending(&local->work_timer) ||
+            time_before(timeout, local->work_timer.expires))
+                mod_timer(&local->work_timer, timeout);
+}
+
+static void work_free_rcu(struct rcu_head *head)
+{
+        struct ieee80211_work *wk =
+                container_of(head, struct ieee80211_work, rcu_head);
+
+        kfree(wk);
+}
+
+void free_work(struct ieee80211_work *wk)
+{
+        call_rcu(&wk->rcu_head, work_free_rcu);
+}
+
+static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
+                                      struct ieee80211_supported_band *sband,
+                                      u32 *rates)
+{
+        int i, j, count;
+        *rates = 0;
+        count = 0;
+        for (i = 0; i < supp_rates_len; i++) {
+                int rate = (supp_rates[i] & 0x7F) * 5;
+
+                for (j = 0; j < sband->n_bitrates; j++)
+                        if (sband->bitrates[j].bitrate == rate) {
+                                *rates |= BIT(j);
+                                count++;
+                                break;
+                        }
+        }
+
+        return count;
+}
+
+/* frame sending functions */
+
+static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
+                                struct ieee80211_supported_band *sband,
+                                struct ieee80211_channel *channel,
+                                enum ieee80211_smps_mode smps)
+{
+        struct ieee80211_ht_info *ht_info;
+        u8 *pos;
+        u32 flags = channel->flags;
+        u16 cap = sband->ht_cap.cap;
+        __le16 tmp;
+
+        if (!sband->ht_cap.ht_supported)
+                return;
+
+        if (!ht_info_ie)
+                return;
+
+        if (ht_info_ie[1] < sizeof(struct ieee80211_ht_info))
+                return;
+
+        ht_info = (struct ieee80211_ht_info *)(ht_info_ie + 2);
+
+        /* determine capability flags */
+
+        if (ieee80211_disable_40mhz_24ghz &&
+            sband->band == IEEE80211_BAND_2GHZ) {
+                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                cap &= ~IEEE80211_HT_CAP_SGI_40;
+        }
+
+        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
+                break;
+        }
+
+        /* set SM PS mode properly */
+        cap &= ~IEEE80211_HT_CAP_SM_PS;
+        switch (smps) {
+        case IEEE80211_SMPS_AUTOMATIC:
+        case IEEE80211_SMPS_NUM_MODES:
+                WARN_ON(1);
+        case IEEE80211_SMPS_OFF:
+                cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        case IEEE80211_SMPS_STATIC:
+                cap |= WLAN_HT_CAP_SM_PS_STATIC <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        case IEEE80211_SMPS_DYNAMIC:
+                cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        }
+
+        /* reserve and fill IE */
+
+        pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
+        *pos++ = WLAN_EID_HT_CAPABILITY;
+        *pos++ = sizeof(struct ieee80211_ht_cap);
+        memset(pos, 0, sizeof(struct ieee80211_ht_cap));
+
+        /* capability flags */
+        tmp = cpu_to_le16(cap);
+        memcpy(pos, &tmp, sizeof(u16));
+        pos += sizeof(u16);
+
+        /* AMPDU parameters */
+        *pos++ = sband->ht_cap.ampdu_factor |
+                 (sband->ht_cap.ampdu_density <<
+                        IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
+
+        /* MCS set */
+        memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
+        pos += sizeof(sband->ht_cap.mcs);
+
+        /* extended capabilities */
+        pos += sizeof(__le16);
+
+        /* BF capabilities */
+        pos += sizeof(__le32);
+
+        /* antenna selection */
+        pos += sizeof(u8);
+}
+
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee80211_work *wk)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u8 *pos, qos_info;
+        const u8 *ies;
+        size_t offset = 0, noffset;
+        int i, len, count, rates_len, supp_rates_len;
+        u16 capab;
+        struct ieee80211_supported_band *sband;
+        u32 rates = 0;
+
+        sband = local->hw.wiphy->bands[wk->chan->band];
+
+        /*
+         * Get all rates supported by the device and the AP as
+         * some APs don't like getting a superset of their rates
+         * in the association request (e.g. D-Link DAP 1353 in
+         * b-only mode)...
+         */
+        rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
+                                               wk->assoc.supp_rates_len,
+                                               sband, &rates);
+
+        skb = alloc_skb(local->hw.extra_tx_headroom +
+                        sizeof(*mgmt) + /* bit too much but doesn't matter */
+                        2 + wk->assoc.ssid_len + /* SSID */
+                        4 + rates_len + /* (extended) rates */
+                        4 + /* power capability */
+                        2 + 2 * sband->n_channels + /* supported channels */
+                        2 + sizeof(struct ieee80211_ht_cap) + /* HT */
+                        wk->ie_len + /* extra IEs */
+                        9, /* WMM */
+                        GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
+                       "frame\n", sdata->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        capab = WLAN_CAPABILITY_ESS;
+
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+        }
+
+        if (wk->assoc.capability & WLAN_CAPABILITY_PRIVACY)
+                capab |= WLAN_CAPABILITY_PRIVACY;
+
+        if ((wk->assoc.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
+
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, wk->filter_ta, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, wk->filter_ta, ETH_ALEN);
+
+        if (!is_zero_ether_addr(wk->assoc.prev_bssid)) {
+                skb_put(skb, 10);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_REASSOC_REQ);
+                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
+                mgmt->u.reassoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
+                memcpy(mgmt->u.reassoc_req.current_ap, wk->assoc.prev_bssid,
+                       ETH_ALEN);
+        } else {
+                skb_put(skb, 4);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_ASSOC_REQ);
+                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
+                mgmt->u.assoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
+        }
+
+        /* SSID */
+        ies = pos = skb_put(skb, 2 + wk->assoc.ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = wk->assoc.ssid_len;
+        memcpy(pos, wk->assoc.ssid, wk->assoc.ssid_len);
+
+        /* add all rates which were marked to be used above */
+        supp_rates_len = rates_len;
+        if (supp_rates_len > 8)
+                supp_rates_len = 8;
+
+        len = sband->n_bitrates;
+        pos = skb_put(skb, supp_rates_len + 2);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = supp_rates_len;
+
+        count = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if (BIT(i) & rates) {
+                        int rate = sband->bitrates[i].bitrate;
+                        *pos++ = (u8) (rate / 5);
+                        if (++count == 8)
+                                break;
+                }
+        }
+
+        if (rates_len > count) {
+                pos = skb_put(skb, rates_len - count + 2);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = rates_len - count;
+
+                for (i++; i < sband->n_bitrates; i++) {
+                        if (BIT(i) & rates) {
+                                int rate = sband->bitrates[i].bitrate;
+                                *pos++ = (u8) (rate / 5);
+                        }
+                }
+        }
+
+        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
+                /* 1. power capabilities */
+                pos = skb_put(skb, 4);
+                *pos++ = WLAN_EID_PWR_CAPABILITY;
+                *pos++ = 2;
+                *pos++ = 0; /* min tx power */
+                *pos++ = wk->chan->max_power; /* max tx power */
+
+                /* 2. supported channels */
+                /* TODO: get this in reg domain format */
+                pos = skb_put(skb, 2 * sband->n_channels + 2);
+                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
+                *pos++ = 2 * sband->n_channels;
+                for (i = 0; i < sband->n_channels; i++) {
+                        *pos++ = ieee80211_frequency_to_channel(
+                                        sband->channels[i].center_freq);
+                        *pos++ = 1; /* one channel in the subband*/
+                }
+        }
+
+        /* if present, add any custom IEs that go before HT */
+        if (wk->ie_len && wk->ie) {
+                static const u8 before_ht[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_EXT_SUPP_RATES,
+                        WLAN_EID_PWR_CAPABILITY,
+                        WLAN_EID_SUPPORTED_CHANNELS,
+                        WLAN_EID_RSN,
+                        WLAN_EID_QOS_CAPA,
+                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
+                        WLAN_EID_MOBILITY_DOMAIN,
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                };
+                noffset = ieee80211_ie_split(wk->ie, wk->ie_len,
+                                             before_ht, ARRAY_SIZE(before_ht),
+                                             offset);
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, wk->ie + offset, noffset - offset);
+                offset = noffset;
+        }
+
+        if (wk->assoc.use_11n && wk->assoc.wmm_used &&
+            local->hw.queues >= 4)
+                ieee80211_add_ht_ie(skb, wk->assoc.ht_information_ie,
+                                    sband, wk->chan, wk->assoc.smps);
+
+        /* if present, add any custom non-vendor IEs that go after HT */
+        if (wk->ie_len && wk->ie) {
+                noffset = ieee80211_ie_split_vendor(wk->ie, wk->ie_len,
+                                                    offset);
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, wk->ie + offset, noffset - offset);
+                offset = noffset;
+        }
+
+        if (wk->assoc.wmm_used && local->hw.queues >= 4) {
+                if (wk->assoc.uapsd_used) {
+                        qos_info = local->uapsd_queues;
+                        qos_info |= (local->uapsd_max_sp_len <<
+                                     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
+                } else {
+                        qos_info = 0;
+                }
+
+                pos = skb_put(skb, 9);
+                *pos++ = WLAN_EID_VENDOR_SPECIFIC;
+                *pos++ = 7; /* len */
+                *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
+                *pos++ = 0x50;
+                *pos++ = 0xf2;
+                *pos++ = 2; /* WME */
+                *pos++ = 0; /* WME info */
+                *pos++ = 1; /* WME ver */
+                *pos++ = qos_info;
+        }
+
+        /* add any remaining custom (i.e. vendor specific here) IEs */
+        if (wk->ie_len && wk->ie) {
+                noffset = wk->ie_len;
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, wk->ie + offset, noffset - offset);
+        }
+
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
+}
+
+static void ieee80211_remove_auth_bss(struct ieee80211_local *local,
+                                      struct ieee80211_work *wk)
+{
+        struct cfg80211_bss *cbss;
+        u16 capa_val = WLAN_CAPABILITY_ESS;
+
+        if (wk->probe_auth.privacy)
+                capa_val |= WLAN_CAPABILITY_PRIVACY;
+
+        cbss = cfg80211_get_bss(local->hw.wiphy, wk->chan, wk->filter_ta,
+                                wk->probe_auth.ssid, wk->probe_auth.ssid_len,
+                                WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
+                                capa_val);
+        if (!cbss)
+                return;
+
+        cfg80211_unlink_bss(local->hw.wiphy, cbss);
+        cfg80211_put_bss(cbss);
+}
+
+static enum work_action __must_check
+ieee80211_direct_probe(struct ieee80211_work *wk)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        wk->probe_auth.tries++;
+        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: direct probe to %pM timed out\n",
+                       sdata->name, wk->filter_ta);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                ieee80211_remove_auth_bss(local, wk);
+
+                return WORK_ACT_TIMEOUT;
+        }
+
+        printk(KERN_DEBUG "%s: direct probe to %pM (try %d)\n",
+                        sdata->name, wk->filter_ta, wk->probe_auth.tries);
+
+        /*
+         * Direct probe is sent to broadcast address as some APs
+         * will not answer to direct packet in unassociated state.
+         */
+        ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
+                                 wk->probe_auth.ssid_len, NULL, 0);
+
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(local, wk->timeout);
+
+        return WORK_ACT_NONE;
+}
+
+
+static enum work_action __must_check
+ieee80211_authenticate(struct ieee80211_work *wk)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        wk->probe_auth.tries++;
+        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: authentication with %pM"
+                       " timed out\n", sdata->name, wk->filter_ta);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                ieee80211_remove_auth_bss(local, wk);
+
+                return WORK_ACT_TIMEOUT;
+        }
+
+        printk(KERN_DEBUG "%s: authenticate with %pM (try %d)\n",
+               sdata->name, wk->filter_ta, wk->probe_auth.tries);
+
+        ieee80211_send_auth(sdata, 1, wk->probe_auth.algorithm, wk->ie,
+                            wk->ie_len, wk->filter_ta, NULL, 0, 0);
+        wk->probe_auth.transaction = 2;
+
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(local, wk->timeout);
+
+        return WORK_ACT_NONE;
+}
+
+static enum work_action __must_check
+ieee80211_associate(struct ieee80211_work *wk)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        wk->assoc.tries++;
+        if (wk->assoc.tries > IEEE80211_ASSOC_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: association with %pM"
+                       " timed out\n",
+                       sdata->name, wk->filter_ta);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                if (wk->assoc.bss)
+                        cfg80211_unlink_bss(local->hw.wiphy, wk->assoc.bss);
+
+                return WORK_ACT_TIMEOUT;
+        }
+
+        printk(KERN_DEBUG "%s: associate with %pM (try %d)\n",
+               sdata->name, wk->filter_ta, wk->assoc.tries);
+        ieee80211_send_assoc(sdata, wk);
+
+        wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+        run_again(local, wk->timeout);
+
+        return WORK_ACT_NONE;
+}
+
+static enum work_action __must_check
+ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
+{
+        /*
+         * First time we run, do nothing -- the generic code will
+         * have switched to the right channel etc.
+         */
+        if (!wk->started) {
+                wk->timeout = jiffies + msecs_to_jiffies(wk->remain.duration);
+
+                cfg80211_ready_on_channel(wk->sdata->dev, (unsigned long) wk,
+                                          wk->chan, wk->chan_type,
+                                          wk->remain.duration, GFP_KERNEL);
+
+                return WORK_ACT_NONE;
+        }
+
+        return WORK_ACT_TIMEOUT;
+}
+
+static void ieee80211_auth_challenge(struct ieee80211_work *wk,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        u8 *pos;
+        struct ieee802_11_elems elems;
+
+        pos = mgmt->u.auth.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+        if (!elems.challenge)
+                return;
+        ieee80211_send_auth(sdata, 3, wk->probe_auth.algorithm,
+                            elems.challenge - 2, elems.challenge_len + 2,
+                            wk->filter_ta, wk->probe_auth.key,
+                            wk->probe_auth.key_len, wk->probe_auth.key_idx);
+        wk->probe_auth.transaction = 4;
+}
+
+static enum work_action __must_check
+ieee80211_rx_mgmt_auth(struct ieee80211_work *wk,
+                       struct ieee80211_mgmt *mgmt, size_t len)
+{
+        u16 auth_alg, auth_transaction, status_code;
+
+        if (wk->type != IEEE80211_WORK_AUTH)
+                return WORK_ACT_NONE;
+
+        if (len < 24 + 6)
+                return WORK_ACT_NONE;
+
+        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+        status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        if (auth_alg != wk->probe_auth.algorithm ||
+            auth_transaction != wk->probe_auth.transaction)
+                return WORK_ACT_NONE;
+
+        if (status_code != WLAN_STATUS_SUCCESS) {
+                printk(KERN_DEBUG "%s: %pM denied authentication (status %d)\n",
+                       wk->sdata->name, mgmt->sa, status_code);
+                return WORK_ACT_DONE;
+        }
+
+        switch (wk->probe_auth.algorithm) {
+        case WLAN_AUTH_OPEN:
+        case WLAN_AUTH_LEAP:
+        case WLAN_AUTH_FT:
+                break;
+        case WLAN_AUTH_SHARED_KEY:
+                if (wk->probe_auth.transaction != 4) {
+                        ieee80211_auth_challenge(wk, mgmt, len);
+                        /* need another frame */
+                        return WORK_ACT_NONE;
+                }
+                break;
+        default:
+                WARN_ON(1);
+                return WORK_ACT_NONE;
+        }
+
+        printk(KERN_DEBUG "%s: authenticated\n", wk->sdata->name);
+        return WORK_ACT_DONE;
+}
+
+static enum work_action __must_check
+ieee80211_rx_mgmt_assoc_resp(struct ieee80211_work *wk,
+                             struct ieee80211_mgmt *mgmt, size_t len,
+                             bool reassoc)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+        u16 capab_info, status_code, aid;
+        struct ieee802_11_elems elems;
+        u8 *pos;
+
+        /*
+         * AssocResp and ReassocResp have identical structure, so process both
+         * of them in this function.
+         */
+
+        if (len < 24 + 6)
+                return WORK_ACT_NONE;
+
+        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+        aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+
+        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
+               "status=%d aid=%d)\n",
+               sdata->name, reassoc ? "Rea" : "A", mgmt->sa,
+               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
+
+        pos = mgmt->u.assoc_resp.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
+        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+            elems.timeout_int && elems.timeout_int_len == 5 &&
+            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
+                u32 tu, ms;
+                tu = get_unaligned_le32(elems.timeout_int + 1);
+                ms = tu * 1024 / 1000;
+                printk(KERN_DEBUG "%s: %pM rejected association temporarily; "
+                       "comeback duration %u TU (%u ms)\n",
+                       sdata->name, mgmt->sa, tu, ms);
+                wk->timeout = jiffies + msecs_to_jiffies(ms);
+                if (ms > IEEE80211_ASSOC_TIMEOUT)
+                        run_again(local, wk->timeout);
+                return WORK_ACT_NONE;
+        }
+
+        if (status_code != WLAN_STATUS_SUCCESS)
+                printk(KERN_DEBUG "%s: %pM denied association (code=%d)\n",
+                       sdata->name, mgmt->sa, status_code);
+        else
+                printk(KERN_DEBUG "%s: associated\n", sdata->name);
+
+        return WORK_ACT_DONE;
+}
+
+static enum work_action __must_check
+ieee80211_rx_mgmt_probe_resp(struct ieee80211_work *wk,
+                             struct ieee80211_mgmt *mgmt, size_t len,
+                             struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+        size_t baselen;
+
+        ASSERT_WORK_MTX(local);
+
+        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return WORK_ACT_NONE;
+
+        printk(KERN_DEBUG "%s: direct probe responded\n", sdata->name);
+        return WORK_ACT_DONE;
+}
+
+static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *rx_status;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_work *wk;
+        enum work_action rma = WORK_ACT_NONE;
+        u16 fc;
+
+        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        mutex_lock(&local->work_mtx);
+
+        list_for_each_entry(wk, &local->work_list, list) {
+                const u8 *bssid = NULL;
+
+                switch (wk->type) {
+                case IEEE80211_WORK_DIRECT_PROBE:
+                case IEEE80211_WORK_AUTH:
+                case IEEE80211_WORK_ASSOC:
+                        bssid = wk->filter_ta;
+                        break;
+                default:
+                        continue;
+                }
+
+                /*
+                 * Before queuing, we already verified mgmt->sa,
+                 * so this is needed just for matching.
+                 */
+                if (compare_ether_addr(bssid, mgmt->bssid))
+                        continue;
+
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_PROBE_RESP:
+                        rma = ieee80211_rx_mgmt_probe_resp(wk, mgmt, skb->len,
+                                                           rx_status);
+                        break;
+                case IEEE80211_STYPE_AUTH:
+                        rma = ieee80211_rx_mgmt_auth(wk, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_ASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
+                                                           skb->len, false);
+                        break;
+                case IEEE80211_STYPE_REASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
+                                                           skb->len, true);
+                        break;
+                default:
+                        WARN_ON(1);
+                }
+                /*
+                 * We've processed this frame for that work, so it can't
+                 * belong to another work struct.
+                 * NB: this is also required for correctness for 'rma'!
+                 */
+                break;
+        }
+
+        switch (rma) {
+        case WORK_ACT_NONE:
+                break;
+        case WORK_ACT_DONE:
+                list_del_rcu(&wk->list);
+                break;
+        default:
+                WARN(1, "unexpected: %d", rma);
+        }
+
+        mutex_unlock(&local->work_mtx);
+
+        if (rma != WORK_ACT_DONE)
+                goto out;
+
+        switch (wk->done(wk, skb)) {
+        case WORK_DONE_DESTROY:
+                free_work(wk);
+                break;
+        case WORK_DONE_REQUEUE:
+                synchronize_rcu();
+                wk->started = false; /* restart */
+                mutex_lock(&local->work_mtx);
+                list_add_tail(&wk->list, &local->work_list);
+                mutex_unlock(&local->work_mtx);
+        }
+
+ out:
+        kfree_skb(skb);
+}
+
+static void ieee80211_work_timer(unsigned long data)
+{
+        struct ieee80211_local *local = (void *) data;
+
+        if (local->quiescing)
+                return;
+
+        ieee80211_queue_work(&local->hw, &local->work_work);
+}
+
+static void ieee80211_work_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, work_work);
+        struct sk_buff *skb;
+        struct ieee80211_work *wk, *tmp;
+        LIST_HEAD(free_work);
+        enum work_action rma;
+        bool remain_off_channel = false;
+
+        if (local->scanning)
+                return;
+
+        /*
+         * ieee80211_queue_work() should have picked up most cases,
+         * here we'll pick the the rest.
+         */
+        if (WARN(local->suspended, "work scheduled while going to suspend\n"))
+                return;
+
+        /* first process frames to avoid timing out while a frame is pending */
+        while ((skb = skb_dequeue(&local->work_skb_queue)))
+                ieee80211_work_rx_queued_mgmt(local, skb);
+
+        ieee80211_recalc_idle(local);
+
+        mutex_lock(&local->work_mtx);
+
+        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
+                bool started = wk->started;
+
+                /* mark work as started if it's on the current off-channel */
+                if (!started && local->tmp_channel &&
+                    wk->chan == local->tmp_channel &&
+                    wk->chan_type == local->tmp_channel_type) {
+                        started = true;
+                        wk->timeout = jiffies;
+                }
+
+                if (!started && !local->tmp_channel) {
+                        /*
+                         * TODO: could optimize this by leaving the
+                         *       station vifs in awake mode if they
+                         *       happen to be on the same channel as
+                         *       the requested channel
+                         */
+                        ieee80211_offchannel_stop_beaconing(local);
+                        ieee80211_offchannel_stop_station(local);
+
+                        local->tmp_channel = wk->chan;
+                        local->tmp_channel_type = wk->chan_type;
+                        ieee80211_hw_config(local, 0);
+                        started = true;
+                        wk->timeout = jiffies;
+                }
+
+                /* don't try to work with items that aren't started */
+                if (!started)
+                        continue;
+
+                if (time_is_after_jiffies(wk->timeout)) {
+                        /*
+                         * This work item isn't supposed to be worked on
+                         * right now, but take care to adjust the timer
+                         * properly.
+                         */
+                        run_again(local, wk->timeout);
+                        continue;
+                }
+
+                switch (wk->type) {
+                default:
+                        WARN_ON(1);
+                        /* nothing */
+                        rma = WORK_ACT_NONE;
+                        break;
+                case IEEE80211_WORK_ABORT:
+                        rma = WORK_ACT_TIMEOUT;
+                        break;
+                case IEEE80211_WORK_DIRECT_PROBE:
+                        rma = ieee80211_direct_probe(wk);
+                        break;
+                case IEEE80211_WORK_AUTH:
+                        rma = ieee80211_authenticate(wk);
+                        break;
+                case IEEE80211_WORK_ASSOC:
+                        rma = ieee80211_associate(wk);
+                        break;
+                case IEEE80211_WORK_REMAIN_ON_CHANNEL:
+                        rma = ieee80211_remain_on_channel_timeout(wk);
+                        break;
+                }
+
+                wk->started = started;
+
+                switch (rma) {
+                case WORK_ACT_NONE:
+                        /* might have changed the timeout */
+                        run_again(local, wk->timeout);
+                        break;
+                case WORK_ACT_TIMEOUT:
+                        list_del_rcu(&wk->list);
+                        synchronize_rcu();
+                        list_add(&wk->list, &free_work);
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", rma);
+                }
+        }
+
+        list_for_each_entry(wk, &local->work_list, list) {
+                if (!wk->started)
+                        continue;
+                if (wk->chan != local->tmp_channel)
+                        continue;
+                if (wk->chan_type != local->tmp_channel_type)
+                        continue;
+                remain_off_channel = true;
+        }
+
+        if (!remain_off_channel && local->tmp_channel) {
+                local->tmp_channel = NULL;
+                ieee80211_hw_config(local, 0);
+                ieee80211_offchannel_return(local, true);
+                /* give connection some time to breathe */
+                run_again(local, jiffies + HZ/2);
+        }
+
+        if (list_empty(&local->work_list) && local->scan_req)
+                ieee80211_queue_delayed_work(&local->hw,
+                                             &local->scan_work,
+                                             round_jiffies_relative(0));
+
+        mutex_unlock(&local->work_mtx);
+
+        ieee80211_recalc_idle(local);
+
+        list_for_each_entry_safe(wk, tmp, &free_work, list) {
+                wk->done(wk, NULL);
+                list_del(&wk->list);
+                kfree(wk);
+        }
+}
+
+void ieee80211_add_work(struct ieee80211_work *wk)
+{
+        struct ieee80211_local *local;
+
+        if (WARN_ON(!wk->chan))
+                return;
+
+        if (WARN_ON(!wk->sdata))
+                return;
+
+        if (WARN_ON(!wk->done))
+                return;
+
+        if (WARN_ON(!ieee80211_sdata_running(wk->sdata)))
+                return;
+
+        wk->started = false;
+
+        local = wk->sdata->local;
+        mutex_lock(&local->work_mtx);
+        list_add_tail(&wk->list, &local->work_list);
+        mutex_unlock(&local->work_mtx);
+
+        ieee80211_queue_work(&local->hw, &local->work_work);
+}
+
+void ieee80211_work_init(struct ieee80211_local *local)
+{
+        mutex_init(&local->work_mtx);
+        INIT_LIST_HEAD(&local->work_list);
+        setup_timer(&local->work_timer, ieee80211_work_timer,
+                    (unsigned long)local);
+        INIT_WORK(&local->work_work, ieee80211_work_work);
+        skb_queue_head_init(&local->work_skb_queue);
+}
+
+void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_work *wk;
+
+        mutex_lock(&local->work_mtx);
+        list_for_each_entry(wk, &local->work_list, list) {
+                if (wk->sdata != sdata)
+                        continue;
+                wk->type = IEEE80211_WORK_ABORT;
+                wk->started = true;
+                wk->timeout = jiffies;
+        }
+        mutex_unlock(&local->work_mtx);
+
+        /* run cleanups etc. */
+        ieee80211_work_work(&local->work_work);
+
+        mutex_lock(&local->work_mtx);
+        list_for_each_entry(wk, &local->work_list, list) {
+                if (wk->sdata != sdata)
+                        continue;
+                WARN_ON(1);
+                break;
+        }
+        mutex_unlock(&local->work_mtx);
+}
+
+ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                           struct sk_buff *skb)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_work *wk;
+        u16 fc;
+
+        if (skb->len < 24)
+                return RX_DROP_MONITOR;
+
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        list_for_each_entry_rcu(wk, &local->work_list, list) {
+                if (sdata != wk->sdata)
+                        continue;
+                if (compare_ether_addr(wk->filter_ta, mgmt->sa))
+                        continue;
+                if (compare_ether_addr(wk->filter_ta, mgmt->bssid))
+                        continue;
+
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_AUTH:
+                case IEEE80211_STYPE_PROBE_RESP:
+                case IEEE80211_STYPE_ASSOC_RESP:
+                case IEEE80211_STYPE_REASSOC_RESP:
+                        skb_queue_tail(&local->work_skb_queue, skb);
+                        ieee80211_queue_work(&local->hw, &local->work_work);
+                        return RX_QUEUED;
+                }
+        }
+
+        return RX_CONTINUE;
+}
+
+static enum work_done_result ieee80211_remain_done(struct ieee80211_work *wk,
+                                                   struct sk_buff *skb)
+{
+        /*
+         * We are done serving the remain-on-channel command.
+         */
+        cfg80211_remain_on_channel_expired(wk->sdata->dev, (unsigned long) wk,
+                                           wk->chan, wk->chan_type,
+                                           GFP_KERNEL);
+
+        return WORK_DONE_DESTROY;
+}
+
+int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_channel *chan,
+                                   enum nl80211_channel_type channel_type,
+                                   unsigned int duration, u64 *cookie)
+{
+        struct ieee80211_work *wk;
+
+        wk = kzalloc(sizeof(*wk), GFP_KERNEL);
+        if (!wk)
+                return -ENOMEM;
+
+        wk->type = IEEE80211_WORK_REMAIN_ON_CHANNEL;
+        wk->chan = chan;
+        wk->chan_type = channel_type;
+        wk->sdata = sdata;
+        wk->done = ieee80211_remain_done;
+
+        wk->remain.duration = duration;
+
+        *cookie = (unsigned long) wk;
+
+        ieee80211_add_work(wk);
+
+        return 0;
+}
+
+int ieee80211_wk_cancel_remain_on_channel(struct ieee80211_sub_if_data *sdata,
+                                          u64 cookie)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_work *wk, *tmp;
+        bool found = false;
+
+        mutex_lock(&local->work_mtx);
+        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
+                if ((unsigned long) wk == cookie) {
+                        wk->timeout = jiffies;
+                        found = true;
+                        break;
+                }
+        }
+        mutex_unlock(&local->work_mtx);
+
+        if (!found)
+                return -ENOENT;
+
+        ieee80211_queue_work(&local->hw, &local->work_work);
+
+        return 0;
+}
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 70778694877b..0adbcc941ac9 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -9,10 +9,10 @@
 
 #include <linux/netdevice.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/compiler.h>
 #include <linux/ieee80211.h>
+#include <linux/gfp.h>
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 
@@ -31,8 +31,8 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
         unsigned int hdrlen;
         struct ieee80211_hdr *hdr;
         struct sk_buff *skb = tx->skb;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int authenticator;
-        int wpa_test = 0;
         int tail;
 
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -47,16 +47,15 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
         data = skb->data + hdrlen;
         data_len = skb->len - hdrlen;
 
-        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
+        if (info->control.hw_key &&
             !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) &&
-            !wpa_test) {
-                /* hwaccel - with no need for preallocated room for MMIC */
+            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
+                /* hwaccel - with no need for SW-generated MMIC */
                 return TX_CONTINUE;
         }
 
         tail = MICHAEL_MIC_LEN;
-        if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
+        if (!info->control.hw_key)
                 tail += TKIP_ICV_LEN;
 
         if (WARN_ON(skb_tailroom(skb) < tail ||
@@ -85,16 +84,16 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         u8 *data, *key = NULL, key_offset;
         size_t data_len;
         unsigned int hdrlen;
-        struct ieee80211_hdr *hdr;
         u8 mic[MICHAEL_MIC_LEN];
         struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int authenticator = 1, wpa_test = 0;
 
         /* No way to verify the MIC if the hardware stripped it */
-        if (rx->status->flag & RX_FLAG_MMIC_STRIPPED)
+        if (status->flag & RX_FLAG_MMIC_STRIPPED)
                 return RX_CONTINUE;
 
-        hdr = (struct ieee80211_hdr *)skb->data;
         if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
             !ieee80211_has_protected(hdr->frame_control) ||
             !ieee80211_is_data_present(hdr->frame_control))
@@ -147,17 +146,16 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         int len, tail;
         u8 *pos;
 
-        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
-                /* hwaccel - with no need for preallocated room for IV/ICV */
-                info->control.hw_key = &tx->key->conf;
+        if (info->control.hw_key &&
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+                /* hwaccel - with no need for software-generated IV */
                 return 0;
         }
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         len = skb->len - hdrlen;
 
-        if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+        if (info->control.hw_key)
                 tail = 0;
         else
                 tail = TKIP_ICV_LEN;
@@ -175,13 +173,11 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         if (key->u.tkip.tx.iv16 == 0)
                 key->u.tkip.tx.iv32++;
 
-        if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
-                /* hwaccel - with preallocated room for IV */
-                ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
+        pos = ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
 
-                info->control.hw_key = &tx->key->conf;
+        /* hwaccel - with software IV */
+        if (info->control.hw_key)
                 return 0;
-        }
 
         /* Add room for ICV */
         skb_put(skb, TKIP_ICV_LEN);
@@ -216,6 +212,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         int hdrlen, res, hwaccel = 0, wpa_test = 0;
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -225,8 +222,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         if (!rx->sta || skb->len - hdrlen < 12)
                 return RX_DROP_UNUSABLE;
 
-        if (rx->status->flag & RX_FLAG_DECRYPTED) {
-                if (rx->status->flag & RX_FLAG_IV_STRIPPED) {
+        if (status->flag & RX_FLAG_DECRYPTED) {
+                if (status->flag & RX_FLAG_IV_STRIPPED) {
                         /*
                          * Hardware took care of all processing, including
                          * replay protection, and stripped the ICV/IV so
@@ -362,24 +359,20 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         int hdrlen, len, tail;
         u8 *pos, *pn;
         int i;
-        bool skip_hw;
-
-        skip_hw = (tx->key->conf.flags & IEEE80211_KEY_FLAG_SW_MGMT) &&
-                ieee80211_is_mgmt(hdr->frame_control);
 
-        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
-            !skip_hw) {
-                /* hwaccel - with no need for preallocated room for CCMP
-                 * header or MIC fields */
-                info->control.hw_key = &tx->key->conf;
+        if (info->control.hw_key &&
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+                /*
+                 * hwaccel has no need for preallocated room for CCMP
+                 * header or MIC fields
+                 */
                 return 0;
         }
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         len = skb->len - hdrlen;
 
-        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+        if (info->control.hw_key)
                 tail = 0;
         else
                 tail = CCMP_MIC_LEN;
@@ -404,11 +397,9 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         ccmp_pn2hdr(pos, pn, key->conf.keyidx);
 
-        if ((key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && !skip_hw) {
-                /* hwaccel - with preallocated room for CCMP header */
-                info->control.hw_key = &tx->key->conf;
+        /* hwaccel - with software CCMP header */
+        if (info->control.hw_key)
                 return 0;
-        }
 
         pos += CCMP_HDR_LEN;
         ccmp_special_blocks(skb, pn, key->u.ccmp.tx_crypto_buf, 0);
@@ -442,6 +433,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         int hdrlen;
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         u8 pn[CCMP_PN_LEN];
         int data_len;
 
@@ -455,8 +447,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         if (!rx->sta || data_len < 0)
                 return RX_DROP_UNUSABLE;
 
-        if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
-            (rx->status->flag & RX_FLAG_IV_STRIPPED))
+        if ((status->flag & RX_FLAG_DECRYPTED) &&
+            (status->flag & RX_FLAG_IV_STRIPPED))
                 return RX_CONTINUE;
 
         ccmp_hdr2pn(pn, skb->data + hdrlen);
@@ -466,7 +458,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
         }
 
-        if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
+        if (!(status->flag & RX_FLAG_DECRYPTED)) {
                 /* hardware didn't decrypt/verify MIC */
                 ccmp_special_blocks(skb, pn, key->u.ccmp.rx_crypto_buf, 1);
 
@@ -523,11 +515,8 @@ ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
         u8 *pn, aad[20];
         int i;
 
-        if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
-                /* hwaccel */
-                info->control.hw_key = &tx->key->conf;
+        if (info->control.hw_key)
                 return 0;
-        }
 
         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
                 return TX_DROP;
@@ -563,6 +552,7 @@ ieee80211_rx_result
 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
 {
         struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_key *key = rx->key;
         struct ieee80211_mmie *mmie;
         u8 aad[20], mic[8], ipn[6];
@@ -571,8 +561,8 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
         if (!ieee80211_is_mgmt(hdr->frame_control))
                 return RX_CONTINUE;
 
-        if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
-            (rx->status->flag & RX_FLAG_IV_STRIPPED))
+        if ((status->flag & RX_FLAG_DECRYPTED) &&
+            (status->flag & RX_FLAG_IV_STRIPPED))
                 return RX_CONTINUE;
 
         if (skb->len < 24 + sizeof(*mmie))
@@ -591,7 +581,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
         }
 
-        if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
+        if (!(status->flag & RX_FLAG_DECRYPTED)) {
                 /* hardware didn't decrypt/verify MIC */
                 bip_aad(skb, aad);
                 ieee80211_aes_cmac(key->u.aes_cmac.tfm,
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 634d14affc8d..18d77b5c351a 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -83,6 +83,19 @@ config NF_CONNTRACK_SECMARK
 
           If unsure, say 'N'.
 
+config NF_CONNTRACK_ZONES
+        bool  'Connection tracking zones'
+        depends on NETFILTER_ADVANCED
+        depends on NETFILTER_XT_TARGET_CT
+        help
+          This option enables support for connection tracking zones.
+          Normally, each connection needs to have a unique system wide
+          identity. Connection tracking zones allow to have multiple
+          connections using the same identity, as long as they are
+          contained in different zones.
+
+          If unsure, say `N'.
+
 config NF_CONNTRACK_EVENTS
         bool "Connection tracking events"
         depends on NETFILTER_ADVANCED
@@ -341,6 +354,18 @@ config NETFILTER_XT_TARGET_CONNSECMARK
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_TARGET_CT
+        tristate '"CT" target support'
+        depends on NF_CONNTRACK
+        depends on IP_NF_RAW || IP6_NF_RAW
+        depends on NETFILTER_ADVANCED
+        help
+          This options adds a `CT' target, which allows to specify initial
+          connection tracking parameters like events to be delivered and
+          the helper to be used.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_DSCP
         tristate '"DSCP" and "TOS" target support'
         depends on IP_NF_MANGLE || IP6_NF_MANGLE
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 49f62ee4e9ff..f873644f02f6 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -44,6 +44,7 @@ obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNMARK) += xt_CONNMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 5bb34737501f..78b505d33bfb 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -19,6 +19,7 @@
 #include <linux/inetdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 
@@ -273,8 +274,8 @@ void __init netfilter_init(void)
 
 #ifdef CONFIG_SYSCTL
 struct ctl_path nf_net_netfilter_sysctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "netfilter", .ctl_name = NET_NETFILTER, },
+        { .procname = "net", },
+        { .procname = "netfilter", },
         { }
 };
 EXPORT_SYMBOL_GPL(nf_net_netfilter_sysctl_path);
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index 79a698052218..712ccad13344 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -68,6 +68,10 @@ config	IP_VS_TAB_BITS
           each hash entry uses 8 bytes, so you can estimate how much memory is
           needed for your box.
 
+          You can overwrite this number setting conn_tab_bits module parameter
+          or by appending ip_vs.conn_tab_bits=? to the kernel command line
+          if IP VS was compiled built-in.
+
 comment "IPVS transport protocol load balancing support"
 
 config  IP_VS_PROTO_TCP
@@ -100,6 +104,13 @@ config	IP_VS_PROTO_AH
           This option enables support for load balancing AH (Authentication
           Header) transport protocol. Say Y if unsure.
 
+config  IP_VS_PROTO_SCTP
+        bool "SCTP load balancing support"
+        select LIBCRC32C
+        ---help---
+          This option enables support for load balancing SCTP transport
+          protocol. Say Y if unsure.
+
 comment "IPVS scheduler"
 
 config  IP_VS_RR
@@ -112,7 +123,8 @@ config	IP_VS_RR
           module, choose M here. If unsure, say N.
  
 config  IP_VS_WRR
-        tristate "weighted round-robin scheduling" 
+        tristate "weighted round-robin scheduling"
+        select GCD
         ---help---
           The weighted robin-robin scheduling algorithm directs network
           connections to different real servers based on server weights
diff --git a/net/netfilter/ipvs/Makefile b/net/netfilter/ipvs/Makefile
index 73a46fe1fe4c..e3baefd7066e 100644
--- a/net/netfilter/ipvs/Makefile
+++ b/net/netfilter/ipvs/Makefile
@@ -7,6 +7,7 @@ ip_vs_proto-objs-y :=
 ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_TCP) += ip_vs_proto_tcp.o
 ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_UDP) += ip_vs_proto_udp.o
 ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_AH_ESP) += ip_vs_proto_ah_esp.o
+ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_SCTP) += ip_vs_proto_sctp.o
 
 ip_vs-objs :=   ip_vs_conn.o ip_vs_core.o ip_vs_ctl.o ip_vs_sched.o        \
                 ip_vs_xmit.o ip_vs_app.o ip_vs_sync.o                      \
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 3c7e42735b60..1cb0e834f8ff 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -27,6 +27,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
 #include <net/tcp.h>
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 27c30cf933da..d8f7e8ef67b4 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -32,6 +32,7 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/proc_fs.h>              /* for proc_net_* */
+#include <linux/slab.h>
 #include <linux/seq_file.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
@@ -40,6 +41,21 @@
 #include <net/ip_vs.h>
 
 
+#ifndef CONFIG_IP_VS_TAB_BITS
+#define CONFIG_IP_VS_TAB_BITS   12
+#endif
+
+/*
+ * Connection hash size. Default is what was selected at compile time.
+*/
+int ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
+module_param_named(conn_tab_bits, ip_vs_conn_tab_bits, int, 0444);
+MODULE_PARM_DESC(conn_tab_bits, "Set connections' hash size");
+
+/* size and mask values */
+int ip_vs_conn_tab_size;
+int ip_vs_conn_tab_mask;
+
 /*
  *  Connection hash table: for input and output packets lookups of IPVS
  */
@@ -125,11 +141,11 @@ static unsigned int ip_vs_conn_hashkey(int af, unsigned proto,
         if (af == AF_INET6)
                 return jhash_3words(jhash(addr, 16, ip_vs_conn_rnd),
                                     (__force u32)port, proto, ip_vs_conn_rnd)
-                        & IP_VS_CONN_TAB_MASK;
+                        & ip_vs_conn_tab_mask;
 #endif
         return jhash_3words((__force u32)addr->ip, (__force u32)port, proto,
                             ip_vs_conn_rnd)
-                & IP_VS_CONN_TAB_MASK;
+                & ip_vs_conn_tab_mask;
 }
 
 
@@ -760,7 +776,7 @@ static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos)
         int idx;
         struct ip_vs_conn *cp;
 
-        for(idx = 0; idx < IP_VS_CONN_TAB_SIZE; idx++) {
+        for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
                 ct_read_lock_bh(idx);
                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         if (pos-- == 0) {
@@ -797,7 +813,7 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         idx = l - ip_vs_conn_tab;
         ct_read_unlock_bh(idx);
 
-        while (++idx < IP_VS_CONN_TAB_SIZE) {
+        while (++idx < ip_vs_conn_tab_size) {
                 ct_read_lock_bh(idx);
                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         seq->private = &ip_vs_conn_tab[idx];
@@ -976,8 +992,8 @@ void ip_vs_random_dropentry(void)
         /*
          * Randomly scan 1/32 of the whole table every second
          */
-        for (idx = 0; idx < (IP_VS_CONN_TAB_SIZE>>5); idx++) {
-                unsigned hash = net_random() & IP_VS_CONN_TAB_MASK;
+        for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) {
+                unsigned hash = net_random() & ip_vs_conn_tab_mask;
 
                 /*
                  *  Lock is actually needed in this loop.
@@ -1029,7 +1045,7 @@ static void ip_vs_conn_flush(void)
         struct ip_vs_conn *cp;
 
   flush_again:
-        for (idx=0; idx<IP_VS_CONN_TAB_SIZE; idx++) {
+        for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
                 /*
                  *  Lock is actually needed in this loop.
                  */
@@ -1060,10 +1076,15 @@ int __init ip_vs_conn_init(void)
 {
         int idx;
 
+        /* Compute size and mask */
+        ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
+        ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
+
         /*
          * Allocate the connection hash table and initialize its list heads
          */
-        ip_vs_conn_tab = vmalloc(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head));
+        ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size *
+                                 sizeof(struct list_head));
         if (!ip_vs_conn_tab)
                 return -ENOMEM;
 
@@ -1078,12 +1099,12 @@ int __init ip_vs_conn_init(void)
 
         pr_info("Connection hash table configured "
                 "(size=%d, memory=%ldKbytes)\n",
-                IP_VS_CONN_TAB_SIZE,
-                (long)(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head))/1024);
+                ip_vs_conn_tab_size,
+                (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024);
         IP_VS_DBG(0, "Each connection entry needs %Zd bytes at least\n",
                   sizeof(struct ip_vs_conn));
 
-        for (idx = 0; idx < IP_VS_CONN_TAB_SIZE; idx++) {
+        for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
                 INIT_LIST_HEAD(&ip_vs_conn_tab[idx]);
         }
 
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index b95699f00545..1cd6e3fd058b 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -31,7 +31,9 @@
 #include <linux/kernel.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
+#include <linux/sctp.h>
 #include <linux/icmp.h>
+#include <linux/slab.h>
 
 #include <net/ip.h>
 #include <net/tcp.h>
@@ -81,6 +83,8 @@ const char *ip_vs_proto_name(unsigned proto)
                 return "UDP";
         case IPPROTO_TCP:
                 return "TCP";
+        case IPPROTO_SCTP:
+                return "SCTP";
         case IPPROTO_ICMP:
                 return "ICMP";
 #ifdef CONFIG_IP_VS_IPV6
@@ -512,8 +516,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
          */
 #ifdef CONFIG_IP_VS_IPV6
         if (svc->af == AF_INET6)
-                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0,
-                            skb->dev);
+                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
         else
 #endif
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
@@ -589,8 +592,9 @@ void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
                 ip_send_check(ciph);
         }
 
-        /* the TCP/UDP port */
-        if (IPPROTO_TCP == ciph->protocol || IPPROTO_UDP == ciph->protocol) {
+        /* the TCP/UDP/SCTP port */
+        if (IPPROTO_TCP == ciph->protocol || IPPROTO_UDP == ciph->protocol ||
+            IPPROTO_SCTP == ciph->protocol) {
                 __be16 *ports = (void *)ciph + ciph->ihl*4;
 
                 if (inout)
@@ -630,8 +634,9 @@ void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
                 ciph->saddr = cp->daddr.in6;
         }
 
-        /* the TCP/UDP port */
-        if (IPPROTO_TCP == ciph->nexthdr || IPPROTO_UDP == ciph->nexthdr) {
+        /* the TCP/UDP/SCTP port */
+        if (IPPROTO_TCP == ciph->nexthdr || IPPROTO_UDP == ciph->nexthdr ||
+            IPPROTO_SCTP == ciph->nexthdr) {
                 __be16 *ports = (void *)ciph + sizeof(struct ipv6hdr);
 
                 if (inout)
@@ -679,7 +684,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
                 goto out;
         }
 
-        if (IPPROTO_TCP == protocol || IPPROTO_UDP == protocol)
+        if (IPPROTO_TCP == protocol || IPPROTO_UDP == protocol ||
+            IPPROTO_SCTP == protocol)
                 offset += 2 * sizeof(__u16);
         if (!skb_make_writable(skb, offset))
                 goto out;
@@ -857,6 +863,21 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related)
 }
 #endif
 
+/*
+ * Check if sctp chunc is ABORT chunk
+ */
+static inline int is_sctp_abort(const struct sk_buff *skb, int nh_len)
+{
+        sctp_chunkhdr_t *sch, schunk;
+        sch = skb_header_pointer(skb, nh_len + sizeof(sctp_sctphdr_t),
+                        sizeof(schunk), &schunk);
+        if (sch == NULL)
+                return 0;
+        if (sch->type == SCTP_CID_ABORT)
+                return 1;
+        return 0;
+}
+
 static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
 {
         struct tcphdr _tcph, *th;
@@ -999,7 +1020,8 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
         if (unlikely(!cp)) {
                 if (sysctl_ip_vs_nat_icmp_send &&
                     (pp->protocol == IPPROTO_TCP ||
-                     pp->protocol == IPPROTO_UDP)) {
+                     pp->protocol == IPPROTO_UDP ||
+                     pp->protocol == IPPROTO_SCTP)) {
                         __be16 _ports[2], *pptr;
 
                         pptr = skb_header_pointer(skb, iph.len,
@@ -1014,14 +1036,19 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
                                  * existing entry if it is not RST
                                  * packet or not TCP packet.
                                  */
-                                if (iph.protocol != IPPROTO_TCP
-                                    || !is_tcp_reset(skb, iph.len)) {
+                                if ((iph.protocol != IPPROTO_TCP &&
+                                     iph.protocol != IPPROTO_SCTP)
+                                     || ((iph.protocol == IPPROTO_TCP
+                                          && !is_tcp_reset(skb, iph.len))
+                                         || (iph.protocol == IPPROTO_SCTP
+                                                && !is_sctp_abort(skb,
+                                                        iph.len)))) {
 #ifdef CONFIG_IP_VS_IPV6
                                         if (af == AF_INET6)
                                                 icmpv6_send(skb,
                                                             ICMPV6_DEST_UNREACH,
                                                             ICMPV6_PORT_UNREACH,
-                                                            0, skb->dev);
+                                                            0);
                                         else
 #endif
                                                 icmp_send(skb,
@@ -1235,7 +1262,8 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)
 
         /* do the statistics and put it back */
         ip_vs_in_stats(cp, skb);
-        if (IPPROTO_TCP == cih->nexthdr || IPPROTO_UDP == cih->nexthdr)
+        if (IPPROTO_TCP == cih->nexthdr || IPPROTO_UDP == cih->nexthdr ||
+            IPPROTO_SCTP == cih->nexthdr)
                 offset += 2 * sizeof(__u16);
         verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, offset);
         /* do not touch skb anymore */
@@ -1358,6 +1386,21 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
          * encorage the standby servers to update the connections timeout
          */
         pkts = atomic_add_return(1, &cp->in_pkts);
+        if (af == AF_INET && (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
+            cp->protocol == IPPROTO_SCTP) {
+                if ((cp->state == IP_VS_SCTP_S_ESTABLISHED &&
+                        (atomic_read(&cp->in_pkts) %
+                         sysctl_ip_vs_sync_threshold[1]
+                         == sysctl_ip_vs_sync_threshold[0])) ||
+                                (cp->old_state != cp->state &&
+                                 ((cp->state == IP_VS_SCTP_S_CLOSED) ||
+                                  (cp->state == IP_VS_SCTP_S_SHUT_ACK_CLI) ||
+                                  (cp->state == IP_VS_SCTP_S_SHUT_ACK_SER)))) {
+                        ip_vs_sync_conn(cp);
+                        goto out;
+                }
+        }
+
         if (af == AF_INET &&
             (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
             (((cp->protocol != IPPROTO_TCP ||
@@ -1366,9 +1409,11 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
                == sysctl_ip_vs_sync_threshold[0])) ||
              ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) &&
               ((cp->state == IP_VS_TCP_S_FIN_WAIT) ||
+               (cp->state == IP_VS_TCP_S_CLOSE) ||
                (cp->state == IP_VS_TCP_S_CLOSE_WAIT) ||
                (cp->state == IP_VS_TCP_S_TIME_WAIT)))))
                 ip_vs_sync_conn(cp);
+out:
         cp->old_state = cp->state;
 
         ip_vs_conn_put(cp);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 446e9bd4b4bc..36dc1d88c2fa 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -31,6 +31,7 @@
 #include <linux/workqueue.h>
 #include <linux/swap.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
@@ -1706,12 +1707,12 @@ static struct ctl_table vs_vars[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 const struct ctl_path net_vs_ctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
         { .procname = "vs", },
         { }
 };
@@ -1843,7 +1844,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN) {
                 seq_printf(seq,
                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
-                        NVERSION(IP_VS_VERSION_CODE), IP_VS_CONN_TAB_SIZE);
+                        NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
                 seq_puts(seq,
                          "Prot LocalAddress:Port Scheduler Flags\n");
                 seq_puts(seq,
@@ -2077,6 +2078,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
+        if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
+                return -EINVAL;
+        if (len < 0 || len >  MAX_ARG_LEN)
+                return -EINVAL;
         if (len != set_arglen[SET_CMDID(cmd)]) {
                 pr_err("set_ctl: len %u != %u\n",
                        len, set_arglen[SET_CMDID(cmd)]);
@@ -2128,8 +2133,9 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 }
         }
 
-        /* Check for valid protocol: TCP or UDP, even for fwmark!=0 */
-        if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP) {
+        /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
+        if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
+            usvc.protocol != IPPROTO_SCTP) {
                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
                        usvc.protocol, &usvc.addr.ip,
                        ntohs(usvc.port), usvc.sched_name);
@@ -2352,17 +2358,25 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         unsigned char arg[128];
         int ret = 0;
+        unsigned int copylen;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
+        if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
+                return -EINVAL;
+
         if (*len < get_arglen[GET_CMDID(cmd)]) {
                 pr_err("get_ctl: len %u < %u\n",
                        *len, get_arglen[GET_CMDID(cmd)]);
                 return -EINVAL;
         }
 
-        if (copy_from_user(arg, user, get_arglen[GET_CMDID(cmd)]) != 0)
+        copylen = get_arglen[GET_CMDID(cmd)];
+        if (copylen > 128)
+                return -EINVAL;
+
+        if (copy_from_user(arg, user, copylen) != 0)
                 return -EFAULT;
 
         if (mutex_lock_interruptible(&__ip_vs_mutex))
@@ -2374,7 +2388,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                 char buf[64];
 
                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
-                        NVERSION(IP_VS_VERSION_CODE), IP_VS_CONN_TAB_SIZE);
+                        NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
                         ret = -EFAULT;
                         goto out;
@@ -2387,7 +2401,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         {
                 struct ip_vs_getinfo info;
                 info.version = IP_VS_VERSION_CODE;
-                info.size = IP_VS_CONN_TAB_SIZE;
+                info.size = ip_vs_conn_tab_size;
                 info.num_services = ip_vs_num_services;
                 if (copy_to_user(user, &info, sizeof(info)) != 0)
                         ret = -EFAULT;
@@ -2714,6 +2728,8 @@ static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
                 return -EINVAL;
 
+        memset(usvc, 0, sizeof(*usvc));
+
         usvc->af = nla_get_u16(nla_af);
 #ifdef CONFIG_IP_VS_IPV6
         if (usvc->af != AF_INET && usvc->af != AF_INET6)
@@ -2901,6 +2917,8 @@ static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
         if (!(nla_addr && nla_port))
                 return -EINVAL;
 
+        memset(udest, 0, sizeof(*udest));
+
         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
         udest->port = nla_get_u16(nla_port);
 
@@ -3227,7 +3245,7 @@ static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
         case IPVS_CMD_GET_INFO:
                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
-                            IP_VS_CONN_TAB_SIZE);
+                            ip_vs_conn_tab_size);
                 break;
         }
 
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index fe3e18834b91..95fd0d14200b 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -39,6 +39,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/ip.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index 702b53ca937c..ff28801962e0 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -17,7 +17,6 @@
 
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
-#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/sysctl.h>
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 33e2c799cba7..2c7f185dfae4 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -32,6 +32,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/netfilter.h>
+#include <linux/gfp.h>
 #include <net/protocol.h>
 #include <net/tcp.h>
 #include <asm/unaligned.h>
@@ -208,7 +209,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                  */
                 from.ip = n_cp->vaddr.ip;
                 port = n_cp->vport;
-                sprintf(buf, "%d,%d,%d,%d,%d,%d", NIPQUAD(from.ip),
+                sprintf(buf, "%u,%u,%u,%u,%u,%u", NIPQUAD(from.ip),
                         (ntohs(port)>>8)&255, ntohs(port)&255);
                 buf_len = strlen(buf);
 
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index c1757f3620cd..94a45213faa6 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -43,6 +43,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/ip.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
@@ -121,7 +122,7 @@ static ctl_table vs_vars_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_table_header * sysctl_header;
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 715b57f9540d..535dc2b419d8 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -45,6 +45,8 @@
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/jiffies.h>
+#include <linux/list.h>
+#include <linux/slab.h>
 
 /* for sysctl */
 #include <linux/fs.h>
@@ -85,25 +87,25 @@ static int sysctl_ip_vs_lblcr_expiration = 24*60*60*HZ;
 /*
  *      IPVS destination set structure and operations
  */
-struct ip_vs_dest_list {
-        struct ip_vs_dest_list  *next;          /* list link */
+struct ip_vs_dest_set_elem {
+        struct list_head        list;          /* list link */
         struct ip_vs_dest       *dest;          /* destination server */
 };
 
 struct ip_vs_dest_set {
         atomic_t                size;           /* set size */
         unsigned long           lastmod;        /* last modified time */
-        struct ip_vs_dest_list  *list;          /* destination list */
+        struct list_head        list;           /* destination list */
         rwlock_t                lock;           /* lock for this list */
 };
 
 
-static struct ip_vs_dest_list *
+static struct ip_vs_dest_set_elem *
 ip_vs_dest_set_insert(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 {
-        struct ip_vs_dest_list *e;
+        struct ip_vs_dest_set_elem *e;
 
-        for (e=set->list; e!=NULL; e=e->next) {
+        list_for_each_entry(e, &set->list, list) {
                 if (e->dest == dest)
                         /* already existed */
                         return NULL;
@@ -118,9 +120,7 @@ ip_vs_dest_set_insert(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
         atomic_inc(&dest->refcnt);
         e->dest = dest;
 
-        /* link it to the list */
-        e->next = set->list;
-        set->list = e;
+        list_add(&e->list, &set->list);
         atomic_inc(&set->size);
 
         set->lastmod = jiffies;
@@ -130,34 +130,33 @@ ip_vs_dest_set_insert(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 static void
 ip_vs_dest_set_erase(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 {
-        struct ip_vs_dest_list *e, **ep;
+        struct ip_vs_dest_set_elem *e;
 
-        for (ep=&set->list, e=*ep; e!=NULL; e=*ep) {
+        list_for_each_entry(e, &set->list, list) {
                 if (e->dest == dest) {
                         /* HIT */
-                        *ep = e->next;
                         atomic_dec(&set->size);
                         set->lastmod = jiffies;
                         atomic_dec(&e->dest->refcnt);
+                        list_del(&e->list);
                         kfree(e);
                         break;
                 }
-                ep = &e->next;
         }
 }
 
 static void ip_vs_dest_set_eraseall(struct ip_vs_dest_set *set)
 {
-        struct ip_vs_dest_list *e, **ep;
+        struct ip_vs_dest_set_elem *e, *ep;
 
         write_lock(&set->lock);
-        for (ep=&set->list, e=*ep; e!=NULL; e=*ep) {
-                *ep = e->next;
+        list_for_each_entry_safe(e, ep, &set->list, list) {
                 /*
                  * We don't kfree dest because it is refered either
                  * by its service or by the trash dest list.
                  */
                 atomic_dec(&e->dest->refcnt);
+                list_del(&e->list);
                 kfree(e);
         }
         write_unlock(&set->lock);
@@ -166,7 +165,7 @@ static void ip_vs_dest_set_eraseall(struct ip_vs_dest_set *set)
 /* get weighted least-connection node in the destination set */
 static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
 {
-        register struct ip_vs_dest_list *e;
+        register struct ip_vs_dest_set_elem *e;
         struct ip_vs_dest *dest, *least;
         int loh, doh;
 
@@ -174,7 +173,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
                 return NULL;
 
         /* select the first destination server, whose weight > 0 */
-        for (e=set->list; e!=NULL; e=e->next) {
+        list_for_each_entry(e, &set->list, list) {
                 least = e->dest;
                 if (least->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
@@ -190,7 +189,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
 
         /* find the destination with the weighted least load */
   nextstage:
-        for (e=e->next; e!=NULL; e=e->next) {
+        list_for_each_entry(e, &set->list, list) {
                 dest = e->dest;
                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
@@ -220,7 +219,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
 /* get weighted most-connection node in the destination set */
 static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
 {
-        register struct ip_vs_dest_list *e;
+        register struct ip_vs_dest_set_elem *e;
         struct ip_vs_dest *dest, *most;
         int moh, doh;
 
@@ -228,7 +227,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
                 return NULL;
 
         /* select the first destination server, whose weight > 0 */
-        for (e=set->list; e!=NULL; e=e->next) {
+        list_for_each_entry(e, &set->list, list) {
                 most = e->dest;
                 if (atomic_read(&most->weight) > 0) {
                         moh = atomic_read(&most->activeconns) * 50
@@ -240,7 +239,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
 
         /* find the destination with the weighted most load */
   nextstage:
-        for (e=e->next; e!=NULL; e=e->next) {
+        list_for_each_entry(e, &set->list, list) {
                 dest = e->dest;
                 doh = atomic_read(&dest->activeconns) * 50
                         + atomic_read(&dest->inactconns);
@@ -302,7 +301,7 @@ static ctl_table vs_vars_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_table_header * sysctl_header;
@@ -389,7 +388,7 @@ ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl, const union nf_inet_addr *daddr,
 
                 /* initilize its dest set */
                 atomic_set(&(en->set.size), 0);
-                en->set.list = NULL;
+                INIT_LIST_HEAD(&en->set.list);
                 rwlock_init(&en->set.lock);
 
                 ip_vs_lblcr_hash(tbl, en);
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c
index 3e7671674549..7fc49f4cf5ad 100644
--- a/net/netfilter/ipvs/ip_vs_proto.c
+++ b/net/netfilter/ipvs/ip_vs_proto.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
+#include <linux/gfp.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <net/protocol.h>
@@ -257,6 +258,9 @@ int __init ip_vs_protocol_init(void)
 #ifdef CONFIG_IP_VS_PROTO_UDP
         REGISTER_PROTOCOL(&ip_vs_protocol_udp);
 #endif
+#ifdef CONFIG_IP_VS_PROTO_SCTP
+        REGISTER_PROTOCOL(&ip_vs_protocol_sctp);
+#endif
 #ifdef CONFIG_IP_VS_PROTO_AH
         REGISTER_PROTOCOL(&ip_vs_protocol_ah);
 #endif
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
new file mode 100644
index 000000000000..c9a3f7a21d53
--- /dev/null
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -0,0 +1,1183 @@
+#include <linux/kernel.h>
+#include <linux/ip.h>
+#include <linux/sctp.h>
+#include <net/ip.h>
+#include <net/ip6_checksum.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv4.h>
+#include <net/sctp/checksum.h>
+#include <net/ip_vs.h>
+
+
+static struct ip_vs_conn *
+sctp_conn_in_get(int af,
+                 const struct sk_buff *skb,
+                 struct ip_vs_protocol *pp,
+                 const struct ip_vs_iphdr *iph,
+                 unsigned int proto_off,
+                 int inverse)
+{
+        __be16 _ports[2], *pptr;
+
+        pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
+        if (pptr == NULL)
+                return NULL;
+
+        if (likely(!inverse)) 
+                return ip_vs_conn_in_get(af, iph->protocol,
+                                         &iph->saddr, pptr[0],
+                                         &iph->daddr, pptr[1]);
+        else 
+                return ip_vs_conn_in_get(af, iph->protocol,
+                                         &iph->daddr, pptr[1],
+                                         &iph->saddr, pptr[0]);
+}
+
+static struct ip_vs_conn *
+sctp_conn_out_get(int af,
+                  const struct sk_buff *skb,
+                  struct ip_vs_protocol *pp,
+                  const struct ip_vs_iphdr *iph,
+                  unsigned int proto_off,
+                  int inverse)
+{
+        __be16 _ports[2], *pptr;
+
+        pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
+        if (pptr == NULL)
+                return NULL;
+
+        if (likely(!inverse)) 
+                return ip_vs_conn_out_get(af, iph->protocol,
+                                          &iph->saddr, pptr[0],
+                                          &iph->daddr, pptr[1]);
+        else 
+                return ip_vs_conn_out_get(af, iph->protocol,
+                                          &iph->daddr, pptr[1],
+                                          &iph->saddr, pptr[0]);
+}
+
+static int
+sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
+                   int *verdict, struct ip_vs_conn **cpp)
+{
+        struct ip_vs_service *svc;
+        sctp_chunkhdr_t _schunkh, *sch;
+        sctp_sctphdr_t *sh, _sctph;
+        struct ip_vs_iphdr iph;
+
+        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
+
+        sh = skb_header_pointer(skb, iph.len, sizeof(_sctph), &_sctph);
+        if (sh == NULL)
+                return 0;
+
+        sch = skb_header_pointer(skb, iph.len + sizeof(sctp_sctphdr_t),
+                                 sizeof(_schunkh), &_schunkh);
+        if (sch == NULL)
+                return 0;
+
+        if ((sch->type == SCTP_CID_INIT) &&
+            (svc = ip_vs_service_get(af, skb->mark, iph.protocol,
+                                     &iph.daddr, sh->dest))) {
+                if (ip_vs_todrop()) {
+                        /*
+                         * It seems that we are very loaded.
+                         * We have to drop this packet :(
+                         */
+                        ip_vs_service_put(svc);
+                        *verdict = NF_DROP;
+                        return 0;
+                }
+                /*
+                 * Let the virtual server select a real server for the
+                 * incoming connection, and create a connection entry.
+                 */
+                *cpp = ip_vs_schedule(svc, skb);
+                if (!*cpp) {
+                        *verdict = ip_vs_leave(svc, skb, pp);
+                        return 0;
+                }
+                ip_vs_service_put(svc);
+        }
+
+        return 1;
+}
+
+static int
+sctp_snat_handler(struct sk_buff *skb,
+                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
+{
+        sctp_sctphdr_t *sctph;
+        unsigned int sctphoff;
+        __be32 crc32;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (cp->af == AF_INET6)
+                sctphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                sctphoff = ip_hdrlen(skb);
+
+        /* csum_check requires unshared skb */
+        if (!skb_make_writable(skb, sctphoff + sizeof(*sctph)))
+                return 0;
+
+        if (unlikely(cp->app != NULL)) {
+                /* Some checks before mangling */
+                if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+                        return 0;
+
+                /* Call application helper if needed */
+                if (!ip_vs_app_pkt_out(cp, skb))
+                        return 0;
+        }
+
+        sctph = (void *) skb_network_header(skb) + sctphoff;
+        sctph->source = cp->vport;
+
+        /* Calculate the checksum */
+        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
+        for (skb = skb_shinfo(skb)->frag_list; skb; skb = skb->next)
+                crc32 = sctp_update_cksum((u8 *) skb->data, skb_headlen(skb),
+                                          crc32);
+        crc32 = sctp_end_cksum(crc32);
+        sctph->checksum = crc32;
+
+        return 1;
+}
+
+static int
+sctp_dnat_handler(struct sk_buff *skb,
+                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
+{
+
+        sctp_sctphdr_t *sctph;
+        unsigned int sctphoff;
+        __be32 crc32;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (cp->af == AF_INET6)
+                sctphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                sctphoff = ip_hdrlen(skb);
+
+        /* csum_check requires unshared skb */
+        if (!skb_make_writable(skb, sctphoff + sizeof(*sctph)))
+                return 0;
+
+        if (unlikely(cp->app != NULL)) {
+                /* Some checks before mangling */
+                if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+                        return 0;
+
+                /* Call application helper if needed */
+                if (!ip_vs_app_pkt_out(cp, skb))
+                        return 0;
+        }
+
+        sctph = (void *) skb_network_header(skb) + sctphoff;
+        sctph->dest = cp->dport;
+
+        /* Calculate the checksum */
+        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
+        for (skb = skb_shinfo(skb)->frag_list; skb; skb = skb->next)
+                crc32 = sctp_update_cksum((u8 *) skb->data, skb_headlen(skb),
+                                          crc32);
+        crc32 = sctp_end_cksum(crc32);
+        sctph->checksum = crc32;
+
+        return 1;
+}
+
+static int
+sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
+{
+        struct sk_buff *list = skb_shinfo(skb)->frag_list;
+        unsigned int sctphoff;
+        struct sctphdr *sh, _sctph;
+        __le32 cmp;
+        __le32 val;
+        __u32 tmp;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                sctphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                sctphoff = ip_hdrlen(skb);
+
+        sh = skb_header_pointer(skb, sctphoff, sizeof(_sctph), &_sctph);
+        if (sh == NULL)
+                return 0;
+
+        cmp = sh->checksum;
+
+        tmp = sctp_start_cksum((__u8 *) sh, skb_headlen(skb));
+        for (; list; list = list->next)
+                tmp = sctp_update_cksum((__u8 *) list->data,
+                                        skb_headlen(list), tmp);
+
+        val = sctp_end_cksum(tmp);
+
+        if (val != cmp) {
+                /* CRC failure, dump it. */
+                IP_VS_DBG_RL_PKT(0, pp, skb, 0,
+                                "Failed checksum for");
+                return 0;
+        }
+        return 1;
+}
+
+struct ipvs_sctp_nextstate {
+        int next_state;
+};
+enum ipvs_sctp_event_t {
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_DATA_SER,
+        IP_VS_SCTP_EVE_INIT_CLI,
+        IP_VS_SCTP_EVE_INIT_SER,
+        IP_VS_SCTP_EVE_INIT_ACK_CLI,
+        IP_VS_SCTP_EVE_INIT_ACK_SER,
+        IP_VS_SCTP_EVE_COOKIE_ECHO_CLI,
+        IP_VS_SCTP_EVE_COOKIE_ECHO_SER,
+        IP_VS_SCTP_EVE_COOKIE_ACK_CLI,
+        IP_VS_SCTP_EVE_COOKIE_ACK_SER,
+        IP_VS_SCTP_EVE_ABORT_CLI,
+        IP_VS_SCTP_EVE__ABORT_SER,
+        IP_VS_SCTP_EVE_SHUT_CLI,
+        IP_VS_SCTP_EVE_SHUT_SER,
+        IP_VS_SCTP_EVE_SHUT_ACK_CLI,
+        IP_VS_SCTP_EVE_SHUT_ACK_SER,
+        IP_VS_SCTP_EVE_SHUT_COM_CLI,
+        IP_VS_SCTP_EVE_SHUT_COM_SER,
+        IP_VS_SCTP_EVE_LAST
+};
+
+static enum ipvs_sctp_event_t sctp_events[255] = {
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_INIT_CLI,
+        IP_VS_SCTP_EVE_INIT_ACK_CLI,
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_ABORT_CLI,
+        IP_VS_SCTP_EVE_SHUT_CLI,
+        IP_VS_SCTP_EVE_SHUT_ACK_CLI,
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_COOKIE_ECHO_CLI,
+        IP_VS_SCTP_EVE_COOKIE_ACK_CLI,
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_DATA_CLI,
+        IP_VS_SCTP_EVE_SHUT_COM_CLI,
+};
+
+static struct ipvs_sctp_nextstate
+ sctp_states_table[IP_VS_SCTP_S_LAST][IP_VS_SCTP_EVE_LAST] = {
+        /*
+         * STATE : IP_VS_SCTP_S_NONE
+         */
+        /*next state *//*event */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ },
+         },
+        /*
+         * STATE : IP_VS_SCTP_S_INIT_CLI
+         * Cient sent INIT and is waiting for reply from server(In ECHO_WAIT)
+         */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_ECHO_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_INIT_SER
+         * Server sent INIT and waiting for INIT ACK from the client
+         */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_INIT_ACK_CLI
+         * Client sent INIT ACK and waiting for ECHO from the server
+         */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK has been resent by the client, let us stay is in
+          * the same state
+          */
+         {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         /*
+          * INIT_ACK sent by the server, close the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * ECHO by client, it should not happen, close the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         /*
+          * ECHO by server, this is what we are expecting, move to ECHO_SER
+          */
+         {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, it should not happen, close the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         /*
+          * Unexpected COOKIE ACK from server, staty in the same state
+          */
+         {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_INIT_ACK_SER
+         * Server sent INIT ACK and waiting for ECHO from the client
+         */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * Unexpected INIT_ACK by the client, let us close the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         /*
+          * INIT_ACK resent by the server, let us move to same state
+          */
+         {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client send the ECHO, this is what we are expecting,
+          * move to ECHO_CLI
+          */
+         {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         /*
+          * ECHO received from the server, Not sure what to do,
+          * let us close it
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, let us stay in the same state
+          */
+         {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         /*
+          * COOKIE ACK from server, hmm... this should not happen, lets close
+          * the connection.
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_ECHO_CLI
+         * Cient  sent ECHO and waiting COOKEI ACK from the Server
+         */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK has been by the client, let us close the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         /*
+          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
+          * “If an INIT ACK is received by an endpoint in any state other
+          * than the COOKIE-WAIT state, the endpoint should discard the
+          * INIT ACK chunk”. Stay in the same state
+          */
+         {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client resent the ECHO, let us stay in the same state
+          */
+         {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         /*
+          * ECHO received from the server, Not sure what to do,
+          * let us close it
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, this shoud not happen, let's close the
+          * connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         /*
+          * COOKIE ACK from server, this is what we are awaiting,lets move to
+          * ESTABLISHED.
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_ECHO_SER
+         * Server sent ECHO and waiting COOKEI ACK from the client
+         */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
+          * “If an INIT ACK is received by an endpoint in any state other
+          * than the COOKIE-WAIT state, the endpoint should discard the
+          * INIT ACK chunk”. Stay in the same state
+          */
+         {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         /*
+          * INIT_ACK has been by the server, let us close the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client sent the ECHO, not sure what to do, let's close the
+          * connection.
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         /*
+          * ECHO resent by the server, stay in the same state
+          */
+         {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, this is what we are expecting, let's move
+          * to ESTABLISHED.
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         /*
+          * COOKIE ACK from server, this should not happen, lets close the
+          * connection.
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_ESTABLISHED
+         * Association established
+         */
+        {{IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
+          * “If an INIT ACK is received by an endpoint in any state other
+          * than the COOKIE-WAIT state, the endpoint should discard the
+          * INIT ACK chunk”. Stay in the same state
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
+          * peer and peer shall move to the ESTABISHED. if it doesn't handle
+          * it will send ERROR chunk. So, stay in the same state
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, not sure what to do stay in the same state
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         /*
+          * SHUTDOWN from the client, move to SHUDDOWN_CLI
+          */
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         /*
+          * SHUTDOWN from the server, move to SHUTDOWN_SER
+          */
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         /*
+          * client sent SHUDTDOWN_ACK, this should not happen, let's close
+          * the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_SHUT_CLI
+         * SHUTDOWN sent from the client, waitinf for SHUT ACK from the server
+         */
+        /*
+         * We recieved the data chuck, keep the state unchanged. I assume
+         * that still data chuncks  can be received by both the peers in
+         * SHUDOWN state
+         */
+
+        {{IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
+          * “If an INIT ACK is received by an endpoint in any state other
+          * than the COOKIE-WAIT state, the endpoint should discard the
+          * INIT ACK chunk”. Stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
+          * peer and peer shall move to the ESTABISHED. if it doesn't handle
+          * it will send ERROR chunk. So, stay in the same state
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, not sure what to do stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         /*
+          * SHUTDOWN resent from the client, move to SHUDDOWN_CLI
+          */
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         /*
+          * SHUTDOWN from the server, move to SHUTDOWN_SER
+          */
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         /*
+          * client sent SHUDTDOWN_ACK, this should not happen, let's close
+          * the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         /*
+          * Server sent SHUTDOWN ACK, this is what we are expecting, let's move
+          * to SHUDOWN_ACK_SER
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         /*
+          * SHUTDOWN COM from client, this should not happen, let's close the
+          * connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_SHUT_SER
+         * SHUTDOWN sent from the server, waitinf for SHUTDOWN ACK from client
+         */
+        /*
+         * We recieved the data chuck, keep the state unchanged. I assume
+         * that still data chuncks  can be received by both the peers in
+         * SHUDOWN state
+         */
+
+        {{IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
+          * “If an INIT ACK is received by an endpoint in any state other
+          * than the COOKIE-WAIT state, the endpoint should discard the
+          * INIT ACK chunk”. Stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
+          * peer and peer shall move to the ESTABISHED. if it doesn't handle
+          * it will send ERROR chunk. So, stay in the same state
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, not sure what to do stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         /*
+          * SHUTDOWN resent from the client, move to SHUDDOWN_CLI
+          */
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         /*
+          * SHUTDOWN resent from the server, move to SHUTDOWN_SER
+          */
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         /*
+          * client sent SHUDTDOWN_ACK, this is what we are expecting, let's
+          * move to SHUT_ACK_CLI
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         /*
+          * Server sent SHUTDOWN ACK, this should not happen, let's close the
+          * connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         /*
+          * SHUTDOWN COM from client, this should not happen, let's close the
+          * connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+
+        /*
+         * State : IP_VS_SCTP_S_SHUT_ACK_CLI
+         * SHUTDOWN ACK from the client, awaiting for SHUTDOWN COM from server
+         */
+        /*
+         * We recieved the data chuck, keep the state unchanged. I assume
+         * that still data chuncks  can be received by both the peers in
+         * SHUDOWN state
+         */
+
+        {{IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
+          * “If an INIT ACK is received by an endpoint in any state other
+          * than the COOKIE-WAIT state, the endpoint should discard the
+          * INIT ACK chunk”. Stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
+          * peer and peer shall move to the ESTABISHED. if it doesn't handle
+          * it will send ERROR chunk. So, stay in the same state
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, not sure what to do stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         /*
+          * SHUTDOWN sent from the client, move to SHUDDOWN_CLI
+          */
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         /*
+          * SHUTDOWN sent from the server, move to SHUTDOWN_SER
+          */
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         /*
+          * client resent SHUDTDOWN_ACK, let's stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         /*
+          * Server sent SHUTDOWN ACK, this should not happen, let's close the
+          * connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         /*
+          * SHUTDOWN COM from client, this should not happen, let's close the
+          * connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         /*
+          * SHUTDOWN COMPLETE from server this is what we are expecting.
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+
+        /*
+         * State : IP_VS_SCTP_S_SHUT_ACK_SER
+         * SHUTDOWN ACK from the server, awaiting for SHUTDOWN COM from client
+         */
+        /*
+         * We recieved the data chuck, keep the state unchanged. I assume
+         * that still data chuncks  can be received by both the peers in
+         * SHUDOWN state
+         */
+
+        {{IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_DATA_SER */ },
+         /*
+          * We have got an INIT from client. From the spec.“Upon receipt of
+          * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
+          * an INIT ACK using the same parameters it sent in its  original
+          * INIT chunk (including its Initiate Tag, unchanged”).
+          */
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         /*
+          * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
+          * “If an INIT ACK is received by an endpoint in any state other
+          * than the COOKIE-WAIT state, the endpoint should discard the
+          * INIT ACK chunk”. Stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         /*
+          * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
+          * peer and peer shall move to the ESTABISHED. if it doesn't handle
+          * it will send ERROR chunk. So, stay in the same state
+          */
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         /*
+          * COOKIE ACK from client, not sure what to do stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         /*
+          * SHUTDOWN sent from the client, move to SHUDDOWN_CLI
+          */
+         {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         /*
+          * SHUTDOWN sent from the server, move to SHUTDOWN_SER
+          */
+         {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         /*
+          * client sent SHUDTDOWN_ACK, this should not happen let's close
+          * the connection.
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         /*
+          * Server resent SHUTDOWN ACK, stay in the same state
+          */
+         {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         /*
+          * SHUTDOWN COM from client, this what we are expecting, let's close
+          * the connection
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         /*
+          * SHUTDOWN COMPLETE from server this should not happen.
+          */
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         },
+        /*
+         * State : IP_VS_SCTP_S_CLOSED
+         */
+        {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
+         {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
+         {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
+         {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
+         }
+};
+
+/*
+ *      Timeout table[state]
+ */
+static int sctp_timeouts[IP_VS_SCTP_S_LAST + 1] = {
+        [IP_VS_SCTP_S_NONE]         =     2 * HZ,
+        [IP_VS_SCTP_S_INIT_CLI]     =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_INIT_SER]     =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_INIT_ACK_CLI] =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_INIT_ACK_SER] =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_ECHO_CLI]     =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_ECHO_SER]     =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_ESTABLISHED]  =    15 * 60 * HZ,
+        [IP_VS_SCTP_S_SHUT_CLI]     =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_SHUT_SER]     =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_SHUT_ACK_CLI] =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_SHUT_ACK_SER] =     1 * 60 * HZ,
+        [IP_VS_SCTP_S_CLOSED]       =    10 * HZ,
+        [IP_VS_SCTP_S_LAST]         =     2 * HZ,
+};
+
+static const char *sctp_state_name_table[IP_VS_SCTP_S_LAST + 1] = {
+        [IP_VS_SCTP_S_NONE]         =    "NONE",
+        [IP_VS_SCTP_S_INIT_CLI]     =    "INIT_CLI",
+        [IP_VS_SCTP_S_INIT_SER]     =    "INIT_SER",
+        [IP_VS_SCTP_S_INIT_ACK_CLI] =    "INIT_ACK_CLI",
+        [IP_VS_SCTP_S_INIT_ACK_SER] =    "INIT_ACK_SER",
+        [IP_VS_SCTP_S_ECHO_CLI]     =    "COOKIE_ECHO_CLI",
+        [IP_VS_SCTP_S_ECHO_SER]     =    "COOKIE_ECHO_SER",
+        [IP_VS_SCTP_S_ESTABLISHED]  =    "ESTABISHED",
+        [IP_VS_SCTP_S_SHUT_CLI]     =    "SHUTDOWN_CLI",
+        [IP_VS_SCTP_S_SHUT_SER]     =    "SHUTDOWN_SER",
+        [IP_VS_SCTP_S_SHUT_ACK_CLI] =    "SHUTDOWN_ACK_CLI",
+        [IP_VS_SCTP_S_SHUT_ACK_SER] =    "SHUTDOWN_ACK_SER",
+        [IP_VS_SCTP_S_CLOSED]       =    "CLOSED",
+        [IP_VS_SCTP_S_LAST]         =    "BUG!"
+};
+
+
+static const char *sctp_state_name(int state)
+{
+        if (state >= IP_VS_SCTP_S_LAST)
+                return "ERR!";
+        if (sctp_state_name_table[state])
+                return sctp_state_name_table[state];
+        return "?";
+}
+
+static void sctp_timeout_change(struct ip_vs_protocol *pp, int flags)
+{
+}
+
+static int
+sctp_set_state_timeout(struct ip_vs_protocol *pp, char *sname, int to)
+{
+
+return ip_vs_set_state_timeout(pp->timeout_table, IP_VS_SCTP_S_LAST,
+                                sctp_state_name_table, sname, to);
+}
+
+static inline int
+set_sctp_state(struct ip_vs_protocol *pp, struct ip_vs_conn *cp,
+                int direction, const struct sk_buff *skb)
+{
+        sctp_chunkhdr_t _sctpch, *sch;
+        unsigned char chunk_type;
+        int event, next_state;
+        int ihl;
+
+#ifdef CONFIG_IP_VS_IPV6
+        ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
+#else
+        ihl = ip_hdrlen(skb);
+#endif
+
+        sch = skb_header_pointer(skb, ihl + sizeof(sctp_sctphdr_t),
+                                sizeof(_sctpch), &_sctpch);
+        if (sch == NULL)
+                return 0;
+
+        chunk_type = sch->type;
+        /*
+         * Section 3: Multiple chunks can be bundled into one SCTP packet
+         * up to the MTU size, except for the INIT, INIT ACK, and
+         * SHUTDOWN COMPLETE chunks. These chunks MUST NOT be bundled with
+         * any other chunk in a packet.
+         *
+         * Section 3.3.7: DATA chunks MUST NOT be bundled with ABORT. Control
+         * chunks (except for INIT, INIT ACK, and SHUTDOWN COMPLETE) MAY be
+         * bundled with an ABORT, but they MUST be placed before the ABORT
+         * in the SCTP packet or they will be ignored by the receiver.
+         */
+        if ((sch->type == SCTP_CID_COOKIE_ECHO) ||
+            (sch->type == SCTP_CID_COOKIE_ACK)) {
+                sch = skb_header_pointer(skb, (ihl + sizeof(sctp_sctphdr_t) +
+                                sch->length), sizeof(_sctpch), &_sctpch);
+                if (sch) {
+                        if (sch->type == SCTP_CID_ABORT)
+                                chunk_type = sch->type;
+                }
+        }
+
+        event = sctp_events[chunk_type];
+
+        /*
+         *  If the direction is IP_VS_DIR_OUTPUT, this event is from server
+         */
+        if (direction == IP_VS_DIR_OUTPUT)
+                event++;
+        /*
+         * get next state
+         */
+        next_state = sctp_states_table[cp->state][event].next_state;
+
+        if (next_state != cp->state) {
+                struct ip_vs_dest *dest = cp->dest;
+
+                IP_VS_DBG_BUF(8, "%s %s  %s:%d->"
+                                "%s:%d state: %s->%s conn->refcnt:%d\n",
+                                pp->name,
+                                ((direction == IP_VS_DIR_OUTPUT) ?
+                                 "output " : "input "),
+                                IP_VS_DBG_ADDR(cp->af, &cp->daddr),
+                                ntohs(cp->dport),
+                                IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                                ntohs(cp->cport),
+                                sctp_state_name(cp->state),
+                                sctp_state_name(next_state),
+                                atomic_read(&cp->refcnt));
+                if (dest) {
+                        if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
+                                (next_state != IP_VS_SCTP_S_ESTABLISHED)) {
+                                atomic_dec(&dest->activeconns);
+                                atomic_inc(&dest->inactconns);
+                                cp->flags |= IP_VS_CONN_F_INACTIVE;
+                        } else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
+                                   (next_state == IP_VS_SCTP_S_ESTABLISHED)) {
+                                atomic_inc(&dest->activeconns);
+                                atomic_dec(&dest->inactconns);
+                                cp->flags &= ~IP_VS_CONN_F_INACTIVE;
+                        }
+                }
+        }
+
+         cp->timeout = pp->timeout_table[cp->state = next_state];
+
+         return 1;
+}
+
+static int
+sctp_state_transition(struct ip_vs_conn *cp, int direction,
+                const struct sk_buff *skb, struct ip_vs_protocol *pp)
+{
+        int ret = 0;
+
+        spin_lock(&cp->lock);
+        ret = set_sctp_state(pp, cp, direction, skb);
+        spin_unlock(&cp->lock);
+
+        return ret;
+}
+
+/*
+ *      Hash table for SCTP application incarnations
+ */
+#define SCTP_APP_TAB_BITS        4
+#define SCTP_APP_TAB_SIZE        (1 << SCTP_APP_TAB_BITS)
+#define SCTP_APP_TAB_MASK        (SCTP_APP_TAB_SIZE - 1)
+
+static struct list_head sctp_apps[SCTP_APP_TAB_SIZE];
+static DEFINE_SPINLOCK(sctp_app_lock);
+
+static inline __u16 sctp_app_hashkey(__be16 port)
+{
+        return (((__force u16)port >> SCTP_APP_TAB_BITS) ^ (__force u16)port)
+                & SCTP_APP_TAB_MASK;
+}
+
+static int sctp_register_app(struct ip_vs_app *inc)
+{
+        struct ip_vs_app *i;
+        __u16 hash;
+        __be16 port = inc->port;
+        int ret = 0;
+
+        hash = sctp_app_hashkey(port);
+
+        spin_lock_bh(&sctp_app_lock);
+        list_for_each_entry(i, &sctp_apps[hash], p_list) {
+                if (i->port == port) {
+                        ret = -EEXIST;
+                        goto out;
+                }
+        }
+        list_add(&inc->p_list, &sctp_apps[hash]);
+        atomic_inc(&ip_vs_protocol_sctp.appcnt);
+out:
+        spin_unlock_bh(&sctp_app_lock);
+
+        return ret;
+}
+
+static void sctp_unregister_app(struct ip_vs_app *inc)
+{
+        spin_lock_bh(&sctp_app_lock);
+        atomic_dec(&ip_vs_protocol_sctp.appcnt);
+        list_del(&inc->p_list);
+        spin_unlock_bh(&sctp_app_lock);
+}
+
+static int sctp_app_conn_bind(struct ip_vs_conn *cp)
+{
+        int hash;
+        struct ip_vs_app *inc;
+        int result = 0;
+
+        /* Default binding: bind app only for NAT */
+        if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                return 0;
+        /* Lookup application incarnations and bind the right one */
+        hash = sctp_app_hashkey(cp->vport);
+
+        spin_lock(&sctp_app_lock);
+        list_for_each_entry(inc, &sctp_apps[hash], p_list) {
+                if (inc->port == cp->vport) {
+                        if (unlikely(!ip_vs_app_inc_get(inc)))
+                                break;
+                        spin_unlock(&sctp_app_lock);
+
+                        IP_VS_DBG_BUF(9, "%s: Binding conn %s:%u->"
+                                        "%s:%u to app %s on port %u\n",
+                                        __func__,
+                                        IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                                        ntohs(cp->cport),
+                                        IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
+                                        ntohs(cp->vport),
+                                        inc->name, ntohs(inc->port));
+                        cp->app = inc;
+                        if (inc->init_conn)
+                                result = inc->init_conn(inc, cp);
+                        goto out;
+                }
+        }
+        spin_unlock(&sctp_app_lock);
+out:
+        return result;
+}
+
+static void ip_vs_sctp_init(struct ip_vs_protocol *pp)
+{
+        IP_VS_INIT_HASH_TABLE(sctp_apps);
+        pp->timeout_table = sctp_timeouts;
+}
+
+
+static void ip_vs_sctp_exit(struct ip_vs_protocol *pp)
+{
+
+}
+
+struct ip_vs_protocol ip_vs_protocol_sctp = {
+        .name = "SCTP",
+        .protocol = IPPROTO_SCTP,
+        .num_states = IP_VS_SCTP_S_LAST,
+        .dont_defrag = 0,
+        .appcnt = ATOMIC_INIT(0),
+        .init = ip_vs_sctp_init,
+        .exit = ip_vs_sctp_exit,
+        .register_app = sctp_register_app,
+        .unregister_app = sctp_unregister_app,
+        .conn_schedule = sctp_conn_schedule,
+        .conn_in_get = sctp_conn_in_get,
+        .conn_out_get = sctp_conn_out_get,
+        .snat_handler = sctp_snat_handler,
+        .dnat_handler = sctp_dnat_handler,
+        .csum_check = sctp_csum_check,
+        .state_name = sctp_state_name,
+        .state_transition = sctp_state_transition,
+        .app_conn_bind = sctp_app_conn_bind,
+        .debug_packet = ip_vs_tcpudp_debug_packet,
+        .timeout_change = sctp_timeout_change,
+        .set_state_timeout = sctp_set_state_timeout,
+};
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 8e6cfd36e6f0..e6cc174fbc06 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -36,6 +36,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/ip.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index e177f0dc2084..8fb0ae616761 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -400,6 +400,11 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                                         flags |= IP_VS_CONN_F_INACTIVE;
                                 else
                                         flags &= ~IP_VS_CONN_F_INACTIVE;
+                        } else if (s->protocol == IPPROTO_SCTP) {
+                                if (state != IP_VS_SCTP_S_ESTABLISHED)
+                                        flags |= IP_VS_CONN_F_INACTIVE;
+                                else
+                                        flags &= ~IP_VS_CONN_F_INACTIVE;
                         }
                         cp = ip_vs_conn_new(AF_INET, s->protocol,
                                             (union nf_inet_addr *)&s->caddr,
@@ -434,6 +439,15 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                                 atomic_dec(&dest->inactconns);
                                 cp->flags &= ~IP_VS_CONN_F_INACTIVE;
                         }
+                } else if ((cp->dest) && (cp->protocol == IPPROTO_SCTP) &&
+                           (cp->state != state)) {
+                        dest = cp->dest;
+                        if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
+                             (state != IP_VS_SCTP_S_ESTABLISHED)) {
+                            atomic_dec(&dest->activeconns);
+                            atomic_inc(&dest->inactconns);
+                            cp->flags &= ~IP_VS_CONN_F_INACTIVE;
+                        }
                 }
 
                 if (opt)
diff --git a/net/netfilter/ipvs/ip_vs_wrr.c b/net/netfilter/ipvs/ip_vs_wrr.c
index 6182e8ea0be7..30db633f88f1 100644
--- a/net/netfilter/ipvs/ip_vs_wrr.c
+++ b/net/netfilter/ipvs/ip_vs_wrr.c
@@ -23,7 +23,9 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/net.h>
+#include <linux/gcd.h>
 
 #include <net/ip_vs.h>
 
@@ -38,20 +40,6 @@ struct ip_vs_wrr_mark {
 };
 
 
-/*
- *    Get the gcd of server weights
- */
-static int gcd(int a, int b)
-{
-        int c;
-
-        while ((c = a % b)) {
-                a = b;
-                b = c;
-        }
-        return b;
-}
-
 static int ip_vs_wrr_gcd_weight(struct ip_vs_service *svc)
 {
         struct ip_vs_dest *dest;
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 30b3189bd29c..e450cd6f4eb5 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -17,6 +17,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/tcp.h>                  /* for tcphdr */
 #include <net/ip.h>
 #include <net/tcp.h>                    /* for csum_tcpudp_magic */
@@ -311,7 +312,7 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         mtu = dst_mtu(&rt->u.dst);
         if (skb->len > mtu) {
                 dst_release(&rt->u.dst);
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
@@ -454,7 +455,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         mtu = dst_mtu(&rt->u.dst);
         if (skb->len > mtu) {
                 dst_release(&rt->u.dst);
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP_VS_DBG_RL_PKT(0, pp, skb, 0,
                                  "ip_vs_nat_xmit_v6(): frag needed for");
                 goto tx_error;
@@ -672,7 +673,7 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
 
         if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr)) {
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 dst_release(&rt->u.dst);
                 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
@@ -814,7 +815,7 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         /* MTU checking */
         mtu = dst_mtu(&rt->u.dst);
         if (skb->len > mtu) {
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 dst_release(&rt->u.dst);
                 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
@@ -965,7 +966,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         mtu = dst_mtu(&rt->u.dst);
         if (skb->len > mtu) {
                 dst_release(&rt->u.dst);
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error;
         }
diff --git a/net/netfilter/nf_conntrack_acct.c b/net/netfilter/nf_conntrack_acct.c
index 4a1d94aac20b..ab81b380eae6 100644
--- a/net/netfilter/nf_conntrack_acct.c
+++ b/net/netfilter/nf_conntrack_acct.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/moduleparam.h>
 
@@ -30,7 +31,6 @@ MODULE_PARM_DESC(acct, "Enable connection tracking flow accounting.");
 #ifdef CONFIG_SYSCTL
 static struct ctl_table acct_sysctl_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_acct",
                 .data           = &init_net.ct.sysctl_acct,
                 .maxlen         = sizeof(unsigned int),
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 07d9d8857e5d..372e80f07a81 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -16,6 +16,7 @@
 #include <linux/in.h>
 #include <linux/udp.h>
 #include <linux/netfilter.h>
+#include <linux/gfp.h>
 
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_expect.h>
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index b9168c1864ca..0c9bbe93cc16 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -30,6 +30,7 @@
 #include <linux/netdevice.h>
 #include <linux/socket.h>
 #include <linux/mm.h>
+#include <linux/nsproxy.h>
 #include <linux/rculist_nulls.h>
 
 #include <net/netfilter/nf_conntrack.h>
@@ -41,6 +42,7 @@
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_acct.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 
@@ -63,13 +65,11 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
 struct nf_conn nf_conntrack_untracked __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
 
-static struct kmem_cache *nf_conntrack_cachep __read_mostly;
-
 static int nf_conntrack_hash_rnd_initted;
 static unsigned int nf_conntrack_hash_rnd;
 
 static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
-                                  unsigned int size, unsigned int rnd)
+                                  u16 zone, unsigned int size, unsigned int rnd)
 {
         unsigned int n;
         u_int32_t h;
@@ -80,15 +80,16 @@ static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
          */
         n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
         h = jhash2((u32 *)tuple, n,
-                   rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
-                          tuple->dst.protonum));
+                   zone ^ rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
+                                 tuple->dst.protonum));
 
         return ((u64)h * size) >> 32;
 }
 
-static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
+static inline u_int32_t hash_conntrack(const struct net *net, u16 zone,
+                                       const struct nf_conntrack_tuple *tuple)
 {
-        return __hash_conntrack(tuple, nf_conntrack_htable_size,
+        return __hash_conntrack(tuple, zone, net->ct.htable_size,
                                 nf_conntrack_hash_rnd);
 }
 
@@ -292,11 +293,12 @@ static void death_by_timeout(unsigned long ul_conntrack)
  * - Caller must lock nf_conntrack_lock before calling this function
  */
 struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
+__nf_conntrack_find(struct net *net, u16 zone,
+                    const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_tuple_hash *h;
         struct hlist_nulls_node *n;
-        unsigned int hash = hash_conntrack(tuple);
+        unsigned int hash = hash_conntrack(net, zone, tuple);
 
         /* Disable BHs the entire time since we normally need to disable them
          * at least once for the stats anyway.
@@ -304,7 +306,8 @@ __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
         local_bh_disable();
 begin:
         hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnnode) {
-                if (nf_ct_tuple_equal(tuple, &h->tuple)) {
+                if (nf_ct_tuple_equal(tuple, &h->tuple) &&
+                    nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)) == zone) {
                         NF_CT_STAT_INC(net, found);
                         local_bh_enable();
                         return h;
@@ -326,21 +329,23 @@ EXPORT_SYMBOL_GPL(__nf_conntrack_find);
 
 /* Find a connection corresponding to a tuple. */
 struct nf_conntrack_tuple_hash *
-nf_conntrack_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
+nf_conntrack_find_get(struct net *net, u16 zone,
+                      const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_tuple_hash *h;
         struct nf_conn *ct;
 
         rcu_read_lock();
 begin:
-        h = __nf_conntrack_find(net, tuple);
+        h = __nf_conntrack_find(net, zone, tuple);
         if (h) {
                 ct = nf_ct_tuplehash_to_ctrack(h);
                 if (unlikely(nf_ct_is_dying(ct) ||
                              !atomic_inc_not_zero(&ct->ct_general.use)))
                         h = NULL;
                 else {
-                        if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple))) {
+                        if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple) ||
+                                     nf_ct_zone(ct) != zone)) {
                                 nf_ct_put(ct);
                                 goto begin;
                         }
@@ -366,10 +371,13 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
 
 void nf_conntrack_hash_insert(struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
         unsigned int hash, repl_hash;
+        u16 zone;
 
-        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        zone = nf_ct_zone(ct);
+        hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
 }
@@ -386,6 +394,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         struct hlist_nulls_node *n;
         enum ip_conntrack_info ctinfo;
         struct net *net;
+        u16 zone;
 
         ct = nf_ct_get(skb, &ctinfo);
         net = nf_ct_net(ct);
@@ -397,8 +406,9 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
                 return NF_ACCEPT;
 
-        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        zone = nf_ct_zone(ct);
+        hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
         /* We're not in hash table, and we refuse to set up related
            connections for unconfirmed conns.  But packet copies and
@@ -417,11 +427,13 @@ __nf_conntrack_confirm(struct sk_buff *skb)
            not in the hash.  If there is, we lost race. */
         hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
-                                      &h->tuple))
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                         goto out;
         hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
-                                      &h->tuple))
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                         goto out;
 
         /* Remove from unconfirmed list */
@@ -468,15 +480,19 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
         struct net *net = nf_ct_net(ignored_conntrack);
         struct nf_conntrack_tuple_hash *h;
         struct hlist_nulls_node *n;
-        unsigned int hash = hash_conntrack(tuple);
+        struct nf_conn *ct;
+        u16 zone = nf_ct_zone(ignored_conntrack);
+        unsigned int hash = hash_conntrack(net, zone, tuple);
 
         /* Disable BHs the entire time since we need to disable them at
          * least once for the stats anyway.
          */
         rcu_read_lock_bh();
         hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnnode) {
-                if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
-                    nf_ct_tuple_equal(tuple, &h->tuple)) {
+                ct = nf_ct_tuplehash_to_ctrack(h);
+                if (ct != ignored_conntrack &&
+                    nf_ct_tuple_equal(tuple, &h->tuple) &&
+                    nf_ct_zone(ct) == zone) {
                         NF_CT_STAT_INC(net, found);
                         rcu_read_unlock_bh();
                         return 1;
@@ -503,7 +519,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
         int dropped = 0;
 
         rcu_read_lock();
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < net->ct.htable_size; i++) {
                 hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash],
                                          hnnode) {
                         tmp = nf_ct_tuplehash_to_ctrack(h);
@@ -512,12 +528,18 @@ static noinline int early_drop(struct net *net, unsigned int hash)
                         cnt++;
                 }
 
-                if (ct && unlikely(nf_ct_is_dying(ct) ||
-                                   !atomic_inc_not_zero(&ct->ct_general.use)))
-                        ct = NULL;
-                if (ct || cnt >= NF_CT_EVICTION_RANGE)
+                if (ct != NULL) {
+                        if (likely(!nf_ct_is_dying(ct) &&
+                                   atomic_inc_not_zero(&ct->ct_general.use)))
+                                break;
+                        else
+                                ct = NULL;
+                }
+
+                if (cnt >= NF_CT_EVICTION_RANGE)
                         break;
-                hash = (hash + 1) % nf_conntrack_htable_size;
+
+                hash = (hash + 1) % net->ct.htable_size;
         }
         rcu_read_unlock();
 
@@ -533,7 +555,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
         return dropped;
 }
 
-struct nf_conn *nf_conntrack_alloc(struct net *net,
+struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone,
                                    const struct nf_conntrack_tuple *orig,
                                    const struct nf_conntrack_tuple *repl,
                                    gfp_t gfp)
@@ -551,7 +573,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
 
         if (nf_conntrack_max &&
             unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
-                unsigned int hash = hash_conntrack(orig);
+                unsigned int hash = hash_conntrack(net, zone, orig);
                 if (!early_drop(net, hash)) {
                         atomic_dec(&net->ct.count);
                         if (net_ratelimit())
@@ -566,7 +588,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
          * Do not use kmem_cache_zalloc(), as this cache uses
          * SLAB_DESTROY_BY_RCU.
          */
-        ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
+        ct = kmem_cache_alloc(net->ct.nf_conntrack_cachep, gfp);
         if (ct == NULL) {
                 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
                 atomic_dec(&net->ct.count);
@@ -588,13 +610,28 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
 #ifdef CONFIG_NET_NS
         ct->ct_net = net;
 #endif
-
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+        if (zone) {
+                struct nf_conntrack_zone *nf_ct_zone;
+
+                nf_ct_zone = nf_ct_ext_add(ct, NF_CT_EXT_ZONE, GFP_ATOMIC);
+                if (!nf_ct_zone)
+                        goto out_free;
+                nf_ct_zone->id = zone;
+        }
+#endif
         /*
          * changes to lookup keys must be done before setting refcnt to 1
          */
         smp_wmb();
         atomic_set(&ct->ct_general.use, 1);
         return ct;
+
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+out_free:
+        kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
+        return ERR_PTR(-ENOMEM);
+#endif
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
 
@@ -605,14 +642,14 @@ void nf_conntrack_free(struct nf_conn *ct)
         nf_ct_ext_destroy(ct);
         atomic_dec(&net->ct.count);
         nf_ct_ext_free(ct);
-        kmem_cache_free(nf_conntrack_cachep, ct);
+        kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
 
 /* Allocate a new conntrack: we return -ENOMEM if classification
    failed due to stress.  Otherwise it really is unclassifiable. */
 static struct nf_conntrack_tuple_hash *
-init_conntrack(struct net *net,
+init_conntrack(struct net *net, struct nf_conn *tmpl,
                const struct nf_conntrack_tuple *tuple,
                struct nf_conntrack_l3proto *l3proto,
                struct nf_conntrack_l4proto *l4proto,
@@ -622,14 +659,16 @@ init_conntrack(struct net *net,
         struct nf_conn *ct;
         struct nf_conn_help *help;
         struct nf_conntrack_tuple repl_tuple;
+        struct nf_conntrack_ecache *ecache;
         struct nf_conntrack_expect *exp;
+        u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
 
         if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {
                 pr_debug("Can't invert tuple.\n");
                 return NULL;
         }
 
-        ct = nf_conntrack_alloc(net, tuple, &repl_tuple, GFP_ATOMIC);
+        ct = nf_conntrack_alloc(net, zone, tuple, &repl_tuple, GFP_ATOMIC);
         if (IS_ERR(ct)) {
                 pr_debug("Can't allocate conntrack.\n");
                 return (struct nf_conntrack_tuple_hash *)ct;
@@ -642,10 +681,14 @@ init_conntrack(struct net *net,
         }
 
         nf_ct_acct_ext_add(ct, GFP_ATOMIC);
-        nf_ct_ecache_ext_add(ct, GFP_ATOMIC);
+
+        ecache = tmpl ? nf_ct_ecache_find(tmpl) : NULL;
+        nf_ct_ecache_ext_add(ct, ecache ? ecache->ctmask : 0,
+                                 ecache ? ecache->expmask : 0,
+                             GFP_ATOMIC);
 
         spin_lock_bh(&nf_conntrack_lock);
-        exp = nf_ct_find_expectation(net, tuple);
+        exp = nf_ct_find_expectation(net, zone, tuple);
         if (exp) {
                 pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
                          ct, exp);
@@ -667,7 +710,7 @@ init_conntrack(struct net *net,
                 nf_conntrack_get(&ct->master->ct_general);
                 NF_CT_STAT_INC(net, expect_new);
         } else {
-                __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
+                __nf_ct_try_assign_helper(ct, tmpl, GFP_ATOMIC);
                 NF_CT_STAT_INC(net, new);
         }
 
@@ -688,7 +731,7 @@ init_conntrack(struct net *net,
 
 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
 static inline struct nf_conn *
-resolve_normal_ct(struct net *net,
+resolve_normal_ct(struct net *net, struct nf_conn *tmpl,
                   struct sk_buff *skb,
                   unsigned int dataoff,
                   u_int16_t l3num,
@@ -701,6 +744,7 @@ resolve_normal_ct(struct net *net,
         struct nf_conntrack_tuple tuple;
         struct nf_conntrack_tuple_hash *h;
         struct nf_conn *ct;
+        u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
 
         if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
                              dataoff, l3num, protonum, &tuple, l3proto,
@@ -710,9 +754,10 @@ resolve_normal_ct(struct net *net,
         }
 
         /* look for tuple match */
-        h = nf_conntrack_find_get(net, &tuple);
+        h = nf_conntrack_find_get(net, zone, &tuple);
         if (!h) {
-                h = init_conntrack(net, &tuple, l3proto, l4proto, skb, dataoff);
+                h = init_conntrack(net, tmpl, &tuple, l3proto, l4proto,
+                                   skb, dataoff);
                 if (!h)
                         return NULL;
                 if (IS_ERR(h))
@@ -749,7 +794,7 @@ unsigned int
 nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
                 struct sk_buff *skb)
 {
-        struct nf_conn *ct;
+        struct nf_conn *ct, *tmpl = NULL;
         enum ip_conntrack_info ctinfo;
         struct nf_conntrack_l3proto *l3proto;
         struct nf_conntrack_l4proto *l4proto;
@@ -758,10 +803,14 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
         int set_reply = 0;
         int ret;
 
-        /* Previously seen (loopback or untracked)?  Ignore. */
         if (skb->nfct) {
-                NF_CT_STAT_INC_ATOMIC(net, ignore);
-                return NF_ACCEPT;
+                /* Previously seen (loopback or untracked)?  Ignore. */
+                tmpl = (struct nf_conn *)skb->nfct;
+                if (!nf_ct_is_template(tmpl)) {
+                        NF_CT_STAT_INC_ATOMIC(net, ignore);
+                        return NF_ACCEPT;
+                }
+                skb->nfct = NULL;
         }
 
         /* rcu_read_lock()ed by nf_hook_slow */
@@ -772,7 +821,8 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
                 pr_debug("not prepared to track yet or error occured\n");
                 NF_CT_STAT_INC_ATOMIC(net, error);
                 NF_CT_STAT_INC_ATOMIC(net, invalid);
-                return -ret;
+                ret = -ret;
+                goto out;
         }
 
         l4proto = __nf_ct_l4proto_find(pf, protonum);
@@ -781,26 +831,30 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
          * inverse of the return code tells to the netfilter
          * core what to do with the packet. */
         if (l4proto->error != NULL) {
-                ret = l4proto->error(net, skb, dataoff, &ctinfo, pf, hooknum);
+                ret = l4proto->error(net, tmpl, skb, dataoff, &ctinfo,
+                                     pf, hooknum);
                 if (ret <= 0) {
                         NF_CT_STAT_INC_ATOMIC(net, error);
                         NF_CT_STAT_INC_ATOMIC(net, invalid);
-                        return -ret;
+                        ret = -ret;
+                        goto out;
                 }
         }
 
-        ct = resolve_normal_ct(net, skb, dataoff, pf, protonum,
+        ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,
                                l3proto, l4proto, &set_reply, &ctinfo);
         if (!ct) {
                 /* Not valid part of a connection */
                 NF_CT_STAT_INC_ATOMIC(net, invalid);
-                return NF_ACCEPT;
+                ret = NF_ACCEPT;
+                goto out;
         }
 
         if (IS_ERR(ct)) {
                 /* Too stressed to deal. */
                 NF_CT_STAT_INC_ATOMIC(net, drop);
-                return NF_DROP;
+                ret = NF_DROP;
+                goto out;
         }
 
         NF_CT_ASSERT(skb->nfct);
@@ -815,11 +869,15 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
                 NF_CT_STAT_INC_ATOMIC(net, invalid);
                 if (ret == -NF_DROP)
                         NF_CT_STAT_INC_ATOMIC(net, drop);
-                return -ret;
+                ret = -ret;
+                goto out;
         }
 
         if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
-                nf_conntrack_event_cache(IPCT_STATUS, ct);
+                nf_conntrack_event_cache(IPCT_REPLY, ct);
+out:
+        if (tmpl)
+                nf_ct_put(tmpl);
 
         return ret;
 }
@@ -858,7 +916,7 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
                 return;
 
         rcu_read_lock();
-        __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
+        __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);
         rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
@@ -932,6 +990,14 @@ bool __nf_ct_kill_acct(struct nf_conn *ct,
 }
 EXPORT_SYMBOL_GPL(__nf_ct_kill_acct);
 
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+static struct nf_ct_ext_type nf_ct_zone_extend __read_mostly = {
+        .len    = sizeof(struct nf_conntrack_zone),
+        .align  = __alignof__(struct nf_conntrack_zone),
+        .id     = NF_CT_EXT_ZONE,
+};
+#endif
+
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
@@ -1008,7 +1074,7 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
         struct hlist_nulls_node *n;
 
         spin_lock_bh(&nf_conntrack_lock);
-        for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
+        for (; *bucket < net->ct.htable_size; (*bucket)++) {
                 hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
                         ct = nf_ct_tuplehash_to_ctrack(h);
                         if (iter(ct, data))
@@ -1107,9 +1173,15 @@ static void nf_ct_release_dying_list(struct net *net)
 
 static void nf_conntrack_cleanup_init_net(void)
 {
+        /* wait until all references to nf_conntrack_untracked are dropped */
+        while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
+                schedule();
+
         nf_conntrack_helper_fini();
         nf_conntrack_proto_fini();
-        kmem_cache_destroy(nf_conntrack_cachep);
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+        nf_ct_extend_unregister(&nf_ct_zone_extend);
+#endif
 }
 
 static void nf_conntrack_cleanup_net(struct net *net)
@@ -1121,15 +1193,14 @@ static void nf_conntrack_cleanup_net(struct net *net)
                 schedule();
                 goto i_see_dead_people;
         }
-        /* wait until all references to nf_conntrack_untracked are dropped */
-        while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
-                schedule();
 
         nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
-                             nf_conntrack_htable_size);
+                             net->ct.htable_size);
         nf_conntrack_ecache_fini(net);
         nf_conntrack_acct_fini(net);
         nf_conntrack_expect_fini(net);
+        kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+        kfree(net->ct.slabname);
         free_percpu(net->ct.stat);
 }
 
@@ -1184,9 +1255,12 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
 {
         int i, bucket, vmalloced, old_vmalloced;
         unsigned int hashsize, old_size;
-        int rnd;
         struct hlist_nulls_head *hash, *old_hash;
         struct nf_conntrack_tuple_hash *h;
+        struct nf_conn *ct;
+
+        if (current->nsproxy->net_ns != &init_net)
+                return -EOPNOTSUPP;
 
         /* On boot, we can set this without any fancy locking. */
         if (!nf_conntrack_htable_size)
@@ -1200,33 +1274,31 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
         if (!hash)
                 return -ENOMEM;
 
-        /* We have to rehahs for the new table anyway, so we also can
-         * use a newrandom seed */
-        get_random_bytes(&rnd, sizeof(rnd));
-
         /* Lookups in the old hash might happen in parallel, which means we
          * might get false negatives during connection lookup. New connections
          * created because of a false negative won't make it into the hash
          * though since that required taking the lock.
          */
         spin_lock_bh(&nf_conntrack_lock);
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < init_net.ct.htable_size; i++) {
                 while (!hlist_nulls_empty(&init_net.ct.hash[i])) {
                         h = hlist_nulls_entry(init_net.ct.hash[i].first,
                                         struct nf_conntrack_tuple_hash, hnnode);
+                        ct = nf_ct_tuplehash_to_ctrack(h);
                         hlist_nulls_del_rcu(&h->hnnode);
-                        bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
+                        bucket = __hash_conntrack(&h->tuple, nf_ct_zone(ct),
+                                                  hashsize,
+                                                  nf_conntrack_hash_rnd);
                         hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);
                 }
         }
-        old_size = nf_conntrack_htable_size;
+        old_size = init_net.ct.htable_size;
         old_vmalloced = init_net.ct.hash_vmalloc;
         old_hash = init_net.ct.hash;
 
-        nf_conntrack_htable_size = hashsize;
+        init_net.ct.htable_size = nf_conntrack_htable_size = hashsize;
         init_net.ct.hash_vmalloc = vmalloced;
         init_net.ct.hash = hash;
-        nf_conntrack_hash_rnd = rnd;
         spin_unlock_bh(&nf_conntrack_lock);
 
         nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
@@ -1265,15 +1337,6 @@ static int nf_conntrack_init_init_net(void)
                NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
                nf_conntrack_max);
 
-        nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
-                                                sizeof(struct nf_conn),
-                                                0, SLAB_DESTROY_BY_RCU, NULL);
-        if (!nf_conntrack_cachep) {
-                printk(KERN_ERR "Unable to create nf_conn slab cache\n");
-                ret = -ENOMEM;
-                goto err_cache;
-        }
-
         ret = nf_conntrack_proto_init();
         if (ret < 0)
                 goto err_proto;
@@ -1282,13 +1345,28 @@ static int nf_conntrack_init_init_net(void)
         if (ret < 0)
                 goto err_helper;
 
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+        ret = nf_ct_extend_register(&nf_ct_zone_extend);
+        if (ret < 0)
+                goto err_extend;
+#endif
+        /* Set up fake conntrack: to never be deleted, not in any hashes */
+#ifdef CONFIG_NET_NS
+        nf_conntrack_untracked.ct_net = &init_net;
+#endif
+        atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
+        /*  - and look it like as a confirmed connection */
+        set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
+
         return 0;
 
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+err_extend:
+        nf_conntrack_helper_fini();
+#endif
 err_helper:
         nf_conntrack_proto_fini();
 err_proto:
-        kmem_cache_destroy(nf_conntrack_cachep);
-err_cache:
         return ret;
 }
 
@@ -1310,7 +1388,24 @@ static int nf_conntrack_init_net(struct net *net)
                 ret = -ENOMEM;
                 goto err_stat;
         }
-        net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
+
+        net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
+        if (!net->ct.slabname) {
+                ret = -ENOMEM;
+                goto err_slabname;
+        }
+
+        net->ct.nf_conntrack_cachep = kmem_cache_create(net->ct.slabname,
+                                                        sizeof(struct nf_conn), 0,
+                                                        SLAB_DESTROY_BY_RCU, NULL);
+        if (!net->ct.nf_conntrack_cachep) {
+                printk(KERN_ERR "Unable to create nf_conn slab cache\n");
+                ret = -ENOMEM;
+                goto err_cache;
+        }
+
+        net->ct.htable_size = nf_conntrack_htable_size;
+        net->ct.hash = nf_ct_alloc_hashtable(&net->ct.htable_size,
                                              &net->ct.hash_vmalloc, 1);
         if (!net->ct.hash) {
                 ret = -ENOMEM;
@@ -1327,15 +1422,6 @@ static int nf_conntrack_init_net(struct net *net)
         if (ret < 0)
                 goto err_ecache;
 
-        /* Set up fake conntrack:
-            - to never be deleted, not in any hashes */
-#ifdef CONFIG_NET_NS
-        nf_conntrack_untracked.ct_net = &init_net;
-#endif
-        atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
-        /*  - and look it like as a confirmed connection */
-        set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
-
         return 0;
 
 err_ecache:
@@ -1344,8 +1430,12 @@ err_acct:
         nf_conntrack_expect_fini(net);
 err_expect:
         nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
-                             nf_conntrack_htable_size);
+                             net->ct.htable_size);
 err_hash:
+        kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+err_cache:
+        kfree(net->ct.slabname);
+err_slabname:
         free_percpu(net->ct.stat);
 err_stat:
         return ret;
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index aee560b4768d..f516961a83b4 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -18,6 +18,7 @@
 #include <linux/percpu.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
@@ -151,7 +152,6 @@ static int nf_ct_events_retry_timeout __read_mostly = 15*HZ;
 #ifdef CONFIG_SYSCTL
 static struct ctl_table event_sysctl_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_events",
                 .data           = &init_net.ct.sysctl_events,
                 .maxlen         = sizeof(unsigned int),
@@ -159,7 +159,6 @@ static struct ctl_table event_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_events_retry_timeout",
                 .data           = &init_net.ct.sysctl_events_retry_timeout,
                 .maxlen         = sizeof(unsigned int),
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 2032dfe25ca8..acb29ccaa41f 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -27,6 +27,7 @@
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 unsigned int nf_ct_expect_hsize __read_mostly;
 EXPORT_SYMBOL_GPL(nf_ct_expect_hsize);
@@ -84,7 +85,8 @@ static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple
 }
 
 struct nf_conntrack_expect *
-__nf_ct_expect_find(struct net *net, const struct nf_conntrack_tuple *tuple)
+__nf_ct_expect_find(struct net *net, u16 zone,
+                    const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i;
         struct hlist_node *n;
@@ -95,7 +97,8 @@ __nf_ct_expect_find(struct net *net, const struct nf_conntrack_tuple *tuple)
 
         h = nf_ct_expect_dst_hash(tuple);
         hlist_for_each_entry_rcu(i, n, &net->ct.expect_hash[h], hnode) {
-                if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
+                if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
+                    nf_ct_zone(i->master) == zone)
                         return i;
         }
         return NULL;
@@ -104,12 +107,13 @@ EXPORT_SYMBOL_GPL(__nf_ct_expect_find);
 
 /* Just find a expectation corresponding to a tuple. */
 struct nf_conntrack_expect *
-nf_ct_expect_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
+nf_ct_expect_find_get(struct net *net, u16 zone,
+                      const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i;
 
         rcu_read_lock();
-        i = __nf_ct_expect_find(net, tuple);
+        i = __nf_ct_expect_find(net, zone, tuple);
         if (i && !atomic_inc_not_zero(&i->use))
                 i = NULL;
         rcu_read_unlock();
@@ -121,7 +125,8 @@ EXPORT_SYMBOL_GPL(nf_ct_expect_find_get);
 /* If an expectation for this connection is found, it gets delete from
  * global list then returned. */
 struct nf_conntrack_expect *
-nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple)
+nf_ct_find_expectation(struct net *net, u16 zone,
+                       const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i, *exp = NULL;
         struct hlist_node *n;
@@ -133,7 +138,8 @@ nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple)
         h = nf_ct_expect_dst_hash(tuple);
         hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
                 if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
-                    nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
+                    nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
+                    nf_ct_zone(i->master) == zone) {
                         exp = i;
                         break;
                 }
@@ -202,9 +208,10 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
 static inline int expect_matches(const struct nf_conntrack_expect *a,
                                  const struct nf_conntrack_expect *b)
 {
-        return a->master == b->master && a->class == b->class
-                && nf_ct_tuple_equal(&a->tuple, &b->tuple)
-                && nf_ct_tuple_mask_equal(&a->mask, &b->mask);
+        return a->master == b->master && a->class == b->class &&
+                nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
+                nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
+                nf_ct_zone(a->master) == nf_ct_zone(b->master);
 }
 
 /* Generally a bad idea to call this: could have matched already. */
@@ -232,7 +239,6 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 
         new->master = me;
         atomic_set(&new->use, 1);
-        INIT_RCU_HEAD(&new->rcu);
         return new;
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);
@@ -500,6 +506,7 @@ static void exp_seq_stop(struct seq_file *seq, void *v)
 static int exp_seq_show(struct seq_file *s, void *v)
 {
         struct nf_conntrack_expect *expect;
+        struct nf_conntrack_helper *helper;
         struct hlist_node *n = v;
         char *delim = "";
 
@@ -525,6 +532,14 @@ static int exp_seq_show(struct seq_file *s, void *v)
         if (expect->flags & NF_CT_EXPECT_INACTIVE)
                 seq_printf(s, "%sINACTIVE", delim);
 
+        helper = rcu_dereference(nfct_help(expect->master)->helper);
+        if (helper) {
+                seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
+                if (helper->expect_policy[expect->class].name)
+                        seq_printf(s, "/%s",
+                                   helper->expect_policy[expect->class].name);
+        }
+
         return seq_putc(s, '\n');
 }
 
@@ -569,7 +584,7 @@ static void exp_proc_remove(struct net *net)
 #endif /* CONFIG_PROC_FS */
 }
 
-module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600);
+module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400);
 
 int nf_conntrack_expect_init(struct net *net)
 {
@@ -577,7 +592,7 @@ int nf_conntrack_expect_init(struct net *net)
 
         if (net_eq(net, &init_net)) {
                 if (!nf_ct_expect_hsize) {
-                        nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
+                        nf_ct_expect_hsize = net->ct.htable_size / 256;
                         if (!nf_ct_expect_hsize)
                                 nf_ct_expect_hsize = 1;
                 }
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index fef95be334bd..fdc8fb4ae10f 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -59,7 +59,6 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
         if (!*ext)
                 return NULL;
 
-        INIT_RCU_HEAD(&(*ext)->rcu);
         (*ext)->offset[id] = off;
         (*ext)->len = len;
 
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 5509dd1f14cf..2ae3169e7633 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -13,6 +13,7 @@
 #include <linux/moduleparam.h>
 #include <linux/netfilter.h>
 #include <linux/ip.h>
+#include <linux/slab.h>
 #include <linux/ipv6.h>
 #include <linux/ctype.h>
 #include <linux/inet.h>
@@ -243,8 +244,8 @@ static int try_epsv_response(const char *data, size_t dlen,
         /* Three delimiters. */
         if (dlen <= 3) return 0;
         delim = data[0];
-        if (isdigit(delim) || delim < 33 || delim > 126
-            || data[1] != delim || data[2] != delim)
+        if (isdigit(delim) || delim < 33 || delim > 126 ||
+            data[1] != delim || data[2] != delim)
                 return 0;
 
         return get_port(data, 3, dlen, delim, &cmd->u.tcp.port);
@@ -323,24 +324,24 @@ static void update_nl_seq(struct nf_conn *ct, u32 nl_seq,
                           struct nf_ct_ftp_master *info, int dir,
                           struct sk_buff *skb)
 {
-        unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
+        unsigned int i, oldest;
 
         /* Look for oldest: if we find exact match, we're done. */
         for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
                 if (info->seq_aft_nl[dir][i] == nl_seq)
                         return;
-
-                if (oldest == info->seq_aft_nl_num[dir] ||
-                    before(info->seq_aft_nl[dir][i],
-                           info->seq_aft_nl[dir][oldest]))
-                        oldest = i;
         }
 
         if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
                 info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
-        } else if (oldest != NUM_SEQ_TO_REMEMBER &&
-                   after(nl_seq, info->seq_aft_nl[dir][oldest])) {
-                info->seq_aft_nl[dir][oldest] = nl_seq;
+        } else {
+                if (before(info->seq_aft_nl[dir][0], info->seq_aft_nl[dir][1]))
+                        oldest = 0;
+                else
+                        oldest = 1;
+
+                if (after(nl_seq, info->seq_aft_nl[dir][oldest]))
+                        info->seq_aft_nl[dir][oldest] = nl_seq;
         }
 }
 
@@ -366,8 +367,8 @@ static int help(struct sk_buff *skb,
         typeof(nf_nat_ftp_hook) nf_nat_ftp;
 
         /* Until there's been traffic both ways, don't look in packets. */
-        if (ctinfo != IP_CT_ESTABLISHED
-            && ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
+        if (ctinfo != IP_CT_ESTABLISHED &&
+            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
                 pr_debug("ftp: Conntrackinfo = %u\n", ctinfo);
                 return NF_ACCEPT;
         }
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 66369490230e..a487c8038044 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -17,6 +17,7 @@
 #include <linux/inet.h>
 #include <linux/in.h>
 #include <linux/ip.h>
+#include <linux/slab.h>
 #include <linux/udp.h>
 #include <linux/tcp.h>
 #include <linux/skbuff.h>
@@ -29,6 +30,7 @@
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <linux/netfilter/nf_conntrack_h323.h>
 
 /* Parameters */
@@ -1216,7 +1218,7 @@ static struct nf_conntrack_expect *find_expect(struct nf_conn *ct,
         tuple.dst.u.tcp.port = port;
         tuple.dst.protonum = IPPROTO_TCP;
 
-        exp = __nf_ct_expect_find(net, &tuple);
+        exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
         if (exp && exp->master == ct)
                 return exp;
         return NULL;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 65c2a7bc3afc..59e1a4cd4e8b 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -15,7 +15,6 @@
 #include <linux/skbuff.h>
 #include <linux/vmalloc.h>
 #include <linux/stddef.h>
-#include <linux/slab.h>
 #include <linux/random.h>
 #include <linux/err.h>
 #include <linux/kernel.h>
@@ -65,7 +64,7 @@ __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
 }
 
 struct nf_conntrack_helper *
-__nf_conntrack_helper_find_byname(const char *name)
+__nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum)
 {
         struct nf_conntrack_helper *h;
         struct hlist_node *n;
@@ -73,13 +72,34 @@ __nf_conntrack_helper_find_byname(const char *name)
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
                 hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) {
-                        if (!strcmp(h->name, name))
+                        if (!strcmp(h->name, name) &&
+                            h->tuple.src.l3num == l3num &&
+                            h->tuple.dst.protonum == protonum)
                                 return h;
                 }
         }
         return NULL;
 }
-EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find_byname);
+EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find);
+
+struct nf_conntrack_helper *
+nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
+{
+        struct nf_conntrack_helper *h;
+
+        h = __nf_conntrack_helper_find(name, l3num, protonum);
+#ifdef CONFIG_MODULES
+        if (h == NULL) {
+                if (request_module("nfct-helper-%s", name) == 0)
+                        h = __nf_conntrack_helper_find(name, l3num, protonum);
+        }
+#endif
+        if (h != NULL && !try_module_get(h->me))
+                h = NULL;
+
+        return h;
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get);
 
 struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp)
 {
@@ -94,13 +114,22 @@ struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp)
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
 
-int __nf_ct_try_assign_helper(struct nf_conn *ct, gfp_t flags)
+int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
+                              gfp_t flags)
 {
+        struct nf_conntrack_helper *helper = NULL;
+        struct nf_conn_help *help;
         int ret = 0;
-        struct nf_conntrack_helper *helper;
-        struct nf_conn_help *help = nfct_help(ct);
 
-        helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        if (tmpl != NULL) {
+                help = nfct_help(tmpl);
+                if (help != NULL)
+                        helper = help->helper;
+        }
+
+        help = nfct_help(ct);
+        if (helper == NULL)
+                helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
         if (helper == NULL) {
                 if (help)
                         rcu_assign_pointer(help->helper, NULL);
@@ -192,7 +221,7 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
         /* Get rid of expecteds, set helpers to NULL. */
         hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
                 unhelp(h, me);
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < net->ct.htable_size; i++) {
                 hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
                         unhelp(h, me);
         }
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 8bd98c84f77e..7673930ca342 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -15,6 +15,7 @@
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_expect.h>
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 59d8064eb522..afc52f2ee4ac 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -27,9 +27,11 @@
 #include <linux/netlink.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 
 #include <linux/netfilter.h>
 #include <net/netlink.h>
+#include <net/sock.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_expect.h>
@@ -38,6 +40,7 @@
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_protocol.h>
@@ -378,6 +381,9 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
                 goto nla_put_failure;
         nla_nest_end(skb, nest_parms);
 
+        if (nf_ct_zone(ct))
+                NLA_PUT_BE16(skb, CTA_ZONE, htons(nf_ct_zone(ct)));
+
         if (ctnetlink_dump_status(skb, ct) < 0 ||
             ctnetlink_dump_timeout(skb, ct) < 0 ||
             ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
@@ -456,6 +462,7 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct)
 static int
 ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
 {
+        struct net *net;
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
         struct nlattr *nest_parms;
@@ -482,7 +489,8 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
         } else
                 return 0;
 
-        if (!item->report && !nfnetlink_has_listeners(group))
+        net = nf_ct_net(ct);
+        if (!item->report && !nfnetlink_has_listeners(net, group))
                 return 0;
 
         skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);
@@ -514,6 +522,9 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
                 goto nla_put_failure;
         nla_nest_end(skb, nest_parms);
 
+        if (nf_ct_zone(ct))
+                NLA_PUT_BE16(skb, CTA_ZONE, htons(nf_ct_zone(ct)));
+
         if (ctnetlink_dump_id(skb, ct) < 0)
                 goto nla_put_failure;
 
@@ -559,7 +570,8 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
         rcu_read_unlock();
 
         nlmsg_end(skb, nlh);
-        err = nfnetlink_send(skb, item->pid, group, item->report, GFP_ATOMIC);
+        err = nfnetlink_send(skb, net, item->pid, group, item->report,
+                             GFP_ATOMIC);
         if (err == -ENOBUFS || err == -EAGAIN)
                 return -ENOBUFS;
 
@@ -571,7 +583,9 @@ nla_put_failure:
 nlmsg_failure:
         kfree_skb(skb);
 errout:
-        nfnetlink_set_err(0, group, -ENOBUFS);
+        if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)
+                return -ENOBUFS;
+
         return 0;
 }
 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
@@ -586,6 +600,7 @@ static int ctnetlink_done(struct netlink_callback *cb)
 static int
 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct net *net = sock_net(skb->sk);
         struct nf_conn *ct, *last;
         struct nf_conntrack_tuple_hash *h;
         struct hlist_nulls_node *n;
@@ -594,9 +609,9 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 
         rcu_read_lock();
         last = (struct nf_conn *)cb->args[1];
-        for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
+        for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
 restart:
-                hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
+                hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[cb->args[0]],
                                          hnnode) {
                         if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
                                 continue;
@@ -703,6 +718,11 @@ ctnetlink_parse_tuple_proto(struct nlattr *attr,
         return ret;
 }
 
+static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
+        [CTA_TUPLE_IP]          = { .type = NLA_NESTED },
+        [CTA_TUPLE_PROTO]       = { .type = NLA_NESTED },
+};
+
 static int
 ctnetlink_parse_tuple(const struct nlattr * const cda[],
                       struct nf_conntrack_tuple *tuple,
@@ -713,7 +733,7 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[],
 
         memset(tuple, 0, sizeof(*tuple));
 
-        nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], NULL);
+        nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);
 
         if (!tb[CTA_TUPLE_IP])
                 return -EINVAL;
@@ -740,12 +760,31 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[],
         return 0;
 }
 
+static int
+ctnetlink_parse_zone(const struct nlattr *attr, u16 *zone)
+{
+        if (attr)
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+                *zone = ntohs(nla_get_be16(attr));
+#else
+                return -EOPNOTSUPP;
+#endif
+        else
+                *zone = 0;
+
+        return 0;
+}
+
+static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = {
+        [CTA_HELP_NAME]         = { .type = NLA_NUL_STRING },
+};
+
 static inline int
 ctnetlink_parse_help(const struct nlattr *attr, char **helper_name)
 {
         struct nlattr *tb[CTA_HELP_MAX+1];
 
-        nla_parse_nested(tb, CTA_HELP_MAX, attr, NULL);
+        nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy);
 
         if (!tb[CTA_HELP_NAME])
                 return -EINVAL;
@@ -756,11 +795,18 @@ ctnetlink_parse_help(const struct nlattr *attr, char **helper_name)
 }
 
 static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
+        [CTA_TUPLE_ORIG]        = { .type = NLA_NESTED },
+        [CTA_TUPLE_REPLY]       = { .type = NLA_NESTED },
         [CTA_STATUS]            = { .type = NLA_U32 },
+        [CTA_PROTOINFO]         = { .type = NLA_NESTED },
+        [CTA_HELP]              = { .type = NLA_NESTED },
+        [CTA_NAT_SRC]           = { .type = NLA_NESTED },
         [CTA_TIMEOUT]           = { .type = NLA_U32 },
         [CTA_MARK]              = { .type = NLA_U32 },
-        [CTA_USE]               = { .type = NLA_U32 },
         [CTA_ID]                = { .type = NLA_U32 },
+        [CTA_NAT_DST]           = { .type = NLA_NESTED },
+        [CTA_TUPLE_MASTER]      = { .type = NLA_NESTED },
+        [CTA_ZONE]              = { .type = NLA_U16 },
 };
 
 static int
@@ -768,12 +814,18 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         const struct nlmsghdr *nlh,
                         const struct nlattr * const cda[])
 {
+        struct net *net = sock_net(ctnl);
         struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_tuple tuple;
         struct nf_conn *ct;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u_int8_t u3 = nfmsg->nfgen_family;
-        int err = 0;
+        u16 zone;
+        int err;
+
+        err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
+        if (err < 0)
+                return err;
 
         if (cda[CTA_TUPLE_ORIG])
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
@@ -781,7 +833,7 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
         else {
                 /* Flush the whole table */
-                nf_conntrack_flush_report(&init_net,
+                nf_conntrack_flush_report(net,
                                          NETLINK_CB(skb).pid,
                                          nlmsg_report(nlh));
                 return 0;
@@ -790,7 +842,7 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        h = nf_conntrack_find_get(&init_net, &tuple);
+        h = nf_conntrack_find_get(net, zone, &tuple);
         if (!h)
                 return -ENOENT;
 
@@ -828,18 +880,24 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         const struct nlmsghdr *nlh,
                         const struct nlattr * const cda[])
 {
+        struct net *net = sock_net(ctnl);
         struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_tuple tuple;
         struct nf_conn *ct;
         struct sk_buff *skb2 = NULL;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u_int8_t u3 = nfmsg->nfgen_family;
-        int err = 0;
+        u16 zone;
+        int err;
 
         if (nlh->nlmsg_flags & NLM_F_DUMP)
                 return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
                                           ctnetlink_done);
 
+        err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
+        if (err < 0)
+                return err;
+
         if (cda[CTA_TUPLE_ORIG])
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
         else if (cda[CTA_TUPLE_REPLY])
@@ -850,7 +908,7 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        h = nf_conntrack_find_get(&init_net, &tuple);
+        h = nf_conntrack_find_get(net, zone, &tuple);
         if (!h)
                 return -ENOENT;
 
@@ -994,7 +1052,8 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
                 return 0;
         }
 
-        helper = __nf_conntrack_helper_find_byname(helpname);
+        helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
+                                            nf_ct_protonum(ct));
         if (helper == NULL) {
 #ifdef CONFIG_MODULES
                 spin_unlock_bh(&nf_conntrack_lock);
@@ -1005,7 +1064,8 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
                 }
 
                 spin_lock_bh(&nf_conntrack_lock);
-                helper = __nf_conntrack_helper_find_byname(helpname);
+                helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
+                                                    nf_ct_protonum(ct));
                 if (helper)
                         return -EAGAIN;
 #endif
@@ -1020,9 +1080,8 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
                 /* need to zero data of old helper */
                 memset(&help->help, 0, sizeof(help->help));
         } else {
-                help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
-                if (help == NULL)
-                        return -ENOMEM;
+                /* we cannot set a helper for an existing conntrack */
+                return -EOPNOTSUPP;
         }
 
         rcu_assign_pointer(help->helper, helper);
@@ -1044,6 +1103,12 @@ ctnetlink_change_timeout(struct nf_conn *ct, const struct nlattr * const cda[])
         return 0;
 }
 
+static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = {
+        [CTA_PROTOINFO_TCP]     = { .type = NLA_NESTED },
+        [CTA_PROTOINFO_DCCP]    = { .type = NLA_NESTED },
+        [CTA_PROTOINFO_SCTP]    = { .type = NLA_NESTED },
+};
+
 static inline int
 ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[])
 {
@@ -1052,7 +1117,7 @@ ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[]
         struct nf_conntrack_l4proto *l4proto;
         int err = 0;
 
-        nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, NULL);
+        nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy);
 
         rcu_read_lock();
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
@@ -1064,12 +1129,18 @@ ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[]
 }
 
 #ifdef CONFIG_NF_NAT_NEEDED
+static const struct nla_policy nat_seq_policy[CTA_NAT_SEQ_MAX+1] = {
+        [CTA_NAT_SEQ_CORRECTION_POS]    = { .type = NLA_U32 },
+        [CTA_NAT_SEQ_OFFSET_BEFORE]     = { .type = NLA_U32 },
+        [CTA_NAT_SEQ_OFFSET_AFTER]      = { .type = NLA_U32 },
+};
+
 static inline int
 change_nat_seq_adj(struct nf_nat_seq *natseq, const struct nlattr * const attr)
 {
         struct nlattr *cda[CTA_NAT_SEQ_MAX+1];
 
-        nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, NULL);
+        nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, nat_seq_policy);
 
         if (!cda[CTA_NAT_SEQ_CORRECTION_POS])
                 return -EINVAL;
@@ -1175,7 +1246,8 @@ ctnetlink_change_conntrack(struct nf_conn *ct,
 }
 
 static struct nf_conn *
-ctnetlink_create_conntrack(const struct nlattr * const cda[],
+ctnetlink_create_conntrack(struct net *net, u16 zone,
+                           const struct nlattr * const cda[],
                            struct nf_conntrack_tuple *otuple,
                            struct nf_conntrack_tuple *rtuple,
                            u8 u3)
@@ -1184,7 +1256,7 @@ ctnetlink_create_conntrack(const struct nlattr * const cda[],
         int err = -EINVAL;
         struct nf_conntrack_helper *helper;
 
-        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
+        ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
         if (IS_ERR(ct))
                 return ERR_PTR(-ENOMEM);
 
@@ -1193,7 +1265,6 @@ ctnetlink_create_conntrack(const struct nlattr * const cda[],
         ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
 
         ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
-        ct->status |= IPS_CONFIRMED;
 
         rcu_read_lock();
         if (cda[CTA_HELP]) {
@@ -1203,7 +1274,8 @@ ctnetlink_create_conntrack(const struct nlattr * const cda[],
                 if (err < 0)
                         goto err2;
 
-                helper = __nf_conntrack_helper_find_byname(helpname);
+                helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
+                                                    nf_ct_protonum(ct));
                 if (helper == NULL) {
                         rcu_read_unlock();
 #ifdef CONFIG_MODULES
@@ -1213,7 +1285,9 @@ ctnetlink_create_conntrack(const struct nlattr * const cda[],
                         }
 
                         rcu_read_lock();
-                        helper = __nf_conntrack_helper_find_byname(helpname);
+                        helper = __nf_conntrack_helper_find(helpname,
+                                                            nf_ct_l3num(ct),
+                                                            nf_ct_protonum(ct));
                         if (helper) {
                                 err = -EAGAIN;
                                 goto err2;
@@ -1236,19 +1310,24 @@ ctnetlink_create_conntrack(const struct nlattr * const cda[],
                 }
         } else {
                 /* try an implicit helper assignation */
-                err = __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
+                err = __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);
                 if (err < 0)
                         goto err2;
         }
 
-        if (cda[CTA_STATUS]) {
-                err = ctnetlink_change_status(ct, cda);
+        if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
+                err = ctnetlink_change_nat(ct, cda);
                 if (err < 0)
                         goto err2;
         }
 
-        if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
-                err = ctnetlink_change_nat(ct, cda);
+        nf_ct_acct_ext_add(ct, GFP_ATOMIC);
+        nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
+        /* we must add conntrack extensions before confirmation. */
+        ct->status |= IPS_CONFIRMED;
+
+        if (cda[CTA_STATUS]) {
+                err = ctnetlink_change_status(ct, cda);
                 if (err < 0)
                         goto err2;
         }
@@ -1267,9 +1346,6 @@ ctnetlink_create_conntrack(const struct nlattr * const cda[],
                         goto err2;
         }
 
-        nf_ct_acct_ext_add(ct, GFP_ATOMIC);
-        nf_ct_ecache_ext_add(ct, GFP_ATOMIC);
-
 #if defined(CONFIG_NF_CONNTRACK_MARK)
         if (cda[CTA_MARK])
                 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
@@ -1285,7 +1361,7 @@ ctnetlink_create_conntrack(const struct nlattr * const cda[],
                 if (err < 0)
                         goto err2;
 
-                master_h = nf_conntrack_find_get(&init_net, &master);
+                master_h = nf_conntrack_find_get(net, zone, &master);
                 if (master_h == NULL) {
                         err = -ENOENT;
                         goto err2;
@@ -1313,11 +1389,17 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         const struct nlmsghdr *nlh,
                         const struct nlattr * const cda[])
 {
+        struct net *net = sock_net(ctnl);
         struct nf_conntrack_tuple otuple, rtuple;
         struct nf_conntrack_tuple_hash *h = NULL;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u_int8_t u3 = nfmsg->nfgen_family;
-        int err = 0;
+        u16 zone;
+        int err;
+
+        err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
+        if (err < 0)
+                return err;
 
         if (cda[CTA_TUPLE_ORIG]) {
                 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
@@ -1333,9 +1415,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         spin_lock_bh(&nf_conntrack_lock);
         if (cda[CTA_TUPLE_ORIG])
-                h = __nf_conntrack_find(&init_net, &otuple);
+                h = __nf_conntrack_find(net, zone, &otuple);
         else if (cda[CTA_TUPLE_REPLY])
-                h = __nf_conntrack_find(&init_net, &rtuple);
+                h = __nf_conntrack_find(net, zone, &rtuple);
 
         if (h == NULL) {
                 err = -ENOENT;
@@ -1343,7 +1425,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         struct nf_conn *ct;
                         enum ip_conntrack_events events;
 
-                        ct = ctnetlink_create_conntrack(cda, &otuple,
+                        ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
                                                         &rtuple, u3);
                         if (IS_ERR(ct)) {
                                 err = PTR_ERR(ct);
@@ -1357,7 +1439,8 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         else
                                 events = IPCT_NEW;
 
-                        nf_conntrack_eventmask_report((1 << IPCT_STATUS) |
+                        nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
+                                                      (1 << IPCT_ASSURED) |
                                                       (1 << IPCT_HELPER) |
                                                       (1 << IPCT_PROTOINFO) |
                                                       (1 << IPCT_NATSEQADJ) |
@@ -1382,7 +1465,8 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 if (err == 0) {
                         nf_conntrack_get(&ct->ct_general);
                         spin_unlock_bh(&nf_conntrack_lock);
-                        nf_conntrack_eventmask_report((1 << IPCT_STATUS) |
+                        nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
+                                                      (1 << IPCT_ASSURED) |
                                                       (1 << IPCT_HELPER) |
                                                       (1 << IPCT_PROTOINFO) |
                                                       (1 << IPCT_NATSEQADJ) |
@@ -1437,8 +1521,9 @@ ctnetlink_exp_dump_mask(struct sk_buff *skb,
         struct nlattr *nest_parms;
 
         memset(&m, 0xFF, sizeof(m));
-        m.src.u.all = mask->src.u.all;
         memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+        m.src.u.all = mask->src.u.all;
+        m.dst.protonum = tuple->dst.protonum;
 
         nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
         if (!nest_parms)
@@ -1468,6 +1553,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
                           const struct nf_conntrack_expect *exp)
 {
         struct nf_conn *master = exp->master;
+        struct nf_conntrack_helper *helper;
         long timeout = (exp->timeout.expires - jiffies) / HZ;
 
         if (timeout < 0)
@@ -1484,6 +1570,9 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
 
         NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
         NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
+        helper = rcu_dereference(nfct_help(master)->helper);
+        if (helper)
+                NLA_PUT_STRING(skb, CTA_EXPECT_HELP_NAME, helper->name);
 
         return 0;
 
@@ -1525,9 +1614,10 @@ nla_put_failure:
 static int
 ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
 {
+        struct nf_conntrack_expect *exp = item->exp;
+        struct net *net = nf_ct_exp_net(exp);
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
-        struct nf_conntrack_expect *exp = item->exp;
         struct sk_buff *skb;
         unsigned int type;
         int flags = 0;
@@ -1539,7 +1629,7 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
                 return 0;
 
         if (!item->report &&
-            !nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
+            !nfnetlink_has_listeners(net, NFNLGRP_CONNTRACK_EXP_NEW))
                 return 0;
 
         skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
@@ -1562,7 +1652,7 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
         rcu_read_unlock();
 
         nlmsg_end(skb, nlh);
-        nfnetlink_send(skb, item->pid, NFNLGRP_CONNTRACK_EXP_NEW,
+        nfnetlink_send(skb, net, item->pid, NFNLGRP_CONNTRACK_EXP_NEW,
                        item->report, GFP_ATOMIC);
         return 0;
 
@@ -1572,7 +1662,7 @@ nla_put_failure:
 nlmsg_failure:
         kfree_skb(skb);
 errout:
-        nfnetlink_set_err(0, 0, -ENOBUFS);
+        nfnetlink_set_err(net, 0, 0, -ENOBUFS);
         return 0;
 }
 #endif
@@ -1586,7 +1676,7 @@ static int ctnetlink_exp_done(struct netlink_callback *cb)
 static int
 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net *net = &init_net;
+        struct net *net = sock_net(skb->sk);
         struct nf_conntrack_expect *exp, *last;
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
         struct hlist_node *n;
@@ -1630,8 +1720,12 @@ out:
 }
 
 static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
+        [CTA_EXPECT_MASTER]     = { .type = NLA_NESTED },
+        [CTA_EXPECT_TUPLE]      = { .type = NLA_NESTED },
+        [CTA_EXPECT_MASK]       = { .type = NLA_NESTED },
         [CTA_EXPECT_TIMEOUT]    = { .type = NLA_U32 },
         [CTA_EXPECT_ID]         = { .type = NLA_U32 },
+        [CTA_EXPECT_HELP_NAME]  = { .type = NLA_NUL_STRING },
 };
 
 static int
@@ -1639,12 +1733,14 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
                      const struct nlmsghdr *nlh,
                      const struct nlattr * const cda[])
 {
+        struct net *net = sock_net(ctnl);
         struct nf_conntrack_tuple tuple;
         struct nf_conntrack_expect *exp;
         struct sk_buff *skb2;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u_int8_t u3 = nfmsg->nfgen_family;
-        int err = 0;
+        u16 zone;
+        int err;
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 return netlink_dump_start(ctnl, skb, nlh,
@@ -1652,6 +1748,10 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
                                           ctnetlink_exp_done);
         }
 
+        err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
+        if (err < 0)
+                return err;
+
         if (cda[CTA_EXPECT_MASTER])
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
         else
@@ -1660,7 +1760,7 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        exp = nf_ct_expect_find_get(&init_net, &tuple);
+        exp = nf_ct_expect_find_get(net, zone, &tuple);
         if (!exp)
                 return -ENOENT;
 
@@ -1700,23 +1800,28 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                      const struct nlmsghdr *nlh,
                      const struct nlattr * const cda[])
 {
+        struct net *net = sock_net(ctnl);
         struct nf_conntrack_expect *exp;
         struct nf_conntrack_tuple tuple;
-        struct nf_conntrack_helper *h;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         struct hlist_node *n, *next;
         u_int8_t u3 = nfmsg->nfgen_family;
         unsigned int i;
+        u16 zone;
         int err;
 
         if (cda[CTA_EXPECT_TUPLE]) {
                 /* delete a single expect by tuple */
+                err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
+                if (err < 0)
+                        return err;
+
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
                 if (err < 0)
                         return err;
 
                 /* bump usage count to 2 */
-                exp = nf_ct_expect_find_get(&init_net, &tuple);
+                exp = nf_ct_expect_find_get(net, zone, &tuple);
                 if (!exp)
                         return -ENOENT;
 
@@ -1739,18 +1844,13 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
 
                 /* delete all expectations for this helper */
                 spin_lock_bh(&nf_conntrack_lock);
-                h = __nf_conntrack_helper_find_byname(name);
-                if (!h) {
-                        spin_unlock_bh(&nf_conntrack_lock);
-                        return -EOPNOTSUPP;
-                }
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
                         hlist_for_each_entry_safe(exp, n, next,
-                                                  &init_net.ct.expect_hash[i],
+                                                  &net->ct.expect_hash[i],
                                                   hnode) {
                                 m_help = nfct_help(exp->master);
-                                if (m_help->helper == h
-                                    && del_timer(&exp->timeout)) {
+                                if (!strcmp(m_help->helper->name, name) &&
+                                    del_timer(&exp->timeout)) {
                                         nf_ct_unlink_expect(exp);
                                         nf_ct_expect_put(exp);
                                 }
@@ -1762,7 +1862,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 spin_lock_bh(&nf_conntrack_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
                         hlist_for_each_entry_safe(exp, n, next,
-                                                  &init_net.ct.expect_hash[i],
+                                                  &net->ct.expect_hash[i],
                                                   hnode) {
                                 if (del_timer(&exp->timeout)) {
                                         nf_ct_unlink_expect(exp);
@@ -1783,7 +1883,9 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x,
 }
 
 static int
-ctnetlink_create_expect(const struct nlattr * const cda[], u_int8_t u3,
+ctnetlink_create_expect(struct net *net, u16 zone,
+                        const struct nlattr * const cda[],
+                        u_int8_t u3,
                         u32 pid, int report)
 {
         struct nf_conntrack_tuple tuple, mask, master_tuple;
@@ -1805,7 +1907,7 @@ ctnetlink_create_expect(const struct nlattr * const cda[], u_int8_t u3,
                 return err;
 
         /* Look for master conntrack of this expectation */
-        h = nf_conntrack_find_get(&init_net, &master_tuple);
+        h = nf_conntrack_find_get(net, zone, &master_tuple);
         if (!h)
                 return -ENOENT;
         ct = nf_ct_tuplehash_to_ctrack(h);
@@ -1845,29 +1947,35 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                      const struct nlmsghdr *nlh,
                      const struct nlattr * const cda[])
 {
+        struct net *net = sock_net(ctnl);
         struct nf_conntrack_tuple tuple;
         struct nf_conntrack_expect *exp;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u_int8_t u3 = nfmsg->nfgen_family;
-        int err = 0;
+        u16 zone;
+        int err;
 
         if (!cda[CTA_EXPECT_TUPLE]
             || !cda[CTA_EXPECT_MASK]
             || !cda[CTA_EXPECT_MASTER])
                 return -EINVAL;
 
+        err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
+        if (err < 0)
+                return err;
+
         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
         if (err < 0)
                 return err;
 
         spin_lock_bh(&nf_conntrack_lock);
-        exp = __nf_ct_expect_find(&init_net, &tuple);
+        exp = __nf_ct_expect_find(net, zone, &tuple);
 
         if (!exp) {
                 spin_unlock_bh(&nf_conntrack_lock);
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
-                        err = ctnetlink_create_expect(cda,
+                        err = ctnetlink_create_expect(net, zone, cda,
                                                       u3,
                                                       NETLINK_CB(skb).pid,
                                                       nlmsg_report(nlh));
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 3807ac7faf4c..088944824e13 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -28,6 +28,7 @@
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 
@@ -123,7 +124,7 @@ static void pptp_expectfn(struct nf_conn *ct,
                 pr_debug("trying to unexpect other dir: ");
                 nf_ct_dump_tuple(&inv_t);
 
-                exp_other = nf_ct_expect_find_get(net, &inv_t);
+                exp_other = nf_ct_expect_find_get(net, nf_ct_zone(ct), &inv_t);
                 if (exp_other) {
                         /* delete other expectation.  */
                         pr_debug("found\n");
@@ -136,17 +137,18 @@ static void pptp_expectfn(struct nf_conn *ct,
         rcu_read_unlock();
 }
 
-static int destroy_sibling_or_exp(struct net *net,
+static int destroy_sibling_or_exp(struct net *net, struct nf_conn *ct,
                                   const struct nf_conntrack_tuple *t)
 {
         const struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_expect *exp;
         struct nf_conn *sibling;
+        u16 zone = nf_ct_zone(ct);
 
         pr_debug("trying to timeout ct or exp for tuple ");
         nf_ct_dump_tuple(t);
 
-        h = nf_conntrack_find_get(net, t);
+        h = nf_conntrack_find_get(net, zone, t);
         if (h)  {
                 sibling = nf_ct_tuplehash_to_ctrack(h);
                 pr_debug("setting timeout of conntrack %p to 0\n", sibling);
@@ -157,7 +159,7 @@ static int destroy_sibling_or_exp(struct net *net,
                 nf_ct_put(sibling);
                 return 1;
         } else {
-                exp = nf_ct_expect_find_get(net, t);
+                exp = nf_ct_expect_find_get(net, zone, t);
                 if (exp) {
                         pr_debug("unexpect_related of expect %p\n", exp);
                         nf_ct_unexpect_related(exp);
@@ -182,7 +184,7 @@ static void pptp_destroy_siblings(struct nf_conn *ct)
         t.dst.protonum = IPPROTO_GRE;
         t.src.u.gre.key = help->help.ct_pptp_info.pns_call_id;
         t.dst.u.gre.key = help->help.ct_pptp_info.pac_call_id;
-        if (!destroy_sibling_or_exp(net, &t))
+        if (!destroy_sibling_or_exp(net, ct, &t))
                 pr_debug("failed to timeout original pns->pac ct/exp\n");
 
         /* try reply (pac->pns) tuple */
@@ -190,7 +192,7 @@ static void pptp_destroy_siblings(struct nf_conn *ct)
         t.dst.protonum = IPPROTO_GRE;
         t.src.u.gre.key = help->help.ct_pptp_info.pac_call_id;
         t.dst.u.gre.key = help->help.ct_pptp_info.pns_call_id;
-        if (!destroy_sibling_or_exp(net, &t))
+        if (!destroy_sibling_or_exp(net, ct, &t))
                 pr_debug("failed to timeout reply pac->pns ct/exp\n");
 }
 
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 1a4568bf7ea5..a44fa75b5178 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <linux/netfilter.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/skbuff.h>
 #include <linux/vmalloc.h>
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 1b816a2ea813..5292560d6d4a 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -15,6 +15,7 @@
 #include <linux/spinlock.h>
 #include <linux/skbuff.h>
 #include <linux/dccp.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -384,7 +385,7 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
 };
 
 /* this module per-net specifics */
-static int dccp_net_id;
+static int dccp_net_id __read_mostly;
 struct dccp_net {
         int dccp_loose;
         unsigned int dccp_timeout[CT_DCCP_MAX + 1];
@@ -561,8 +562,9 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
         return NF_ACCEPT;
 }
 
-static int dccp_error(struct net *net, struct sk_buff *skb,
-                      unsigned int dataoff, enum ip_conntrack_info *ctinfo,
+static int dccp_error(struct net *net, struct nf_conn *tmpl,
+                      struct sk_buff *skb, unsigned int dataoff,
+                      enum ip_conntrack_info *ctinfo,
                       u_int8_t pf, unsigned int hooknum)
 {
         struct dccp_hdr _dh, *dh;
@@ -703,64 +705,54 @@ static int dccp_nlattr_size(void)
 /* template, data assigned later */
 static struct ctl_table dccp_sysctl_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_timeout_request",
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_timeout_respond",
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_timeout_partopen",
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_timeout_open",
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_timeout_closereq",
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_timeout_closing",
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_timeout_timewait",
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_dccp_loose",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        {
-                .ctl_name       = 0,
-        }
+        { }
 };
 #endif /* CONFIG_SYSCTL */
 
@@ -810,12 +802,7 @@ static struct nf_conntrack_l4proto dccp_proto6 __read_mostly = {
 
 static __net_init int dccp_net_init(struct net *net)
 {
-        struct dccp_net *dn;
-        int err;
-
-        dn = kmalloc(sizeof(*dn), GFP_KERNEL);
-        if (!dn)
-                return -ENOMEM;
+        struct dccp_net *dn = dccp_pernet(net);
 
         /* default values */
         dn->dccp_loose = 1;
@@ -827,16 +814,11 @@ static __net_init int dccp_net_init(struct net *net)
         dn->dccp_timeout[CT_DCCP_CLOSING]       = 64 * HZ;
         dn->dccp_timeout[CT_DCCP_TIMEWAIT]      = 2 * DCCP_MSL;
 
-        err = net_assign_generic(net, dccp_net_id, dn);
-        if (err)
-                goto out;
-
 #ifdef CONFIG_SYSCTL
-        err = -ENOMEM;
         dn->sysctl_table = kmemdup(dccp_sysctl_table,
                         sizeof(dccp_sysctl_table), GFP_KERNEL);
         if (!dn->sysctl_table)
-                goto out;
+                return -ENOMEM;
 
         dn->sysctl_table[0].data = &dn->dccp_timeout[CT_DCCP_REQUEST];
         dn->sysctl_table[1].data = &dn->dccp_timeout[CT_DCCP_RESPOND];
@@ -851,15 +833,11 @@ static __net_init int dccp_net_init(struct net *net)
                         nf_net_netfilter_sysctl_path, dn->sysctl_table);
         if (!dn->sysctl_header) {
                 kfree(dn->sysctl_table);
-                goto out;
+                return -ENOMEM;
         }
 #endif
 
         return 0;
-
-out:
-        kfree(dn);
-        return err;
 }
 
 static __net_exit void dccp_net_exit(struct net *net)
@@ -869,21 +847,20 @@ static __net_exit void dccp_net_exit(struct net *net)
         unregister_net_sysctl_table(dn->sysctl_header);
         kfree(dn->sysctl_table);
 #endif
-        kfree(dn);
-
-        net_assign_generic(net, dccp_net_id, NULL);
 }
 
 static struct pernet_operations dccp_net_ops = {
         .init = dccp_net_init,
         .exit = dccp_net_exit,
+        .id   = &dccp_net_id,
+        .size = sizeof(struct dccp_net),
 };
 
 static int __init nf_conntrack_proto_dccp_init(void)
 {
         int err;
 
-        err = register_pernet_gen_subsys(&dccp_net_id, &dccp_net_ops);
+        err = register_pernet_subsys(&dccp_net_ops);
         if (err < 0)
                 goto err1;
 
@@ -899,14 +876,14 @@ static int __init nf_conntrack_proto_dccp_init(void)
 err3:
         nf_conntrack_l4proto_unregister(&dccp_proto4);
 err2:
-        unregister_pernet_gen_subsys(dccp_net_id, &dccp_net_ops);
+        unregister_pernet_subsys(&dccp_net_ops);
 err1:
         return err;
 }
 
 static void __exit nf_conntrack_proto_dccp_fini(void)
 {
-        unregister_pernet_gen_subsys(dccp_net_id, &dccp_net_ops);
+        unregister_pernet_subsys(&dccp_net_ops);
         nf_conntrack_l4proto_unregister(&dccp_proto6);
         nf_conntrack_l4proto_unregister(&dccp_proto4);
 }
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index 829374f426c4..e2091d0c7a2f 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -69,9 +69,7 @@ static struct ctl_table generic_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 static struct ctl_table generic_compat_sysctl_table[] = {
@@ -82,9 +80,7 @@ static struct ctl_table generic_compat_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif /* CONFIG_SYSCTL */
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index a54a0af0edba..cf616e55ca41 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -31,6 +31,7 @@
 #include <linux/in.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -43,7 +44,7 @@
 #define GRE_TIMEOUT             (30 * HZ)
 #define GRE_STREAM_TIMEOUT      (180 * HZ)
 
-static int proto_gre_net_id;
+static int proto_gre_net_id __read_mostly;
 struct netns_proto_gre {
         rwlock_t                keymap_lock;
         struct list_head        keymap_list;
@@ -241,7 +242,7 @@ static int gre_packet(struct nf_conn *ct,
                                    ct->proto.gre.stream_timeout);
                 /* Also, more likely to be important, and not a probe. */
                 set_bit(IPS_ASSURED_BIT, &ct->status);
-                nf_conntrack_event_cache(IPCT_STATUS, ct);
+                nf_conntrack_event_cache(IPCT_ASSURED, ct);
         } else
                 nf_ct_refresh_acct(ct, ctinfo, skb,
                                    ct->proto.gre.timeout);
@@ -300,32 +301,24 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 __read_mostly = {
 
 static int proto_gre_net_init(struct net *net)
 {
-        struct netns_proto_gre *net_gre;
-        int rv;
+        struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
 
-        net_gre = kmalloc(sizeof(struct netns_proto_gre), GFP_KERNEL);
-        if (!net_gre)
-                return -ENOMEM;
         rwlock_init(&net_gre->keymap_lock);
         INIT_LIST_HEAD(&net_gre->keymap_list);
 
-        rv = net_assign_generic(net, proto_gre_net_id, net_gre);
-        if (rv < 0)
-                kfree(net_gre);
-        return rv;
+        return 0;
 }
 
 static void proto_gre_net_exit(struct net *net)
 {
-        struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
-
         nf_ct_gre_keymap_flush(net);
-        kfree(net_gre);
 }
 
 static struct pernet_operations proto_gre_net_ops = {
         .init = proto_gre_net_init,
         .exit = proto_gre_net_exit,
+        .id   = &proto_gre_net_id,
+        .size = sizeof(struct netns_proto_gre),
 };
 
 static int __init nf_ct_proto_gre_init(void)
@@ -335,7 +328,7 @@ static int __init nf_ct_proto_gre_init(void)
         rv = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_gre4);
         if (rv < 0)
                 return rv;
-        rv = register_pernet_gen_subsys(&proto_gre_net_id, &proto_gre_net_ops);
+        rv = register_pernet_subsys(&proto_gre_net_ops);
         if (rv < 0)
                 nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_gre4);
         return rv;
@@ -344,7 +337,7 @@ static int __init nf_ct_proto_gre_init(void)
 static void __exit nf_ct_proto_gre_fini(void)
 {
         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_gre4);
-        unregister_pernet_gen_subsys(proto_gre_net_id, &proto_gre_net_ops);
+        unregister_pernet_subsys(&proto_gre_net_ops);
 }
 
 module_init(nf_ct_proto_gre_init);
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index c10e6f36e31e..b68ff15ed979 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -377,7 +377,7 @@ static int sctp_packet(struct nf_conn *ct,
             new_state == SCTP_CONNTRACK_ESTABLISHED) {
                 pr_debug("Setting assured bit\n");
                 set_bit(IPS_ASSURED_BIT, &ct->status);
-                nf_conntrack_event_cache(IPCT_STATUS, ct);
+                nf_conntrack_event_cache(IPCT_ASSURED, ct);
         }
 
         return NF_ACCEPT;
@@ -595,9 +595,7 @@ static struct ctl_table sctp_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name = 0
-        }
+        { }
 };
 
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
@@ -651,9 +649,7 @@ static struct ctl_table sctp_compat_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name = 0
-        }
+        { }
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index ba2b76937283..9dd8cd4fb6e6 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -760,7 +760,7 @@ static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
 };
 
 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
-static int tcp_error(struct net *net,
+static int tcp_error(struct net *net, struct nf_conn *tmpl,
                      struct sk_buff *skb,
                      unsigned int dataoff,
                      enum ip_conntrack_info *ctinfo,
@@ -896,23 +896,54 @@ static int tcp_packet(struct nf_conn *ct,
                         /* b) This SYN/ACK acknowledges a SYN that we earlier
                          * ignored as invalid. This means that the client and
                          * the server are both in sync, while the firewall is
-                         * not. We kill this session and block the SYN/ACK so
-                         * that the client cannot but retransmit its SYN and
-                         * thus initiate a clean new session.
+                         * not. We get in sync from the previously annotated
+                         * values.
                          */
-                        spin_unlock_bh(&ct->lock);
-                        if (LOG_INVALID(net, IPPROTO_TCP))
-                                nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
-                                          "nf_ct_tcp: killing out of sync session ");
-                        nf_ct_kill(ct);
-                        return NF_DROP;
+                        old_state = TCP_CONNTRACK_SYN_SENT;
+                        new_state = TCP_CONNTRACK_SYN_RECV;
+                        ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_end =
+                                ct->proto.tcp.last_end;
+                        ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxend =
+                                ct->proto.tcp.last_end;
+                        ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxwin =
+                                ct->proto.tcp.last_win == 0 ?
+                                        1 : ct->proto.tcp.last_win;
+                        ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
+                                ct->proto.tcp.last_wscale;
+                        ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
+                                ct->proto.tcp.last_flags;
+                        memset(&ct->proto.tcp.seen[dir], 0,
+                               sizeof(struct ip_ct_tcp_state));
+                        break;
                 }
                 ct->proto.tcp.last_index = index;
                 ct->proto.tcp.last_dir = dir;
                 ct->proto.tcp.last_seq = ntohl(th->seq);
                 ct->proto.tcp.last_end =
                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
-
+                ct->proto.tcp.last_win = ntohs(th->window);
+
+                /* a) This is a SYN in ORIGINAL. The client and the server
+                 * may be in sync but we are not. In that case, we annotate
+                 * the TCP options and let the packet go through. If it is a
+                 * valid SYN packet, the server will reply with a SYN/ACK, and
+                 * then we'll get in sync. Otherwise, the server ignores it. */
+                if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
+                        struct ip_ct_tcp_state seen = {};
+
+                        ct->proto.tcp.last_flags =
+                        ct->proto.tcp.last_wscale = 0;
+                        tcp_options(skb, dataoff, th, &seen);
+                        if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
+                                ct->proto.tcp.last_flags |=
+                                        IP_CT_TCP_FLAG_WINDOW_SCALE;
+                                ct->proto.tcp.last_wscale = seen.td_scale;
+                        }
+                        if (seen.flags & IP_CT_TCP_FLAG_SACK_PERM) {
+                                ct->proto.tcp.last_flags |=
+                                        IP_CT_TCP_FLAG_SACK_PERM;
+                        }
+                }
                 spin_unlock_bh(&ct->lock);
                 if (LOG_INVALID(net, IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
@@ -1014,7 +1045,7 @@ static int tcp_packet(struct nf_conn *ct,
                    after SYN_RECV or a valid answer for a picked up
                    connection. */
                 set_bit(IPS_ASSURED_BIT, &ct->status);
-                nf_conntrack_event_cache(IPCT_STATUS, ct);
+                nf_conntrack_event_cache(IPCT_ASSURED, ct);
         }
         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
 
@@ -1291,7 +1322,6 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
                 .procname       = "nf_conntrack_tcp_loose",
                 .data           = &nf_ct_tcp_loose,
                 .maxlen         = sizeof(unsigned int),
@@ -1299,7 +1329,6 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
                 .procname       = "nf_conntrack_tcp_be_liberal",
                 .data           = &nf_ct_tcp_be_liberal,
                 .maxlen         = sizeof(unsigned int),
@@ -1307,16 +1336,13 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
                 .procname       = "nf_conntrack_tcp_max_retrans",
                 .data           = &nf_ct_tcp_max_retrans,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
@@ -1392,7 +1418,6 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
                 .procname       = "ip_conntrack_tcp_loose",
                 .data           = &nf_ct_tcp_loose,
                 .maxlen         = sizeof(unsigned int),
@@ -1400,7 +1425,6 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
                 .procname       = "ip_conntrack_tcp_be_liberal",
                 .data           = &nf_ct_tcp_be_liberal,
                 .maxlen         = sizeof(unsigned int),
@@ -1408,16 +1432,13 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
                 .procname       = "ip_conntrack_tcp_max_retrans",
                 .data           = &nf_ct_tcp_max_retrans,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif /* CONFIG_SYSCTL */
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 70809d117b91..8289088b8218 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -77,7 +77,7 @@ static int udp_packet(struct nf_conn *ct,
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream);
                 /* Also, more likely to be important, and not a probe */
                 if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
-                        nf_conntrack_event_cache(IPCT_STATUS, ct);
+                        nf_conntrack_event_cache(IPCT_ASSURED, ct);
         } else
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout);
 
@@ -91,8 +91,8 @@ static bool udp_new(struct nf_conn *ct, const struct sk_buff *skb,
         return true;
 }
 
-static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
-                     enum ip_conntrack_info *ctinfo,
+static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
+                     unsigned int dataoff, enum ip_conntrack_info *ctinfo,
                      u_int8_t pf,
                      unsigned int hooknum)
 {
@@ -154,9 +154,7 @@ static struct ctl_table udp_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 static struct ctl_table udp_compat_sysctl_table[] = {
@@ -174,9 +172,7 @@ static struct ctl_table udp_compat_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif /* CONFIG_SYSCTL */
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index 0badedc542d3..263b5a72588d 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -75,7 +75,7 @@ static int udplite_packet(struct nf_conn *ct,
                                    nf_ct_udplite_timeout_stream);
                 /* Also, more likely to be important, and not a probe */
                 if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
-                        nf_conntrack_event_cache(IPCT_STATUS, ct);
+                        nf_conntrack_event_cache(IPCT_ASSURED, ct);
         } else
                 nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);
 
@@ -89,7 +89,7 @@ static bool udplite_new(struct nf_conn *ct, const struct sk_buff *skb,
         return true;
 }
 
-static int udplite_error(struct net *net,
+static int udplite_error(struct net *net, struct nf_conn *tmpl,
                          struct sk_buff *skb,
                          unsigned int dataoff,
                          enum ip_conntrack_info *ctinfo,
@@ -146,7 +146,6 @@ static unsigned int udplite_sysctl_table_users;
 static struct ctl_table_header *udplite_sysctl_header;
 static struct ctl_table udplite_sysctl_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_udplite_timeout",
                 .data           = &nf_ct_udplite_timeout,
                 .maxlen         = sizeof(unsigned int),
@@ -154,16 +153,13 @@ static struct ctl_table udplite_sysctl_table[] = {
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_udplite_timeout_stream",
                 .data           = &nf_ct_udplite_timeout_stream,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #endif /* CONFIG_SYSCTL */
 
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index dcfecbb81c46..d9e27734b2a2 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <linux/tcp.h>
 #include <net/netfilter/nf_conntrack.h>
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 4b572163784b..c6cd1b84eddd 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -16,12 +16,14 @@
 #include <linux/inet.h>
 #include <linux/in.h>
 #include <linux/udp.h>
+#include <linux/tcp.h>
 #include <linux/netfilter.h>
 
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <linux/netfilter/nf_conntrack_sip.h>
 
 MODULE_LICENSE("GPL");
@@ -50,12 +52,16 @@ module_param(sip_direct_media, int, 0600);
 MODULE_PARM_DESC(sip_direct_media, "Expect Media streams between signalling "
                                    "endpoints only (default 1)");
 
-unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
+unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb, unsigned int dataoff,
                                 const char **dptr,
                                 unsigned int *datalen) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
 
+void (*nf_nat_sip_seq_adjust_hook)(struct sk_buff *skb, s16 off) __read_mostly;
+EXPORT_SYMBOL_GPL(nf_nat_sip_seq_adjust_hook);
+
 unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
+                                       unsigned int dataoff,
                                        const char **dptr,
                                        unsigned int *datalen,
                                        struct nf_conntrack_expect *exp,
@@ -63,17 +69,17 @@ unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
                                        unsigned int matchlen) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_expect_hook);
 
-unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb,
+unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb, unsigned int dataoff,
                                      const char **dptr,
-                                     unsigned int dataoff,
                                      unsigned int *datalen,
+                                     unsigned int sdpoff,
                                      enum sdp_header_types type,
                                      enum sdp_header_types term,
                                      const union nf_inet_addr *addr)
                                      __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_addr_hook);
 
-unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb,
+unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb, unsigned int dataoff,
                                      const char **dptr,
                                      unsigned int *datalen,
                                      unsigned int matchoff,
@@ -82,14 +88,15 @@ unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb,
 EXPORT_SYMBOL_GPL(nf_nat_sdp_port_hook);
 
 unsigned int (*nf_nat_sdp_session_hook)(struct sk_buff *skb,
-                                        const char **dptr,
                                         unsigned int dataoff,
+                                        const char **dptr,
                                         unsigned int *datalen,
+                                        unsigned int sdpoff,
                                         const union nf_inet_addr *addr)
                                         __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_session_hook);
 
-unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb,
+unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb, unsigned int dataoff,
                                       const char **dptr,
                                       unsigned int *datalen,
                                       struct nf_conntrack_expect *rtp_exp,
@@ -236,12 +243,13 @@ int ct_sip_parse_request(const struct nf_conn *ct,
                 return 0;
 
         /* Find SIP URI */
-        limit -= strlen("sip:");
-        for (; dptr < limit; dptr++) {
+        for (; dptr < limit - strlen("sip:"); dptr++) {
                 if (*dptr == '\r' || *dptr == '\n')
                         return -1;
-                if (strnicmp(dptr, "sip:", strlen("sip:")) == 0)
+                if (strnicmp(dptr, "sip:", strlen("sip:")) == 0) {
+                        dptr += strlen("sip:");
                         break;
+                }
         }
         if (!skp_epaddr_len(ct, dptr, limit, &shift))
                 return 0;
@@ -276,7 +284,7 @@ EXPORT_SYMBOL_GPL(ct_sip_parse_request);
  * tabs, spaces and continuation lines, which are treated as a single whitespace
  * character.
  *
- * Some headers may appear multiple times. A comma seperated list of values is
+ * Some headers may appear multiple times. A comma separated list of values is
  * equivalent to multiple headers.
  */
 static const struct sip_header ct_sip_hdrs[] = {
@@ -284,7 +292,8 @@ static const struct sip_header ct_sip_hdrs[] = {
         [SIP_HDR_FROM]                  = SIP_HDR("From", "f", "sip:", skp_epaddr_len),
         [SIP_HDR_TO]                    = SIP_HDR("To", "t", "sip:", skp_epaddr_len),
         [SIP_HDR_CONTACT]               = SIP_HDR("Contact", "m", "sip:", skp_epaddr_len),
-        [SIP_HDR_VIA]                   = SIP_HDR("Via", "v", "UDP ", epaddr_len),
+        [SIP_HDR_VIA_UDP]               = SIP_HDR("Via", "v", "UDP ", epaddr_len),
+        [SIP_HDR_VIA_TCP]               = SIP_HDR("Via", "v", "TCP ", epaddr_len),
         [SIP_HDR_EXPIRES]               = SIP_HDR("Expires", NULL, NULL, digits_len),
         [SIP_HDR_CONTENT_LENGTH]        = SIP_HDR("Content-Length", "l", NULL, digits_len),
 };
@@ -376,7 +385,7 @@ int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
                         dptr += hdr->len;
                 else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
                          strnicmp(dptr, hdr->cname, hdr->clen) == 0 &&
-                         !isalpha(*(dptr + hdr->clen + 1)))
+                         !isalpha(*(dptr + hdr->clen)))
                         dptr += hdr->clen;
                 else
                         continue;
@@ -412,7 +421,7 @@ int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
 }
 EXPORT_SYMBOL_GPL(ct_sip_get_header);
 
-/* Get next header field in a list of comma seperated values */
+/* Get next header field in a list of comma separated values */
 static int ct_sip_next_header(const struct nf_conn *ct, const char *dptr,
                               unsigned int dataoff, unsigned int datalen,
                               enum sip_header_types type,
@@ -516,6 +525,33 @@ int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr,
 }
 EXPORT_SYMBOL_GPL(ct_sip_parse_header_uri);
 
+static int ct_sip_parse_param(const struct nf_conn *ct, const char *dptr,
+                              unsigned int dataoff, unsigned int datalen,
+                              const char *name,
+                              unsigned int *matchoff, unsigned int *matchlen)
+{
+        const char *limit = dptr + datalen;
+        const char *start;
+        const char *end;
+
+        limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
+        if (!limit)
+                limit = dptr + datalen;
+
+        start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
+        if (!start)
+                return 0;
+        start += strlen(name);
+
+        end = ct_sip_header_search(start, limit, ";", strlen(";"));
+        if (!end)
+                end = limit;
+
+        *matchoff = start - dptr;
+        *matchlen = end - start;
+        return 1;
+}
+
 /* Parse address from header parameter and return address, offset and length */
 int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
                                unsigned int dataoff, unsigned int datalen,
@@ -574,6 +610,29 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
 }
 EXPORT_SYMBOL_GPL(ct_sip_parse_numerical_param);
 
+static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
+                                  unsigned int dataoff, unsigned int datalen,
+                                  u8 *proto)
+{
+        unsigned int matchoff, matchlen;
+
+        if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=",
+                               &matchoff, &matchlen)) {
+                if (!strnicmp(dptr + matchoff, "TCP", strlen("TCP")))
+                        *proto = IPPROTO_TCP;
+                else if (!strnicmp(dptr + matchoff, "UDP", strlen("UDP")))
+                        *proto = IPPROTO_UDP;
+                else
+                        return 0;
+
+                if (*proto != nf_ct_protonum(ct))
+                        return 0;
+        } else
+                *proto = nf_ct_protonum(ct);
+
+        return 1;
+}
+
 /* SDP header parsing: a SDP session description contains an ordered set of
  * headers, starting with a section containing general session parameters,
  * optionally followed by multiple media descriptions.
@@ -682,7 +741,7 @@ static int ct_sip_parse_sdp_addr(const struct nf_conn *ct, const char *dptr,
 
 static int refresh_signalling_expectation(struct nf_conn *ct,
                                           union nf_inet_addr *addr,
-                                          __be16 port,
+                                          u8 proto, __be16 port,
                                           unsigned int expires)
 {
         struct nf_conn_help *help = nfct_help(ct);
@@ -694,6 +753,7 @@ static int refresh_signalling_expectation(struct nf_conn *ct,
         hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
                 if (exp->class != SIP_EXPECT_SIGNALLING ||
                     !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
+                    exp->tuple.dst.protonum != proto ||
                     exp->tuple.dst.u.udp.port != port)
                         continue;
                 if (!del_timer(&exp->timeout))
@@ -728,7 +788,7 @@ static void flush_expectations(struct nf_conn *ct, bool media)
         spin_unlock_bh(&nf_conntrack_lock);
 }
 
-static int set_expected_rtp_rtcp(struct sk_buff *skb,
+static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int dataoff,
                                  const char **dptr, unsigned int *datalen,
                                  union nf_inet_addr *daddr, __be16 port,
                                  enum sip_expectation_classes class,
@@ -777,7 +837,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,
 
         rcu_read_lock();
         do {
-                exp = __nf_ct_expect_find(net, &tuple);
+                exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
 
                 if (!exp || exp->master == ct ||
                     nfct_help(exp->master)->helper != nfct_help(ct)->helper ||
@@ -805,7 +865,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,
         if (direct_rtp) {
                 nf_nat_sdp_port = rcu_dereference(nf_nat_sdp_port_hook);
                 if (nf_nat_sdp_port &&
-                    !nf_nat_sdp_port(skb, dptr, datalen,
+                    !nf_nat_sdp_port(skb, dataoff, dptr, datalen,
                                      mediaoff, medialen, ntohs(rtp_port)))
                         goto err1;
         }
@@ -827,7 +887,8 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,
 
         nf_nat_sdp_media = rcu_dereference(nf_nat_sdp_media_hook);
         if (nf_nat_sdp_media && ct->status & IPS_NAT_MASK && !direct_rtp)
-                ret = nf_nat_sdp_media(skb, dptr, datalen, rtp_exp, rtcp_exp,
+                ret = nf_nat_sdp_media(skb, dataoff, dptr, datalen,
+                                       rtp_exp, rtcp_exp,
                                        mediaoff, medialen, daddr);
         else {
                 if (nf_ct_expect_related(rtp_exp) == 0) {
@@ -847,6 +908,7 @@ err1:
 static const struct sdp_media_type sdp_media_types[] = {
         SDP_MEDIA_TYPE("audio ", SIP_EXPECT_AUDIO),
         SDP_MEDIA_TYPE("video ", SIP_EXPECT_VIDEO),
+        SDP_MEDIA_TYPE("image ", SIP_EXPECT_IMAGE),
 };
 
 static const struct sdp_media_type *sdp_media_type(const char *dptr,
@@ -866,13 +928,12 @@ static const struct sdp_media_type *sdp_media_type(const char *dptr,
         return NULL;
 }
 
-static int process_sdp(struct sk_buff *skb,
+static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
                        const char **dptr, unsigned int *datalen,
                        unsigned int cseq)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
-        struct nf_conn_help *help = nfct_help(ct);
         unsigned int matchoff, matchlen;
         unsigned int mediaoff, medialen;
         unsigned int sdpoff;
@@ -941,7 +1002,7 @@ static int process_sdp(struct sk_buff *skb,
                 else
                         return NF_DROP;
 
-                ret = set_expected_rtp_rtcp(skb, dptr, datalen,
+                ret = set_expected_rtp_rtcp(skb, dataoff, dptr, datalen,
                                             &rtp_addr, htons(port), t->class,
                                             mediaoff, medialen);
                 if (ret != NF_ACCEPT)
@@ -949,8 +1010,9 @@ static int process_sdp(struct sk_buff *skb,
 
                 /* Update media connection address if present */
                 if (maddr_len && nf_nat_sdp_addr && ct->status & IPS_NAT_MASK) {
-                        ret = nf_nat_sdp_addr(skb, dptr, mediaoff, datalen,
-                                              c_hdr, SDP_HDR_MEDIA, &rtp_addr);
+                        ret = nf_nat_sdp_addr(skb, dataoff, dptr, datalen,
+                                              mediaoff, c_hdr, SDP_HDR_MEDIA,
+                                              &rtp_addr);
                         if (ret != NF_ACCEPT)
                                 return ret;
                 }
@@ -960,14 +1022,12 @@ static int process_sdp(struct sk_buff *skb,
         /* Update session connection and owner addresses */
         nf_nat_sdp_session = rcu_dereference(nf_nat_sdp_session_hook);
         if (nf_nat_sdp_session && ct->status & IPS_NAT_MASK)
-                ret = nf_nat_sdp_session(skb, dptr, sdpoff, datalen, &rtp_addr);
-
-        if (ret == NF_ACCEPT && i > 0)
-                help->help.ct_sip_info.invite_cseq = cseq;
+                ret = nf_nat_sdp_session(skb, dataoff, dptr, datalen, sdpoff,
+                                         &rtp_addr);
 
         return ret;
 }
-static int process_invite_response(struct sk_buff *skb,
+static int process_invite_response(struct sk_buff *skb, unsigned int dataoff,
                                    const char **dptr, unsigned int *datalen,
                                    unsigned int cseq, unsigned int code)
 {
@@ -977,13 +1037,13 @@ static int process_invite_response(struct sk_buff *skb,
 
         if ((code >= 100 && code <= 199) ||
             (code >= 200 && code <= 299))
-                return process_sdp(skb, dptr, datalen, cseq);
+                return process_sdp(skb, dataoff, dptr, datalen, cseq);
         else if (help->help.ct_sip_info.invite_cseq == cseq)
                 flush_expectations(ct, true);
         return NF_ACCEPT;
 }
 
-static int process_update_response(struct sk_buff *skb,
+static int process_update_response(struct sk_buff *skb, unsigned int dataoff,
                                    const char **dptr, unsigned int *datalen,
                                    unsigned int cseq, unsigned int code)
 {
@@ -993,13 +1053,13 @@ static int process_update_response(struct sk_buff *skb,
 
         if ((code >= 100 && code <= 199) ||
             (code >= 200 && code <= 299))
-                return process_sdp(skb, dptr, datalen, cseq);
+                return process_sdp(skb, dataoff, dptr, datalen, cseq);
         else if (help->help.ct_sip_info.invite_cseq == cseq)
                 flush_expectations(ct, true);
         return NF_ACCEPT;
 }
 
-static int process_prack_response(struct sk_buff *skb,
+static int process_prack_response(struct sk_buff *skb, unsigned int dataoff,
                                   const char **dptr, unsigned int *datalen,
                                   unsigned int cseq, unsigned int code)
 {
@@ -1009,13 +1069,29 @@ static int process_prack_response(struct sk_buff *skb,
 
         if ((code >= 100 && code <= 199) ||
             (code >= 200 && code <= 299))
-                return process_sdp(skb, dptr, datalen, cseq);
+                return process_sdp(skb, dataoff, dptr, datalen, cseq);
         else if (help->help.ct_sip_info.invite_cseq == cseq)
                 flush_expectations(ct, true);
         return NF_ACCEPT;
 }
 
-static int process_bye_request(struct sk_buff *skb,
+static int process_invite_request(struct sk_buff *skb, unsigned int dataoff,
+                                  const char **dptr, unsigned int *datalen,
+                                  unsigned int cseq)
+{
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+        struct nf_conn_help *help = nfct_help(ct);
+        unsigned int ret;
+
+        flush_expectations(ct, true);
+        ret = process_sdp(skb, dataoff, dptr, datalen, cseq);
+        if (ret == NF_ACCEPT)
+                help->help.ct_sip_info.invite_cseq = cseq;
+        return ret;
+}
+
+static int process_bye_request(struct sk_buff *skb, unsigned int dataoff,
                                const char **dptr, unsigned int *datalen,
                                unsigned int cseq)
 {
@@ -1030,7 +1106,7 @@ static int process_bye_request(struct sk_buff *skb,
  * signalling connections. The expectation is marked inactive and is activated
  * when receiving a response indicating success from the registrar.
  */
-static int process_register_request(struct sk_buff *skb,
+static int process_register_request(struct sk_buff *skb, unsigned int dataoff,
                                     const char **dptr, unsigned int *datalen,
                                     unsigned int cseq)
 {
@@ -1042,6 +1118,7 @@ static int process_register_request(struct sk_buff *skb,
         struct nf_conntrack_expect *exp;
         union nf_inet_addr *saddr, daddr;
         __be16 port;
+        u8 proto;
         unsigned int expires = 0;
         int ret;
         typeof(nf_nat_sip_expect_hook) nf_nat_sip_expect;
@@ -1074,6 +1151,10 @@ static int process_register_request(struct sk_buff *skb,
         if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, &daddr))
                 return NF_ACCEPT;
 
+        if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen, *datalen,
+                                   &proto) == 0)
+                return NF_ACCEPT;
+
         if (ct_sip_parse_numerical_param(ct, *dptr,
                                          matchoff + matchlen, *datalen,
                                          "expires=", NULL, NULL, &expires) < 0)
@@ -1093,14 +1174,14 @@ static int process_register_request(struct sk_buff *skb,
                 saddr = &ct->tuplehash[!dir].tuple.src.u3;
 
         nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
-                          saddr, &daddr, IPPROTO_UDP, NULL, &port);
+                          saddr, &daddr, proto, NULL, &port);
         exp->timeout.expires = sip_timeout * HZ;
         exp->helper = nfct_help(ct)->helper;
         exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
 
         nf_nat_sip_expect = rcu_dereference(nf_nat_sip_expect_hook);
         if (nf_nat_sip_expect && ct->status & IPS_NAT_MASK)
-                ret = nf_nat_sip_expect(skb, dptr, datalen, exp,
+                ret = nf_nat_sip_expect(skb, dataoff, dptr, datalen, exp,
                                         matchoff, matchlen);
         else {
                 if (nf_ct_expect_related(exp) != 0)
@@ -1116,7 +1197,7 @@ store_cseq:
         return ret;
 }
 
-static int process_register_response(struct sk_buff *skb,
+static int process_register_response(struct sk_buff *skb, unsigned int dataoff,
                                      const char **dptr, unsigned int *datalen,
                                      unsigned int cseq, unsigned int code)
 {
@@ -1126,7 +1207,8 @@ static int process_register_response(struct sk_buff *skb,
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         union nf_inet_addr addr;
         __be16 port;
-        unsigned int matchoff, matchlen, dataoff = 0;
+        u8 proto;
+        unsigned int matchoff, matchlen, coff = 0;
         unsigned int expires = 0;
         int in_contact = 0, ret;
 
@@ -1153,7 +1235,7 @@ static int process_register_response(struct sk_buff *skb,
         while (1) {
                 unsigned int c_expires = expires;
 
-                ret = ct_sip_parse_header_uri(ct, *dptr, &dataoff, *datalen,
+                ret = ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
                                               SIP_HDR_CONTACT, &in_contact,
                                               &matchoff, &matchlen,
                                               &addr, &port);
@@ -1166,6 +1248,10 @@ static int process_register_response(struct sk_buff *skb,
                 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, &addr))
                         continue;
 
+                if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen,
+                                           *datalen, &proto) == 0)
+                        continue;
+
                 ret = ct_sip_parse_numerical_param(ct, *dptr,
                                                    matchoff + matchlen,
                                                    *datalen, "expires=",
@@ -1174,7 +1260,8 @@ static int process_register_response(struct sk_buff *skb,
                         return NF_DROP;
                 if (c_expires == 0)
                         break;
-                if (refresh_signalling_expectation(ct, &addr, port, c_expires))
+                if (refresh_signalling_expectation(ct, &addr, proto, port,
+                                                   c_expires))
                         return NF_ACCEPT;
         }
 
@@ -1184,7 +1271,7 @@ flush:
 }
 
 static const struct sip_handler sip_handlers[] = {
-        SIP_HANDLER("INVITE", process_sdp, process_invite_response),
+        SIP_HANDLER("INVITE", process_invite_request, process_invite_response),
         SIP_HANDLER("UPDATE", process_sdp, process_update_response),
         SIP_HANDLER("ACK", process_sdp, NULL),
         SIP_HANDLER("PRACK", process_sdp, process_prack_response),
@@ -1192,13 +1279,13 @@ static const struct sip_handler sip_handlers[] = {
         SIP_HANDLER("REGISTER", process_register_request, process_register_response),
 };
 
-static int process_sip_response(struct sk_buff *skb,
+static int process_sip_response(struct sk_buff *skb, unsigned int dataoff,
                                 const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
-        unsigned int matchoff, matchlen;
-        unsigned int code, cseq, dataoff, i;
+        unsigned int matchoff, matchlen, matchend;
+        unsigned int code, cseq, i;
 
         if (*datalen < strlen("SIP/2.0 200"))
                 return NF_ACCEPT;
@@ -1212,7 +1299,7 @@ static int process_sip_response(struct sk_buff *skb,
         cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
         if (!cseq)
                 return NF_DROP;
-        dataoff = matchoff + matchlen + 1;
+        matchend = matchoff + matchlen + 1;
 
         for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
                 const struct sip_handler *handler;
@@ -1220,15 +1307,16 @@ static int process_sip_response(struct sk_buff *skb,
                 handler = &sip_handlers[i];
                 if (handler->response == NULL)
                         continue;
-                if (*datalen < dataoff + handler->len ||
-                    strnicmp(*dptr + dataoff, handler->method, handler->len))
+                if (*datalen < matchend + handler->len ||
+                    strnicmp(*dptr + matchend, handler->method, handler->len))
                         continue;
-                return handler->response(skb, dptr, datalen, cseq, code);
+                return handler->response(skb, dataoff, dptr, datalen,
+                                         cseq, code);
         }
         return NF_ACCEPT;
 }
 
-static int process_sip_request(struct sk_buff *skb,
+static int process_sip_request(struct sk_buff *skb, unsigned int dataoff,
                                const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
@@ -1253,69 +1341,157 @@ static int process_sip_request(struct sk_buff *skb,
                 if (!cseq)
                         return NF_DROP;
 
-                return handler->request(skb, dptr, datalen, cseq);
+                return handler->request(skb, dataoff, dptr, datalen, cseq);
         }
         return NF_ACCEPT;
 }
 
-static int sip_help(struct sk_buff *skb,
-                    unsigned int protoff,
-                    struct nf_conn *ct,
-                    enum ip_conntrack_info ctinfo)
+static int process_sip_msg(struct sk_buff *skb, struct nf_conn *ct,
+                           unsigned int dataoff, const char **dptr,
+                           unsigned int *datalen)
+{
+        typeof(nf_nat_sip_hook) nf_nat_sip;
+        int ret;
+
+        if (strnicmp(*dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0)
+                ret = process_sip_request(skb, dataoff, dptr, datalen);
+        else
+                ret = process_sip_response(skb, dataoff, dptr, datalen);
+
+        if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
+                nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
+                if (nf_nat_sip && !nf_nat_sip(skb, dataoff, dptr, datalen))
+                        ret = NF_DROP;
+        }
+
+        return ret;
+}
+
+static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
+                        struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
+        struct tcphdr *th, _tcph;
         unsigned int dataoff, datalen;
-        const char *dptr;
+        unsigned int matchoff, matchlen, clen;
+        unsigned int msglen, origlen;
+        const char *dptr, *end;
+        s16 diff, tdiff = 0;
         int ret;
-        typeof(nf_nat_sip_hook) nf_nat_sip;
+        typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust;
+
+        if (ctinfo != IP_CT_ESTABLISHED &&
+            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
+                return NF_ACCEPT;
 
         /* No Data ? */
-        dataoff = protoff + sizeof(struct udphdr);
+        th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
+        if (th == NULL)
+                return NF_ACCEPT;
+        dataoff = protoff + th->doff * 4;
         if (dataoff >= skb->len)
                 return NF_ACCEPT;
 
         nf_ct_refresh(ct, skb, sip_timeout * HZ);
 
-        if (!skb_is_nonlinear(skb))
-                dptr = skb->data + dataoff;
-        else {
+        if (skb_is_nonlinear(skb)) {
                 pr_debug("Copy of skbuff not supported yet.\n");
                 return NF_ACCEPT;
         }
 
+        dptr = skb->data + dataoff;
         datalen = skb->len - dataoff;
         if (datalen < strlen("SIP/2.0 200"))
                 return NF_ACCEPT;
 
-        if (strnicmp(dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0)
-                ret = process_sip_request(skb, &dptr, &datalen);
-        else
-                ret = process_sip_response(skb, &dptr, &datalen);
+        while (1) {
+                if (ct_sip_get_header(ct, dptr, 0, datalen,
+                                      SIP_HDR_CONTENT_LENGTH,
+                                      &matchoff, &matchlen) <= 0)
+                        break;
+
+                clen = simple_strtoul(dptr + matchoff, (char **)&end, 10);
+                if (dptr + matchoff == end)
+                        break;
+
+                if (end + strlen("\r\n\r\n") > dptr + datalen)
+                        break;
+                if (end[0] != '\r' || end[1] != '\n' ||
+                    end[2] != '\r' || end[3] != '\n')
+                        break;
+                end += strlen("\r\n\r\n") + clen;
+
+                msglen = origlen = end - dptr;
+
+                ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
+                if (ret != NF_ACCEPT)
+                        break;
+                diff     = msglen - origlen;
+                tdiff   += diff;
+
+                dataoff += msglen;
+                dptr    += msglen;
+                datalen  = datalen + diff - msglen;
+        }
 
         if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
-                nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
-                if (nf_nat_sip && !nf_nat_sip(skb, &dptr, &datalen))
-                        ret = NF_DROP;
+                nf_nat_sip_seq_adjust = rcu_dereference(nf_nat_sip_seq_adjust_hook);
+                if (nf_nat_sip_seq_adjust)
+                        nf_nat_sip_seq_adjust(skb, tdiff);
         }
 
         return ret;
 }
 
-static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
-static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
+static int sip_help_udp(struct sk_buff *skb, unsigned int protoff,
+                        struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+{
+        unsigned int dataoff, datalen;
+        const char *dptr;
+
+        /* No Data ? */
+        dataoff = protoff + sizeof(struct udphdr);
+        if (dataoff >= skb->len)
+                return NF_ACCEPT;
+
+        nf_ct_refresh(ct, skb, sip_timeout * HZ);
+
+        if (skb_is_nonlinear(skb)) {
+                pr_debug("Copy of skbuff not supported yet.\n");
+                return NF_ACCEPT;
+        }
+
+        dptr = skb->data + dataoff;
+        datalen = skb->len - dataoff;
+        if (datalen < strlen("SIP/2.0 200"))
+                return NF_ACCEPT;
+
+        return process_sip_msg(skb, ct, dataoff, &dptr, &datalen);
+}
+
+static struct nf_conntrack_helper sip[MAX_PORTS][4] __read_mostly;
+static char sip_names[MAX_PORTS][4][sizeof("sip-65535")] __read_mostly;
 
 static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = {
         [SIP_EXPECT_SIGNALLING] = {
+                .name           = "signalling",
                 .max_expected   = 1,
                 .timeout        = 3 * 60,
         },
         [SIP_EXPECT_AUDIO] = {
+                .name           = "audio",
                 .max_expected   = 2 * IP_CT_DIR_MAX,
                 .timeout        = 3 * 60,
         },
         [SIP_EXPECT_VIDEO] = {
+                .name           = "video",
                 .max_expected   = 2 * IP_CT_DIR_MAX,
                 .timeout        = 3 * 60,
         },
+        [SIP_EXPECT_IMAGE] = {
+                .name           = "image",
+                .max_expected   = IP_CT_DIR_MAX,
+                .timeout        = 3 * 60,
+        },
 };
 
 static void nf_conntrack_sip_fini(void)
@@ -1323,7 +1499,7 @@ static void nf_conntrack_sip_fini(void)
         int i, j;
 
         for (i = 0; i < ports_c; i++) {
-                for (j = 0; j < 2; j++) {
+                for (j = 0; j < ARRAY_SIZE(sip[i]); j++) {
                         if (sip[i][j].me == NULL)
                                 continue;
                         nf_conntrack_helper_unregister(&sip[i][j]);
@@ -1343,14 +1519,24 @@ static int __init nf_conntrack_sip_init(void)
                 memset(&sip[i], 0, sizeof(sip[i]));
 
                 sip[i][0].tuple.src.l3num = AF_INET;
-                sip[i][1].tuple.src.l3num = AF_INET6;
-                for (j = 0; j < 2; j++) {
-                        sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
+                sip[i][0].tuple.dst.protonum = IPPROTO_UDP;
+                sip[i][0].help = sip_help_udp;
+                sip[i][1].tuple.src.l3num = AF_INET;
+                sip[i][1].tuple.dst.protonum = IPPROTO_TCP;
+                sip[i][1].help = sip_help_tcp;
+
+                sip[i][2].tuple.src.l3num = AF_INET6;
+                sip[i][2].tuple.dst.protonum = IPPROTO_UDP;
+                sip[i][2].help = sip_help_udp;
+                sip[i][3].tuple.src.l3num = AF_INET6;
+                sip[i][3].tuple.dst.protonum = IPPROTO_TCP;
+                sip[i][3].help = sip_help_tcp;
+
+                for (j = 0; j < ARRAY_SIZE(sip[i]); j++) {
                         sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
                         sip[i][j].expect_policy = sip_exp_policy;
                         sip[i][j].expect_class_max = SIP_EXPECT_MAX;
                         sip[i][j].me = THIS_MODULE;
-                        sip[i][j].help = sip_help;
 
                         tmpname = &sip_names[i][j][0];
                         if (ports[i] == SIP_PORT)
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 193515381970..faa8eb3722b9 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -8,6 +8,7 @@
 
 #include <linux/types.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
@@ -26,6 +27,7 @@
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_acct.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 MODULE_LICENSE("GPL");
 
@@ -51,7 +53,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
         struct hlist_nulls_node *n;
 
         for (st->bucket = 0;
-             st->bucket < nf_conntrack_htable_size;
+             st->bucket < net->ct.htable_size;
              st->bucket++) {
                 n = rcu_dereference(net->ct.hash[st->bucket].first);
                 if (!is_a_nulls(n))
@@ -69,7 +71,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
         head = rcu_dereference(head->next);
         while (is_a_nulls(head)) {
                 if (likely(get_nulls_value(head) == st->bucket)) {
-                        if (++st->bucket >= nf_conntrack_htable_size)
+                        if (++st->bucket >= net->ct.htable_size)
                                 return NULL;
                 }
                 head = rcu_dereference(net->ct.hash[st->bucket].first);
@@ -171,6 +173,11 @@ static int ct_seq_show(struct seq_file *s, void *v)
                 goto release;
 #endif
 
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+        if (seq_printf(s, "zone=%u ", nf_ct_zone(ct)))
+                goto release;
+#endif
+
         if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
                 goto release;
 
@@ -340,7 +347,6 @@ static struct ctl_table_header *nf_ct_netfilter_header;
 
 static ctl_table nf_ct_sysctl_table[] = {
         {
-                .ctl_name       = NET_NF_CONNTRACK_MAX,
                 .procname       = "nf_conntrack_max",
                 .data           = &nf_conntrack_max,
                 .maxlen         = sizeof(int),
@@ -348,7 +354,6 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_COUNT,
                 .procname       = "nf_conntrack_count",
                 .data           = &init_net.ct.count,
                 .maxlen         = sizeof(int),
@@ -356,15 +361,13 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_BUCKETS,
                 .procname       = "nf_conntrack_buckets",
-                .data           = &nf_conntrack_htable_size,
+                .data           = &init_net.ct.htable_size,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0444,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_CHECKSUM,
                 .procname       = "nf_conntrack_checksum",
                 .data           = &init_net.ct.sysctl_checksum,
                 .maxlen         = sizeof(unsigned int),
@@ -372,43 +375,39 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_NF_CONNTRACK_LOG_INVALID,
                 .procname       = "nf_conntrack_log_invalid",
                 .data           = &init_net.ct.sysctl_log_invalid,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &log_invalid_proto_min,
                 .extra2         = &log_invalid_proto_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nf_conntrack_expect_max",
                 .data           = &nf_ct_expect_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 #define NET_NF_CONNTRACK_MAX 2089
 
 static ctl_table nf_ct_netfilter_table[] = {
         {
-                .ctl_name       = NET_NF_CONNTRACK_MAX,
                 .procname       = "nf_conntrack_max",
                 .data           = &nf_conntrack_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_path nf_ct_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
+        { .procname = "net", },
         { }
 };
 
@@ -429,6 +428,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
                 goto out_kmemdup;
 
         table[1].data = &net->ct.count;
+        table[2].data = &net->ct.htable_size;
         table[3].data = &net->ct.sysctl_checksum;
         table[4].data = &net->ct.sysctl_log_invalid;
 
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index d65d3481919c..015725a5cd50 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -208,9 +208,9 @@ static const struct file_operations nflog_file_ops = {
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_path nf_log_sysctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "netfilter", .ctl_name = NET_NETFILTER, },
-        { .procname = "nf_log", .ctl_name = CTL_UNNUMBERED, },
+        { .procname = "net", },
+        { .procname = "netfilter", },
+        { .procname = "nf_log", },
         { }
 };
 
@@ -265,7 +265,6 @@ static __init int netfilter_log_sysctl_init(void)
 
         for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
                 snprintf(nf_log_sysctl_fnames[i-NFPROTO_UNSPEC], 3, "%d", i);
-                nf_log_sysctl_table[i].ctl_name = CTL_UNNUMBERED;
                 nf_log_sysctl_table[i].procname =
                         nf_log_sysctl_fnames[i-NFPROTO_UNSPEC];
                 nf_log_sysctl_table[i].data = NULL;
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 3a6fd77f7761..c49ef219899e 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -1,4 +1,5 @@
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/proc_fs.h>
@@ -265,7 +266,6 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
                 local_bh_disable();
                 entry->okfn(skb);
                 local_bh_enable();
-        case NF_STOLEN:
                 break;
         case NF_QUEUE:
                 if (!__nf_queue(skb, elem, entry->pf, entry->hook,
@@ -273,6 +273,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
                                 verdict >> NF_VERDICT_BITS))
                         goto next_hook;
                 break;
+        case NF_STOLEN:
         default:
                 kfree_skb(skb);
         }
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index eedc0c1ac7a4..6afa3d52ea5f 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -40,7 +40,6 @@ MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER);
 
 static char __initdata nfversion[] = "0.30";
 
-static struct sock *nfnl = NULL;
 static const struct nfnetlink_subsystem *subsys_table[NFNL_SUBSYS_COUNT];
 static DEFINE_MUTEX(nfnl_mutex);
 
@@ -101,34 +100,35 @@ nfnetlink_find_client(u_int16_t type, const struct nfnetlink_subsystem *ss)
         return &ss->cb[cb_id];
 }
 
-int nfnetlink_has_listeners(unsigned int group)
+int nfnetlink_has_listeners(struct net *net, unsigned int group)
 {
-        return netlink_has_listeners(nfnl, group);
+        return netlink_has_listeners(net->nfnl, group);
 }
 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners);
 
-int nfnetlink_send(struct sk_buff *skb, u32 pid,
+int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid,
                    unsigned group, int echo, gfp_t flags)
 {
-        return nlmsg_notify(nfnl, skb, pid, group, echo, flags);
+        return nlmsg_notify(net->nfnl, skb, pid, group, echo, flags);
 }
 EXPORT_SYMBOL_GPL(nfnetlink_send);
 
-void nfnetlink_set_err(u32 pid, u32 group, int error)
+int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error)
 {
-        netlink_set_err(nfnl, pid, group, error);
+        return netlink_set_err(net->nfnl, pid, group, error);
 }
 EXPORT_SYMBOL_GPL(nfnetlink_set_err);
 
-int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags)
+int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags)
 {
-        return netlink_unicast(nfnl, skb, pid, flags);
+        return netlink_unicast(net->nfnl, skb, pid, flags);
 }
 EXPORT_SYMBOL_GPL(nfnetlink_unicast);
 
 /* Process one complete nfnetlink message. */
 static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
+        struct net *net = sock_net(skb->sk);
         const struct nfnl_callback *nc;
         const struct nfnetlink_subsystem *ss;
         int type, err;
@@ -170,7 +170,7 @@ replay:
                 if (err < 0)
                         return err;
 
-                err = nc->call(nfnl, skb, nlh, (const struct nlattr **)cda);
+                err = nc->call(net->nfnl, skb, nlh, (const struct nlattr **)cda);
                 if (err == -EAGAIN)
                         goto replay;
                 return err;
@@ -184,26 +184,45 @@ static void nfnetlink_rcv(struct sk_buff *skb)
         nfnl_unlock();
 }
 
-static void __exit nfnetlink_exit(void)
+static int __net_init nfnetlink_net_init(struct net *net)
 {
-        printk("Removing netfilter NETLINK layer.\n");
-        netlink_kernel_release(nfnl);
-        return;
+        struct sock *nfnl;
+
+        nfnl = netlink_kernel_create(net, NETLINK_NETFILTER, NFNLGRP_MAX,
+                                     nfnetlink_rcv, NULL, THIS_MODULE);
+        if (!nfnl)
+                return -ENOMEM;
+        net->nfnl_stash = nfnl;
+        rcu_assign_pointer(net->nfnl, nfnl);
+        return 0;
 }
 
-static int __init nfnetlink_init(void)
+static void __net_exit nfnetlink_net_exit_batch(struct list_head *net_exit_list)
 {
-        printk("Netfilter messages via NETLINK v%s.\n", nfversion);
+        struct net *net;
 
-        nfnl = netlink_kernel_create(&init_net, NETLINK_NETFILTER, NFNLGRP_MAX,
-                                     nfnetlink_rcv, NULL, THIS_MODULE);
-        if (!nfnl) {
-                printk(KERN_ERR "cannot initialize nfnetlink!\n");
-                return -ENOMEM;
-        }
+        list_for_each_entry(net, net_exit_list, exit_list)
+                rcu_assign_pointer(net->nfnl, NULL);
+        synchronize_net();
+        list_for_each_entry(net, net_exit_list, exit_list)
+                netlink_kernel_release(net->nfnl_stash);
+}
 
-        return 0;
+static struct pernet_operations nfnetlink_net_ops = {
+        .init           = nfnetlink_net_init,
+        .exit_batch     = nfnetlink_net_exit_batch,
+};
+
+static int __init nfnetlink_init(void)
+{
+        printk("Netfilter messages via NETLINK v%s.\n", nfversion);
+        return register_pernet_subsys(&nfnetlink_net_ops);
 }
 
+static void __exit nfnetlink_exit(void)
+{
+        printk("Removing netfilter NETLINK layer.\n");
+        unregister_pernet_subsys(&nfnetlink_net_ops);
+}
 module_init(nfnetlink_init);
 module_exit(nfnetlink_exit);
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index f900dc3194af..203643fb2c52 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -28,6 +28,7 @@
 #include <linux/list.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/netfilter/nf_log.h>
 #include <net/netfilter/nfnetlink_log.h>
@@ -323,7 +324,8 @@ __nfulnl_send(struct nfulnl_instance *inst)
                           NLMSG_DONE,
                           sizeof(struct nfgenmsg));
 
-        status = nfnetlink_unicast(inst->skb, inst->peer_pid, MSG_DONTWAIT);
+        status = nfnetlink_unicast(inst->skb, &init_net, inst->peer_pid,
+                                   MSG_DONTWAIT);
 
         inst->qlen = 0;
         inst->skb = NULL;
@@ -666,8 +668,7 @@ nfulnl_rcv_nl_event(struct notifier_block *this,
 {
         struct netlink_notify *n = ptr;
 
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_NETFILTER && n->pid) {
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) {
                 int i;
 
                 /* destroy all instances for this pid */
@@ -678,7 +679,7 @@ nfulnl_rcv_nl_event(struct notifier_block *this,
                         struct hlist_head *head = &instance_table[i];
 
                         hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
-                                if ((n->net == &init_net) &&
+                                if ((net_eq(n->net, &init_net)) &&
                                     (n->pid == inst->peer_pid))
                                         __instance_destroy(inst);
                         }
@@ -768,7 +769,7 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
                         }
 
                         instance_destroy(inst);
-                        goto out;
+                        goto out_put;
                 default:
                         ret = -ENOTSUPP;
                         break;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 7a9dec9fb822..e70a6ef1f4f2 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -18,6 +18,7 @@
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
+#include <linux/slab.h>
 #include <linux/notifier.h>
 #include <linux/netdevice.h>
 #include <linux/netfilter.h>
@@ -112,7 +113,6 @@ instance_create(u_int16_t queue_num, int pid)
         inst->copy_mode = NFQNL_COPY_NONE;
         spin_lock_init(&inst->lock);
         INIT_LIST_HEAD(&inst->queue_list);
-        INIT_RCU_HEAD(&inst->rcu);
 
         if (!try_module_get(THIS_MODULE)) {
                 err = -EAGAIN;
@@ -414,13 +414,13 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
                 queue->queue_dropped++;
                 if (net_ratelimit())
                           printk(KERN_WARNING "nf_queue: full at %d entries, "
-                                 "dropping packets(s). Dropped: %d\n",
-                                 queue->queue_total, queue->queue_dropped);
+                                 "dropping packets(s).\n",
+                                 queue->queue_total);
                 goto err_out_free_nskb;
         }
 
         /* nfnetlink_unicast will either free the nskb or add it to a socket */
-        err = nfnetlink_unicast(nskb, queue->peer_pid, MSG_DONTWAIT);
+        err = nfnetlink_unicast(nskb, &init_net, queue->peer_pid, MSG_DONTWAIT);
         if (err < 0) {
                 queue->queue_user_dropped++;
                 goto err_out_unlock;
@@ -574,8 +574,7 @@ nfqnl_rcv_nl_event(struct notifier_block *this,
 {
         struct netlink_notify *n = ptr;
 
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_NETFILTER && n->pid) {
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) {
                 int i;
 
                 /* destroy all instances for this pid */
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index f01955cce314..665f5beef6ad 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -22,11 +22,14 @@
 #include <linux/vmalloc.h>
 #include <linux/mutex.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp.h>
-
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_arp/arp_tables.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
@@ -37,7 +40,7 @@ MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
 struct compat_delta {
         struct compat_delta *next;
         unsigned int offset;
-        short delta;
+        int delta;
 };
 
 struct xt_af {
@@ -364,8 +367,10 @@ int xt_check_match(struct xt_mtchk_param *par,
                  * ebt_among is exempt from centralized matchsize checking
                  * because it uses a dynamic-size data set.
                  */
-                pr_err("%s_tables: %s match: invalid size %Zu != %u\n",
+                pr_err("%s_tables: %s.%u match: invalid size "
+                       "%u (kernel) != (user) %u\n",
                        xt_prefix[par->family], par->match->name,
+                       par->match->revision,
                        XT_ALIGN(par->match->matchsize), size);
                 return -EINVAL;
         }
@@ -435,10 +440,10 @@ void xt_compat_flush_offsets(u_int8_t af)
 }
 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
 
-short xt_compat_calc_jump(u_int8_t af, unsigned int offset)
+int xt_compat_calc_jump(u_int8_t af, unsigned int offset)
 {
         struct compat_delta *tmp;
-        short delta;
+        int delta;
 
         for (tmp = xt[af].compat_offsets, delta = 0; tmp; tmp = tmp->next)
                 if (tmp->offset < offset)
@@ -481,8 +486,8 @@ int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 }
 EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
 
-int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
-                            unsigned int *size)
+int xt_compat_match_to_user(const struct xt_entry_match *m,
+                            void __user **dstptr, unsigned int *size)
 {
         const struct xt_match *match = m->u.kernel.match;
         struct compat_xt_entry_match __user *cm = *dstptr;
@@ -514,8 +519,10 @@ int xt_check_target(struct xt_tgchk_param *par,
                     unsigned int size, u_int8_t proto, bool inv_proto)
 {
         if (XT_ALIGN(par->target->targetsize) != size) {
-                pr_err("%s_tables: %s target: invalid size %Zu != %u\n",
+                pr_err("%s_tables: %s.%u target: invalid size "
+                       "%u (kernel) != (user) %u\n",
                        xt_prefix[par->family], par->target->name,
+                       par->target->revision,
                        XT_ALIGN(par->target->targetsize), size);
                 return -EINVAL;
         }
@@ -582,8 +589,8 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
 }
 EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
 
-int xt_compat_target_to_user(struct xt_entry_target *t, void __user **dstptr,
-                             unsigned int *size)
+int xt_compat_target_to_user(const struct xt_entry_target *t,
+                             void __user **dstptr, unsigned int *size)
 {
         const struct xt_target *target = t->u.kernel.target;
         struct compat_xt_entry_target __user *ct = *dstptr;
@@ -1091,6 +1098,60 @@ static const struct file_operations xt_target_ops = {
 
 #endif /* CONFIG_PROC_FS */
 
+/**
+ * xt_hook_link - set up hooks for a new table
+ * @table:      table with metadata needed to set up hooks
+ * @fn:         Hook function
+ *
+ * This function will take care of creating and registering the necessary
+ * Netfilter hooks for XT tables.
+ */
+struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn)
+{
+        unsigned int hook_mask = table->valid_hooks;
+        uint8_t i, num_hooks = hweight32(hook_mask);
+        uint8_t hooknum;
+        struct nf_hook_ops *ops;
+        int ret;
+
+        ops = kmalloc(sizeof(*ops) * num_hooks, GFP_KERNEL);
+        if (ops == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0;
+             hook_mask >>= 1, ++hooknum) {
+                if (!(hook_mask & 1))
+                        continue;
+                ops[i].hook     = fn;
+                ops[i].owner    = table->me;
+                ops[i].pf       = table->af;
+                ops[i].hooknum  = hooknum;
+                ops[i].priority = table->priority;
+                ++i;
+        }
+
+        ret = nf_register_hooks(ops, num_hooks);
+        if (ret < 0) {
+                kfree(ops);
+                return ERR_PTR(ret);
+        }
+
+        return ops;
+}
+EXPORT_SYMBOL_GPL(xt_hook_link);
+
+/**
+ * xt_hook_unlink - remove hooks for a table
+ * @ops:        nf_hook_ops array as returned by nf_hook_link
+ * @hook_mask:  the very same mask that was passed to nf_hook_link
+ */
+void xt_hook_unlink(const struct xt_table *table, struct nf_hook_ops *ops)
+{
+        nf_unregister_hooks(ops, hweight32(table->valid_hooks));
+        kfree(ops);
+}
+EXPORT_SYMBOL_GPL(xt_hook_unlink);
+
 int xt_proto_init(struct net *net, u_int8_t af)
 {
 #ifdef CONFIG_PROC_FS
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
new file mode 100644
index 000000000000..ee18b231b950
--- /dev/null
+++ b/net/netfilter/xt_CT.c
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/gfp.h>
+#include <linux/skbuff.h>
+#include <linux/selinux.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_CT.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_zones.h>
+
+static unsigned int xt_ct_target(struct sk_buff *skb,
+                                 const struct xt_target_param *par)
+{
+        const struct xt_ct_target_info *info = par->targinfo;
+        struct nf_conn *ct = info->ct;
+
+        /* Previously seen (loopback)? Ignore. */
+        if (skb->nfct != NULL)
+                return XT_CONTINUE;
+
+        atomic_inc(&ct->ct_general.use);
+        skb->nfct = &ct->ct_general;
+        skb->nfctinfo = IP_CT_NEW;
+
+        return XT_CONTINUE;
+}
+
+static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
+{
+        if (par->family == AF_INET) {
+                const struct ipt_entry *e = par->entryinfo;
+
+                if (e->ip.invflags & IPT_INV_PROTO)
+                        return 0;
+                return e->ip.proto;
+        } else if (par->family == AF_INET6) {
+                const struct ip6t_entry *e = par->entryinfo;
+
+                if (e->ipv6.invflags & IP6T_INV_PROTO)
+                        return 0;
+                return e->ipv6.proto;
+        } else
+                return 0;
+}
+
+static bool xt_ct_tg_check(const struct xt_tgchk_param *par)
+{
+        struct xt_ct_target_info *info = par->targinfo;
+        struct nf_conntrack_tuple t;
+        struct nf_conn_help *help;
+        struct nf_conn *ct;
+        u8 proto;
+
+        if (info->flags & ~XT_CT_NOTRACK)
+                return false;
+
+        if (info->flags & XT_CT_NOTRACK) {
+                ct = &nf_conntrack_untracked;
+                atomic_inc(&ct->ct_general.use);
+                goto out;
+        }
+
+#ifndef CONFIG_NF_CONNTRACK_ZONES
+        if (info->zone)
+                goto err1;
+#endif
+
+        if (nf_ct_l3proto_try_module_get(par->family) < 0)
+                goto err1;
+
+        memset(&t, 0, sizeof(t));
+        ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
+        if (IS_ERR(ct))
+                goto err2;
+
+        if ((info->ct_events || info->exp_events) &&
+            !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
+                                  GFP_KERNEL))
+                goto err3;
+
+        if (info->helper[0]) {
+                proto = xt_ct_find_proto(par);
+                if (!proto)
+                        goto err3;
+
+                help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
+                if (help == NULL)
+                        goto err3;
+
+                help->helper = nf_conntrack_helper_try_module_get(info->helper,
+                                                                  par->family,
+                                                                  proto);
+                if (help->helper == NULL)
+                        goto err3;
+        }
+
+        __set_bit(IPS_TEMPLATE_BIT, &ct->status);
+        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+out:
+        info->ct = ct;
+        return true;
+
+err3:
+        nf_conntrack_free(ct);
+err2:
+        nf_ct_l3proto_module_put(par->family);
+err1:
+        return false;
+}
+
+static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par)
+{
+        struct xt_ct_target_info *info = par->targinfo;
+        struct nf_conn *ct = info->ct;
+        struct nf_conn_help *help;
+
+        if (ct != &nf_conntrack_untracked) {
+                help = nfct_help(ct);
+                if (help)
+                        module_put(help->helper->me);
+
+                nf_ct_l3proto_module_put(par->family);
+        }
+        nf_ct_put(info->ct);
+}
+
+static struct xt_target xt_ct_tg __read_mostly = {
+        .name           = "CT",
+        .family         = NFPROTO_UNSPEC,
+        .targetsize     = XT_ALIGN(sizeof(struct xt_ct_target_info)),
+        .checkentry     = xt_ct_tg_check,
+        .destroy        = xt_ct_tg_destroy,
+        .target         = xt_ct_target,
+        .table          = "raw",
+        .me             = THIS_MODULE,
+};
+
+static int __init xt_ct_tg_init(void)
+{
+        return xt_register_target(&xt_ct_tg);
+}
+
+static void __exit xt_ct_tg_exit(void)
+{
+        xt_unregister_target(&xt_ct_tg);
+}
+
+module_init(xt_ct_tg_init);
+module_exit(xt_ct_tg_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Xtables: connection tracking target");
+MODULE_ALIAS("ipt_CT");
+MODULE_ALIAS("ip6t_CT");
diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c
index 8ff7843bb921..3271c8e52153 100644
--- a/net/netfilter/xt_LED.c
+++ b/net/netfilter/xt_LED.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/netfilter/x_tables.h>
+#include <linux/slab.h>
 #include <linux/leds.h>
 #include <linux/mutex.h>
 
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index f28f6a5fc02d..12dcd7007c3e 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -28,6 +28,7 @@ MODULE_ALIAS("ip6t_NFQUEUE");
 MODULE_ALIAS("arpt_NFQUEUE");
 
 static u32 jhash_initval __read_mostly;
+static bool rnd_inited __read_mostly;
 
 static unsigned int
 nfqueue_tg(struct sk_buff *skb, const struct xt_target_param *par)
@@ -90,6 +91,10 @@ static bool nfqueue_tg_v1_check(const struct xt_tgchk_param *par)
         const struct xt_NFQ_info_v1 *info = par->targinfo;
         u32 maxid;
 
+        if (unlikely(!rnd_inited)) {
+                get_random_bytes(&jhash_initval, sizeof(jhash_initval));
+                rnd_inited = true;
+        }
         if (info->queues_total == 0) {
                 pr_err("NFQUEUE: number of total queues is 0\n");
                 return false;
@@ -135,7 +140,6 @@ static struct xt_target nfqueue_tg_reg[] __read_mostly = {
 
 static int __init nfqueue_tg_init(void)
 {
-        get_random_bytes(&jhash_initval, sizeof(jhash_initval));
         return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
 }
 
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index d80b8192e0d4..d16d55df4f61 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -11,6 +11,7 @@
 #include <linux/jhash.h>
 #include <linux/rtnetlink.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <net/gen_stats.h>
 #include <net/netlink.h>
 
@@ -23,6 +24,7 @@ static DEFINE_MUTEX(xt_rateest_mutex);
 #define RATEEST_HSIZE   16
 static struct hlist_head rateest_hash[RATEEST_HSIZE] __read_mostly;
 static unsigned int jhash_rnd __read_mostly;
+static bool rnd_inited __read_mostly;
 
 static unsigned int xt_rateest_hash(const char *name)
 {
@@ -93,6 +95,11 @@ static bool xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
                 struct gnet_estimator   est;
         } cfg;
 
+        if (unlikely(!rnd_inited)) {
+                get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));
+                rnd_inited = true;
+        }
+
         est = xt_rateest_lookup(info->name);
         if (est) {
                 /*
@@ -164,7 +171,6 @@ static int __init xt_rateest_tg_init(void)
         for (i = 0; i < ARRAY_SIZE(rateest_hash); i++)
                 INIT_HLIST_HEAD(&rateest_hash[i]);
 
-        get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));
         return xt_register_target(&xt_rateest_tg_reg);
 }
 
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index eda64c1cb1e5..c5f4b9919e9a 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
+#include <linux/gfp.h>
 #include <linux/ipv6.h>
 #include <linux/tcp.h>
 #include <net/dst.h>
@@ -60,17 +61,9 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         tcplen = skb->len - tcphoff;
         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
 
-        /* Since it passed flags test in tcp match, we know it is is
-           not a fragment, and has data >= tcp header length.  SYN
-           packets should not contain data: if they did, then we risk
-           running over MTU, sending Frag Needed and breaking things
-           badly. --RR */
-        if (tcplen != tcph->doff*4) {
-                if (net_ratelimit())
-                        printk(KERN_ERR "xt_TCPMSS: bad length (%u bytes)\n",
-                               skb->len);
+        /* Header cannot be larger than the packet */
+        if (tcplen < tcph->doff*4)
                 return -1;
-        }
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
                 if (dst_mtu(skb_dst(skb)) <= minlen) {
@@ -115,6 +108,12 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                 }
         }
 
+        /* There is data after the header so the option can't be added
+           without moving it, and doing so may make the SYN packet
+           itself too large. Accept the packet unmodified instead. */
+        if (tcplen > tcph->doff*4)
+                return 0;
+
         /*
          * MSS Option not found ?! add it..
          */
@@ -241,6 +240,7 @@ static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
 {
         const struct xt_tcpmss_info *info = par->targinfo;
         const struct ipt_entry *e = par->entryinfo;
+        const struct xt_entry_match *ematch;
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
@@ -250,8 +250,9 @@ static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
                        "FORWARD, OUTPUT and POSTROUTING hooks\n");
                 return false;
         }
-        if (IPT_MATCH_ITERATE(e, find_syn_match))
-                return true;
+        xt_ematch_foreach(ematch, e)
+                if (find_syn_match(ematch))
+                        return true;
         printk("xt_TCPMSS: Only works on TCP SYN packets\n");
         return false;
 }
@@ -261,6 +262,7 @@ static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
 {
         const struct xt_tcpmss_info *info = par->targinfo;
         const struct ip6t_entry *e = par->entryinfo;
+        const struct xt_entry_match *ematch;
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
@@ -270,8 +272,9 @@ static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
                        "FORWARD, OUTPUT and POSTROUTING hooks\n");
                 return false;
         }
-        if (IP6T_MATCH_ITERATE(e, find_syn_match))
-                return true;
+        xt_ematch_foreach(ematch, e)
+                if (find_syn_match(ematch))
+                        return true;
         printk("xt_TCPMSS: Only works on TCP SYN packets\n");
         return false;
 }
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 38f03f75a636..388ca4596098 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -17,6 +17,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/random.h>
@@ -28,6 +29,7 @@
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 /* we will save the tuples of all connections we care about */
 struct xt_connlimit_conn {
@@ -40,15 +42,11 @@ struct xt_connlimit_data {
         spinlock_t lock;
 };
 
-static u_int32_t connlimit_rnd;
-static bool connlimit_rnd_inited;
+static u_int32_t connlimit_rnd __read_mostly;
+static bool connlimit_rnd_inited __read_mostly;
 
 static inline unsigned int connlimit_iphash(__be32 addr)
 {
-        if (unlikely(!connlimit_rnd_inited)) {
-                get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
-                connlimit_rnd_inited = true;
-        }
         return jhash_1word((__force __u32)addr, connlimit_rnd) & 0xFF;
 }
 
@@ -59,11 +57,6 @@ connlimit_iphash6(const union nf_inet_addr *addr,
         union nf_inet_addr res;
         unsigned int i;
 
-        if (unlikely(!connlimit_rnd_inited)) {
-                get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
-                connlimit_rnd_inited = true;
-        }
-
         for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i)
                 res.ip6[i] = addr->ip6[i] & mask->ip6[i];
 
@@ -99,7 +92,8 @@ same_source_net(const union nf_inet_addr *addr,
         }
 }
 
-static int count_them(struct xt_connlimit_data *data,
+static int count_them(struct net *net,
+                      struct xt_connlimit_data *data,
                       const struct nf_conntrack_tuple *tuple,
                       const union nf_inet_addr *addr,
                       const union nf_inet_addr *mask,
@@ -122,7 +116,8 @@ static int count_them(struct xt_connlimit_data *data,
 
         /* check the saved connections */
         list_for_each_entry_safe(conn, tmp, hash, list) {
-                found    = nf_conntrack_find_get(&init_net, &conn->tuple);
+                found    = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
+                                                 &conn->tuple);
                 found_ct = NULL;
 
                 if (found != NULL)
@@ -180,6 +175,7 @@ static int count_them(struct xt_connlimit_data *data,
 static bool
 connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
+        struct net *net = dev_net(par->in ? par->in : par->out);
         const struct xt_connlimit_info *info = par->matchinfo;
         union nf_inet_addr addr;
         struct nf_conntrack_tuple tuple;
@@ -204,7 +200,7 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
         }
 
         spin_lock_bh(&info->data->lock);
-        connections = count_them(info->data, tuple_ptr, &addr,
+        connections = count_them(net, info->data, tuple_ptr, &addr,
                                  &info->mask, par->family);
         spin_unlock_bh(&info->data->lock);
 
@@ -226,6 +222,10 @@ static bool connlimit_mt_check(const struct xt_mtchk_param *par)
         struct xt_connlimit_info *info = par->matchinfo;
         unsigned int i;
 
+        if (unlikely(!connlimit_rnd_inited)) {
+                get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
+                connlimit_rnd_inited = true;
+        }
         if (nf_ct_l3proto_try_module_get(par->family) < 0) {
                 printk(KERN_WARNING "cannot load conntrack support for "
                        "address family %u\n", par->family);
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 6dc4652f2fe8..ae66305f0fe5 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -113,7 +113,8 @@ ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
 }
 
 static bool
-conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
+conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par,
+             u16 state_mask, u16 status_mask)
 {
         const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
         enum ip_conntrack_info ctinfo;
@@ -136,7 +137,7 @@ conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                         if (test_bit(IPS_DST_NAT_BIT, &ct->status))
                                 statebit |= XT_CONNTRACK_STATE_DNAT;
                 }
-                if (!!(info->state_mask & statebit) ^
+                if (!!(state_mask & statebit) ^
                     !(info->invert_flags & XT_CONNTRACK_STATE))
                         return false;
         }
@@ -172,7 +173,7 @@ conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                 return false;
 
         if ((info->match_flags & XT_CONNTRACK_STATUS) &&
-            (!!(info->status_mask & ct->status) ^
+            (!!(status_mask & ct->status) ^
             !(info->invert_flags & XT_CONNTRACK_STATUS)))
                 return false;
 
@@ -192,11 +193,17 @@ conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 static bool
 conntrack_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_conntrack_mtinfo2 *const *info = par->matchinfo;
-        struct xt_match_param newpar = *par;
+        const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
 
-        newpar.matchinfo = *info;
-        return conntrack_mt(skb, &newpar);
+        return conntrack_mt(skb, par, info->state_mask, info->status_mask);
+}
+
+static bool
+conntrack_mt_v2(const struct sk_buff *skb, const struct xt_match_param *par)
+{
+        const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
+
+        return conntrack_mt(skb, par, info->state_mask, info->status_mask);
 }
 
 static bool conntrack_mt_check(const struct xt_mtchk_param *par)
@@ -209,45 +216,11 @@ static bool conntrack_mt_check(const struct xt_mtchk_param *par)
         return true;
 }
 
-static bool conntrack_mt_check_v1(const struct xt_mtchk_param *par)
-{
-        struct xt_conntrack_mtinfo1 *info = par->matchinfo;
-        struct xt_conntrack_mtinfo2 *up;
-        int ret = conntrack_mt_check(par);
-
-        if (ret < 0)
-                return ret;
-
-        up = kmalloc(sizeof(*up), GFP_KERNEL);
-        if (up == NULL) {
-                nf_ct_l3proto_module_put(par->family);
-                return -ENOMEM;
-        }
-
-        /*
-         * The strategy here is to minimize the overhead of v1 matching,
-         * by prebuilding a v2 struct and putting the pointer into the
-         * v1 dataspace.
-         */
-        memcpy(up, info, offsetof(typeof(*info), state_mask));
-        up->state_mask  = info->state_mask;
-        up->status_mask = info->status_mask;
-        *(void **)info  = up;
-        return true;
-}
-
 static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
 {
         nf_ct_l3proto_module_put(par->family);
 }
 
-static void conntrack_mt_destroy_v1(const struct xt_mtdtor_param *par)
-{
-        struct xt_conntrack_mtinfo2 **info = par->matchinfo;
-        kfree(*info);
-        conntrack_mt_destroy(par);
-}
-
 static struct xt_match conntrack_mt_reg[] __read_mostly = {
         {
                 .name       = "conntrack",
@@ -255,8 +228,8 @@ static struct xt_match conntrack_mt_reg[] __read_mostly = {
                 .family     = NFPROTO_UNSPEC,
                 .matchsize  = sizeof(struct xt_conntrack_mtinfo1),
                 .match      = conntrack_mt_v1,
-                .checkentry = conntrack_mt_check_v1,
-                .destroy    = conntrack_mt_destroy_v1,
+                .checkentry = conntrack_mt_check,
+                .destroy    = conntrack_mt_destroy,
                 .me         = THIS_MODULE,
         },
         {
@@ -264,7 +237,7 @@ static struct xt_match conntrack_mt_reg[] __read_mostly = {
                 .revision   = 2,
                 .family     = NFPROTO_UNSPEC,
                 .matchsize  = sizeof(struct xt_conntrack_mtinfo2),
-                .match      = conntrack_mt,
+                .match      = conntrack_mt_v2,
                 .checkentry = conntrack_mt_check,
                 .destroy    = conntrack_mt_destroy,
                 .me         = THIS_MODULE,
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index 0989f29ade2e..395af5943ffd 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -10,6 +10,7 @@
 
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <net/ip.h>
 #include <linux/dccp.h>
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index dd16e404424f..215a64835de8 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -1,6 +1,6 @@
 /*
  *      xt_hashlimit - Netfilter module to limit the number of packets per time
- *      seperately for each hashbucket (sourceip/sourceport/dstip/dstport)
+ *      separately for each hashbucket (sourceip/sourceport/dstip/dstport)
  *
  *      (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
  *      Copyright © CC Computer Consultants GmbH, 2007 - 2008
@@ -26,6 +26,7 @@
 #endif
 
 #include <net/net_namespace.h>
+#include <net/netns/generic.h>
 
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
@@ -40,9 +41,19 @@ MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
 MODULE_ALIAS("ipt_hashlimit");
 MODULE_ALIAS("ip6t_hashlimit");
 
+struct hashlimit_net {
+        struct hlist_head       htables;
+        struct proc_dir_entry   *ipt_hashlimit;
+        struct proc_dir_entry   *ip6t_hashlimit;
+};
+
+static int hashlimit_net_id;
+static inline struct hashlimit_net *hashlimit_pernet(struct net *net)
+{
+        return net_generic(net, hashlimit_net_id);
+}
+
 /* need to declare this at the top */
-static struct proc_dir_entry *hashlimit_procdir4;
-static struct proc_dir_entry *hashlimit_procdir6;
 static const struct file_operations dl_file_ops;
 
 /* hash table crap */
@@ -79,27 +90,26 @@ struct dsthash_ent {
 
 struct xt_hashlimit_htable {
         struct hlist_node node;         /* global list of all htables */
-        atomic_t use;
+        int use;
         u_int8_t family;
+        bool rnd_initialized;
 
         struct hashlimit_cfg1 cfg;      /* config */
 
         /* used internally */
         spinlock_t lock;                /* lock for list_head */
         u_int32_t rnd;                  /* random seed for hash */
-        int rnd_initialized;
         unsigned int count;             /* number entries in table */
         struct timer_list timer;        /* timer for gc */
 
         /* seq_file stuff */
         struct proc_dir_entry *pde;
+        struct net *net;
 
         struct hlist_head hash[0];      /* hashtable itself */
 };
 
-static DEFINE_SPINLOCK(hashlimit_lock); /* protects htables list */
-static DEFINE_MUTEX(hlimit_mutex);      /* additional checkentry protection */
-static HLIST_HEAD(hashlimit_htables);
+static DEFINE_MUTEX(hashlimit_mutex);   /* protects htables list */
 static struct kmem_cache *hashlimit_cachep __read_mostly;
 
 static inline bool dst_cmp(const struct dsthash_ent *ent,
@@ -150,7 +160,7 @@ dsthash_alloc_init(struct xt_hashlimit_htable *ht,
          * the first hashtable entry */
         if (!ht->rnd_initialized) {
                 get_random_bytes(&ht->rnd, sizeof(ht->rnd));
-                ht->rnd_initialized = 1;
+                ht->rnd_initialized = true;
         }
 
         if (ht->cfg.max && ht->count >= ht->cfg.max) {
@@ -185,8 +195,9 @@ dsthash_free(struct xt_hashlimit_htable *ht, struct dsthash_ent *ent)
 }
 static void htable_gc(unsigned long htlong);
 
-static int htable_create_v0(struct xt_hashlimit_info *minfo, u_int8_t family)
+static int htable_create_v0(struct net *net, struct xt_hashlimit_info *minfo, u_int8_t family)
 {
+        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
         struct xt_hashlimit_htable *hinfo;
         unsigned int size;
         unsigned int i;
@@ -232,33 +243,34 @@ static int htable_create_v0(struct xt_hashlimit_info *minfo, u_int8_t family)
         for (i = 0; i < hinfo->cfg.size; i++)
                 INIT_HLIST_HEAD(&hinfo->hash[i]);
 
-        atomic_set(&hinfo->use, 1);
+        hinfo->use = 1;
         hinfo->count = 0;
         hinfo->family = family;
-        hinfo->rnd_initialized = 0;
+        hinfo->rnd_initialized = false;
         spin_lock_init(&hinfo->lock);
         hinfo->pde = proc_create_data(minfo->name, 0,
                 (family == NFPROTO_IPV4) ?
-                hashlimit_procdir4 : hashlimit_procdir6,
+                hashlimit_net->ipt_hashlimit : hashlimit_net->ip6t_hashlimit,
                 &dl_file_ops, hinfo);
         if (!hinfo->pde) {
                 vfree(hinfo);
                 return -1;
         }
+        hinfo->net = net;
 
         setup_timer(&hinfo->timer, htable_gc, (unsigned long )hinfo);
         hinfo->timer.expires = jiffies + msecs_to_jiffies(hinfo->cfg.gc_interval);
         add_timer(&hinfo->timer);
 
-        spin_lock_bh(&hashlimit_lock);
-        hlist_add_head(&hinfo->node, &hashlimit_htables);
-        spin_unlock_bh(&hashlimit_lock);
+        hlist_add_head(&hinfo->node, &hashlimit_net->htables);
 
         return 0;
 }
 
-static int htable_create(struct xt_hashlimit_mtinfo1 *minfo, u_int8_t family)
+static int htable_create(struct net *net, struct xt_hashlimit_mtinfo1 *minfo,
+                         u_int8_t family)
 {
+        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
         struct xt_hashlimit_htable *hinfo;
         unsigned int size;
         unsigned int i;
@@ -293,28 +305,27 @@ static int htable_create(struct xt_hashlimit_mtinfo1 *minfo, u_int8_t family)
         for (i = 0; i < hinfo->cfg.size; i++)
                 INIT_HLIST_HEAD(&hinfo->hash[i]);
 
-        atomic_set(&hinfo->use, 1);
+        hinfo->use = 1;
         hinfo->count = 0;
         hinfo->family = family;
-        hinfo->rnd_initialized = 0;
+        hinfo->rnd_initialized = false;
         spin_lock_init(&hinfo->lock);
 
         hinfo->pde = proc_create_data(minfo->name, 0,
                 (family == NFPROTO_IPV4) ?
-                hashlimit_procdir4 : hashlimit_procdir6,
+                hashlimit_net->ipt_hashlimit : hashlimit_net->ip6t_hashlimit,
                 &dl_file_ops, hinfo);
         if (hinfo->pde == NULL) {
                 vfree(hinfo);
                 return -1;
         }
+        hinfo->net = net;
 
         setup_timer(&hinfo->timer, htable_gc, (unsigned long)hinfo);
         hinfo->timer.expires = jiffies + msecs_to_jiffies(hinfo->cfg.gc_interval);
         add_timer(&hinfo->timer);
 
-        spin_lock_bh(&hashlimit_lock);
-        hlist_add_head(&hinfo->node, &hashlimit_htables);
-        spin_unlock_bh(&hashlimit_lock);
+        hlist_add_head(&hinfo->node, &hashlimit_net->htables);
 
         return 0;
 }
@@ -364,43 +375,46 @@ static void htable_gc(unsigned long htlong)
 
 static void htable_destroy(struct xt_hashlimit_htable *hinfo)
 {
+        struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
+        struct proc_dir_entry *parent;
+
         del_timer_sync(&hinfo->timer);
 
-        /* remove proc entry */
-        remove_proc_entry(hinfo->pde->name,
-                          hinfo->family == NFPROTO_IPV4 ? hashlimit_procdir4 :
-                                                     hashlimit_procdir6);
+        if (hinfo->family == NFPROTO_IPV4)
+                parent = hashlimit_net->ipt_hashlimit;
+        else
+                parent = hashlimit_net->ip6t_hashlimit;
+        remove_proc_entry(hinfo->pde->name, parent);
         htable_selective_cleanup(hinfo, select_all);
         vfree(hinfo);
 }
 
-static struct xt_hashlimit_htable *htable_find_get(const char *name,
+static struct xt_hashlimit_htable *htable_find_get(struct net *net,
+                                                   const char *name,
                                                    u_int8_t family)
 {
+        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
         struct xt_hashlimit_htable *hinfo;
         struct hlist_node *pos;
 
-        spin_lock_bh(&hashlimit_lock);
-        hlist_for_each_entry(hinfo, pos, &hashlimit_htables, node) {
+        hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node) {
                 if (!strcmp(name, hinfo->pde->name) &&
                     hinfo->family == family) {
-                        atomic_inc(&hinfo->use);
-                        spin_unlock_bh(&hashlimit_lock);
+                        hinfo->use++;
                         return hinfo;
                 }
         }
-        spin_unlock_bh(&hashlimit_lock);
         return NULL;
 }
 
 static void htable_put(struct xt_hashlimit_htable *hinfo)
 {
-        if (atomic_dec_and_test(&hinfo->use)) {
-                spin_lock_bh(&hashlimit_lock);
+        mutex_lock(&hashlimit_mutex);
+        if (--hinfo->use == 0) {
                 hlist_del(&hinfo->node);
-                spin_unlock_bh(&hashlimit_lock);
                 htable_destroy(hinfo);
         }
+        mutex_unlock(&hashlimit_mutex);
 }
 
 /* The algorithm used is the Simple Token Bucket Filter (TBF)
@@ -479,6 +493,7 @@ static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
         case 64 ... 95:
                 i[2] = maskl(i[2], p - 64);
                 i[3] = 0;
+                break;
         case 96 ... 127:
                 i[3] = maskl(i[3], p - 96);
                 break;
@@ -665,6 +680,7 @@ hashlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 
 static bool hashlimit_mt_check_v0(const struct xt_mtchk_param *par)
 {
+        struct net *net = par->net;
         struct xt_hashlimit_info *r = par->matchinfo;
 
         /* Check for overflow. */
@@ -687,25 +703,20 @@ static bool hashlimit_mt_check_v0(const struct xt_mtchk_param *par)
         if (r->name[sizeof(r->name) - 1] != '\0')
                 return false;
 
-        /* This is the best we've got: We cannot release and re-grab lock,
-         * since checkentry() is called before x_tables.c grabs xt_mutex.
-         * We also cannot grab the hashtable spinlock, since htable_create will
-         * call vmalloc, and that can sleep.  And we cannot just re-search
-         * the list of htable's in htable_create(), since then we would
-         * create duplicate proc files. -HW */
-        mutex_lock(&hlimit_mutex);
-        r->hinfo = htable_find_get(r->name, par->match->family);
-        if (!r->hinfo && htable_create_v0(r, par->match->family) != 0) {
-                mutex_unlock(&hlimit_mutex);
+        mutex_lock(&hashlimit_mutex);
+        r->hinfo = htable_find_get(net, r->name, par->match->family);
+        if (!r->hinfo && htable_create_v0(net, r, par->match->family) != 0) {
+                mutex_unlock(&hashlimit_mutex);
                 return false;
         }
-        mutex_unlock(&hlimit_mutex);
+        mutex_unlock(&hashlimit_mutex);
 
         return true;
 }
 
 static bool hashlimit_mt_check(const struct xt_mtchk_param *par)
 {
+        struct net *net = par->net;
         struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
 
         /* Check for overflow. */
@@ -728,19 +739,13 @@ static bool hashlimit_mt_check(const struct xt_mtchk_param *par)
                         return false;
         }
 
-        /* This is the best we've got: We cannot release and re-grab lock,
-         * since checkentry() is called before x_tables.c grabs xt_mutex.
-         * We also cannot grab the hashtable spinlock, since htable_create will
-         * call vmalloc, and that can sleep.  And we cannot just re-search
-         * the list of htable's in htable_create(), since then we would
-         * create duplicate proc files. -HW */
-        mutex_lock(&hlimit_mutex);
-        info->hinfo = htable_find_get(info->name, par->match->family);
-        if (!info->hinfo && htable_create(info, par->match->family) != 0) {
-                mutex_unlock(&hlimit_mutex);
+        mutex_lock(&hashlimit_mutex);
+        info->hinfo = htable_find_get(net, info->name, par->match->family);
+        if (!info->hinfo && htable_create(net, info, par->match->family) != 0) {
+                mutex_unlock(&hashlimit_mutex);
                 return false;
         }
-        mutex_unlock(&hlimit_mutex);
+        mutex_unlock(&hashlimit_mutex);
         return true;
 }
 
@@ -767,7 +772,7 @@ struct compat_xt_hashlimit_info {
         compat_uptr_t master;
 };
 
-static void hashlimit_mt_compat_from_user(void *dst, void *src)
+static void hashlimit_mt_compat_from_user(void *dst, const void *src)
 {
         int off = offsetof(struct compat_xt_hashlimit_info, hinfo);
 
@@ -775,7 +780,7 @@ static void hashlimit_mt_compat_from_user(void *dst, void *src)
         memset(dst + off, 0, sizeof(struct compat_xt_hashlimit_info) - off);
 }
 
-static int hashlimit_mt_compat_to_user(void __user *dst, void *src)
+static int hashlimit_mt_compat_to_user(void __user *dst, const void *src)
 {
         int off = offsetof(struct compat_xt_hashlimit_info, hinfo);
 
@@ -841,8 +846,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {
 static void *dl_seq_start(struct seq_file *s, loff_t *pos)
         __acquires(htable->lock)
 {
-        struct proc_dir_entry *pde = s->private;
-        struct xt_hashlimit_htable *htable = pde->data;
+        struct xt_hashlimit_htable *htable = s->private;
         unsigned int *bucket;
 
         spin_lock_bh(&htable->lock);
@@ -859,8 +863,7 @@ static void *dl_seq_start(struct seq_file *s, loff_t *pos)
 
 static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct proc_dir_entry *pde = s->private;
-        struct xt_hashlimit_htable *htable = pde->data;
+        struct xt_hashlimit_htable *htable = s->private;
         unsigned int *bucket = (unsigned int *)v;
 
         *pos = ++(*bucket);
@@ -874,11 +877,11 @@ static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
 static void dl_seq_stop(struct seq_file *s, void *v)
         __releases(htable->lock)
 {
-        struct proc_dir_entry *pde = s->private;
-        struct xt_hashlimit_htable *htable = pde->data;
+        struct xt_hashlimit_htable *htable = s->private;
         unsigned int *bucket = (unsigned int *)v;
 
-        kfree(bucket);
+        if (!IS_ERR(bucket))
+                kfree(bucket);
         spin_unlock_bh(&htable->lock);
 }
 
@@ -917,8 +920,7 @@ static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
 
 static int dl_seq_show(struct seq_file *s, void *v)
 {
-        struct proc_dir_entry *pde = s->private;
-        struct xt_hashlimit_htable *htable = pde->data;
+        struct xt_hashlimit_htable *htable = s->private;
         unsigned int *bucket = (unsigned int *)v;
         struct dsthash_ent *ent;
         struct hlist_node *pos;
@@ -944,7 +946,7 @@ static int dl_proc_open(struct inode *inode, struct file *file)
 
         if (!ret) {
                 struct seq_file *sf = file->private_data;
-                sf->private = PDE(inode);
+                sf->private = PDE(inode)->data;
         }
         return ret;
 }
@@ -957,10 +959,61 @@ static const struct file_operations dl_file_ops = {
         .release = seq_release
 };
 
+static int __net_init hashlimit_proc_net_init(struct net *net)
+{
+        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
+
+        hashlimit_net->ipt_hashlimit = proc_mkdir("ipt_hashlimit", net->proc_net);
+        if (!hashlimit_net->ipt_hashlimit)
+                return -ENOMEM;
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+        hashlimit_net->ip6t_hashlimit = proc_mkdir("ip6t_hashlimit", net->proc_net);
+        if (!hashlimit_net->ip6t_hashlimit) {
+                proc_net_remove(net, "ipt_hashlimit");
+                return -ENOMEM;
+        }
+#endif
+        return 0;
+}
+
+static void __net_exit hashlimit_proc_net_exit(struct net *net)
+{
+        proc_net_remove(net, "ipt_hashlimit");
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+        proc_net_remove(net, "ip6t_hashlimit");
+#endif
+}
+
+static int __net_init hashlimit_net_init(struct net *net)
+{
+        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
+
+        INIT_HLIST_HEAD(&hashlimit_net->htables);
+        return hashlimit_proc_net_init(net);
+}
+
+static void __net_exit hashlimit_net_exit(struct net *net)
+{
+        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
+
+        BUG_ON(!hlist_empty(&hashlimit_net->htables));
+        hashlimit_proc_net_exit(net);
+}
+
+static struct pernet_operations hashlimit_net_ops = {
+        .init   = hashlimit_net_init,
+        .exit   = hashlimit_net_exit,
+        .id     = &hashlimit_net_id,
+        .size   = sizeof(struct hashlimit_net),
+};
+
 static int __init hashlimit_mt_init(void)
 {
         int err;
 
+        err = register_pernet_subsys(&hashlimit_net_ops);
+        if (err < 0)
+                return err;
         err = xt_register_matches(hashlimit_mt_reg,
               ARRAY_SIZE(hashlimit_mt_reg));
         if (err < 0)
@@ -974,41 +1027,21 @@ static int __init hashlimit_mt_init(void)
                 printk(KERN_ERR "xt_hashlimit: unable to create slab cache\n");
                 goto err2;
         }
-        hashlimit_procdir4 = proc_mkdir("ipt_hashlimit", init_net.proc_net);
-        if (!hashlimit_procdir4) {
-                printk(KERN_ERR "xt_hashlimit: unable to create proc dir "
-                                "entry\n");
-                goto err3;
-        }
-        err = 0;
-#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-        hashlimit_procdir6 = proc_mkdir("ip6t_hashlimit", init_net.proc_net);
-        if (!hashlimit_procdir6) {
-                printk(KERN_ERR "xt_hashlimit: unable to create proc dir "
-                                "entry\n");
-                err = -ENOMEM;
-        }
-#endif
-        if (!err)
-                return 0;
-        remove_proc_entry("ipt_hashlimit", init_net.proc_net);
-err3:
-        kmem_cache_destroy(hashlimit_cachep);
+        return 0;
+
 err2:
         xt_unregister_matches(hashlimit_mt_reg, ARRAY_SIZE(hashlimit_mt_reg));
 err1:
+        unregister_pernet_subsys(&hashlimit_net_ops);
         return err;
 
 }
 
 static void __exit hashlimit_mt_exit(void)
 {
-        remove_proc_entry("ipt_hashlimit", init_net.proc_net);
-#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-        remove_proc_entry("ip6t_hashlimit", init_net.proc_net);
-#endif
         kmem_cache_destroy(hashlimit_cachep);
         xt_unregister_matches(hashlimit_mt_reg, ARRAY_SIZE(hashlimit_mt_reg));
+        unregister_pernet_subsys(&hashlimit_net_ops);
 }
 
 module_init(hashlimit_mt_init);
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index 2773be6a71dd..e5d7e1ffb1a4 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -6,6 +6,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
@@ -148,7 +149,7 @@ struct compat_xt_rateinfo {
 
 /* To keep the full "prev" timestamp, the upper 32 bits are stored in the
  * master pointer, which does not need to be preserved. */
-static void limit_mt_compat_from_user(void *dst, void *src)
+static void limit_mt_compat_from_user(void *dst, const void *src)
 {
         const struct compat_xt_rateinfo *cm = src;
         struct xt_rateinfo m = {
@@ -162,7 +163,7 @@ static void limit_mt_compat_from_user(void *dst, void *src)
         memcpy(dst, &m, sizeof(m));
 }
 
-static int limit_mt_compat_to_user(void __user *dst, void *src)
+static int limit_mt_compat_to_user(void __user *dst, const void *src)
 {
         const struct xt_rateinfo *m = src;
         struct compat_xt_rateinfo cm = {
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 4d1a41bbd5d7..4169e200588d 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -334,7 +334,7 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
                         if (info->flags & XT_OSF_LOG)
                                 nf_log_packet(p->family, p->hooknum, skb,
                                         p->in, p->out, NULL,
-                                        "%s [%s:%s] : %pi4:%d -> %pi4:%d hops=%d\n",
+                                        "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
                                         f->genre, f->version, f->subtype,
                                         &ip->saddr, ntohs(tcp->source),
                                         &ip->daddr, ntohs(tcp->dest),
@@ -349,7 +349,7 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
 
         if (!fcount && (info->flags & XT_OSF_LOG))
                 nf_log_packet(p->family, p->hooknum, skb, p->in, p->out, NULL,
-                        "Remote OS is not known: %pi4:%u -> %pi4:%u\n",
+                        "Remote OS is not known: %pI4:%u -> %pI4:%u\n",
                                 &ip->saddr, ntohs(tcp->source),
                                 &ip->daddr, ntohs(tcp->dest));
 
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 390b7d09fe51..2d5562498c43 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -4,6 +4,7 @@
  * Sam Johnston <samj@samj.net>
  */
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 
 #include <linux/netfilter/x_tables.h>
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index eb0ceb846527..834b736857cb 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -27,7 +27,9 @@
 #include <linux/bitops.h>
 #include <linux/skbuff.h>
 #include <linux/inet.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
+#include <net/netns/generic.h>
 
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_recent.h>
@@ -52,7 +54,7 @@ module_param(ip_list_perms, uint, 0400);
 module_param(ip_list_uid, uint, 0400);
 module_param(ip_list_gid, uint, 0400);
 MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
-MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP to remember (max. 255)");
+MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP address to remember (max. 255)");
 MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
 MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/xt_recent/* files");
 MODULE_PARM_DESC(ip_list_uid,"owner of /proc/net/xt_recent/* files");
@@ -78,37 +80,40 @@ struct recent_table {
         struct list_head        iphash[0];
 };
 
-static LIST_HEAD(tables);
+struct recent_net {
+        struct list_head        tables;
+#ifdef CONFIG_PROC_FS
+        struct proc_dir_entry   *xt_recent;
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+        struct proc_dir_entry   *ipt_recent;
+#endif
+#endif
+};
+
+static int recent_net_id;
+static inline struct recent_net *recent_pernet(struct net *net)
+{
+        return net_generic(net, recent_net_id);
+}
+
 static DEFINE_SPINLOCK(recent_lock);
 static DEFINE_MUTEX(recent_mutex);
 
 #ifdef CONFIG_PROC_FS
-#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
-static struct proc_dir_entry *proc_old_dir;
-#endif
-static struct proc_dir_entry *recent_proc_dir;
 static const struct file_operations recent_old_fops, recent_mt_fops;
 #endif
 
-static u_int32_t hash_rnd;
-static bool hash_rnd_initted;
+static u_int32_t hash_rnd __read_mostly;
+static bool hash_rnd_inited __read_mostly;
 
-static unsigned int recent_entry_hash4(const union nf_inet_addr *addr)
+static inline unsigned int recent_entry_hash4(const union nf_inet_addr *addr)
 {
-        if (!hash_rnd_initted) {
-                get_random_bytes(&hash_rnd, sizeof(hash_rnd));
-                hash_rnd_initted = true;
-        }
         return jhash_1word((__force u32)addr->ip, hash_rnd) &
                (ip_list_hash_size - 1);
 }
 
-static unsigned int recent_entry_hash6(const union nf_inet_addr *addr)
+static inline unsigned int recent_entry_hash6(const union nf_inet_addr *addr)
 {
-        if (!hash_rnd_initted) {
-                get_random_bytes(&hash_rnd, sizeof(hash_rnd));
-                hash_rnd_initted = true;
-        }
         return jhash2((u32 *)addr->ip6, ARRAY_SIZE(addr->ip6), hash_rnd) &
                (ip_list_hash_size - 1);
 }
@@ -173,18 +178,19 @@ recent_entry_init(struct recent_table *t, const union nf_inet_addr *addr,
 
 static void recent_entry_update(struct recent_table *t, struct recent_entry *e)
 {
+        e->index %= ip_pkt_list_tot;
         e->stamps[e->index++] = jiffies;
         if (e->index > e->nstamps)
                 e->nstamps = e->index;
-        e->index %= ip_pkt_list_tot;
         list_move_tail(&e->lru_list, &t->lru_list);
 }
 
-static struct recent_table *recent_table_lookup(const char *name)
+static struct recent_table *recent_table_lookup(struct recent_net *recent_net,
+                                                const char *name)
 {
         struct recent_table *t;
 
-        list_for_each_entry(t, &tables, list)
+        list_for_each_entry(t, &recent_net->tables, list)
                 if (!strcmp(t->name, name))
                         return t;
         return NULL;
@@ -203,6 +209,8 @@ static void recent_table_flush(struct recent_table *t)
 static bool
 recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
+        struct net *net = dev_net(par->in ? par->in : par->out);
+        struct recent_net *recent_net = recent_pernet(net);
         const struct xt_recent_mtinfo *info = par->matchinfo;
         struct recent_table *t;
         struct recent_entry *e;
@@ -235,7 +243,7 @@ recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                 ttl++;
 
         spin_lock_bh(&recent_lock);
-        t = recent_table_lookup(info->name);
+        t = recent_table_lookup(recent_net, info->name);
         e = recent_entry_lookup(t, &addr, par->match->family,
                                 (info->check_set & XT_RECENT_TTL) ? ttl : 0);
         if (e == NULL) {
@@ -260,7 +268,7 @@ recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                 for (i = 0; i < e->nstamps; i++) {
                         if (info->seconds && time_after(time, e->stamps[i]))
                                 continue;
-                        if (++hits >= info->hit_count) {
+                        if (!info->hit_count || ++hits >= info->hit_count) {
                                 ret = !ret;
                                 break;
                         }
@@ -279,6 +287,7 @@ out:
 
 static bool recent_mt_check(const struct xt_mtchk_param *par)
 {
+        struct recent_net *recent_net = recent_pernet(par->net);
         const struct xt_recent_mtinfo *info = par->matchinfo;
         struct recent_table *t;
 #ifdef CONFIG_PROC_FS
@@ -287,6 +296,10 @@ static bool recent_mt_check(const struct xt_mtchk_param *par)
         unsigned i;
         bool ret = false;
 
+        if (unlikely(!hash_rnd_inited)) {
+                get_random_bytes(&hash_rnd, sizeof(hash_rnd));
+                hash_rnd_inited = true;
+        }
         if (hweight8(info->check_set &
                      (XT_RECENT_SET | XT_RECENT_REMOVE |
                       XT_RECENT_CHECK | XT_RECENT_UPDATE)) != 1)
@@ -294,14 +307,18 @@ static bool recent_mt_check(const struct xt_mtchk_param *par)
         if ((info->check_set & (XT_RECENT_SET | XT_RECENT_REMOVE)) &&
             (info->seconds || info->hit_count))
                 return false;
-        if (info->hit_count > ip_pkt_list_tot)
+        if (info->hit_count > ip_pkt_list_tot) {
+                pr_info(KBUILD_MODNAME ": hitcount (%u) is larger than "
+                        "packets to be remembered (%u)\n",
+                        info->hit_count, ip_pkt_list_tot);
                 return false;
+        }
         if (info->name[0] == '\0' ||
             strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN)
                 return false;
 
         mutex_lock(&recent_mutex);
-        t = recent_table_lookup(info->name);
+        t = recent_table_lookup(recent_net, info->name);
         if (t != NULL) {
                 t->refcnt++;
                 ret = true;
@@ -318,7 +335,7 @@ static bool recent_mt_check(const struct xt_mtchk_param *par)
         for (i = 0; i < ip_list_hash_size; i++)
                 INIT_LIST_HEAD(&t->iphash[i]);
 #ifdef CONFIG_PROC_FS
-        pde = proc_create_data(t->name, ip_list_perms, recent_proc_dir,
+        pde = proc_create_data(t->name, ip_list_perms, recent_net->xt_recent,
                   &recent_mt_fops, t);
         if (pde == NULL) {
                 kfree(t);
@@ -327,10 +344,10 @@ static bool recent_mt_check(const struct xt_mtchk_param *par)
         pde->uid = ip_list_uid;
         pde->gid = ip_list_gid;
 #ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
-        pde = proc_create_data(t->name, ip_list_perms, proc_old_dir,
+        pde = proc_create_data(t->name, ip_list_perms, recent_net->ipt_recent,
                       &recent_old_fops, t);
         if (pde == NULL) {
-                remove_proc_entry(t->name, proc_old_dir);
+                remove_proc_entry(t->name, recent_net->xt_recent);
                 kfree(t);
                 goto out;
         }
@@ -339,7 +356,7 @@ static bool recent_mt_check(const struct xt_mtchk_param *par)
 #endif
 #endif
         spin_lock_bh(&recent_lock);
-        list_add_tail(&t->list, &tables);
+        list_add_tail(&t->list, &recent_net->tables);
         spin_unlock_bh(&recent_lock);
         ret = true;
 out:
@@ -349,20 +366,21 @@ out:
 
 static void recent_mt_destroy(const struct xt_mtdtor_param *par)
 {
+        struct recent_net *recent_net = recent_pernet(par->net);
         const struct xt_recent_mtinfo *info = par->matchinfo;
         struct recent_table *t;
 
         mutex_lock(&recent_mutex);
-        t = recent_table_lookup(info->name);
+        t = recent_table_lookup(recent_net, info->name);
         if (--t->refcnt == 0) {
                 spin_lock_bh(&recent_lock);
                 list_del(&t->list);
                 spin_unlock_bh(&recent_lock);
 #ifdef CONFIG_PROC_FS
 #ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
-                remove_proc_entry(t->name, proc_old_dir);
+                remove_proc_entry(t->name, recent_net->ipt_recent);
 #endif
-                remove_proc_entry(t->name, recent_proc_dir);
+                remove_proc_entry(t->name, recent_net->xt_recent);
 #endif
                 recent_table_flush(t);
                 kfree(t);
@@ -482,8 +500,7 @@ static ssize_t recent_old_proc_write(struct file *file,
         if (copy_from_user(buf, input, size))
                 return -EFAULT;
 
-        while (isspace(*c))
-                c++;
+        c = skip_spaces(c);
 
         if (size - (c - buf) < 5)
                 return c - buf;
@@ -612,8 +629,65 @@ static const struct file_operations recent_mt_fops = {
         .release = seq_release_private,
         .owner   = THIS_MODULE,
 };
+
+static int __net_init recent_proc_net_init(struct net *net)
+{
+        struct recent_net *recent_net = recent_pernet(net);
+
+        recent_net->xt_recent = proc_mkdir("xt_recent", net->proc_net);
+        if (!recent_net->xt_recent)
+                return -ENOMEM;
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+        recent_net->ipt_recent = proc_mkdir("ipt_recent", net->proc_net);
+        if (!recent_net->ipt_recent) {
+                proc_net_remove(net, "xt_recent");
+                return -ENOMEM;
+        }
+#endif
+        return 0;
+}
+
+static void __net_exit recent_proc_net_exit(struct net *net)
+{
+#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
+        proc_net_remove(net, "ipt_recent");
+#endif
+        proc_net_remove(net, "xt_recent");
+}
+#else
+static inline int recent_proc_net_init(struct net *net)
+{
+        return 0;
+}
+
+static inline void recent_proc_net_exit(struct net *net)
+{
+}
 #endif /* CONFIG_PROC_FS */
 
+static int __net_init recent_net_init(struct net *net)
+{
+        struct recent_net *recent_net = recent_pernet(net);
+
+        INIT_LIST_HEAD(&recent_net->tables);
+        return recent_proc_net_init(net);
+}
+
+static void __net_exit recent_net_exit(struct net *net)
+{
+        struct recent_net *recent_net = recent_pernet(net);
+
+        BUG_ON(!list_empty(&recent_net->tables));
+        recent_proc_net_exit(net);
+}
+
+static struct pernet_operations recent_net_ops = {
+        .init   = recent_net_init,
+        .exit   = recent_net_exit,
+        .id     = &recent_net_id,
+        .size   = sizeof(struct recent_net),
+};
+
 static struct xt_match recent_mt_reg[] __read_mostly = {
         {
                 .name       = "recent",
@@ -645,39 +719,19 @@ static int __init recent_mt_init(void)
                 return -EINVAL;
         ip_list_hash_size = 1 << fls(ip_list_tot);
 
-        err = xt_register_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
-#ifdef CONFIG_PROC_FS
+        err = register_pernet_subsys(&recent_net_ops);
         if (err)
                 return err;
-        recent_proc_dir = proc_mkdir("xt_recent", init_net.proc_net);
-        if (recent_proc_dir == NULL) {
-                xt_unregister_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
-                err = -ENOMEM;
-        }
-#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
-        if (err < 0)
-                return err;
-        proc_old_dir = proc_mkdir("ipt_recent", init_net.proc_net);
-        if (proc_old_dir == NULL) {
-                remove_proc_entry("xt_recent", init_net.proc_net);
-                xt_unregister_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
-                err = -ENOMEM;
-        }
-#endif
-#endif
+        err = xt_register_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
+        if (err)
+                unregister_pernet_subsys(&recent_net_ops);
         return err;
 }
 
 static void __exit recent_mt_exit(void)
 {
-        BUG_ON(!list_empty(&tables));
         xt_unregister_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
-#ifdef CONFIG_PROC_FS
-#ifdef CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT
-        remove_proc_entry("ipt_recent", init_net.proc_net);
-#endif
-        remove_proc_entry("xt_recent", init_net.proc_net);
-#endif
+        unregister_pernet_subsys(&recent_net_ops);
 }
 
 module_init(recent_mt_init);
diff --git a/net/netfilter/xt_repldata.h b/net/netfilter/xt_repldata.h
new file mode 100644
index 000000000000..6efe4e5a81c6
--- /dev/null
+++ b/net/netfilter/xt_repldata.h
@@ -0,0 +1,35 @@
+/*
+ * Today's hack: quantum tunneling in structs
+ *
+ * 'entries' and 'term' are never anywhere referenced by word in code. In fact,
+ * they serve as the hanging-off data accessed through repl.data[].
+ */
+
+#define xt_alloc_initial_table(type, typ2) ({ \
+        unsigned int hook_mask = info->valid_hooks; \
+        unsigned int nhooks = hweight32(hook_mask); \
+        unsigned int bytes = 0, hooknum = 0, i = 0; \
+        struct { \
+                struct type##_replace repl; \
+                struct type##_standard entries[nhooks]; \
+                struct type##_error term; \
+        } *tbl = kzalloc(sizeof(*tbl), GFP_KERNEL); \
+        if (tbl == NULL) \
+                return NULL; \
+        strncpy(tbl->repl.name, info->name, sizeof(tbl->repl.name)); \
+        tbl->term = (struct type##_error)typ2##_ERROR_INIT;  \
+        tbl->repl.valid_hooks = hook_mask; \
+        tbl->repl.num_entries = nhooks + 1; \
+        tbl->repl.size = nhooks * sizeof(struct type##_standard) + \
+                         sizeof(struct type##_error); \
+        for (; hook_mask != 0; hook_mask >>= 1, ++hooknum) { \
+                if (!(hook_mask & 1)) \
+                        continue; \
+                tbl->repl.hook_entry[hooknum] = bytes; \
+                tbl->repl.underflow[hooknum]  = bytes; \
+                tbl->entries[i++] = (struct type##_standard) \
+                        typ2##_STANDARD_INIT(NF_ACCEPT); \
+                bytes += sizeof(struct type##_standard); \
+        } \
+        tbl; \
+})
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index ebf00ad5b194..6a902564d24f 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -149,7 +149,7 @@ socket_match(const struct sk_buff *skb, const struct xt_match_param *par,
 
                 /* Ignore sockets listening on INADDR_ANY */
                 wildcard = (sk->sk_state != TCP_TIME_WAIT &&
-                            inet_sk(sk)->rcv_saddr == 0);
+                            inet_sk(sk)->inet_rcv_saddr == 0);
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
@@ -192,7 +192,8 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                 .revision       = 0,
                 .family         = NFPROTO_IPV4,
                 .match          = socket_mt_v0,
-                .hooks          = 1 << NF_INET_PRE_ROUTING,
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
         {
@@ -201,7 +202,8 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                 .family         = NFPROTO_IPV4,
                 .match          = socket_mt_v1,
                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
-                .hooks          = 1 << NF_INET_PRE_ROUTING,
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
 };
diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c
index d8c0f8f1a78e..937ce0633e99 100644
--- a/net/netfilter/xt_statistic.c
+++ b/net/netfilter/xt_statistic.c
@@ -12,6 +12,7 @@
 #include <linux/spinlock.h>
 #include <linux/skbuff.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 
 #include <linux/netfilter/xt_statistic.h>
 #include <linux/netfilter/x_tables.h>
diff --git a/net/netfilter/xt_string.c b/net/netfilter/xt_string.c
index b4d774111311..96801ffd8af8 100644
--- a/net/netfilter/xt_string.c
+++ b/net/netfilter/xt_string.c
@@ -7,6 +7,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index e639298bc9c8..5f14c8462e30 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -33,6 +33,7 @@
 #include <linux/string.h>
 #include <linux/skbuff.h>
 #include <linux/audit.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index 7a10bbe02c13..d37b7f80fa37 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -35,6 +35,7 @@
 #include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/audit.h>
+#include <linux/slab.h>
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
 #include <asm/bug.h>
@@ -50,9 +51,12 @@ struct netlbl_domhsh_tbl {
 };
 
 /* Domain hash table */
-/* XXX - updates should be so rare that having one spinlock for the entire
- * hash table should be okay */
+/* updates should be so rare that having one spinlock for the entire hash table
+ * should be okay */
 static DEFINE_SPINLOCK(netlbl_domhsh_lock);
+#define netlbl_domhsh_rcu_deref(p) \
+        rcu_dereference_check(p, rcu_read_lock_held() || \
+                                 lockdep_is_held(&netlbl_domhsh_lock))
 static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
 static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
 
@@ -106,7 +110,8 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry)
  * Description:
  * This is the hashing function for the domain hash table, it returns the
  * correct bucket number for the domain.  The caller is responsibile for
- * calling the rcu_read_[un]lock() functions.
+ * ensuring that the hash table is protected with either a RCU read lock or the
+ * hash table lock.
  *
  */
 static u32 netlbl_domhsh_hash(const char *key)
@@ -120,7 +125,7 @@ static u32 netlbl_domhsh_hash(const char *key)
 
         for (iter = 0, val = 0, len = strlen(key); iter < len; iter++)
                 val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];
-        return val & (rcu_dereference(netlbl_domhsh)->size - 1);
+        return val & (netlbl_domhsh_rcu_deref(netlbl_domhsh)->size - 1);
 }
 
 /**
@@ -130,7 +135,8 @@ static u32 netlbl_domhsh_hash(const char *key)
  * Description:
  * Searches the domain hash table and returns a pointer to the hash table
  * entry if found, otherwise NULL is returned.  The caller is responsibile for
- * the rcu hash table locks (i.e. the caller much call rcu_read_[un]lock()).
+ * ensuring that the hash table is protected with either a RCU read lock or the
+ * hash table lock.
  *
  */
 static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain)
@@ -141,7 +147,7 @@ static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain)
 
         if (domain != NULL) {
                 bkt = netlbl_domhsh_hash(domain);
-                bkt_list = &rcu_dereference(netlbl_domhsh)->tbl[bkt];
+                bkt_list = &netlbl_domhsh_rcu_deref(netlbl_domhsh)->tbl[bkt];
                 list_for_each_entry_rcu(iter, bkt_list, list)
                         if (iter->valid && strcmp(iter->domain, domain) == 0)
                                 return iter;
@@ -159,8 +165,8 @@ static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain)
  * Searches the domain hash table and returns a pointer to the hash table
  * entry if an exact match is found, if an exact match is not present in the
  * hash table then the default entry is returned if valid otherwise NULL is
- * returned.  The caller is responsibile for the rcu hash table locks
- * (i.e. the caller much call rcu_read_[un]lock()).
+ * returned.  The caller is responsibile ensuring that the hash table is
+ * protected with either a RCU read lock or the hash table lock.
  *
  */
 static struct netlbl_dom_map *netlbl_domhsh_search_def(const char *domain)
@@ -169,7 +175,7 @@ static struct netlbl_dom_map *netlbl_domhsh_search_def(const char *domain)
 
         entry = netlbl_domhsh_search(domain);
         if (entry == NULL) {
-                entry = rcu_dereference(netlbl_domhsh_def);
+                entry = netlbl_domhsh_rcu_deref(netlbl_domhsh_def);
                 if (entry != NULL && !entry->valid)
                         entry = NULL;
         }
@@ -306,8 +312,11 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
         struct netlbl_af6list *tmp6;
 #endif /* IPv6 */
 
+        /* XXX - we can remove this RCU read lock as the spinlock protects the
+         *       entire function, but before we do we need to fixup the
+         *       netlbl_af[4,6]list RCU functions to do "the right thing" with
+         *       respect to rcu_dereference() when only a spinlock is held. */
         rcu_read_lock();
-
         spin_lock(&netlbl_domhsh_lock);
         if (entry->domain != NULL)
                 entry_old = netlbl_domhsh_search(entry->domain);
@@ -315,7 +324,6 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 entry_old = netlbl_domhsh_search_def(entry->domain);
         if (entry_old == NULL) {
                 entry->valid = 1;
-                INIT_RCU_HEAD(&entry->rcu);
 
                 if (entry->domain != NULL) {
                         u32 bkt = netlbl_domhsh_hash(entry->domain);
@@ -682,7 +690,7 @@ struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
  * buckets and @skip_chain entries.  For each entry in the table call
  * @callback, if @callback returns a negative value stop 'walking' through the
  * table and return.  Updates the values in @skip_bkt and @skip_chain on
- * return.  Returns zero on succcess, negative values on failure.
+ * return.  Returns zero on success, negative values on failure.
  *
  */
 int netlbl_domhsh_walk(u32 *skip_bkt,
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 6ce00205f342..1b83e0009d8d 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -30,6 +30,7 @@
 
 #include <linux/init.h>
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/audit.h>
 #include <linux/in.h>
 #include <linux/in6.h>
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 8203623e65ad..998e85e895d0 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/in.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index fb357f010189..a3d64aabe2f7 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -43,6 +43,7 @@
 #include <linux/notifier.h>
 #include <linux/netdevice.h>
 #include <linux/security.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
@@ -114,6 +115,9 @@ struct netlbl_unlhsh_walk_arg {
 /* updates should be so rare that having one spinlock for the entire
  * hash table should be okay */
 static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
+#define netlbl_unlhsh_rcu_deref(p) \
+        rcu_dereference_check(p, rcu_read_lock_held() || \
+                                 lockdep_is_held(&netlbl_unlhsh_lock))
 static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL;
 static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL;
 
@@ -235,15 +239,13 @@ static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
  * Description:
  * This is the hashing function for the unlabeled hash table, it returns the
  * bucket number for the given device/interface.  The caller is responsible for
- * calling the rcu_read_[un]lock() functions.
+ * ensuring that the hash table is protected with either a RCU read lock or
+ * the hash table lock.
  *
  */
 static u32 netlbl_unlhsh_hash(int ifindex)
 {
-        /* this is taken _almost_ directly from
-         * security/selinux/netif.c:sel_netif_hasfn() as they do pretty much
-         * the same thing */
-        return ifindex & (rcu_dereference(netlbl_unlhsh)->size - 1);
+        return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
 }
 
 /**
@@ -253,7 +255,8 @@ static u32 netlbl_unlhsh_hash(int ifindex)
  * Description:
  * Searches the unlabeled connection hash table and returns a pointer to the
  * interface entry which matches @ifindex, otherwise NULL is returned.  The
- * caller is responsible for calling the rcu_read_[un]lock() functions.
+ * caller is responsible for ensuring that the hash table is protected with
+ * either a RCU read lock or the hash table lock.
  *
  */
 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
@@ -263,7 +266,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
         struct netlbl_unlhsh_iface *iter;
 
         bkt = netlbl_unlhsh_hash(ifindex);
-        bkt_list = &rcu_dereference(netlbl_unlhsh)->tbl[bkt];
+        bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
         list_for_each_entry_rcu(iter, bkt_list, list)
                 if (iter->valid && iter->ifindex == ifindex)
                         return iter;
@@ -272,33 +275,6 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
 }
 
 /**
- * netlbl_unlhsh_search_iface_def - Search for a matching interface entry
- * @ifindex: the network interface
- *
- * Description:
- * Searches the unlabeled connection hash table and returns a pointer to the
- * interface entry which matches @ifindex.  If an exact match can not be found
- * and there is a valid default entry, the default entry is returned, otherwise
- * NULL is returned.  The caller is responsible for calling the
- * rcu_read_[un]lock() functions.
- *
- */
-static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface_def(int ifindex)
-{
-        struct netlbl_unlhsh_iface *entry;
-
-        entry = netlbl_unlhsh_search_iface(ifindex);
-        if (entry != NULL)
-                return entry;
-
-        entry = rcu_dereference(netlbl_unlhsh_def);
-        if (entry != NULL && entry->valid)
-                return entry;
-
-        return NULL;
-}
-
-/**
  * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
  * @iface: the associated interface entry
  * @addr: IPv4 address in network byte order
@@ -308,8 +284,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface_def(int ifindex)
  * Description:
  * Add a new address entry into the unlabeled connection hash table using the
  * interface entry specified by @iface.  On success zero is returned, otherwise
- * a negative value is returned.  The caller is responsible for calling the
- * rcu_read_[un]lock() functions.
+ * a negative value is returned.
  *
  */
 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
@@ -327,7 +302,6 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
         entry->list.addr = addr->s_addr & mask->s_addr;
         entry->list.mask = mask->s_addr;
         entry->list.valid = 1;
-        INIT_RCU_HEAD(&entry->rcu);
         entry->secid = secid;
 
         spin_lock(&netlbl_unlhsh_lock);
@@ -350,8 +324,7 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
  * Description:
  * Add a new address entry into the unlabeled connection hash table using the
  * interface entry specified by @iface.  On success zero is returned, otherwise
- * a negative value is returned.  The caller is responsible for calling the
- * rcu_read_[un]lock() functions.
+ * a negative value is returned.
  *
  */
 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
@@ -373,7 +346,6 @@ static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
         entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
         ipv6_addr_copy(&entry->list.mask, mask);
         entry->list.valid = 1;
-        INIT_RCU_HEAD(&entry->rcu);
         entry->secid = secid;
 
         spin_lock(&netlbl_unlhsh_lock);
@@ -393,8 +365,7 @@ static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
  * Description:
  * Add a new, empty, interface entry into the unlabeled connection hash table.
  * On success a pointer to the new interface entry is returned, on failure NULL
- * is returned.  The caller is responsible for calling the rcu_read_[un]lock()
- * functions.
+ * is returned.
  *
  */
 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
@@ -410,7 +381,6 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
         INIT_LIST_HEAD(&iface->addr4_list);
         INIT_LIST_HEAD(&iface->addr6_list);
         iface->valid = 1;
-        INIT_RCU_HEAD(&iface->rcu);
 
         spin_lock(&netlbl_unlhsh_lock);
         if (ifindex > 0) {
@@ -418,10 +388,10 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
                 if (netlbl_unlhsh_search_iface(ifindex) != NULL)
                         goto add_iface_failure;
                 list_add_tail_rcu(&iface->list,
-                                  &rcu_dereference(netlbl_unlhsh)->tbl[bkt]);
+                             &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
         } else {
                 INIT_LIST_HEAD(&iface->list);
-                if (rcu_dereference(netlbl_unlhsh_def) != NULL)
+                if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
                         goto add_iface_failure;
                 rcu_assign_pointer(netlbl_unlhsh_def, iface);
         }
@@ -472,13 +442,12 @@ int netlbl_unlhsh_add(struct net *net,
 
         rcu_read_lock();
         if (dev_name != NULL) {
-                dev = dev_get_by_name(net, dev_name);
+                dev = dev_get_by_name_rcu(net, dev_name);
                 if (dev == NULL) {
                         ret_val = -ENODEV;
                         goto unlhsh_add_return;
                 }
                 ifindex = dev->ifindex;
-                dev_put(dev);
                 iface = netlbl_unlhsh_search_iface(ifindex);
         } else {
                 ifindex = 0;
@@ -552,8 +521,7 @@ unlhsh_add_return:
  *
  * Description:
  * Remove an IP address entry from the unlabeled connection hash table.
- * Returns zero on success, negative values on failure.  The caller is
- * responsible for calling the rcu_read_[un]lock() functions.
+ * Returns zero on success, negative values on failure.
  *
  */
 static int netlbl_unlhsh_remove_addr4(struct net *net,
@@ -615,8 +583,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
  *
  * Description:
  * Remove an IP address entry from the unlabeled connection hash table.
- * Returns zero on success, negative values on failure.  The caller is
- * responsible for calling the rcu_read_[un]lock() functions.
+ * Returns zero on success, negative values on failure.
  *
  */
 static int netlbl_unlhsh_remove_addr6(struct net *net,
@@ -737,13 +704,12 @@ int netlbl_unlhsh_remove(struct net *net,
 
         rcu_read_lock();
         if (dev_name != NULL) {
-                dev = dev_get_by_name(net, dev_name);
+                dev = dev_get_by_name_rcu(net, dev_name);
                 if (dev == NULL) {
                         ret_val = -ENODEV;
                         goto unlhsh_remove_return;
                 }
                 iface = netlbl_unlhsh_search_iface(dev->ifindex);
-                dev_put(dev);
         } else
                 iface = rcu_dereference(netlbl_unlhsh_def);
         if (iface == NULL) {
@@ -1552,8 +1518,10 @@ int netlbl_unlabel_getattr(const struct sk_buff *skb,
         struct netlbl_unlhsh_iface *iface;
 
         rcu_read_lock();
-        iface = netlbl_unlhsh_search_iface_def(skb->iif);
+        iface = netlbl_unlhsh_search_iface(skb->skb_iif);
         if (iface == NULL)
+                iface = rcu_dereference(netlbl_unlhsh_def);
+        if (iface == NULL || !iface->valid)
                 goto unlabel_getattr_nolabel;
         switch (family) {
         case PF_INET: {
diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
index 68706b4e3bf8..a3fd75ac3fa5 100644
--- a/net/netlabel/netlabel_user.c
+++ b/net/netlabel/netlabel_user.c
@@ -35,6 +35,7 @@
 #include <linux/audit.h>
 #include <linux/tty.h>
 #include <linux/security.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 19e98007691c..795424396aff 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -428,7 +428,8 @@ static int __netlink_create(struct net *net, struct socket *sock,
         return 0;
 }
 
-static int netlink_create(struct net *net, struct socket *sock, int protocol)
+static int netlink_create(struct net *net, struct socket *sock, int protocol,
+                          int kern)
 {
         struct module *module = NULL;
         struct mutex *cb_mutex;
@@ -454,9 +455,14 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol)
         if (nl_table[protocol].registered &&
             try_module_get(nl_table[protocol].module))
                 module = nl_table[protocol].module;
+        else
+                err = -EPROTONOSUPPORT;
         cb_mutex = nl_table[protocol].cb_mutex;
         netlink_unlock_table();
 
+        if (err < 0)
+                goto out;
+
         err = __netlink_create(net, sock, cb_mutex, protocol);
         if (err < 0)
                 goto out_module;
@@ -497,7 +503,7 @@ static int netlink_release(struct socket *sock)
 
         skb_queue_purge(&sk->sk_write_queue);
 
-        if (nlk->pid && !nlk->subscriptions) {
+        if (nlk->pid) {
                 struct netlink_notify n = {
                                                 .net = sock_net(sk),
                                                 .protocol = sk->sk_protocol,
@@ -677,6 +683,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
         struct netlink_sock *nlk = nlk_sk(sk);
         struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
 
+        if (alen < sizeof(addr->sa_family))
+                return -EINVAL;
+
         if (addr->sa_family == AF_UNSPEC) {
                 sk->sk_state    = NETLINK_UNCONNECTED;
                 nlk->dst_pid    = 0;
@@ -707,7 +716,7 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr,
 {
         struct sock *sk = sock->sk;
         struct netlink_sock *nlk = nlk_sk(sk);
-        struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
+        DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
 
         nladdr->nl_family = AF_NETLINK;
         nladdr->nl_pad = 0;
@@ -1087,21 +1096,27 @@ static inline int do_one_set_err(struct sock *sk,
                                  struct netlink_set_err_data *p)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
+        int ret = 0;
 
         if (sk == p->exclude_sk)
                 goto out;
 
-        if (sock_net(sk) != sock_net(p->exclude_sk))
+        if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
                 goto out;
 
         if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups ||
             !test_bit(p->group - 1, nlk->groups))
                 goto out;
 
+        if (p->code == ENOBUFS && nlk->flags & NETLINK_RECV_NO_ENOBUFS) {
+                ret = 1;
+                goto out;
+        }
+
         sk->sk_err = p->code;
         sk->sk_error_report(sk);
 out:
-        return 0;
+        return ret;
 }
 
 /**
@@ -1110,12 +1125,16 @@ out:
  * @pid: the PID of a process that we want to skip (if any)
  * @groups: the broadcast group that will notice the error
  * @code: error code, must be negative (as usual in kernelspace)
+ *
+ * This function returns the number of broadcast listeners that have set the
+ * NETLINK_RECV_NO_ENOBUFS socket option.
  */
-void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
+int netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 {
         struct netlink_set_err_data info;
         struct hlist_node *node;
         struct sock *sk;
+        int ret = 0;
 
         info.exclude_sk = ssk;
         info.pid = pid;
@@ -1126,9 +1145,10 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
         read_lock(&nl_table_lock);
 
         sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
-                do_one_set_err(sk, &info);
+                ret += do_one_set_err(sk, &info);
 
         read_unlock(&nl_table_lock);
+        return ret;
 }
 EXPORT_SYMBOL(netlink_set_err);
 
@@ -1972,12 +1992,12 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
                          "sk       Eth Pid    Groups   "
-                         "Rmem     Wmem     Dump     Locks     Drops\n");
+                         "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
         else {
                 struct sock *s = v;
                 struct netlink_sock *nlk = nlk_sk(s);
 
-                seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
+                seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d %-8lu\n",
                            s,
                            s->sk_protocol,
                            nlk->pid,
@@ -1986,7 +2006,8 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
                            sk_wmem_alloc_get(s),
                            nlk->cb,
                            atomic_read(&s->sk_refcnt),
-                           atomic_read(&s->sk_drops)
+                           atomic_read(&s->sk_drops),
+                           sock_i_ino(s)
                         );
 
         }
@@ -2050,7 +2071,7 @@ static const struct proto_ops netlink_ops = {
         .sendpage =     sock_no_sendpage,
 };
 
-static struct net_proto_family netlink_family_ops = {
+static const struct net_proto_family netlink_family_ops = {
         .family = PF_NETLINK,
         .create = netlink_create,
         .owner  = THIS_MODULE,  /* for consistency 8) */
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 44ff3f3810fa..06438fa2b1e5 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -8,6 +8,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -97,25 +98,17 @@ static struct genl_ops *genl_get_cmd(u8 cmd, struct genl_family *family)
 */
 static inline u16 genl_generate_id(void)
 {
-        static u16 id_gen_idx;
-        int overflowed = 0;
+        static u16 id_gen_idx = GENL_MIN_ID;
+        int i;
 
-        do {
-                if (id_gen_idx == 0)
+        for (i = 0; i <= GENL_MAX_ID - GENL_MIN_ID; i++) {
+                if (!genl_family_find_byid(id_gen_idx))
+                        return id_gen_idx;
+                if (++id_gen_idx > GENL_MAX_ID)
                         id_gen_idx = GENL_MIN_ID;
+        }
 
-                if (++id_gen_idx > GENL_MAX_ID) {
-                        if (!overflowed) {
-                                overflowed = 1;
-                                id_gen_idx = 0;
-                                continue;
-                        } else
-                                return 0;
-                }
-
-        } while (genl_family_find_byid(id_gen_idx));
-
-        return id_gen_idx;
+        return 0;
 }
 
 static struct genl_multicast_group notify_grp;
@@ -374,11 +367,6 @@ int genl_register_family(struct genl_family *family)
                 goto errout_locked;
         }
 
-        if (genl_family_find_byid(family->id)) {
-                err = -EEXIST;
-                goto errout_locked;
-        }
-
         if (family->id == GENL_ID_GENERATE) {
                 u16 newid = genl_generate_id();
 
@@ -388,6 +376,9 @@ int genl_register_family(struct genl_family *family)
                 }
 
                 family->id = newid;
+        } else if (genl_family_find_byid(family->id)) {
+                err = -EEXIST;
+                goto errout_locked;
         }
 
         if (family->maxattr) {
@@ -691,9 +682,7 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
         int chains_to_skip = cb->args[0];
         int fams_to_skip = cb->args[1];
 
-        for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
-                if (i < chains_to_skip)
-                        continue;
+        for (i = chains_to_skip; i < GENL_FAM_TAB_SIZE; i++) {
                 n = 0;
                 list_for_each_entry(rt, genl_family_chain(i), family_list) {
                         if (!rt->netnsok && !net_eq(net, &init_net))
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 7a834952f67f..fa07f044b599 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/in.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/timer.h>
@@ -425,12 +426,13 @@ static struct proto nr_proto = {
         .obj_size = sizeof(struct nr_sock),
 };
 
-static int nr_create(struct net *net, struct socket *sock, int protocol)
+static int nr_create(struct net *net, struct socket *sock, int protocol,
+                     int kern)
 {
         struct sock *sk;
         struct nr_sock *nr;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         if (sock->type != SOCK_SEQPACKET || protocol != 0)
@@ -1266,28 +1268,13 @@ static int nr_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 
 static void *nr_info_start(struct seq_file *seq, loff_t *pos)
 {
-        struct sock *s;
-        struct hlist_node *node;
-        int i = 1;
-
         spin_lock_bh(&nr_list_lock);
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        sk_for_each(s, node, &nr_list) {
-                if (i == *pos)
-                        return s;
-                ++i;
-        }
-        return NULL;
+        return seq_hlist_start_head(&nr_list, *pos);
 }
 
 static void *nr_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
-
-        return (v == SEQ_START_TOKEN) ? sk_head(&nr_list)
-                : sk_next((struct sock *)v);
+        return seq_hlist_next(v, &nr_list, pos);
 }
 
 static void nr_info_stop(struct seq_file *seq, void *v)
@@ -1297,7 +1284,7 @@ static void nr_info_stop(struct seq_file *seq, void *v)
 
 static int nr_info_show(struct seq_file *seq, void *v)
 {
-        struct sock *s = v;
+        struct sock *s = sk_entry(v);
         struct net_device *dev;
         struct nr_sock *nr;
         const char *devname;
@@ -1372,7 +1359,7 @@ static const struct file_operations nr_info_fops = {
 };
 #endif  /* CONFIG_PROC_FS */
 
-static struct net_proto_family nr_family_ops = {
+static const struct net_proto_family nr_family_ops = {
         .family         =       PF_NETROM,
         .create         =       nr_create,
         .owner          =       THIS_MODULE,
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index 7aa11b01b2e2..64e6dde9749d 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -19,6 +19,7 @@
 #include <linux/fcntl.h>
 #include <linux/in.h>
 #include <linux/if_ether.h>     /* For the statistics structure. */
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
index 68176483617f..6d4ef6d65b3d 100644
--- a/net/netrom/nr_in.c
+++ b/net/netrom/nr_in.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/netrom/nr_loopback.c b/net/netrom/nr_loopback.c
index f324d5df4186..94d4e922af53 100644
--- a/net/netrom/nr_loopback.c
+++ b/net/netrom/nr_loopback.c
@@ -7,6 +7,7 @@
  * Copyright Tomi Manninen OH2BNS (oh2bns@sral.fi)
  */
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/timer.h>
 #include <net/ax25.h>
diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c
index e3e6c44e1890..607fddb4fdbb 100644
--- a/net/netrom/nr_out.c
+++ b/net/netrom/nr_out.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 4eb1ac9a7679..44059d0c8dd1 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -17,6 +17,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -597,15 +598,15 @@ struct net_device *nr_dev_first(void)
 {
         struct net_device *dev, *first = NULL;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
                 if ((dev->flags & IFF_UP) && dev->type == ARPHRD_NETROM)
                         if (first == NULL || strncmp(dev->name, first->name, 3) < 0)
                                 first = dev;
         }
         if (first)
                 dev_hold(first);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         return first;
 }
@@ -617,16 +618,17 @@ struct net_device *nr_dev_get(ax25_address *addr)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, dev) {
-                if ((dev->flags & IFF_UP) && dev->type == ARPHRD_NETROM && ax25cmp(addr, (ax25_address *)dev->dev_addr) == 0) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
+                if ((dev->flags & IFF_UP) && dev->type == ARPHRD_NETROM &&
+                    ax25cmp(addr, (ax25_address *)dev->dev_addr) == 0) {
                         dev_hold(dev);
                         goto out;
                 }
         }
         dev = NULL;
 out:
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return dev;
 }
 
@@ -842,12 +844,13 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25)
         dptr  = skb_push(skb, 1);
         *dptr = AX25_P_NETROM;
 
-        ax25s = ax25_send_frame(skb, 256, (ax25_address *)dev->dev_addr, &nr_neigh->callsign, nr_neigh->digipeat, nr_neigh->dev);
-        if (nr_neigh->ax25 && ax25s) {
-                /* We were already holding this ax25_cb */
+        ax25s = nr_neigh->ax25;
+        nr_neigh->ax25 = ax25_send_frame(skb, 256,
+                                         (ax25_address *)dev->dev_addr,
+                                         &nr_neigh->callsign,
+                                         nr_neigh->digipeat, nr_neigh->dev);
+        if (ax25s)
                 ax25_cb_put(ax25s);
-        }
-        nr_neigh->ax25 = ax25s;
 
         dev_put(dev);
         ret = (nr_neigh->ax25 != NULL);
@@ -861,33 +864,13 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25)
 
 static void *nr_node_start(struct seq_file *seq, loff_t *pos)
 {
-        struct nr_node *nr_node;
-        struct hlist_node *node;
-        int i = 1;
-
         spin_lock_bh(&nr_node_list_lock);
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        nr_node_for_each(nr_node, node, &nr_node_list) {
-                if (i == *pos)
-                        return nr_node;
-                ++i;
-        }
-
-        return NULL;
+        return seq_hlist_start_head(&nr_node_list, *pos);
 }
 
 static void *nr_node_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct hlist_node *node;
-        ++*pos;
-
-        node = (v == SEQ_START_TOKEN)
-                ? nr_node_list.first
-                : ((struct nr_node *)v)->node_node.next;
-
-        return hlist_entry(node, struct nr_node, node_node);
+        return seq_hlist_next(v, &nr_node_list, pos);
 }
 
 static void nr_node_stop(struct seq_file *seq, void *v)
@@ -904,7 +887,9 @@ static int nr_node_show(struct seq_file *seq, void *v)
                 seq_puts(seq,
                          "callsign  mnemonic w n qual obs neigh qual obs neigh qual obs neigh\n");
         else {
-                struct nr_node *nr_node = v;
+                struct nr_node *nr_node = hlist_entry(v, struct nr_node,
+                                                      node_node);
+
                 nr_node_lock(nr_node);
                 seq_printf(seq, "%-9s %-7s  %d %d",
                         ax2asc(buf, &nr_node->callsign),
@@ -947,31 +932,13 @@ const struct file_operations nr_nodes_fops = {
 
 static void *nr_neigh_start(struct seq_file *seq, loff_t *pos)
 {
-        struct nr_neigh *nr_neigh;
-        struct hlist_node *node;
-        int i = 1;
-
         spin_lock_bh(&nr_neigh_list_lock);
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        nr_neigh_for_each(nr_neigh, node, &nr_neigh_list) {
-                if (i == *pos)
-                        return nr_neigh;
-        }
-        return NULL;
+        return seq_hlist_start_head(&nr_neigh_list, *pos);
 }
 
 static void *nr_neigh_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct hlist_node *node;
-        ++*pos;
-
-        node = (v == SEQ_START_TOKEN)
-                ? nr_neigh_list.first
-                : ((struct nr_neigh *)v)->neigh_node.next;
-
-        return hlist_entry(node, struct nr_neigh, neigh_node);
+        return seq_hlist_next(v, &nr_neigh_list, pos);
 }
 
 static void nr_neigh_stop(struct seq_file *seq, void *v)
@@ -987,8 +954,9 @@ static int nr_neigh_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq, "addr  callsign  dev  qual lock count failed digipeaters\n");
         else {
-                struct nr_neigh *nr_neigh = v;
+                struct nr_neigh *nr_neigh;
 
+                nr_neigh = hlist_entry(v, struct nr_neigh, neigh_node);
                 seq_printf(seq, "%05d %-9s %-4s  %3d    %d   %3d    %3d",
                         nr_neigh->number,
                         ax2asc(buf, &nr_neigh->callsign),
diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c
index 04e7d0d2fd8f..6a947ae50dbd 100644
--- a/net/netrom/nr_subr.c
+++ b/net/netrom/nr_subr.c
@@ -15,6 +15,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
index 7b49591fe87c..1e0fa9e57aac 100644
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -36,143 +36,119 @@ static struct ctl_table_header *nr_table_header;
 
 static ctl_table nr_table[] = {
         {
-                .ctl_name       = NET_NETROM_DEFAULT_PATH_QUALITY,
                 .procname       = "default_path_quality",
                 .data           = &sysctl_netrom_default_path_quality,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_quality,
                 .extra2         = &max_quality
         },
         {
-                .ctl_name       = NET_NETROM_OBSOLESCENCE_COUNT_INITIALISER,
                 .procname       = "obsolescence_count_initialiser",
                 .data           = &sysctl_netrom_obsolescence_count_initialiser,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_obs,
                 .extra2         = &max_obs
         },
         {
-                .ctl_name       = NET_NETROM_NETWORK_TTL_INITIALISER,
                 .procname       = "network_ttl_initialiser",
                 .data           = &sysctl_netrom_network_ttl_initialiser,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ttl,
                 .extra2         = &max_ttl
         },
         {
-                .ctl_name       = NET_NETROM_TRANSPORT_TIMEOUT,
                 .procname       = "transport_timeout",
                 .data           = &sysctl_netrom_transport_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t1,
                 .extra2         = &max_t1
         },
         {
-                .ctl_name       = NET_NETROM_TRANSPORT_MAXIMUM_TRIES,
                 .procname       = "transport_maximum_tries",
                 .data           = &sysctl_netrom_transport_maximum_tries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_n2,
                 .extra2         = &max_n2
         },
         {
-                .ctl_name       = NET_NETROM_TRANSPORT_ACKNOWLEDGE_DELAY,
                 .procname       = "transport_acknowledge_delay",
                 .data           = &sysctl_netrom_transport_acknowledge_delay,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t2,
                 .extra2         = &max_t2
         },
         {
-                .ctl_name       = NET_NETROM_TRANSPORT_BUSY_DELAY,
                 .procname       = "transport_busy_delay",
                 .data           = &sysctl_netrom_transport_busy_delay,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t4,
                 .extra2         = &max_t4
         },
         {
-                .ctl_name       = NET_NETROM_TRANSPORT_REQUESTED_WINDOW_SIZE,
                 .procname       = "transport_requested_window_size",
                 .data           = &sysctl_netrom_transport_requested_window_size,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_window,
                 .extra2         = &max_window
         },
         {
-                .ctl_name       = NET_NETROM_TRANSPORT_NO_ACTIVITY_TIMEOUT,
                 .procname       = "transport_no_activity_timeout",
                 .data           = &sysctl_netrom_transport_no_activity_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_idle,
                 .extra2         = &max_idle
         },
         {
-                .ctl_name       = NET_NETROM_ROUTING_CONTROL,
                 .procname       = "routing_control",
                 .data           = &sysctl_netrom_routing_control,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_route,
                 .extra2         = &max_route
         },
         {
-                .ctl_name       = NET_NETROM_LINK_FAILS_COUNT,
                 .procname       = "link_fails_count",
                 .data           = &sysctl_netrom_link_fails_count,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_fails,
                 .extra2         = &max_fails
         },
         {
-                .ctl_name       = NET_NETROM_RESET,
                 .procname       = "reset",
                 .data           = &sysctl_netrom_reset_circuit,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_reset,
                 .extra2         = &max_reset
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_path nr_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "netrom", .ctl_name = NET_NETROM, },
+        { .procname = "net", },
+        { .procname = "netrom", },
         { }
 };
 
diff --git a/net/packet/Kconfig b/net/packet/Kconfig
index 34ff93ff894d..0060e3b396b7 100644
--- a/net/packet/Kconfig
+++ b/net/packet/Kconfig
@@ -14,13 +14,3 @@ config PACKET
           be called af_packet.
 
           If unsure, say Y.
-
-config PACKET_MMAP
-        bool "Packet socket: mmapped IO"
-        depends on PACKET
-        help
-          If you say Y here, the Packet protocol driver will use an IO
-          mechanism that results in faster communication.
-
-          If unsure, say N.
-
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f2d116a5cb35..243946d4809d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -60,6 +60,7 @@
 #include <linux/wireless.h>
 #include <linux/kernel.h>
 #include <linux/kmod.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -79,6 +80,8 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
+#include <linux/if_vlan.h>
+#include <linux/virtio_net.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -155,7 +158,6 @@ struct packet_mreq_max {
         unsigned char   mr_address[MAX_ADDR_LEN];
 };
 
-#ifdef CONFIG_PACKET_MMAP
 static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 int closing, int tx_ring);
 
@@ -175,7 +177,6 @@ struct packet_ring_buffer {
 
 struct packet_sock;
 static int tpacket_snd(struct packet_sock *po, struct msghdr *msg);
-#endif
 
 static void packet_flush_mclist(struct sock *sk);
 
@@ -183,27 +184,24 @@ struct packet_sock {
         /* struct sock has to be the first member of packet_sock */
         struct sock             sk;
         struct tpacket_stats    stats;
-#ifdef CONFIG_PACKET_MMAP
         struct packet_ring_buffer       rx_ring;
         struct packet_ring_buffer       tx_ring;
         int                     copy_thresh;
-#endif
-        struct packet_type      prot_hook;
         spinlock_t              bind_lock;
         struct mutex            pg_vec_lock;
         unsigned int            running:1,      /* prot_hook is attached*/
                                 auxdata:1,
-                                origdev:1;
+                                origdev:1,
+                                has_vnet_hdr:1;
         int                     ifindex;        /* bound device         */
         __be16                  num;
         struct packet_mclist    *mclist;
-#ifdef CONFIG_PACKET_MMAP
         atomic_t                mapped;
         enum tpacket_versions   tp_version;
         unsigned int            tp_hdrlen;
         unsigned int            tp_reserve;
         unsigned int            tp_loss:1;
-#endif
+        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 };
 
 struct packet_skb_cb {
@@ -216,8 +214,6 @@ struct packet_skb_cb {
 
 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 
-#ifdef CONFIG_PACKET_MMAP
-
 static void __packet_set_status(struct packet_sock *po, void *frame, int status)
 {
         union {
@@ -312,8 +308,6 @@ static inline void packet_increment_head(struct packet_ring_buffer *buff)
         buff->head = buff->head != buff->frame_max ? buff->head+1 : 0;
 }
 
-#endif
-
 static inline struct packet_sock *pkt_sk(struct sock *sk)
 {
         return (struct packet_sock *)sk;
@@ -364,7 +358,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
         if (skb->pkt_type == PACKET_LOOPBACK)
                 goto out;
 
-        if (dev_net(dev) != sock_net(sk))
+        if (!net_eq(dev_net(dev), sock_net(sk)))
                 goto out;
 
         skb = skb_share_check(skb, GFP_ATOMIC);
@@ -414,7 +408,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct sockaddr_pkt *saddr = (struct sockaddr_pkt *)msg->msg_name;
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct net_device *dev;
         __be16 proto = 0;
         int err;
@@ -436,7 +430,9 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
          */
 
         saddr->spkt_device[13] = 0;
-        dev = dev_get_by_name(sock_net(sk), saddr->spkt_device);
+retry:
+        rcu_read_lock();
+        dev = dev_get_by_name_rcu(sock_net(sk), saddr->spkt_device);
         err = -ENODEV;
         if (dev == NULL)
                 goto out_unlock;
@@ -454,58 +450,48 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         if (len > dev->mtu + dev->hard_header_len)
                 goto out_unlock;
 
-        err = -ENOBUFS;
-        skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
-
-        /*
-         * If the write buffer is full, then tough. At this level the user
-         * gets to deal with the problem - do your own algorithmic backoffs.
-         * That's far more flexible.
-         */
-
-        if (skb == NULL)
-                goto out_unlock;
-
-        /*
-         *      Fill it in
-         */
-
-        /* FIXME: Save some space for broken drivers that write a
-         * hard header at transmission time by themselves. PPP is the
-         * notable one here. This should really be fixed at the driver level.
-         */
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb_reset_network_header(skb);
-
-        /* Try to align data part correctly */
-        if (dev->header_ops) {
-                skb->data -= dev->hard_header_len;
-                skb->tail -= dev->hard_header_len;
-                if (len < dev->hard_header_len)
-                        skb_reset_network_header(skb);
+        if (!skb) {
+                size_t reserved = LL_RESERVED_SPACE(dev);
+                unsigned int hhlen = dev->header_ops ? dev->hard_header_len : 0;
+
+                rcu_read_unlock();
+                skb = sock_wmalloc(sk, len + reserved, 0, GFP_KERNEL);
+                if (skb == NULL)
+                        return -ENOBUFS;
+                /* FIXME: Save some space for broken drivers that write a hard
+                 * header at transmission time by themselves. PPP is the notable
+                 * one here. This should really be fixed at the driver level.
+                 */
+                skb_reserve(skb, reserved);
+                skb_reset_network_header(skb);
+
+                /* Try to align data part correctly */
+                if (hhlen) {
+                        skb->data -= hhlen;
+                        skb->tail -= hhlen;
+                        if (len < hhlen)
+                                skb_reset_network_header(skb);
+                }
+                err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+                if (err)
+                        goto out_free;
+                goto retry;
         }
 
-        /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
-        if (err)
-                goto out_free;
-
-        /*
-         *      Now send it
-         */
+        skb->mark = sk->sk_mark;
 
         dev_queue_xmit(skb);
-        dev_put(dev);
+        rcu_read_unlock();
         return len;
 
+out_unlock:
+        rcu_read_unlock();
 out_free:
         kfree_skb(skb);
-out_unlock:
-        if (dev)
-                dev_put(dev);
         return err;
 }
 
@@ -515,7 +501,7 @@ static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
         struct sk_filter *filter;
 
         rcu_read_lock_bh();
-        filter = rcu_dereference(sk->sk_filter);
+        filter = rcu_dereference_bh(sk->sk_filter);
         if (filter != NULL)
                 res = sk_run_filter(skb, filter->insns, filter->len);
         rcu_read_unlock_bh();
@@ -551,7 +537,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
         sk = pt->af_packet_priv;
         po = pkt_sk(sk);
 
-        if (dev_net(dev) != sock_net(sk))
+        if (!net_eq(dev_net(dev), sock_net(sk)))
                 goto drop;
 
         skb->dev = dev;
@@ -626,15 +612,14 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         spin_lock(&sk->sk_receive_queue.lock);
         po->stats.tp_packets++;
+        skb->dropcount = atomic_read(&sk->sk_drops);
         __skb_queue_tail(&sk->sk_receive_queue, skb);
         spin_unlock(&sk->sk_receive_queue.lock);
         sk->sk_data_ready(sk, skb->len);
         return 0;
 
 drop_n_acct:
-        spin_lock(&sk->sk_receive_queue.lock);
-        po->stats.tp_drops++;
-        spin_unlock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
@@ -646,7 +631,6 @@ drop:
         return 0;
 }
 
-#ifdef CONFIG_PACKET_MMAP
 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                        struct packet_type *pt, struct net_device *orig_dev)
 {
@@ -673,7 +657,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
         sk = pt->af_packet_priv;
         po = pkt_sk(sk);
 
-        if (dev_net(dev) != sock_net(sk))
+        if (!net_eq(dev_net(dev), sock_net(sk)))
                 goto drop;
 
         if (dev->header_ops) {
@@ -766,7 +750,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                         getnstimeofday(&ts);
                 h.h2->tp_sec = ts.tv_sec;
                 h.h2->tp_nsec = ts.tv_nsec;
-                h.h2->tp_vlan_tci = skb->vlan_tci;
+                h.h2->tp_vlan_tci = vlan_tx_tag_get(skb);
                 hdrlen = sizeof(*h.h2);
                 break;
         default:
@@ -856,6 +840,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = po->sk.sk_priority;
+        skb->mark = po->sk.sk_mark;
         skb_shinfo(skb)->destructor_arg = ph.raw;
 
         switch (po->tp_version) {
@@ -1028,20 +1013,30 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 
                 status = TP_STATUS_SEND_REQUEST;
                 err = dev_queue_xmit(skb);
-                if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0))
-                        goto out_xmit;
+                if (unlikely(err > 0)) {
+                        err = net_xmit_errno(err);
+                        if (err && __packet_get_status(po, ph) ==
+                                   TP_STATUS_AVAILABLE) {
+                                /* skb was destructed already */
+                                skb = NULL;
+                                goto out_status;
+                        }
+                        /*
+                         * skb was dropped but not destructed yet;
+                         * let's treat it like congestion or err < 0
+                         */
+                        err = 0;
+                }
                 packet_increment_head(&po->tx_ring);
                 len_sum += tp_len;
-        } while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
-                                        && (atomic_read(&po->tx_ring.pending))))
-              );
+        } while (likely((ph != NULL) ||
+                        ((!(msg->msg_flags & MSG_DONTWAIT)) &&
+                         (atomic_read(&po->tx_ring.pending))))
+                );
 
         err = len_sum;
         goto out_put;
 
-out_xmit:
-        skb->destructor = sock_wfree;
-        atomic_dec(&po->tx_ring.pending);
 out_status:
         __packet_set_status(po, ph, status);
         kfree_skb(skb);
@@ -1051,7 +1046,30 @@ out:
         mutex_unlock(&po->pg_vec_lock);
         return err;
 }
-#endif
+
+static inline struct sk_buff *packet_alloc_skb(struct sock *sk, size_t prepad,
+                                               size_t reserve, size_t len,
+                                               size_t linear, int noblock,
+                                               int *err)
+{
+        struct sk_buff *skb;
+
+        /* Under a page?  Don't bother with paged skb. */
+        if (prepad + len < PAGE_SIZE || !linear)
+                linear = len;
+
+        skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
+                                   err);
+        if (!skb)
+                return NULL;
+
+        skb_reserve(skb, reserve);
+        skb_put(skb, linear);
+        skb->data_len = len - linear;
+        skb->len += len - linear;
+
+        return skb;
+}
 
 static int packet_snd(struct socket *sock,
                           struct msghdr *msg, size_t len)
@@ -1063,14 +1081,17 @@ static int packet_snd(struct socket *sock,
         __be16 proto;
         unsigned char *addr;
         int ifindex, err, reserve = 0;
+        struct virtio_net_hdr vnet_hdr = { 0 };
+        int offset = 0;
+        int vnet_hdr_len;
+        struct packet_sock *po = pkt_sk(sk);
+        unsigned short gso_type = 0;
 
         /*
          *      Get and verify the address.
          */
 
         if (saddr == NULL) {
-                struct packet_sock *po = pkt_sk(sk);
-
                 ifindex = po->ifindex;
                 proto   = po->num;
                 addr    = NULL;
@@ -1097,31 +1118,100 @@ static int packet_snd(struct socket *sock,
         if (!(dev->flags & IFF_UP))
                 goto out_unlock;
 
+        if (po->has_vnet_hdr) {
+                vnet_hdr_len = sizeof(vnet_hdr);
+
+                err = -EINVAL;
+                if (len < vnet_hdr_len)
+                        goto out_unlock;
+
+                len -= vnet_hdr_len;
+
+                err = memcpy_fromiovec((void *)&vnet_hdr, msg->msg_iov,
+                                       vnet_hdr_len);
+                if (err < 0)
+                        goto out_unlock;
+
+                if ((vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
+                    (vnet_hdr.csum_start + vnet_hdr.csum_offset + 2 >
+                      vnet_hdr.hdr_len))
+                        vnet_hdr.hdr_len = vnet_hdr.csum_start +
+                                                 vnet_hdr.csum_offset + 2;
+
+                err = -EINVAL;
+                if (vnet_hdr.hdr_len > len)
+                        goto out_unlock;
+
+                if (vnet_hdr.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+                        switch (vnet_hdr.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+                        case VIRTIO_NET_HDR_GSO_TCPV4:
+                                gso_type = SKB_GSO_TCPV4;
+                                break;
+                        case VIRTIO_NET_HDR_GSO_TCPV6:
+                                gso_type = SKB_GSO_TCPV6;
+                                break;
+                        case VIRTIO_NET_HDR_GSO_UDP:
+                                gso_type = SKB_GSO_UDP;
+                                break;
+                        default:
+                                goto out_unlock;
+                        }
+
+                        if (vnet_hdr.gso_type & VIRTIO_NET_HDR_GSO_ECN)
+                                gso_type |= SKB_GSO_TCP_ECN;
+
+                        if (vnet_hdr.gso_size == 0)
+                                goto out_unlock;
+
+                }
+        }
+
         err = -EMSGSIZE;
-        if (len > dev->mtu+reserve)
+        if (!gso_type && (len > dev->mtu+reserve))
                 goto out_unlock;
 
-        skb = sock_alloc_send_skb(sk, len + LL_ALLOCATED_SPACE(dev),
-                                msg->msg_flags & MSG_DONTWAIT, &err);
+        err = -ENOBUFS;
+        skb = packet_alloc_skb(sk, LL_ALLOCATED_SPACE(dev),
+                               LL_RESERVED_SPACE(dev), len, vnet_hdr.hdr_len,
+                               msg->msg_flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out_unlock;
 
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb_reset_network_header(skb);
+        skb_set_network_header(skb, reserve);
 
         err = -EINVAL;
         if (sock->type == SOCK_DGRAM &&
-            dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len) < 0)
+            (offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len)) < 0)
                 goto out_free;
 
         /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+        err = skb_copy_datagram_from_iovec(skb, offset, msg->msg_iov, 0, len);
         if (err)
                 goto out_free;
 
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
+
+        if (po->has_vnet_hdr) {
+                if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
+                        if (!skb_partial_csum_set(skb, vnet_hdr.csum_start,
+                                                  vnet_hdr.csum_offset)) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+                }
+
+                skb_shinfo(skb)->gso_size = vnet_hdr.gso_size;
+                skb_shinfo(skb)->gso_type = gso_type;
+
+                /* Header must be checked, and gso_segs computed. */
+                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+                skb_shinfo(skb)->gso_segs = 0;
+
+                len += vnet_hdr_len;
+        }
 
         /*
          *      Now send it
@@ -1147,13 +1237,11 @@ out:
 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 struct msghdr *msg, size_t len)
 {
-#ifdef CONFIG_PACKET_MMAP
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
         if (po->tx_ring.pg_vec)
                 return tpacket_snd(po, msg);
         else
-#endif
                 return packet_snd(sock, msg, len);
 }
 
@@ -1167,9 +1255,7 @@ static int packet_release(struct socket *sock)
         struct sock *sk = sock->sk;
         struct packet_sock *po;
         struct net *net;
-#ifdef CONFIG_PACKET_MMAP
         struct tpacket_req req;
-#endif
 
         if (!sk)
                 return 0;
@@ -1177,28 +1263,25 @@ static int packet_release(struct socket *sock)
         net = sock_net(sk);
         po = pkt_sk(sk);
 
-        write_lock_bh(&net->packet.sklist_lock);
-        sk_del_node_init(sk);
+        spin_lock_bh(&net->packet.sklist_lock);
+        sk_del_node_init_rcu(sk);
         sock_prot_inuse_add(net, sk->sk_prot, -1);
-        write_unlock_bh(&net->packet.sklist_lock);
-
-        /*
-         *      Unhook packet receive handler.
-         */
+        spin_unlock_bh(&net->packet.sklist_lock);
 
+        spin_lock(&po->bind_lock);
         if (po->running) {
                 /*
-                 *      Remove the protocol hook
+                 * Remove from protocol table
                  */
-                dev_remove_pack(&po->prot_hook);
                 po->running = 0;
                 po->num = 0;
+                __dev_remove_pack(&po->prot_hook);
                 __sock_put(sk);
         }
+        spin_unlock(&po->bind_lock);
 
         packet_flush_mclist(sk);
 
-#ifdef CONFIG_PACKET_MMAP
         memset(&req, 0, sizeof(req));
 
         if (po->rx_ring.pg_vec)
@@ -1206,12 +1289,11 @@ static int packet_release(struct socket *sock)
 
         if (po->tx_ring.pg_vec)
                 packet_set_ring(sk, &req, 1, 1);
-#endif
 
+        synchronize_net();
         /*
          *      Now the socket is dead. No more input will appear.
          */
-
         sock_orphan(sk);
         sock->sk = NULL;
 
@@ -1341,7 +1423,8 @@ static struct proto packet_proto = {
  *      Create a packet of type SOCK_PACKET.
  */
 
-static int packet_create(struct net *net, struct socket *sock, int protocol)
+static int packet_create(struct net *net, struct socket *sock, int protocol,
+                         int kern)
 {
         struct sock *sk;
         struct packet_sock *po;
@@ -1394,10 +1477,11 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
                 po->running = 1;
         }
 
-        write_lock_bh(&net->packet.sklist_lock);
-        sk_add_node(sk, &net->packet.sklist);
+        spin_lock_bh(&net->packet.sklist_lock);
+        sk_add_node_rcu(sk, &net->packet.sklist);
         sock_prot_inuse_add(net, &packet_proto, 1);
-        write_unlock_bh(&net->packet.sklist_lock);
+        spin_unlock_bh(&net->packet.sklist_lock);
+
         return 0;
 out:
         return err;
@@ -1415,6 +1499,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *skb;
         int copied, err;
         struct sockaddr_ll *sll;
+        int vnet_hdr_len = 0;
 
         err = -EINVAL;
         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
@@ -1446,6 +1531,48 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (skb == NULL)
                 goto out;
 
+        if (pkt_sk(sk)->has_vnet_hdr) {
+                struct virtio_net_hdr vnet_hdr = { 0 };
+
+                err = -EINVAL;
+                vnet_hdr_len = sizeof(vnet_hdr);
+                if ((len -= vnet_hdr_len) < 0)
+                        goto out_free;
+
+                if (skb_is_gso(skb)) {
+                        struct skb_shared_info *sinfo = skb_shinfo(skb);
+
+                        /* This is a hint as to how much should be linear. */
+                        vnet_hdr.hdr_len = skb_headlen(skb);
+                        vnet_hdr.gso_size = sinfo->gso_size;
+                        if (sinfo->gso_type & SKB_GSO_TCPV4)
+                                vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
+                        else if (sinfo->gso_type & SKB_GSO_TCPV6)
+                                vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
+                        else if (sinfo->gso_type & SKB_GSO_UDP)
+                                vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP;
+                        else if (sinfo->gso_type & SKB_GSO_FCOE)
+                                goto out_free;
+                        else
+                                BUG();
+                        if (sinfo->gso_type & SKB_GSO_TCP_ECN)
+                                vnet_hdr.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
+                } else
+                        vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE;
+
+                if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                        vnet_hdr.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
+                        vnet_hdr.csum_start = skb->csum_start -
+                                                        skb_headroom(skb);
+                        vnet_hdr.csum_offset = skb->csum_offset;
+                } /* else everything is zero */
+
+                err = memcpy_toiovec(msg->msg_iov, (void *)&vnet_hdr,
+                                     vnet_hdr_len);
+                if (err < 0)
+                        goto out_free;
+        }
+
         /*
          *      If the address length field is there to be filled in, we fill
          *      it in now.
@@ -1472,7 +1599,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (err)
                 goto out_free;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name)
                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
@@ -1488,7 +1615,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                 aux.tp_snaplen = skb->len;
                 aux.tp_mac = 0;
                 aux.tp_net = skb_network_offset(skb);
-                aux.tp_vlan_tci = skb->vlan_tci;
+                aux.tp_vlan_tci = vlan_tx_tag_get(skb);
 
                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
         }
@@ -1497,7 +1624,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
          *      Free or return the buffer as appropriate. Again this
          *      hides all the races and re-entrancy issues from us.
          */
-        err = (flags&MSG_TRUNC) ? skb->len : copied;
+        err = vnet_hdr_len + ((flags&MSG_TRUNC) ? skb->len : copied);
 
 out_free:
         skb_free_datagram(sk, skb);
@@ -1515,12 +1642,13 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
                 return -EOPNOTSUPP;
 
         uaddr->sa_family = AF_PACKET;
-        dev = dev_get_by_index(sock_net(sk), pkt_sk(sk)->ifindex);
-        if (dev) {
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
+        if (dev)
                 strlcpy(uaddr->sa_data, dev->name, 15);
-                dev_put(dev);
-        } else
+        else
                 memset(uaddr->sa_data, 0, 14);
+        rcu_read_unlock();
         *uaddr_len = sizeof(*uaddr);
 
         return 0;
@@ -1532,7 +1660,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         struct net_device *dev;
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
-        struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_ll *, sll, uaddr);
 
         if (peer)
                 return -EOPNOTSUPP;
@@ -1540,16 +1668,17 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         sll->sll_family = AF_PACKET;
         sll->sll_ifindex = po->ifindex;
         sll->sll_protocol = po->num;
-        dev = dev_get_by_index(sock_net(sk), po->ifindex);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex);
         if (dev) {
                 sll->sll_hatype = dev->type;
                 sll->sll_halen = dev->addr_len;
                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
-                dev_put(dev);
         } else {
                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
                 sll->sll_halen = 0;
         }
+        rcu_read_unlock();
         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
 
         return 0;
@@ -1560,6 +1689,8 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
 {
         switch (i->type) {
         case PACKET_MR_MULTICAST:
+                if (i->alen != dev->addr_len)
+                        return -EINVAL;
                 if (what > 0)
                         return dev_mc_add(dev, i->addr, i->alen, 0);
                 else
@@ -1572,6 +1703,8 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
                 return dev_set_allmulti(dev, what);
                 break;
         case PACKET_MR_UNICAST:
+                if (i->alen != dev->addr_len)
+                        return -EINVAL;
                 if (what > 0)
                         return dev_unicast_add(dev, i->addr);
                 else
@@ -1659,11 +1792,9 @@ static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
                         if (--ml->count == 0) {
                                 struct net_device *dev;
                                 *mlp = ml->next;
-                                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
-                                if (dev) {
+                                dev = __dev_get_by_index(sock_net(sk), ml->ifindex);
+                                if (dev)
                                         packet_dev_mc(dev, ml, -1);
-                                        dev_put(dev);
-                                }
                                 kfree(ml);
                         }
                         rtnl_unlock();
@@ -1687,11 +1818,9 @@ static void packet_flush_mclist(struct sock *sk)
                 struct net_device *dev;
 
                 po->mclist = ml->next;
-                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
-                if (dev != NULL) {
+                dev = __dev_get_by_index(sock_net(sk), ml->ifindex);
+                if (dev != NULL)
                         packet_dev_mc(dev, ml, -1);
-                        dev_put(dev);
-                }
                 kfree(ml);
         }
         rtnl_unlock();
@@ -1729,7 +1858,6 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 return ret;
         }
 
-#ifdef CONFIG_PACKET_MMAP
         case PACKET_RX_RING:
         case PACKET_TX_RING:
         {
@@ -1737,6 +1865,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen < sizeof(req))
                         return -EINVAL;
+                if (pkt_sk(sk)->has_vnet_hdr)
+                        return -EINVAL;
                 if (copy_from_user(&req, optval, sizeof(req)))
                         return -EFAULT;
                 return packet_set_ring(sk, &req, 0, optname == PACKET_TX_RING);
@@ -1798,7 +1928,6 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 po->tp_loss = !!val;
                 return 0;
         }
-#endif
         case PACKET_AUXDATA:
         {
                 int val;
@@ -1823,6 +1952,22 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 po->origdev = !!val;
                 return 0;
         }
+        case PACKET_VNET_HDR:
+        {
+                int val;
+
+                if (sock->type != SOCK_RAW)
+                        return -EINVAL;
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+                        return -EBUSY;
+                if (optlen < sizeof(val))
+                        return -EINVAL;
+                if (copy_from_user(&val, optval, sizeof(val)))
+                        return -EFAULT;
+
+                po->has_vnet_hdr = !!val;
+                return 0;
+        }
         default:
                 return -ENOPROTOOPT;
         }
@@ -1873,7 +2018,13 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 
                 data = &val;
                 break;
-#ifdef CONFIG_PACKET_MMAP
+        case PACKET_VNET_HDR:
+                if (len > sizeof(int))
+                        len = sizeof(int);
+                val = po->has_vnet_hdr;
+
+                data = &val;
+                break;
         case PACKET_VERSION:
                 if (len > sizeof(int))
                         len = sizeof(int);
@@ -1909,7 +2060,6 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                 val = po->tp_loss;
                 data = &val;
                 break;
-#endif
         default:
                 return -ENOPROTOOPT;
         }
@@ -1929,8 +2079,8 @@ static int packet_notifier(struct notifier_block *this, unsigned long msg, void
         struct net_device *dev = data;
         struct net *net = dev_net(dev);
 
-        read_lock(&net->packet.sklist_lock);
-        sk_for_each(sk, node, &net->packet.sklist) {
+        rcu_read_lock();
+        sk_for_each_rcu(sk, node, &net->packet.sklist) {
                 struct packet_sock *po = pkt_sk(sk);
 
                 switch (msg) {
@@ -1958,18 +2108,19 @@ static int packet_notifier(struct notifier_block *this, unsigned long msg, void
                         }
                         break;
                 case NETDEV_UP:
-                        spin_lock(&po->bind_lock);
-                        if (dev->ifindex == po->ifindex && po->num &&
-                            !po->running) {
-                                dev_add_pack(&po->prot_hook);
-                                sock_hold(sk);
-                                po->running = 1;
+                        if (dev->ifindex == po->ifindex) {
+                                spin_lock(&po->bind_lock);
+                                if (po->num && !po->running) {
+                                        dev_add_pack(&po->prot_hook);
+                                        sock_hold(sk);
+                                        po->running = 1;
+                                }
+                                spin_unlock(&po->bind_lock);
                         }
-                        spin_unlock(&po->bind_lock);
                         break;
                 }
         }
-        read_unlock(&net->packet.sklist_lock);
+        rcu_read_unlock();
         return NOTIFY_DONE;
 }
 
@@ -2018,8 +2169,6 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
         case SIOCGIFDSTADDR:
         case SIOCSIFDSTADDR:
         case SIOCSIFFLAGS:
-                if (!net_eq(sock_net(sk), &init_net))
-                        return -ENOIOCTLCMD;
                 return inet_dgram_ops.ioctl(sock, cmd, arg);
 #endif
 
@@ -2029,11 +2178,6 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
         return 0;
 }
 
-#ifndef CONFIG_PACKET_MMAP
-#define packet_mmap sock_no_mmap
-#define packet_poll datagram_poll
-#else
-
 static unsigned int packet_poll(struct file *file, struct socket *sock,
                                 poll_table *wait)
 {
@@ -2315,8 +2459,6 @@ out:
         mutex_unlock(&po->pg_vec_lock);
         return err;
 }
-#endif
-
 
 static const struct proto_ops packet_ops_spkt = {
         .family =       PF_PACKET,
@@ -2360,7 +2502,7 @@ static const struct proto_ops packet_ops = {
         .sendpage =     sock_no_sendpage,
 };
 
-static struct net_proto_family packet_family_ops = {
+static const struct net_proto_family packet_family_ops = {
         .family =       PF_PACKET,
         .create =       packet_create,
         .owner  =       THIS_MODULE,
@@ -2371,40 +2513,26 @@ static struct notifier_block packet_netdev_notifier = {
 };
 
 #ifdef CONFIG_PROC_FS
-static inline struct sock *packet_seq_idx(struct net *net, loff_t off)
-{
-        struct sock *s;
-        struct hlist_node *node;
-
-        sk_for_each(s, node, &net->packet.sklist) {
-                if (!off--)
-                        return s;
-        }
-        return NULL;
-}
 
 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(seq_file_net(seq)->packet.sklist_lock)
+        __acquires(RCU)
 {
         struct net *net = seq_file_net(seq);
-        read_lock(&net->packet.sklist_lock);
-        return *pos ? packet_seq_idx(net, *pos - 1) : SEQ_START_TOKEN;
+
+        rcu_read_lock();
+        return seq_hlist_start_head_rcu(&net->packet.sklist, *pos);
 }
 
 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct net *net = seq_file_net(seq);
-        ++*pos;
-        return  (v == SEQ_START_TOKEN)
-                ? sk_head(&net->packet.sklist)
-                : sk_next((struct sock *)v) ;
+        return seq_hlist_next_rcu(v, &net->packet.sklist, pos);
 }
 
 static void packet_seq_stop(struct seq_file *seq, void *v)
-        __releases(seq_file_net(seq)->packet.sklist_lock)
+        __releases(RCU)
 {
-        struct net *net = seq_file_net(seq);
-        read_unlock(&net->packet.sklist_lock);
+        rcu_read_unlock();
 }
 
 static int packet_seq_show(struct seq_file *seq, void *v)
@@ -2412,7 +2540,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
         else {
-                struct sock *s = v;
+                struct sock *s = sk_entry(v);
                 const struct packet_sock *po = pkt_sk(s);
 
                 seq_printf(seq,
@@ -2454,9 +2582,9 @@ static const struct file_operations packet_seq_fops = {
 
 #endif
 
-static int packet_net_init(struct net *net)
+static int __net_init packet_net_init(struct net *net)
 {
-        rwlock_init(&net->packet.sklist_lock);
+        spin_lock_init(&net->packet.sklist_lock);
         INIT_HLIST_HEAD(&net->packet.sklist);
 
         if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))
@@ -2465,7 +2593,7 @@ static int packet_net_init(struct net *net)
         return 0;
 }
 
-static void packet_net_exit(struct net *net)
+static void __net_exit packet_net_exit(struct net *net)
 {
         proc_net_remove(net, "packet");
 }
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index f60c0c2aacba..73aee7f2fcdc 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 #include <net/sock.h>
 
@@ -35,7 +36,6 @@
 
 /* Transport protocol registration */
 static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
 
 static struct phonet_protocol *phonet_proto_get(int protocol)
 {
@@ -44,11 +44,11 @@ static struct phonet_protocol *phonet_proto_get(int protocol)
         if (protocol >= PHONET_NPROTO)
                 return NULL;
 
-        spin_lock(&proto_tab_lock);
-        pp = proto_tab[protocol];
+        rcu_read_lock();
+        pp = rcu_dereference(proto_tab[protocol]);
         if (pp && !try_module_get(pp->prot->owner))
                 pp = NULL;
-        spin_unlock(&proto_tab_lock);
+        rcu_read_unlock();
 
         return pp;
 }
@@ -60,7 +60,8 @@ static inline void phonet_proto_put(struct phonet_protocol *pp)
 
 /* protocol family functions */
 
-static int pn_socket_create(struct net *net, struct socket *sock, int protocol)
+static int pn_socket_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
         struct pn_sock *pn;
@@ -118,7 +119,7 @@ out:
         return err;
 }
 
-static struct net_proto_family phonet_proto_family = {
+static const struct net_proto_family phonet_proto_family = {
         .family = PF_PHONET,
         .create = pn_socket_create,
         .owner = THIS_MODULE,
@@ -190,9 +191,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
         skb->priority = 0;
         skb->dev = dev;
 
-        if (pn_addr(src) == pn_addr(dst)) {
+        if (skb->pkt_type == PACKET_LOOPBACK) {
                 skb_reset_mac_header(skb);
-                skb->pkt_type = PACKET_LOOPBACK;
                 skb_orphan(skb);
                 if (irq)
                         netif_rx(skb);
@@ -222,6 +222,9 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
         if (skb == NULL)
                 return -ENOMEM;
 
+        if (phonet_address_lookup(dev_net(dev), pn_addr(dst)) == 0)
+                skb->pkt_type = PACKET_LOOPBACK;
+
         skb_reserve(skb, MAX_PHONET_HEADER);
         __skb_put(skb, len);
         skb_copy_to_linear_data(skb, data, len);
@@ -235,6 +238,7 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
 int pn_skb_send(struct sock *sk, struct sk_buff *skb,
                 const struct sockaddr_pn *target)
 {
+        struct net *net = sock_net(sk);
         struct net_device *dev;
         struct pn_sock *pn = pn_sk(sk);
         int err;
@@ -243,9 +247,13 @@ int pn_skb_send(struct sock *sk, struct sk_buff *skb,
 
         err = -EHOSTUNREACH;
         if (sk->sk_bound_dev_if)
-                dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
-        else
-                dev = phonet_device_get(sock_net(sk));
+                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
+        else if (phonet_address_lookup(net, daddr) == 0) {
+                dev = phonet_device_get(net);
+                skb->pkt_type = PACKET_LOOPBACK;
+        } else
+                dev = phonet_route_output(net, daddr);
+
         if (!dev || !(dev->flags & IFF_UP))
                 goto drop;
 
@@ -369,6 +377,12 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         pn_skb_get_dst_sockaddr(skb, &sa);
 
+        /* check if this is broadcasted */
+        if (pn_sockaddr_get_addr(&sa) == PNADDR_BROADCAST) {
+                pn_deliver_sock_broadcast(net, skb);
+                goto out;
+        }
+
         /* check if we are the destination */
         if (phonet_address_lookup(net, pn_sockaddr_get_addr(&sa)) == 0) {
                 /* Phonet packet input */
@@ -381,6 +395,38 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
                         send_obj_unreachable(skb);
                         send_reset_indications(skb);
                 }
+        } else if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
+                goto out; /* Race between address deletion and loopback */
+        else {
+                /* Phonet packet routing */
+                struct net_device *out_dev;
+
+                out_dev = phonet_route_output(net, pn_sockaddr_get_addr(&sa));
+                if (!out_dev) {
+                        LIMIT_NETDEBUG(KERN_WARNING"No Phonet route to %02X\n",
+                                        pn_sockaddr_get_addr(&sa));
+                        goto out;
+                }
+
+                __skb_push(skb, sizeof(struct phonethdr));
+                skb->dev = out_dev;
+                if (out_dev == dev) {
+                        LIMIT_NETDEBUG(KERN_ERR"Phonet loop to %02X on %s\n",
+                                        pn_sockaddr_get_addr(&sa), dev->name);
+                        goto out_dev;
+                }
+                /* Some drivers (e.g. TUN) do not allocate HW header space */
+                if (skb_cow_head(skb, out_dev->hard_header_len))
+                        goto out_dev;
+
+                if (dev_hard_header(skb, out_dev, ETH_P_PHONET, NULL, NULL,
+                                        skb->len) < 0)
+                        goto out_dev;
+                dev_queue_xmit(skb);
+                dev_put(out_dev);
+                return NET_RX_SUCCESS;
+out_dev:
+                dev_put(out_dev);
         }
 
 out:
@@ -393,6 +439,8 @@ static struct packet_type phonet_packet_type __read_mostly = {
         .func = phonet_rcv,
 };
 
+static DEFINE_MUTEX(proto_tab_lock);
+
 int __init_or_module phonet_proto_register(int protocol,
                                                 struct phonet_protocol *pp)
 {
@@ -405,12 +453,12 @@ int __init_or_module phonet_proto_register(int protocol,
         if (err)
                 return err;
 
-        spin_lock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
         if (proto_tab[protocol])
                 err = -EBUSY;
         else
-                proto_tab[protocol] = pp;
-        spin_unlock(&proto_tab_lock);
+                rcu_assign_pointer(proto_tab[protocol], pp);
+        mutex_unlock(&proto_tab_lock);
 
         return err;
 }
@@ -418,10 +466,11 @@ EXPORT_SYMBOL(phonet_proto_register);
 
 void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
 {
-        spin_lock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
         BUG_ON(proto_tab[protocol] != pp);
-        proto_tab[protocol] = NULL;
-        spin_unlock(&proto_tab_lock);
+        rcu_assign_pointer(proto_tab[protocol], NULL);
+        mutex_unlock(&proto_tab_lock);
+        synchronize_rcu();
         proto_unregister(pp->prot);
 }
 EXPORT_SYMBOL(phonet_proto_unregister);
@@ -435,6 +484,7 @@ static int __init phonet_init(void)
         if (err)
                 return err;
 
+        pn_sock_init();
         err = sock_register(&phonet_proto_family);
         if (err) {
                 printk(KERN_ALERT
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index ef5c75c372e4..1bd38db4fe1e 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/socket.h>
 #include <asm/ioctls.h>
 #include <net/sock.h>
@@ -75,7 +76,8 @@ static int pn_sendmsg(struct kiocb *iocb, struct sock *sk,
         struct sk_buff *skb;
         int err;
 
-        if (msg->msg_flags & MSG_OOB)
+        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
+                                MSG_CMSG_COMPAT))
                 return -EOPNOTSUPP;
 
         if (msg->msg_name == NULL)
@@ -119,7 +121,8 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
         int rval = -EOPNOTSUPP;
         int copylen;
 
-        if (flags & MSG_OOB)
+        if (flags & ~(MSG_PEEK|MSG_TRUNC|MSG_DONTWAIT|MSG_NOSIGNAL|
+                        MSG_CMSG_COMPAT))
                 goto out_nofree;
 
         if (addr_len)
@@ -159,11 +162,9 @@ out_nofree:
 static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         int err = sock_queue_rcv_skb(sk, skb);
-        if (err < 0) {
+
+        if (err < 0)
                 kfree_skb(skb);
-                if (err == -ENOMEM)
-                        atomic_inc(&sk->sk_drops);
-        }
         return err ? NET_RX_DROP : NET_RX_SUCCESS;
 }
 
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index d183509d3fa6..d01208968c83 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -96,11 +96,11 @@ static int gprs_recv(struct gprs_dev *gp, struct sk_buff *skb)
                 goto drop;
         }
 
-        if (likely(skb_headroom(skb) & 3)) {
+        if (skb_headroom(skb) & 3) {
                 struct sk_buff *rskb, *fs;
                 int flen = 0;
 
-                /* Phonet Pipe data header is misaligned (3 bytes),
+                /* Phonet Pipe data header may be misaligned (3 bytes),
                  * so wrap the IP packet as a single fragment of an head-less
                  * socket buffer. The network stack will pull what it needs,
                  * but at least, the whole IP payload is not memcpy'd. */
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 5f32d217535b..e2a95762abd3 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/socket.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
@@ -354,14 +355,15 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                 queue = &pn->ctrlreq_queue;
                 goto queue;
 
+        case PNS_PIPE_ALIGNED_DATA:
+                __skb_pull(skb, 1);
+                /* fall through */
         case PNS_PIPE_DATA:
                 __skb_pull(skb, 3); /* Pipe data header */
                 if (!pn_flow_safe(pn->rx_fc)) {
                         err = sock_queue_rcv_skb(sk, skb);
                         if (!err)
                                 return 0;
-                        if (err == -ENOMEM)
-                                atomic_inc(&sk->sk_drops);
                         break;
                 }
 
@@ -443,6 +445,7 @@ static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
         struct sockaddr_pn dst;
         u16 peer_type;
         u8 pipe_handle, enabled, n_sb;
+        u8 aligned = 0;
 
         if (!pskb_pull(skb, sizeof(*hdr) + 4))
                 return -EINVAL;
@@ -481,6 +484,9 @@ static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
                                 return -EINVAL;
                         peer_type = (peer_type & 0xff00) | data[0];
                         break;
+                case PN_PIPE_SB_ALIGNED_DATA:
+                        aligned = data[0] != 0;
+                        break;
                 }
                 n_sb--;
         }
@@ -512,6 +518,7 @@ static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
         newpn->rx_credits = 0;
         newpn->rx_fc = newpn->tx_fc = PN_LEGACY_FLOW_CONTROL;
         newpn->init_enable = enabled;
+        newpn->aligned = aligned;
 
         BUG_ON(!skb_queue_empty(&newsk->sk_receive_queue));
         skb_queue_head(&newsk->sk_receive_queue, skb);
@@ -716,8 +723,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         return -EINVAL;
 
                 lock_sock(sk);
-                if (sock_flag(sk, SOCK_URGINLINE)
-                 && !skb_queue_empty(&pn->ctrlreq_queue))
+                if (sock_flag(sk, SOCK_URGINLINE) &&
+                    !skb_queue_empty(&pn->ctrlreq_queue))
                         answ = skb_peek(&pn->ctrlreq_queue)->len;
                 else if (!skb_queue_empty(&sk->sk_receive_queue))
                         answ = skb_peek(&sk->sk_receive_queue)->len;
@@ -831,11 +838,15 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
                 return -ENOBUFS;
         }
 
-        skb_push(skb, 3);
+        skb_push(skb, 3 + pn->aligned);
         skb_reset_transport_header(skb);
         ph = pnp_hdr(skb);
         ph->utid = 0;
-        ph->message_id = PNS_PIPE_DATA;
+        if (pn->aligned) {
+                ph->message_id = PNS_PIPE_ALIGNED_DATA;
+                ph->data[0] = 0; /* padding */
+        } else
+                ph->message_id = PNS_PIPE_DATA;
         ph->pipe_handle = pn->pipe_handle;
 
         return pn_skb_send(sk, skb, &pipe_srv);
@@ -845,14 +856,26 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
                         struct msghdr *msg, size_t len)
 {
         struct pep_sock *pn = pep_sk(sk);
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         long timeo;
         int flags = msg->msg_flags;
         int err, done;
 
-        if (msg->msg_flags & MSG_OOB || !(msg->msg_flags & MSG_EOR))
+        if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
+                                MSG_CMSG_COMPAT)) ||
+                        !(msg->msg_flags & MSG_EOR))
                 return -EOPNOTSUPP;
 
+        skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
+                                        flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return -ENOBUFS;
+
+        skb_reserve(skb, MAX_PHONET_HEADER + 3);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+        if (err < 0)
+                goto outfree;
+
         lock_sock(sk);
         timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
         if ((1 << sk->sk_state) & (TCPF_LISTEN|TCPF_CLOSE)) {
@@ -896,28 +919,13 @@ disabled:
                         goto disabled;
         }
 
-        if (!skb) {
-                skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
-                                                flags & MSG_DONTWAIT, &err);
-                if (skb == NULL)
-                        goto out;
-                skb_reserve(skb, MAX_PHONET_HEADER + 3);
-
-                if (sk->sk_state != TCP_ESTABLISHED ||
-                    !atomic_read(&pn->tx_credits))
-                        goto disabled; /* sock_alloc_send_skb might sleep */
-        }
-
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
-        if (err < 0)
-                goto out;
-
         err = pipe_skb_send(sk, skb);
         if (err >= 0)
                 err = len; /* success! */
         skb = NULL;
 out:
         release_sock(sk);
+outfree:
         kfree_skb(skb);
         return err;
 }
@@ -934,6 +942,9 @@ int pep_write(struct sock *sk, struct sk_buff *skb)
         struct sk_buff *rskb, *fs;
         int flen = 0;
 
+        if (pep_sk(sk)->aligned)
+                return pipe_skb_send(sk, skb);
+
         rskb = alloc_skb(MAX_PNPIPE_HEADER, GFP_ATOMIC);
         if (!rskb) {
                 kfree_skb(skb);
@@ -973,6 +984,10 @@ static int pep_recvmsg(struct kiocb *iocb, struct sock *sk,
         struct sk_buff *skb;
         int err;
 
+        if (flags & ~(MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_DONTWAIT|MSG_WAITALL|
+                        MSG_NOSIGNAL|MSG_CMSG_COMPAT))
+                return -EOPNOTSUPP;
+
         if (unlikely(1 << sk->sk_state & (TCPF_LISTEN | TCPF_CLOSE)))
                 return -ENOTCONN;
 
@@ -980,6 +995,8 @@ static int pep_recvmsg(struct kiocb *iocb, struct sock *sk,
                 /* Dequeue and acknowledge control request */
                 struct pep_sock *pn = pep_sk(sk);
 
+                if (flags & MSG_PEEK)
+                        return -EOPNOTSUPP;
                 skb = skb_dequeue(&pn->ctrlreq_queue);
                 if (skb) {
                         pep_ctrlreq_error(sk, skb, PN_PIPE_NO_ERROR,
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 5f42f30dd168..9b4ced6e0968 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/phonet.h>
 #include <linux/proc_fs.h>
@@ -33,11 +34,17 @@
 #include <net/netns/generic.h>
 #include <net/phonet/pn_dev.h>
 
+struct phonet_routes {
+        struct mutex            lock;
+        struct net_device       *table[64];
+};
+
 struct phonet_net {
         struct phonet_device_list pndevs;
+        struct phonet_routes routes;
 };
 
-int phonet_net_id;
+int phonet_net_id __read_mostly;
 
 struct phonet_device_list *phonet_device_list(struct net *net)
 {
@@ -55,7 +62,8 @@ static struct phonet_device *__phonet_device_alloc(struct net_device *dev)
         pnd->netdev = dev;
         bitmap_zero(pnd->addrs, 64);
 
-        list_add(&pnd->list, &pndevs->list);
+        BUG_ON(!mutex_is_locked(&pndevs->lock));
+        list_add_rcu(&pnd->list, &pndevs->list);
         return pnd;
 }
 
@@ -64,6 +72,7 @@ static struct phonet_device *__phonet_get(struct net_device *dev)
         struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
 
+        BUG_ON(!mutex_is_locked(&pndevs->lock));
         list_for_each_entry(pnd, &pndevs->list, list) {
                 if (pnd->netdev == dev)
                         return pnd;
@@ -71,6 +80,18 @@ static struct phonet_device *__phonet_get(struct net_device *dev)
         return NULL;
 }
 
+static struct phonet_device *__phonet_get_rcu(struct net_device *dev)
+{
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
+        struct phonet_device *pnd;
+
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
+                if (pnd->netdev == dev)
+                        return pnd;
+        }
+        return NULL;
+}
+
 static void phonet_device_destroy(struct net_device *dev)
 {
         struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
@@ -78,17 +99,16 @@ static void phonet_device_destroy(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        spin_lock_bh(&pndevs->lock);
+        mutex_lock(&pndevs->lock);
         pnd = __phonet_get(dev);
         if (pnd)
-                list_del(&pnd->list);
-        spin_unlock_bh(&pndevs->lock);
+                list_del_rcu(&pnd->list);
+        mutex_unlock(&pndevs->lock);
 
         if (pnd) {
                 u8 addr;
 
-                for (addr = find_first_bit(pnd->addrs, 64); addr < 64;
-                        addr = find_next_bit(pnd->addrs, 64, 1+addr))
+                for_each_set_bit(addr, pnd->addrs, 64)
                         phonet_address_notify(RTM_DELADDR, dev, addr);
                 kfree(pnd);
         }
@@ -100,8 +120,8 @@ struct net_device *phonet_device_get(struct net *net)
         struct phonet_device *pnd;
         struct net_device *dev = NULL;
 
-        spin_lock_bh(&pndevs->lock);
-        list_for_each_entry(pnd, &pndevs->list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
                 dev = pnd->netdev;
                 BUG_ON(!dev);
 
@@ -112,7 +132,7 @@ struct net_device *phonet_device_get(struct net *net)
         }
         if (dev)
                 dev_hold(dev);
-        spin_unlock_bh(&pndevs->lock);
+        rcu_read_unlock();
         return dev;
 }
 
@@ -122,7 +142,7 @@ int phonet_address_add(struct net_device *dev, u8 addr)
         struct phonet_device *pnd;
         int err = 0;
 
-        spin_lock_bh(&pndevs->lock);
+        mutex_lock(&pndevs->lock);
         /* Find or create Phonet-specific device data */
         pnd = __phonet_get(dev);
         if (pnd == NULL)
@@ -131,7 +151,7 @@ int phonet_address_add(struct net_device *dev, u8 addr)
                 err = -ENOMEM;
         else if (test_and_set_bit(addr >> 2, pnd->addrs))
                 err = -EEXIST;
-        spin_unlock_bh(&pndevs->lock);
+        mutex_unlock(&pndevs->lock);
         return err;
 }
 
@@ -141,36 +161,56 @@ int phonet_address_del(struct net_device *dev, u8 addr)
         struct phonet_device *pnd;
         int err = 0;
 
-        spin_lock_bh(&pndevs->lock);
+        mutex_lock(&pndevs->lock);
         pnd = __phonet_get(dev);
-        if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
+        if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs)) {
                 err = -EADDRNOTAVAIL;
-        else if (bitmap_empty(pnd->addrs, 64)) {
-                list_del(&pnd->list);
+                pnd = NULL;
+        } else if (bitmap_empty(pnd->addrs, 64))
+                list_del_rcu(&pnd->list);
+        else
+                pnd = NULL;
+        mutex_unlock(&pndevs->lock);
+
+        if (pnd) {
+                synchronize_rcu();
                 kfree(pnd);
         }
-        spin_unlock_bh(&pndevs->lock);
         return err;
 }
 
 /* Gets a source address toward a destination, through a interface. */
-u8 phonet_address_get(struct net_device *dev, u8 addr)
+u8 phonet_address_get(struct net_device *dev, u8 daddr)
 {
-        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
+        u8 saddr;
 
-        spin_lock_bh(&pndevs->lock);
-        pnd = __phonet_get(dev);
+        rcu_read_lock();
+        pnd = __phonet_get_rcu(dev);
         if (pnd) {
                 BUG_ON(bitmap_empty(pnd->addrs, 64));
 
                 /* Use same source address as destination, if possible */
-                if (!test_bit(addr >> 2, pnd->addrs))
-                        addr = find_first_bit(pnd->addrs, 64) << 2;
+                if (test_bit(daddr >> 2, pnd->addrs))
+                        saddr = daddr;
+                else
+                        saddr = find_first_bit(pnd->addrs, 64) << 2;
         } else
-                addr = PN_NO_ADDR;
-        spin_unlock_bh(&pndevs->lock);
-        return addr;
+                saddr = PN_NO_ADDR;
+        rcu_read_unlock();
+
+        if (saddr == PN_NO_ADDR) {
+                /* Fallback to another device */
+                struct net_device *def_dev;
+
+                def_dev = phonet_device_get(dev_net(dev));
+                if (def_dev) {
+                        if (def_dev != dev)
+                                saddr = phonet_address_get(def_dev, daddr);
+                        dev_put(def_dev);
+                }
+        }
+        return saddr;
 }
 
 int phonet_address_lookup(struct net *net, u8 addr)
@@ -179,8 +219,8 @@ int phonet_address_lookup(struct net *net, u8 addr)
         struct phonet_device *pnd;
         int err = -EADDRNOTAVAIL;
 
-        spin_lock_bh(&pndevs->lock);
-        list_for_each_entry(pnd, &pndevs->list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
                 /* Don't allow unregistering devices! */
                 if ((pnd->netdev->reg_state != NETREG_REGISTERED) ||
                                 ((pnd->netdev->flags & IFF_UP)) != IFF_UP)
@@ -192,7 +232,7 @@ int phonet_address_lookup(struct net *net, u8 addr)
                 }
         }
 found:
-        spin_unlock_bh(&pndevs->lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -219,6 +259,32 @@ static int phonet_device_autoconf(struct net_device *dev)
         return 0;
 }
 
+static void phonet_route_autodel(struct net_device *dev)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        unsigned i;
+        DECLARE_BITMAP(deleted, 64);
+
+        /* Remove left-over Phonet routes */
+        bitmap_zero(deleted, 64);
+        mutex_lock(&pnn->routes.lock);
+        for (i = 0; i < 64; i++)
+                if (dev == pnn->routes.table[i]) {
+                        rcu_assign_pointer(pnn->routes.table[i], NULL);
+                        set_bit(i, deleted);
+                }
+        mutex_unlock(&pnn->routes.lock);
+
+        if (bitmap_empty(deleted, 64))
+                return; /* short-circuit RCU */
+        synchronize_rcu();
+        for (i = find_first_bit(deleted, 64); i < 64;
+                        i = find_next_bit(deleted, 64, i + 1)) {
+                rtm_phonet_notify(RTM_DELROUTE, dev, i);
+                dev_put(dev);
+        }
+}
+
 /* notify Phonet of device events */
 static int phonet_device_notify(struct notifier_block *me, unsigned long what,
                                 void *arg)
@@ -232,6 +298,7 @@ static int phonet_device_notify(struct notifier_block *me, unsigned long what,
                 break;
         case NETDEV_UNREGISTER:
                 phonet_device_destroy(dev);
+                phonet_route_autodel(dev);
                 break;
         }
         return 0;
@@ -244,46 +311,52 @@ static struct notifier_block phonet_device_notifier = {
 };
 
 /* Per-namespace Phonet devices handling */
-static int phonet_init_net(struct net *net)
+static int __net_init phonet_init_net(struct net *net)
 {
-        struct phonet_net *pnn = kmalloc(sizeof(*pnn), GFP_KERNEL);
-        if (!pnn)
-                return -ENOMEM;
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
 
-        if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops)) {
-                kfree(pnn);
+        if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops))
                 return -ENOMEM;
-        }
 
         INIT_LIST_HEAD(&pnn->pndevs.list);
-        spin_lock_init(&pnn->pndevs.lock);
-        net_assign_generic(net, phonet_net_id, pnn);
+        mutex_init(&pnn->pndevs.lock);
+        mutex_init(&pnn->routes.lock);
         return 0;
 }
 
-static void phonet_exit_net(struct net *net)
+static void __net_exit phonet_exit_net(struct net *net)
 {
         struct phonet_net *pnn = net_generic(net, phonet_net_id);
         struct net_device *dev;
+        unsigned i;
 
         rtnl_lock();
         for_each_netdev(net, dev)
                 phonet_device_destroy(dev);
+
+        for (i = 0; i < 64; i++) {
+                dev = pnn->routes.table[i];
+                if (dev) {
+                        rtm_phonet_notify(RTM_DELROUTE, dev, i);
+                        dev_put(dev);
+                }
+        }
         rtnl_unlock();
 
         proc_net_remove(net, "phonet");
-        kfree(pnn);
 }
 
 static struct pernet_operations phonet_net_ops = {
         .init = phonet_init_net,
         .exit = phonet_exit_net,
+        .id   = &phonet_net_id,
+        .size = sizeof(struct phonet_net),
 };
 
 /* Initialize Phonet devices list */
 int __init phonet_device_init(void)
 {
-        int err = register_pernet_gen_device(&phonet_net_id, &phonet_net_ops);
+        int err = register_pernet_device(&phonet_net_ops);
         if (err)
                 return err;
 
@@ -298,5 +371,75 @@ void phonet_device_exit(void)
 {
         rtnl_unregister_all(PF_PHONET);
         unregister_netdevice_notifier(&phonet_device_notifier);
-        unregister_pernet_gen_device(phonet_net_id, &phonet_net_ops);
+        unregister_pernet_device(&phonet_net_ops);
+}
+
+int phonet_route_add(struct net_device *dev, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        int err = -EEXIST;
+
+        daddr = daddr >> 2;
+        mutex_lock(&routes->lock);
+        if (routes->table[daddr] == NULL) {
+                rcu_assign_pointer(routes->table[daddr], dev);
+                dev_hold(dev);
+                err = 0;
+        }
+        mutex_unlock(&routes->lock);
+        return err;
+}
+
+int phonet_route_del(struct net_device *dev, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+
+        daddr = daddr >> 2;
+        mutex_lock(&routes->lock);
+        if (dev == routes->table[daddr])
+                rcu_assign_pointer(routes->table[daddr], NULL);
+        else
+                dev = NULL;
+        mutex_unlock(&routes->lock);
+
+        if (!dev)
+                return -ENOENT;
+        synchronize_rcu();
+        dev_put(dev);
+        return 0;
+}
+
+struct net_device *phonet_route_get(struct net *net, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        struct net_device *dev;
+
+        ASSERT_RTNL(); /* no need to hold the device */
+
+        daddr >>= 2;
+        rcu_read_lock();
+        dev = rcu_dereference(routes->table[daddr]);
+        rcu_read_unlock();
+        return dev;
+}
+
+struct net_device *phonet_route_output(struct net *net, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        struct net_device *dev;
+
+        daddr >>= 2;
+        rcu_read_lock();
+        dev = rcu_dereference(routes->table[daddr]);
+        if (dev)
+                dev_hold(dev);
+        rcu_read_unlock();
+
+        if (!dev)
+                dev = phonet_device_get(net); /* Default route */
+        return dev;
 }
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index d21fd3576610..58b3b1f991ed 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -26,9 +26,12 @@
 #include <linux/kernel.h>
 #include <linux/netlink.h>
 #include <linux/phonet.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/phonet/pn_dev.h>
 
+/* Device address handling */
+
 static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
                      u32 pid, u32 seq, int event);
 
@@ -51,8 +54,7 @@ void phonet_address_notify(int event, struct net_device *dev, u8 addr)
                     RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL);
         return;
 errout:
-        if (err < 0)
-                rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err);
+        rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err);
 }
 
 static const struct nla_policy ifa_phonet_policy[IFA_MAX+1] = {
@@ -130,8 +132,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         int addr_idx = 0, addr_start_idx = cb->args[1];
 
         pndevs = phonet_device_list(sock_net(skb->sk));
-        spin_lock_bh(&pndevs->lock);
-        list_for_each_entry(pnd, &pndevs->list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(pnd, &pndevs->list, list) {
                 u8 addr;
 
                 if (dev_idx > dev_start_idx)
@@ -140,8 +142,7 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
                         continue;
 
                 addr_idx = 0;
-                for (addr = find_first_bit(pnd->addrs, 64); addr < 64;
-                        addr = find_next_bit(pnd->addrs, 64, 1+addr)) {
+                for_each_set_bit(addr, pnd->addrs, 64) {
                         if (addr_idx++ < addr_start_idx)
                                 continue;
 
@@ -153,13 +154,137 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         }
 
 out:
-        spin_unlock_bh(&pndevs->lock);
+        rcu_read_unlock();
         cb->args[0] = dev_idx;
         cb->args[1] = addr_idx;
 
         return skb->len;
 }
 
+/* Routes handling */
+
+static int fill_route(struct sk_buff *skb, struct net_device *dev, u8 dst,
+                        u32 pid, u32 seq, int event)
+{
+        struct rtmsg *rtm;
+        struct nlmsghdr *nlh;
+
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*rtm), 0);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        rtm = nlmsg_data(nlh);
+        rtm->rtm_family = AF_PHONET;
+        rtm->rtm_dst_len = 6;
+        rtm->rtm_src_len = 0;
+        rtm->rtm_tos = 0;
+        rtm->rtm_table = RT_TABLE_MAIN;
+        rtm->rtm_protocol = RTPROT_STATIC;
+        rtm->rtm_scope = RT_SCOPE_UNIVERSE;
+        rtm->rtm_type = RTN_UNICAST;
+        rtm->rtm_flags = 0;
+        NLA_PUT_U8(skb, RTA_DST, dst);
+        NLA_PUT_U32(skb, RTA_OIF, dev->ifindex);
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+void rtm_phonet_notify(int event, struct net_device *dev, u8 dst)
+{
+        struct sk_buff *skb;
+        int err = -ENOBUFS;
+
+        skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) +
+                        nla_total_size(1) + nla_total_size(4), GFP_KERNEL);
+        if (skb == NULL)
+                goto errout;
+        err = fill_route(skb, dev, dst, 0, 0, event);
+        if (err < 0) {
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
+        rtnl_notify(skb, dev_net(dev), 0,
+                          RTNLGRP_PHONET_ROUTE, NULL, GFP_KERNEL);
+        return;
+errout:
+        rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_ROUTE, err);
+}
+
+static const struct nla_policy rtm_phonet_policy[RTA_MAX+1] = {
+        [RTA_DST] = { .type = NLA_U8 },
+        [RTA_OIF] = { .type = NLA_U32 },
+};
+
+static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh, void *attr)
+{
+        struct net *net = sock_net(skb->sk);
+        struct nlattr *tb[RTA_MAX+1];
+        struct net_device *dev;
+        struct rtmsg *rtm;
+        int err;
+        u8 dst;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        ASSERT_RTNL();
+
+        err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_phonet_policy);
+        if (err < 0)
+                return err;
+
+        rtm = nlmsg_data(nlh);
+        if (rtm->rtm_table != RT_TABLE_MAIN || rtm->rtm_type != RTN_UNICAST)
+                return -EINVAL;
+        if (tb[RTA_DST] == NULL || tb[RTA_OIF] == NULL)
+                return -EINVAL;
+        dst = nla_get_u8(tb[RTA_DST]);
+        if (dst & 3) /* Phonet addresses only have 6 high-order bits */
+                return -EINVAL;
+
+        dev = __dev_get_by_index(net, nla_get_u32(tb[RTA_OIF]));
+        if (dev == NULL)
+                return -ENODEV;
+
+        if (nlh->nlmsg_type == RTM_NEWROUTE)
+                err = phonet_route_add(dev, dst);
+        else
+                err = phonet_route_del(dev, dst);
+        if (!err)
+                rtm_phonet_notify(nlh->nlmsg_type, dev, dst);
+        return err;
+}
+
+static int route_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        u8 addr, addr_idx = 0, addr_start_idx = cb->args[0];
+
+        for (addr = 0; addr < 64; addr++) {
+                struct net_device *dev;
+
+                dev = phonet_route_get(net, addr << 2);
+                if (!dev)
+                        continue;
+
+                if (addr_idx++ < addr_start_idx)
+                        continue;
+                if (fill_route(skb, dev, addr << 2, NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, RTM_NEWROUTE))
+                        goto out;
+        }
+
+out:
+        cb->args[0] = addr_idx;
+        cb->args[1] = 0;
+
+        return skb->len;
+}
+
 int __init phonet_netlink_register(void)
 {
         int err = __rtnl_register(PF_PHONET, RTM_NEWADDR, addr_doit, NULL);
@@ -169,5 +294,8 @@ int __init phonet_netlink_register(void)
         /* Further __rtnl_register() cannot fail */
         __rtnl_register(PF_PHONET, RTM_DELADDR, addr_doit, NULL);
         __rtnl_register(PF_PHONET, RTM_GETADDR, NULL, getaddr_dumpit);
+        __rtnl_register(PF_PHONET, RTM_NEWROUTE, route_doit, NULL);
+        __rtnl_register(PF_PHONET, RTM_DELROUTE, route_doit, NULL);
+        __rtnl_register(PF_PHONET, RTM_GETROUTE, NULL, route_dumpit);
         return 0;
 }
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index aa5b5a972bff..c785bfd0744f 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -23,6 +23,7 @@
  * 02110-1301 USA
  */
 
+#include <linux/gfp.h>
 #include <linux/kernel.h>
 #include <linux/net.h>
 #include <linux/poll.h>
@@ -45,13 +46,28 @@ static int pn_socket_release(struct socket *sock)
         return 0;
 }
 
+#define PN_HASHSIZE     16
+#define PN_HASHMASK     (PN_HASHSIZE-1)
+
+
 static struct  {
-        struct hlist_head hlist;
+        struct hlist_head hlist[PN_HASHSIZE];
         spinlock_t lock;
-} pnsocks = {
-        .hlist = HLIST_HEAD_INIT,
-        .lock = __SPIN_LOCK_UNLOCKED(pnsocks.lock),
-};
+} pnsocks;
+
+void __init pn_sock_init(void)
+{
+        unsigned i;
+
+        for (i = 0; i < PN_HASHSIZE; i++)
+                INIT_HLIST_HEAD(pnsocks.hlist + i);
+        spin_lock_init(&pnsocks.lock);
+}
+
+static struct hlist_head *pn_hash_list(u16 obj)
+{
+        return pnsocks.hlist + (obj & PN_HASHMASK);
+}
 
 /*
  * Find address based on socket address, match only certain fields.
@@ -64,10 +80,11 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         struct sock *rval = NULL;
         u16 obj = pn_sockaddr_get_object(spn);
         u8 res = spn->spn_resource;
+        struct hlist_head *hlist = pn_hash_list(obj);
 
         spin_lock_bh(&pnsocks.lock);
 
-        sk_for_each(sknode, node, &pnsocks.hlist) {
+        sk_for_each(sknode, node, hlist) {
                 struct pn_sock *pn = pn_sk(sknode);
                 BUG_ON(!pn->sobject); /* unbound socket */
 
@@ -82,8 +99,8 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
                         if (pn->resource != res)
                                 continue;
                 }
-                if (pn_addr(pn->sobject)
-                 && pn_addr(pn->sobject) != pn_addr(obj))
+                if (pn_addr(pn->sobject) &&
+                    pn_addr(pn->sobject) != pn_addr(obj))
                         continue;
 
                 rval = sknode;
@@ -94,13 +111,44 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         spin_unlock_bh(&pnsocks.lock);
 
         return rval;
+}
+
+/* Deliver a broadcast packet (only in bottom-half) */
+void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
+{
+        struct hlist_head *hlist = pnsocks.hlist;
+        unsigned h;
+
+        spin_lock(&pnsocks.lock);
+        for (h = 0; h < PN_HASHSIZE; h++) {
+                struct hlist_node *node;
+                struct sock *sknode;
+
+                sk_for_each(sknode, node, hlist) {
+                        struct sk_buff *clone;
+
+                        if (!net_eq(sock_net(sknode), net))
+                                continue;
+                        if (!sock_flag(sknode, SOCK_BROADCAST))
+                                continue;
 
+                        clone = skb_clone(skb, GFP_ATOMIC);
+                        if (clone) {
+                                sock_hold(sknode);
+                                sk_receive_skb(sknode, clone, 0);
+                        }
+                }
+                hlist++;
+        }
+        spin_unlock(&pnsocks.lock);
 }
 
 void pn_sock_hash(struct sock *sk)
 {
+        struct hlist_head *hlist = pn_hash_list(pn_sk(sk)->sobject);
+
         spin_lock_bh(&pnsocks.lock);
-        sk_add_node(sk, &pnsocks.hlist);
+        sk_add_node(sk, hlist);
         spin_unlock_bh(&pnsocks.lock);
 }
 EXPORT_SYMBOL(pn_sock_hash);
@@ -416,15 +464,20 @@ EXPORT_SYMBOL(pn_sock_get_port);
 static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
 {
         struct net *net = seq_file_net(seq);
+        struct hlist_head *hlist = pnsocks.hlist;
         struct hlist_node *node;
         struct sock *sknode;
+        unsigned h;
 
-        sk_for_each(sknode, node, &pnsocks.hlist) {
-                if (!net_eq(net, sock_net(sknode)))
-                        continue;
-                if (!pos)
-                        return sknode;
-                pos--;
+        for (h = 0; h < PN_HASHSIZE; h++) {
+                sk_for_each(sknode, node, hlist) {
+                        if (!net_eq(net, sock_net(sknode)))
+                                continue;
+                        if (!pos)
+                                return sknode;
+                        pos--;
+                }
+                hlist++;
         }
         return NULL;
 }
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index 2220f3322326..cea1c7dbdae2 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -84,20 +84,18 @@ static int proc_local_port_range(ctl_table *table, int write,
 
 static struct ctl_table phonet_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "local_port_range",
                 .data           = &local_port_range,
                 .maxlen         = sizeof(local_port_range),
                 .mode           = 0644,
                 .proc_handler   = proc_local_port_range,
-                .strategy       = NULL,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_path phonet_ctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "phonet", .ctl_name = CTL_UNNUMBERED, },
+        { .procname = "net", },
+        { .procname = "phonet", },
         { },
 };
 
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 98e05382fd3c..f81862baf4d0 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -33,6 +33,7 @@
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
+#include <linux/gfp.h>
 #include <linux/in.h>
 #include <linux/poll.h>
 #include <net/sock.h>
@@ -174,8 +175,8 @@ static unsigned int rds_poll(struct file *file, struct socket *sock,
                         mask |= (POLLIN | POLLRDNORM);
                 spin_unlock(&rs->rs_lock);
         }
-        if (!list_empty(&rs->rs_recv_queue)
-         || !list_empty(&rs->rs_notify_queue))
+        if (!list_empty(&rs->rs_recv_queue) ||
+            !list_empty(&rs->rs_notify_queue))
                 mask |= (POLLIN | POLLRDNORM);
         if (rs->rs_snd_bytes < rds_sk_sndbuf(rs))
                 mask |= (POLLOUT | POLLWRNORM);
@@ -265,6 +266,9 @@ static int rds_setsockopt(struct socket *sock, int level, int optname,
         case RDS_GET_MR:
                 ret = rds_get_mr(rs, optval, optlen);
                 break;
+        case RDS_GET_MR_FOR_DEST:
+                ret = rds_get_mr_for_dest(rs, optval, optlen);
+                break;
         case RDS_FREE_MR:
                 ret = rds_free_mr(rs, optval, optlen);
                 break;
@@ -305,8 +309,8 @@ static int rds_getsockopt(struct socket *sock, int level, int optname,
                 if (len < sizeof(int))
                         ret = -EINVAL;
                 else
-                if (put_user(rs->rs_recverr, (int __user *) optval)
-                 || put_user(sizeof(int), optlen))
+                if (put_user(rs->rs_recverr, (int __user *) optval) ||
+                    put_user(sizeof(int), optlen))
                         ret = -EFAULT;
                 else
                         ret = 0;
@@ -407,7 +411,8 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
         return 0;
 }
 
-static int rds_create(struct net *net, struct socket *sock, int protocol)
+static int rds_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
         struct sock *sk;
 
@@ -431,7 +436,7 @@ void rds_sock_put(struct rds_sock *rs)
         sock_put(rds_rs_to_sk(rs));
 }
 
-static struct net_proto_family rds_family_ops = {
+static const struct net_proto_family rds_family_ops = {
         .family =       AF_RDS,
         .create =       rds_create,
         .owner  =       THIS_MODULE,
diff --git a/net/rds/cong.c b/net/rds/cong.c
index dd2711df640b..f1da27ceb064 100644
--- a/net/rds/cong.c
+++ b/net/rds/cong.c
@@ -30,6 +30,7 @@
  * SOFTWARE.
  *
  */
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/rbtree.h>
 
@@ -218,6 +219,8 @@ void rds_cong_queue_updates(struct rds_cong_map *map)
         spin_lock_irqsave(&rds_cong_lock, flags);
 
         list_for_each_entry(conn, &map->m_conn_list, c_map_item) {
+                if (conn->c_loopback)
+                        continue;
                 if (!test_and_set_bit(0, &conn->c_map_queued)) {
                         rds_stats_inc(s_cong_update_queued);
                         queue_delayed_work(rds_wq, &conn->c_send_w, 0);
diff --git a/net/rds/connection.c b/net/rds/connection.c
index cc8b568c0c84..7619b671ca28 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -32,6 +32,7 @@
  */
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/inet_hashtables.h>
 
 #include "rds.h"
@@ -133,10 +134,8 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
 
         spin_lock_irqsave(&rds_conn_lock, flags);
         conn = rds_conn_lookup(head, laddr, faddr, trans);
-        if (conn
-         && conn->c_loopback
-         && conn->c_trans != &rds_loop_transport
-         && !is_outgoing) {
+        if (conn && conn->c_loopback && conn->c_trans != &rds_loop_transport &&
+            !is_outgoing) {
                 /* This is a looped back IB connection, and we're
                  * called by the code handling the incoming connect.
                  * We need a second connection object into which we
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 536ebe5d3f6b..8f2d6dd7700a 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -37,6 +37,7 @@
 #include <linux/inetdevice.h>
 #include <linux/if_arp.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 
 #include "rds.h"
 #include "ib.h"
@@ -182,8 +183,8 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
                 ic = conn->c_transport_data;
                 dev_addr = &ic->i_cm_id->route.addr.dev_addr;
 
-                ib_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
-                ib_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
+                rdma_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
+                rdma_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
 
                 rds_ibdev = ib_get_client_data(ic->i_cm_id->device, &rds_ib_client);
                 iinfo->max_send_wr = ic->i_send_ring.w_nr;
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 1378b854cac0..64df4e79b29f 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -98,6 +98,7 @@ struct rds_ib_connection {
         struct rds_ib_send_work *i_sends;
 
         /* rx */
+        struct tasklet_struct   i_recv_tasklet;
         struct mutex            i_recv_mutex;
         struct rds_ib_work_ring i_recv_ring;
         struct rds_ib_incoming  *i_ibinc;
@@ -303,6 +304,7 @@ void rds_ib_inc_free(struct rds_incoming *inc);
 int rds_ib_inc_copy_to_user(struct rds_incoming *inc, struct iovec *iov,
                              size_t size);
 void rds_ib_recv_cq_comp_handler(struct ib_cq *cq, void *context);
+void rds_ib_recv_tasklet_fn(unsigned long data);
 void rds_ib_recv_init_ring(struct rds_ib_connection *ic);
 void rds_ib_recv_clear_ring(struct rds_ib_connection *ic);
 void rds_ib_recv_init_ack(struct rds_ib_connection *ic);
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index c2d372f13dbb..88d0856cb797 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -32,6 +32,7 @@
  */
 #include <linux/kernel.h>
 #include <linux/in.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 
 #include "rds.h"
@@ -377,8 +378,8 @@ static u32 rds_ib_protocol_compatible(struct rdma_cm_event *event)
         }
 
         /* Even if len is crap *now* I still want to check it. -ASG */
-        if (event->param.conn.private_data_len < sizeof (*dp)
-            || dp->dp_protocol_major == 0)
+        if (event->param.conn.private_data_len < sizeof (*dp) ||
+            dp->dp_protocol_major == 0)
                 return RDS_PROTOCOL_3_0;
 
         common = be16_to_cpu(dp->dp_protocol_minor_mask) & RDS_IB_SUPPORTED_PROTOCOLS;
@@ -694,6 +695,8 @@ int rds_ib_conn_alloc(struct rds_connection *conn, gfp_t gfp)
                 return -ENOMEM;
 
         INIT_LIST_HEAD(&ic->ib_node);
+        tasklet_init(&ic->i_recv_tasklet, rds_ib_recv_tasklet_fn,
+                     (unsigned long) ic);
         mutex_init(&ic->i_recv_mutex);
 #ifndef KERNEL_HAS_ATOMIC64
         spin_lock_init(&ic->i_ack_lock);
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index ef3ab5b7283e..059989fdb7d7 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "rds.h"
 #include "rdma.h"
@@ -187,11 +188,8 @@ void __rds_ib_destroy_conns(struct list_head *list, spinlock_t *list_lock)
         INIT_LIST_HEAD(list);
         spin_unlock_irq(list_lock);
 
-        list_for_each_entry_safe(ic, _ic, &tmp_list, ib_node) {
-                if (ic->conn->c_passive)
-                        rds_conn_destroy(ic->conn->c_passive);
+        list_for_each_entry_safe(ic, _ic, &tmp_list, ib_node)
                 rds_conn_destroy(ic->conn);
-        }
 }
 
 struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *rds_ibdev)
@@ -573,8 +571,8 @@ void rds_ib_free_mr(void *trans_private, int invalidate)
         spin_unlock_irqrestore(&pool->list_lock, flags);
 
         /* If we've pinned too many pages, request a flush */
-        if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned
-         || atomic_read(&pool->dirty_count) >= pool->max_items / 10)
+        if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned ||
+            atomic_read(&pool->dirty_count) >= pool->max_items / 10)
                 queue_work(rds_wq, &pool->flush_worker);
 
         if (invalidate) {
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index cd7a6cfcab03..c7dd11b835f0 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <rdma/rdma_cm.h>
@@ -143,15 +144,16 @@ static int rds_ib_recv_refill_one(struct rds_connection *conn,
         int ret = -ENOMEM;
 
         if (recv->r_ibinc == NULL) {
-                if (atomic_read(&rds_ib_allocation) >= rds_ib_sysctl_max_recv_allocation) {
+                if (!atomic_add_unless(&rds_ib_allocation, 1, rds_ib_sysctl_max_recv_allocation)) {
                         rds_ib_stats_inc(s_ib_rx_alloc_limit);
                         goto out;
                 }
                 recv->r_ibinc = kmem_cache_alloc(rds_ib_incoming_slab,
                                                  kptr_gfp);
-                if (recv->r_ibinc == NULL)
+                if (recv->r_ibinc == NULL) {
+                        atomic_dec(&rds_ib_allocation);
                         goto out;
-                atomic_inc(&rds_ib_allocation);
+                }
                 INIT_LIST_HEAD(&recv->r_ibinc->ii_frags);
                 rds_inc_init(&recv->r_ibinc->ii_inc, conn, conn->c_faddr);
         }
@@ -229,8 +231,8 @@ int rds_ib_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
         int ret = 0;
         u32 pos;
 
-        while ((prefill || rds_conn_up(conn))
-                        && rds_ib_ring_alloc(&ic->i_recv_ring, 1, &pos)) {
+        while ((prefill || rds_conn_up(conn)) &&
+               rds_ib_ring_alloc(&ic->i_recv_ring, 1, &pos)) {
                 if (pos >= ic->i_recv_ring.w_nr) {
                         printk(KERN_NOTICE "Argh - ring alloc returned pos=%u\n",
                                         pos);
@@ -770,10 +772,10 @@ static void rds_ib_process_recv(struct rds_connection *conn,
                 hdr = &ibinc->ii_inc.i_hdr;
                 /* We can't just use memcmp here; fragments of a
                  * single message may carry different ACKs */
-                if (hdr->h_sequence != ihdr->h_sequence
-                 || hdr->h_len != ihdr->h_len
-                 || hdr->h_sport != ihdr->h_sport
-                 || hdr->h_dport != ihdr->h_dport) {
+                if (hdr->h_sequence != ihdr->h_sequence ||
+                    hdr->h_len != ihdr->h_len ||
+                    hdr->h_sport != ihdr->h_sport ||
+                    hdr->h_dport != ihdr->h_dport) {
                         rds_ib_conn_error(conn,
                                 "fragment header mismatch; forcing reconnect\n");
                         return;
@@ -824,17 +826,22 @@ void rds_ib_recv_cq_comp_handler(struct ib_cq *cq, void *context)
 {
         struct rds_connection *conn = context;
         struct rds_ib_connection *ic = conn->c_transport_data;
-        struct ib_wc wc;
-        struct rds_ib_ack_state state = { 0, };
-        struct rds_ib_recv_work *recv;
 
         rdsdebug("conn %p cq %p\n", conn, cq);
 
         rds_ib_stats_inc(s_ib_rx_cq_call);
 
-        ib_req_notify_cq(cq, IB_CQ_SOLICITED);
+        tasklet_schedule(&ic->i_recv_tasklet);
+}
+
+static inline void rds_poll_cq(struct rds_ib_connection *ic,
+                               struct rds_ib_ack_state *state)
+{
+        struct rds_connection *conn = ic->conn;
+        struct ib_wc wc;
+        struct rds_ib_recv_work *recv;
 
-        while (ib_poll_cq(cq, 1, &wc) > 0) {
+        while (ib_poll_cq(ic->i_recv_cq, 1, &wc) > 0) {
                 rdsdebug("wc wr_id 0x%llx status %u byte_len %u imm_data %u\n",
                          (unsigned long long)wc.wr_id, wc.status, wc.byte_len,
                          be32_to_cpu(wc.ex.imm_data));
@@ -852,7 +859,7 @@ void rds_ib_recv_cq_comp_handler(struct ib_cq *cq, void *context)
                 if (rds_conn_up(conn) || rds_conn_connecting(conn)) {
                         /* We expect errors as the qp is drained during shutdown */
                         if (wc.status == IB_WC_SUCCESS) {
-                                rds_ib_process_recv(conn, recv, wc.byte_len, &state);
+                                rds_ib_process_recv(conn, recv, wc.byte_len, state);
                         } else {
                                 rds_ib_conn_error(conn, "recv completion on "
                                        "%pI4 had status %u, disconnecting and "
@@ -863,6 +870,17 @@ void rds_ib_recv_cq_comp_handler(struct ib_cq *cq, void *context)
 
                 rds_ib_ring_free(&ic->i_recv_ring, 1);
         }
+}
+
+void rds_ib_recv_tasklet_fn(unsigned long data)
+{
+        struct rds_ib_connection *ic = (struct rds_ib_connection *) data;
+        struct rds_connection *conn = ic->conn;
+        struct rds_ib_ack_state state = { 0, };
+
+        rds_poll_cq(ic, &state);
+        ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
+        rds_poll_cq(ic, &state);
 
         if (state.ack_next_valid)
                 rds_ib_set_ack(ic, state.ack_next, state.ack_required);
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index 23bf830db2d5..a10fab6886d1 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -252,8 +252,8 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
 
                 rds_ib_ring_free(&ic->i_send_ring, completed);
 
-                if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags)
-                 || test_bit(0, &conn->c_map_queued))
+                if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags) ||
+                    test_bit(0, &conn->c_map_queued))
                         queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
                 /* We expect errors as the qp is drained during shutdown */
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 84b5ffcb280f..03f01cb4e0fe 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -67,68 +67,62 @@ unsigned int rds_ib_sysctl_flow_control = 0;
 
 ctl_table rds_ib_sysctl_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_send_wr",
                 .data           = &rds_ib_sysctl_max_send_wr,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_ib_sysctl_max_wr_min,
                 .extra2         = &rds_ib_sysctl_max_wr_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_recv_wr",
                 .data           = &rds_ib_sysctl_max_recv_wr,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_ib_sysctl_max_wr_min,
                 .extra2         = &rds_ib_sysctl_max_wr_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_unsignaled_wr",
                 .data           = &rds_ib_sysctl_max_unsig_wrs,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_ib_sysctl_max_unsig_wr_min,
                 .extra2         = &rds_ib_sysctl_max_unsig_wr_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_unsignaled_bytes",
                 .data           = &rds_ib_sysctl_max_unsig_bytes,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_ib_sysctl_max_unsig_bytes_min,
                 .extra2         = &rds_ib_sysctl_max_unsig_bytes_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_recv_allocation",
                 .data           = &rds_ib_sysctl_max_recv_allocation,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "flow_control",
                 .data           = &rds_ib_sysctl_flow_control,
                 .maxlen         = sizeof(rds_ib_sysctl_flow_control),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0}
+        { }
 };
 
 static struct ctl_path rds_ib_sysctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "rds", .ctl_name = CTL_UNNUMBERED, },
-        { .procname = "ib", .ctl_name = CTL_UNNUMBERED, },
+        { .procname = "net", },
+        { .procname = "rds", },
+        { .procname = "ib", },
         { }
 };
 
diff --git a/net/rds/info.c b/net/rds/info.c
index 814a91a6f4a7..c45c4173a44d 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -32,6 +32,7 @@
  */
 #include <linux/percpu.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/proc_fs.h>
 
 #include "rds.h"
diff --git a/net/rds/iw.c b/net/rds/iw.c
index db224f7c2937..c8f3d3525cb9 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -37,6 +37,7 @@
 #include <linux/inetdevice.h>
 #include <linux/if_arp.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 
 #include "rds.h"
 #include "iw.h"
@@ -184,8 +185,8 @@ static int rds_iw_conn_info_visitor(struct rds_connection *conn,
                 ic = conn->c_transport_data;
                 dev_addr = &ic->i_cm_id->route.addr.dev_addr;
 
-                ib_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
-                ib_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
+                rdma_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
+                rdma_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
 
                 rds_iwdev = ib_get_client_data(ic->i_cm_id->device, &rds_iw_client);
                 iinfo->max_send_wr = ic->i_send_ring.w_nr;
diff --git a/net/rds/iw.h b/net/rds/iw.h
index dd72b62bd506..eef2f0c28476 100644
--- a/net/rds/iw.h
+++ b/net/rds/iw.h
@@ -119,6 +119,7 @@ struct rds_iw_connection {
         struct rds_iw_send_work *i_sends;
 
         /* rx */
+        struct tasklet_struct   i_recv_tasklet;
         struct mutex            i_recv_mutex;
         struct rds_iw_work_ring i_recv_ring;
         struct rds_iw_incoming  *i_iwinc;
@@ -330,6 +331,7 @@ void rds_iw_inc_free(struct rds_incoming *inc);
 int rds_iw_inc_copy_to_user(struct rds_incoming *inc, struct iovec *iov,
                              size_t size);
 void rds_iw_recv_cq_comp_handler(struct ib_cq *cq, void *context);
+void rds_iw_recv_tasklet_fn(unsigned long data);
 void rds_iw_recv_init_ring(struct rds_iw_connection *ic);
 void rds_iw_recv_clear_ring(struct rds_iw_connection *ic);
 void rds_iw_recv_init_ack(struct rds_iw_connection *ic);
diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
index a416b0d492b1..3e9460f935d8 100644
--- a/net/rds/iw_cm.c
+++ b/net/rds/iw_cm.c
@@ -32,6 +32,7 @@
  */
 #include <linux/kernel.h>
 #include <linux/in.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 
 #include "rds.h"
@@ -696,6 +697,8 @@ int rds_iw_conn_alloc(struct rds_connection *conn, gfp_t gfp)
                 return -ENOMEM;
 
         INIT_LIST_HEAD(&ic->iw_node);
+        tasklet_init(&ic->i_recv_tasklet, rds_iw_recv_tasklet_fn,
+                     (unsigned long) ic);
         mutex_init(&ic->i_recv_mutex);
 #ifndef KERNEL_HAS_ATOMIC64
         spin_lock_init(&ic->i_ack_lock);
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index de4a1b16bf7b..13dc1862d862 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "rds.h"
 #include "rdma.h"
@@ -245,11 +246,8 @@ void __rds_iw_destroy_conns(struct list_head *list, spinlock_t *list_lock)
         INIT_LIST_HEAD(list);
         spin_unlock_irq(list_lock);
 
-        list_for_each_entry_safe(ic, _ic, &tmp_list, iw_node) {
-                if (ic->conn->c_passive)
-                        rds_conn_destroy(ic->conn->c_passive);
+        list_for_each_entry_safe(ic, _ic, &tmp_list, iw_node)
                 rds_conn_destroy(ic->conn);
-        }
 }
 
 static void rds_iw_set_scatterlist(struct rds_iw_scatterlist *sg,
@@ -576,8 +574,8 @@ void rds_iw_free_mr(void *trans_private, int invalidate)
         rds_iw_free_fastreg(pool, ibmr);
 
         /* If we've pinned too many pages, request a flush */
-        if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned
-         || atomic_read(&pool->dirty_count) >= pool->max_items / 10)
+        if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned ||
+            atomic_read(&pool->dirty_count) >= pool->max_items / 10)
                 queue_work(rds_wq, &pool->flush_worker);
 
         if (invalidate) {
diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
index 8683f5f66c4b..da43ee840ca3 100644
--- a/net/rds/iw_recv.c
+++ b/net/rds/iw_recv.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <rdma/rdma_cm.h>
@@ -143,15 +144,16 @@ static int rds_iw_recv_refill_one(struct rds_connection *conn,
         int ret = -ENOMEM;
 
         if (recv->r_iwinc == NULL) {
-                if (atomic_read(&rds_iw_allocation) >= rds_iw_sysctl_max_recv_allocation) {
+                if (!atomic_add_unless(&rds_iw_allocation, 1, rds_iw_sysctl_max_recv_allocation)) {
                         rds_iw_stats_inc(s_iw_rx_alloc_limit);
                         goto out;
                 }
                 recv->r_iwinc = kmem_cache_alloc(rds_iw_incoming_slab,
                                                  kptr_gfp);
-                if (recv->r_iwinc == NULL)
+                if (recv->r_iwinc == NULL) {
+                        atomic_dec(&rds_iw_allocation);
                         goto out;
-                atomic_inc(&rds_iw_allocation);
+                }
                 INIT_LIST_HEAD(&recv->r_iwinc->ii_frags);
                 rds_inc_init(&recv->r_iwinc->ii_inc, conn, conn->c_faddr);
         }
@@ -229,8 +231,8 @@ int rds_iw_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
         int ret = 0;
         u32 pos;
 
-        while ((prefill || rds_conn_up(conn))
-                        && rds_iw_ring_alloc(&ic->i_recv_ring, 1, &pos)) {
+        while ((prefill || rds_conn_up(conn)) &&
+               rds_iw_ring_alloc(&ic->i_recv_ring, 1, &pos)) {
                 if (pos >= ic->i_recv_ring.w_nr) {
                         printk(KERN_NOTICE "Argh - ring alloc returned pos=%u\n",
                                         pos);
@@ -729,10 +731,10 @@ static void rds_iw_process_recv(struct rds_connection *conn,
                 hdr = &iwinc->ii_inc.i_hdr;
                 /* We can't just use memcmp here; fragments of a
                  * single message may carry different ACKs */
-                if (hdr->h_sequence != ihdr->h_sequence
-                 || hdr->h_len != ihdr->h_len
-                 || hdr->h_sport != ihdr->h_sport
-                 || hdr->h_dport != ihdr->h_dport) {
+                if (hdr->h_sequence != ihdr->h_sequence ||
+                    hdr->h_len != ihdr->h_len ||
+                    hdr->h_sport != ihdr->h_sport ||
+                    hdr->h_dport != ihdr->h_dport) {
                         rds_iw_conn_error(conn,
                                 "fragment header mismatch; forcing reconnect\n");
                         return;
@@ -783,17 +785,22 @@ void rds_iw_recv_cq_comp_handler(struct ib_cq *cq, void *context)
 {
         struct rds_connection *conn = context;
         struct rds_iw_connection *ic = conn->c_transport_data;
-        struct ib_wc wc;
-        struct rds_iw_ack_state state = { 0, };
-        struct rds_iw_recv_work *recv;
 
         rdsdebug("conn %p cq %p\n", conn, cq);
 
         rds_iw_stats_inc(s_iw_rx_cq_call);
 
-        ib_req_notify_cq(cq, IB_CQ_SOLICITED);
+        tasklet_schedule(&ic->i_recv_tasklet);
+}
+
+static inline void rds_poll_cq(struct rds_iw_connection *ic,
+                               struct rds_iw_ack_state *state)
+{
+        struct rds_connection *conn = ic->conn;
+        struct ib_wc wc;
+        struct rds_iw_recv_work *recv;
 
-        while (ib_poll_cq(cq, 1, &wc) > 0) {
+        while (ib_poll_cq(ic->i_recv_cq, 1, &wc) > 0) {
                 rdsdebug("wc wr_id 0x%llx status %u byte_len %u imm_data %u\n",
                          (unsigned long long)wc.wr_id, wc.status, wc.byte_len,
                          be32_to_cpu(wc.ex.imm_data));
@@ -811,7 +818,7 @@ void rds_iw_recv_cq_comp_handler(struct ib_cq *cq, void *context)
                 if (rds_conn_up(conn) || rds_conn_connecting(conn)) {
                         /* We expect errors as the qp is drained during shutdown */
                         if (wc.status == IB_WC_SUCCESS) {
-                                rds_iw_process_recv(conn, recv, wc.byte_len, &state);
+                                rds_iw_process_recv(conn, recv, wc.byte_len, state);
                         } else {
                                 rds_iw_conn_error(conn, "recv completion on "
                                        "%pI4 had status %u, disconnecting and "
@@ -822,6 +829,17 @@ void rds_iw_recv_cq_comp_handler(struct ib_cq *cq, void *context)
 
                 rds_iw_ring_free(&ic->i_recv_ring, 1);
         }
+}
+
+void rds_iw_recv_tasklet_fn(unsigned long data)
+{
+        struct rds_iw_connection *ic = (struct rds_iw_connection *) data;
+        struct rds_connection *conn = ic->conn;
+        struct rds_iw_ack_state state = { 0, };
+
+        rds_poll_cq(ic, &state);
+        ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
+        rds_poll_cq(ic, &state);
 
         if (state.ack_next_valid)
                 rds_iw_set_ack(ic, state.ack_next, state.ack_required);
diff --git a/net/rds/iw_send.c b/net/rds/iw_send.c
index 1f5abe3cf2b4..1379e9d66a78 100644
--- a/net/rds/iw_send.c
+++ b/net/rds/iw_send.c
@@ -288,8 +288,8 @@ void rds_iw_send_cq_comp_handler(struct ib_cq *cq, void *context)
 
                 rds_iw_ring_free(&ic->i_send_ring, completed);
 
-                if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags)
-                 || test_bit(0, &conn->c_map_queued))
+                if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags) ||
+                    test_bit(0, &conn->c_map_queued))
                         queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
                 /* We expect errors as the qp is drained during shutdown */
@@ -519,8 +519,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
         BUG_ON(hdr_off != 0 && hdr_off != sizeof(struct rds_header));
 
         /* Fastreg support */
-        if (rds_rdma_cookie_key(rm->m_rdma_cookie)
-         && !ic->i_fastreg_posted) {
+        if (rds_rdma_cookie_key(rm->m_rdma_cookie) && !ic->i_fastreg_posted) {
                 ret = -EAGAIN;
                 goto out;
         }
diff --git a/net/rds/iw_sysctl.c b/net/rds/iw_sysctl.c
index 9590678cd616..1c4428a61a02 100644
--- a/net/rds/iw_sysctl.c
+++ b/net/rds/iw_sysctl.c
@@ -57,68 +57,62 @@ unsigned int rds_iw_sysctl_flow_control = 1;
 
 ctl_table rds_iw_sysctl_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_send_wr",
                 .data           = &rds_iw_sysctl_max_send_wr,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_iw_sysctl_max_wr_min,
                 .extra2         = &rds_iw_sysctl_max_wr_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_recv_wr",
                 .data           = &rds_iw_sysctl_max_recv_wr,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_iw_sysctl_max_wr_min,
                 .extra2         = &rds_iw_sysctl_max_wr_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_unsignaled_wr",
                 .data           = &rds_iw_sysctl_max_unsig_wrs,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_iw_sysctl_max_unsig_wr_min,
                 .extra2         = &rds_iw_sysctl_max_unsig_wr_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_unsignaled_bytes",
                 .data           = &rds_iw_sysctl_max_unsig_bytes,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
                 .extra1         = &rds_iw_sysctl_max_unsig_bytes_min,
                 .extra2         = &rds_iw_sysctl_max_unsig_bytes_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_recv_allocation",
                 .data           = &rds_iw_sysctl_max_recv_allocation,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = proc_doulongvec_minmax,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "flow_control",
                 .data           = &rds_iw_sysctl_flow_control,
                 .maxlen         = sizeof(rds_iw_sysctl_flow_control),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0}
+        { }
 };
 
 static struct ctl_path rds_iw_sysctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "rds", .ctl_name = CTL_UNNUMBERED, },
-        { .procname = "iw", .ctl_name = CTL_UNNUMBERED, },
+        { .procname = "net", },
+        { .procname = "rds", },
+        { .procname = "iw", },
         { }
 };
 
diff --git a/net/rds/loop.c b/net/rds/loop.c
index 4a61997f554d..0d7a159158b8 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 
 #include "rds.h"
diff --git a/net/rds/message.c b/net/rds/message.c
index ca50a8ec9742..9a1d67e001ba 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "rds.h"
 #include "rdma.h"
@@ -122,8 +123,7 @@ int rds_message_add_extension(struct rds_header *hdr,
         if (hdr->h_exthdr[0] != RDS_EXTHDR_NONE)
                 return 0;
 
-        if (type >= __RDS_EXTHDR_MAX
-         || len != rds_exthdr_size[type])
+        if (type >= __RDS_EXTHDR_MAX || len != rds_exthdr_size[type])
                 return 0;
 
         if (ext_len >= RDS_HEADER_EXT_SPACE)
diff --git a/net/rds/page.c b/net/rds/page.c
index 36790122dfd4..595a952d4b17 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/highmem.h>
+#include <linux/gfp.h>
 
 #include "rds.h"
 
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 8dc83d2caa58..5ce9437cad67 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/rbtree.h>
 #include <linux/dma-mapping.h> /* for DMA_*_DEVICE */
 
@@ -317,6 +318,30 @@ int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen)
         return __rds_rdma_map(rs, &args, NULL, NULL);
 }
 
+int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
+{
+        struct rds_get_mr_for_dest_args args;
+        struct rds_get_mr_args new_args;
+
+        if (optlen != sizeof(struct rds_get_mr_for_dest_args))
+                return -EINVAL;
+
+        if (copy_from_user(&args, (struct rds_get_mr_for_dest_args __user *)optval,
+                           sizeof(struct rds_get_mr_for_dest_args)))
+                return -EFAULT;
+
+        /*
+         * Initially, just behave like get_mr().
+         * TODO: Implement get_mr as wrapper around this
+         *       and deprecate it.
+         */
+        new_args.vec = args.vec;
+        new_args.cookie_addr = args.cookie_addr;
+        new_args.flags = args.flags;
+
+        return __rds_rdma_map(rs, &new_args, NULL, NULL);
+}
+
 /*
  * Free the MR indicated by the given R_Key
  */
@@ -607,8 +632,8 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
 {
         struct rds_rdma_op *op;
 
-        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args))
-         || rm->m_rdma_op != NULL)
+        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args)) ||
+            rm->m_rdma_op != NULL)
                 return -EINVAL;
 
         op = rds_rdma_prepare(rs, CMSG_DATA(cmsg));
@@ -631,8 +656,8 @@ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
         u32 r_key;
         int err = 0;
 
-        if (cmsg->cmsg_len < CMSG_LEN(sizeof(rds_rdma_cookie_t))
-         || rm->m_rdma_cookie != 0)
+        if (cmsg->cmsg_len < CMSG_LEN(sizeof(rds_rdma_cookie_t)) ||
+            rm->m_rdma_cookie != 0)
                 return -EINVAL;
 
         memcpy(&rm->m_rdma_cookie, CMSG_DATA(cmsg), sizeof(rm->m_rdma_cookie));
@@ -668,8 +693,8 @@ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
 int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
                           struct cmsghdr *cmsg)
 {
-        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_get_mr_args))
-         || rm->m_rdma_cookie != 0)
+        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_get_mr_args)) ||
+            rm->m_rdma_cookie != 0)
                 return -EINVAL;
 
         return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->m_rdma_mr);
diff --git a/net/rds/rdma.h b/net/rds/rdma.h
index 425512098b0b..909c39835a5d 100644
--- a/net/rds/rdma.h
+++ b/net/rds/rdma.h
@@ -61,6 +61,7 @@ static inline u32 rds_rdma_cookie_offset(rds_rdma_cookie_t cookie)
 }
 
 int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen);
+int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen);
 int rds_free_mr(struct rds_sock *rs, char __user *optval, int optlen);
 void rds_rdma_drop_keys(struct rds_sock *rs);
 int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 9ece910ea394..7b155081b4dc 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -134,7 +134,7 @@ static int __init rds_rdma_listen_init(void)
                 ret = PTR_ERR(cm_id);
                 printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_create_id() returned %d\n", ret);
-                goto out;
+                return ret;
         }
 
         sin.sin_family = AF_INET,
diff --git a/net/rds/recv.c b/net/rds/recv.c
index fdff33c7b432..e2a2b9344f7b 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/in.h>
 
@@ -195,8 +196,8 @@ void rds_recv_incoming(struct rds_connection *conn, __be32 saddr, __be32 daddr,
          * XXX we could spend more on the wire to get more robust failure
          * detection, arguably worth it to avoid data corruption.
          */
-        if (be64_to_cpu(inc->i_hdr.h_sequence) < conn->c_next_rx_seq
-         && (inc->i_hdr.h_flags & RDS_FLAG_RETRANSMITTED)) {
+        if (be64_to_cpu(inc->i_hdr.h_sequence) < conn->c_next_rx_seq &&
+            (inc->i_hdr.h_flags & RDS_FLAG_RETRANSMITTED)) {
                 rds_stats_inc(s_recv_drop_old_seq);
                 goto out;
         }
@@ -432,10 +433,9 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                         }
 
                         timeo = wait_event_interruptible_timeout(*sk->sk_sleep,
-                                                (!list_empty(&rs->rs_notify_queue)
-                                                || rs->rs_cong_notify
-                                                || rds_next_incoming(rs, &inc)),
-                                                timeo);
+                                        (!list_empty(&rs->rs_notify_queue) ||
+                                         rs->rs_cong_notify ||
+                                         rds_next_incoming(rs, &inc)), timeo);
                         rdsdebug("recvmsg woke inc %p timeo %ld\n", inc,
                                  timeo);
                         if (timeo > 0 || timeo == MAX_SCHEDULE_TIMEOUT)
diff --git a/net/rds/send.c b/net/rds/send.c
index 28c88ff3d038..f04b929ded92 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 #include <linux/in.h>
 #include <linux/list.h>
@@ -235,8 +236,8 @@ int rds_send_xmit(struct rds_connection *conn)
                          * connection.
                          * Therefore, we never retransmit messages with RDMA ops.
                          */
-                        if (rm->m_rdma_op
-                         && test_bit(RDS_MSG_RETRANSMITTED, &rm->m_flags)) {
+                        if (rm->m_rdma_op &&
+                            test_bit(RDS_MSG_RETRANSMITTED, &rm->m_flags)) {
                                 spin_lock_irqsave(&conn->c_lock, flags);
                                 if (test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags))
                                         list_move(&rm->m_conn_item, &to_be_dropped);
@@ -247,8 +248,8 @@ int rds_send_xmit(struct rds_connection *conn)
 
                         /* Require an ACK every once in a while */
                         len = ntohl(rm->m_inc.i_hdr.h_len);
-                        if (conn->c_unacked_packets == 0
-                         || conn->c_unacked_bytes < len) {
+                        if (conn->c_unacked_packets == 0 ||
+                            conn->c_unacked_bytes < len) {
                                 __set_bit(RDS_MSG_ACK_REQUIRED, &rm->m_flags);
 
                                 conn->c_unacked_packets = rds_sysctl_max_unacked_packets;
@@ -418,8 +419,8 @@ void rds_rdma_send_complete(struct rds_message *rm, int status)
         spin_lock(&rm->m_rs_lock);
 
         ro = rm->m_rdma_op;
-        if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags)
-         && ro && ro->r_notify && ro->r_notifier) {
+        if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) &&
+            ro && ro->r_notify && ro->r_notifier) {
                 notifier = ro->r_notifier;
                 rs = rm->m_rs;
                 sock_hold(rds_rs_to_sk(rs));
@@ -549,8 +550,7 @@ void rds_send_remove_from_sock(struct list_head *messages, int status)
                         list_del_init(&rm->m_sock_item);
                         rds_send_sndbuf_remove(rs, rm);
 
-                        if (ro && ro->r_notifier
-                           && (status || ro->r_notify)) {
+                        if (ro && ro->r_notifier && (status || ro->r_notify)) {
                                 notifier = ro->r_notifier;
                                 list_add_tail(&notifier->n_list,
                                                 &rs->rs_notify_queue);
@@ -877,8 +877,8 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (ret)
                 goto out;
 
-        if ((rm->m_rdma_cookie || rm->m_rdma_op)
-         && conn->c_trans->xmit_rdma == NULL) {
+        if ((rm->m_rdma_cookie || rm->m_rdma_op) &&
+            conn->c_trans->xmit_rdma == NULL) {
                 if (printk_ratelimit())
                         printk(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n",
                                 rm->m_rdma_op, conn->c_trans->xmit_rdma);
@@ -890,8 +890,8 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
          * have scheduled a delayed reconnect however - in this case
          * we should not interfere.
          */
-        if (rds_conn_state(conn) == RDS_CONN_DOWN
-         && !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
+        if (rds_conn_state(conn) == RDS_CONN_DOWN &&
+            !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
                 queue_delayed_work(rds_wq, &conn->c_conn_w, 0);
 
         ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs);
@@ -973,8 +973,8 @@ rds_send_pong(struct rds_connection *conn, __be16 dport)
          * have scheduled a delayed reconnect however - in this case
          * we should not interfere.
          */
-        if (rds_conn_state(conn) == RDS_CONN_DOWN
-         && !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
+        if (rds_conn_state(conn) == RDS_CONN_DOWN &&
+            !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
                 queue_delayed_work(rds_wq, &conn->c_conn_w, 0);
 
         ret = rds_cong_wait(conn->c_fcong, dport, 1, NULL);
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 307dc5c1be15..7829a20325d3 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -51,55 +51,50 @@ unsigned int rds_sysctl_ping_enable = 1;
 
 static ctl_table rds_sysctl_rds_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "reconnect_min_delay_ms",
                 .data           = &rds_sysctl_reconnect_min_jiffies,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_ms_jiffies_minmax,
+                .proc_handler   = proc_doulongvec_ms_jiffies_minmax,
                 .extra1         = &rds_sysctl_reconnect_min,
                 .extra2         = &rds_sysctl_reconnect_max_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "reconnect_max_delay_ms",
                 .data           = &rds_sysctl_reconnect_max_jiffies,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_ms_jiffies_minmax,
+                .proc_handler   = proc_doulongvec_ms_jiffies_minmax,
                 .extra1         = &rds_sysctl_reconnect_min_jiffies,
                 .extra2         = &rds_sysctl_reconnect_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_unacked_packets",
                 .data           = &rds_sysctl_max_unacked_packets,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max_unacked_bytes",
                 .data           = &rds_sysctl_max_unacked_bytes,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "ping_enable",
                 .data           = &rds_sysctl_ping_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0}
+        { }
 };
 
 static struct ctl_path rds_sysctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "rds", .ctl_name = CTL_UNNUMBERED, },
+        { .procname = "net", },
+        { .procname = "rds", },
         { }
 };
 
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index b5198aee45d3..babf4577ff7d 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <net/tcp.h>
 
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index 211522f9a9a2..056256285987 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -90,8 +90,8 @@ int rds_tcp_conn_connect(struct rds_connection *conn)
 
         ret = sock->ops->bind(sock, (struct sockaddr *)&src, sizeof(src));
         if (ret) {
-                rdsdebug("bind failed with %d at address %u.%u.%u.%u\n",
-                     ret, NIPQUAD(conn->c_laddr));
+                rdsdebug("bind failed with %d at address %pI4\n",
+                         ret, &conn->c_laddr);
                 goto out;
         }
 
@@ -108,8 +108,7 @@ int rds_tcp_conn_connect(struct rds_connection *conn)
                                  O_NONBLOCK);
         sock = NULL;
 
-        rdsdebug("connect to address %u.%u.%u.%u returned %d\n",
-                 NIPQUAD(conn->c_faddr), ret);
+        rdsdebug("connect to address %pI4 returned %d\n", &conn->c_faddr, ret);
         if (ret == -EINPROGRESS)
                 ret = 0;
 
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 24b743eb0b1b..975183fe6950 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/gfp.h>
 #include <linux/in.h>
 #include <net/tcp.h>
 
@@ -66,12 +67,12 @@ static int rds_tcp_accept_one(struct socket *sock)
 
         inet = inet_sk(new_sock->sk);
 
-        rdsdebug("accepted tcp %u.%u.%u.%u:%u -> %u.%u.%u.%u:%u\n",
-                  NIPQUAD(inet->saddr), ntohs(inet->sport),
-                  NIPQUAD(inet->daddr), ntohs(inet->dport));
+        rdsdebug("accepted tcp %pI4:%u -> %pI4:%u\n",
+                 &inet->inet_saddr, ntohs(inet->inet_sport),
+                 &inet->inet_daddr, ntohs(inet->inet_dport));
 
-        conn = rds_conn_create(inet->saddr, inet->daddr, &rds_tcp_transport,
-                               GFP_KERNEL);
+        conn = rds_conn_create(inet->inet_saddr, inet->inet_daddr,
+                               &rds_tcp_transport, GFP_KERNEL);
         if (IS_ERR(conn)) {
                 ret = PTR_ERR(conn);
                 goto out;
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index c00dafffbb5a..e08ec912d8b0 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -31,6 +31,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <net/tcp.h>
 
 #include "rds.h"
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index ab545e0cd5d6..34fdcc059e54 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -193,9 +193,9 @@ out:
                         rds_tcp_stats_inc(s_tcp_sndbuf_full);
                         ret = 0;
                 } else {
-                        printk(KERN_WARNING "RDS/tcp: send to %u.%u.%u.%u "
+                        printk(KERN_WARNING "RDS/tcp: send to %pI4 "
                                "returned %d, disconnecting and reconnecting\n",
-                               NIPQUAD(conn->c_faddr), ret);
+                               &conn->c_faddr, ret);
                         rds_conn_drop(conn);
                 }
         }
diff --git a/net/rds/threads.c b/net/rds/threads.c
index dd7e0cad1e7c..00fa10e59af8 100644
--- a/net/rds/threads.c
+++ b/net/rds/threads.c
@@ -170,8 +170,8 @@ void rds_shutdown_worker(struct work_struct *work)
                  * handler is supposed to check for state DISCONNECTING
                  */
                 mutex_lock(&conn->c_cm_lock);
-                if (!rds_conn_transition(conn, RDS_CONN_UP, RDS_CONN_DISCONNECTING)
-                 && !rds_conn_transition(conn, RDS_CONN_ERROR, RDS_CONN_DISCONNECTING)) {
+                if (!rds_conn_transition(conn, RDS_CONN_UP, RDS_CONN_DISCONNECTING) &&
+                    !rds_conn_transition(conn, RDS_CONN_ERROR, RDS_CONN_DISCONNECTING)) {
                         rds_conn_error(conn, "shutdown called in state %d\n",
                                         atomic_read(&conn->c_state));
                         mutex_unlock(&conn->c_cm_lock);
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index a001f7c1f711..a9fa86f65983 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -33,6 +33,7 @@
 #include <linux/wait.h>
 #include <linux/poll.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 
 #include "rfkill.h"
 
@@ -579,6 +580,8 @@ static ssize_t rfkill_name_show(struct device *dev,
 
 static const char *rfkill_get_type_str(enum rfkill_type type)
 {
+        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_FM + 1);
+
         switch (type) {
         case RFKILL_TYPE_WLAN:
                 return "wlan";
@@ -592,11 +595,11 @@ static const char *rfkill_get_type_str(enum rfkill_type type)
                 return "wwan";
         case RFKILL_TYPE_GPS:
                 return "gps";
+        case RFKILL_TYPE_FM:
+                return "fm";
         default:
                 BUG();
         }
-
-        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_GPS + 1);
 }
 
 static ssize_t rfkill_type_show(struct device *dev,
diff --git a/net/rfkill/input.c b/net/rfkill/input.c
index a7295ad5f9cb..3713d7ecab96 100644
--- a/net/rfkill/input.c
+++ b/net/rfkill/input.c
@@ -212,6 +212,9 @@ static void rfkill_event(struct input_handle *handle, unsigned int type,
                 case KEY_WIMAX:
                         rfkill_schedule_toggle(RFKILL_TYPE_WIMAX);
                         break;
+                case KEY_RFKILL:
+                        rfkill_schedule_toggle(RFKILL_TYPE_ALL);
+                        break;
                 }
         } else if (type == EV_SW && code == SW_RFKILL_ALL)
                 rfkill_schedule_evsw_rfkillall(data);
@@ -295,6 +298,11 @@ static const struct input_device_id rfkill_ids[] = {
                 .keybit = { [BIT_WORD(KEY_WIMAX)] = BIT_MASK(KEY_WIMAX) },
         },
         {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(KEY_RFKILL)] = BIT_MASK(KEY_RFKILL) },
+        },
+        {
                 .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_SWBIT,
                 .evbit = { BIT(EV_SW) },
                 .swbit = { [BIT_WORD(SW_RFKILL_ALL)] = BIT_MASK(SW_RFKILL_ALL) },
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 502cce76621d..4fb711a035f4 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -18,6 +18,7 @@
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/in.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
@@ -512,12 +513,13 @@ static struct proto rose_proto = {
         .obj_size = sizeof(struct rose_sock),
 };
 
-static int rose_create(struct net *net, struct socket *sock, int protocol)
+static int rose_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         struct rose_sock *rose;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         if (sock->type != SOCK_SEQPACKET || protocol != 0)
@@ -1403,29 +1405,13 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static void *rose_info_start(struct seq_file *seq, loff_t *pos)
         __acquires(rose_list_lock)
 {
-        int i;
-        struct sock *s;
-        struct hlist_node *node;
-
         spin_lock_bh(&rose_list_lock);
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        i = 1;
-        sk_for_each(s, node, &rose_list) {
-                if (i == *pos)
-                        return s;
-                ++i;
-        }
-        return NULL;
+        return seq_hlist_start_head(&rose_list, *pos);
 }
 
 static void *rose_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
-
-        return (v == SEQ_START_TOKEN) ? sk_head(&rose_list)
-                : sk_next((struct sock *)v);
+        return seq_hlist_next(v, &rose_list, pos);
 }
 
 static void rose_info_stop(struct seq_file *seq, void *v)
@@ -1443,7 +1429,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
                          "dest_addr  dest_call src_addr   src_call  dev   lci neigh st vs vr va   t  t1  t2  t3  hb    idle Snd-Q Rcv-Q inode\n");
 
         else {
-                struct sock *s = v;
+                struct sock *s = sk_entry(v);
                 struct rose_sock *rose = rose_sk(s);
                 const char *devname, *callsign;
                 const struct net_device *dev = rose->device;
@@ -1509,7 +1495,7 @@ static const struct file_operations rose_info_fops = {
 };
 #endif  /* CONFIG_PROC_FS */
 
-static struct net_proto_family rose_family_ops = {
+static const struct net_proto_family rose_family_ops = {
         .family         =       PF_ROSE,
         .create         =       rose_create,
         .owner          =       THIS_MODULE,
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 424b893d1450..178ff4f73c85 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -19,6 +19,7 @@
 #include <linux/fcntl.h>
 #include <linux/in.h>
 #include <linux/if_ether.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/io.h>
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index bd86a63960ce..a750a28e0221 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -101,13 +102,17 @@ static void rose_t0timer_expiry(unsigned long param)
 static int rose_send_frame(struct sk_buff *skb, struct rose_neigh *neigh)
 {
         ax25_address *rose_call;
+        ax25_cb *ax25s;
 
         if (ax25cmp(&rose_callsign, &null_ax25_address) == 0)
                 rose_call = (ax25_address *)neigh->dev->dev_addr;
         else
                 rose_call = &rose_callsign;
 
+        ax25s = neigh->ax25;
         neigh->ax25 = ax25_send_frame(skb, 260, rose_call, &neigh->callsign, neigh->digipeat, neigh->dev);
+        if (ax25s)
+                ax25_cb_put(ax25s);
 
         return (neigh->ax25 != NULL);
 }
@@ -120,13 +125,17 @@ static int rose_send_frame(struct sk_buff *skb, struct rose_neigh *neigh)
 static int rose_link_up(struct rose_neigh *neigh)
 {
         ax25_address *rose_call;
+        ax25_cb *ax25s;
 
         if (ax25cmp(&rose_callsign, &null_ax25_address) == 0)
                 rose_call = (ax25_address *)neigh->dev->dev_addr;
         else
                 rose_call = &rose_callsign;
 
+        ax25s = neigh->ax25;
         neigh->ax25 = ax25_find_cb(rose_call, &neigh->callsign, neigh->digipeat, neigh->dev);
+        if (ax25s)
+                ax25_cb_put(ax25s);
 
         return (neigh->ax25 != NULL);
 }
diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
index 114df6eec8c3..ae4a9d99aec7 100644
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -7,6 +7,7 @@
  * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
  */
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/timer.h>
 #include <net/ax25.h>
@@ -75,7 +76,7 @@ static void rose_loopback_timer(unsigned long param)
                 lci_i     = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
                 frametype = skb->data[2];
                 dest      = (rose_address *)(skb->data + 4);
-                lci_o     = 0xFFF - lci_i;
+                lci_o     = ROSE_DEFAULT_MAXVC + 1 - lci_i;
 
                 skb_reset_transport_header(skb);
 
diff --git a/net/rose/rose_out.c b/net/rose/rose_out.c
index 69820f93414b..4ebf33afbe47 100644
--- a/net/rose/rose_out.c
+++ b/net/rose/rose_out.c
@@ -15,6 +15,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/gfp.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index f3e21989b88c..cbc244a128bd 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -77,8 +78,9 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route,
 
         rose_neigh = rose_neigh_list;
         while (rose_neigh != NULL) {
-                if (ax25cmp(&rose_route->neighbour, &rose_neigh->callsign) == 0
-                    && rose_neigh->dev == dev)
+                if (ax25cmp(&rose_route->neighbour,
+                            &rose_neigh->callsign) == 0 &&
+                    rose_neigh->dev == dev)
                         break;
                 rose_neigh = rose_neigh->next;
         }
@@ -234,6 +236,8 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)
 
         if ((s = rose_neigh_list) == rose_neigh) {
                 rose_neigh_list = rose_neigh->next;
+                if (rose_neigh->ax25)
+                        ax25_cb_put(rose_neigh->ax25);
                 kfree(rose_neigh->digipeat);
                 kfree(rose_neigh);
                 return;
@@ -242,6 +246,8 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)
         while (s != NULL && s->next != NULL) {
                 if (s->next == rose_neigh) {
                         s->next = rose_neigh->next;
+                        if (rose_neigh->ax25)
+                                ax25_cb_put(rose_neigh->ax25);
                         kfree(rose_neigh->digipeat);
                         kfree(rose_neigh);
                         return;
@@ -311,8 +317,9 @@ static int rose_del_node(struct rose_route_struct *rose_route,
 
         rose_neigh = rose_neigh_list;
         while (rose_neigh != NULL) {
-                if (ax25cmp(&rose_route->neighbour, &rose_neigh->callsign) == 0
-                    && rose_neigh->dev == dev)
+                if (ax25cmp(&rose_route->neighbour,
+                            &rose_neigh->callsign) == 0 &&
+                    rose_neigh->dev == dev)
                         break;
                 rose_neigh = rose_neigh->next;
         }
@@ -600,13 +607,13 @@ struct net_device *rose_dev_first(void)
 {
         struct net_device *dev, *first = NULL;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
                 if ((dev->flags & IFF_UP) && dev->type == ARPHRD_ROSE)
                         if (first == NULL || strncmp(dev->name, first->name, 3) < 0)
                                 first = dev;
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         return first;
 }
@@ -618,8 +625,8 @@ struct net_device *rose_dev_get(rose_address *addr)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
                 if ((dev->flags & IFF_UP) && dev->type == ARPHRD_ROSE && rosecmp(addr, (rose_address *)dev->dev_addr) == 0) {
                         dev_hold(dev);
                         goto out;
@@ -627,7 +634,7 @@ struct net_device *rose_dev_get(rose_address *addr)
         }
         dev = NULL;
 out:
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return dev;
 }
 
@@ -635,14 +642,14 @@ static int rose_dev_exists(rose_address *addr)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
                 if ((dev->flags & IFF_UP) && dev->type == ARPHRD_ROSE && rosecmp(addr, (rose_address *)dev->dev_addr) == 0)
                         goto out;
         }
         dev = NULL;
 out:
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return dev != NULL;
 }
 
@@ -810,6 +817,7 @@ void rose_link_failed(ax25_cb *ax25, int reason)
 
         if (rose_neigh != NULL) {
                 rose_neigh->ax25 = NULL;
+                ax25_cb_put(ax25);
 
                 rose_del_route_by_neigh(rose_neigh);
                 rose_kill_by_neigh(rose_neigh);
diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
index b05108f382da..1734abba26a2 100644
--- a/net/rose/rose_subr.c
+++ b/net/rose/rose_subr.c
@@ -15,6 +15,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/rose/sysctl_net_rose.c b/net/rose/sysctl_net_rose.c
index 3bfe504faf86..df6d9dac2186 100644
--- a/net/rose/sysctl_net_rose.c
+++ b/net/rose/sysctl_net_rose.c
@@ -26,121 +26,101 @@ static struct ctl_table_header *rose_table_header;
 
 static ctl_table rose_table[] = {
         {
-                .ctl_name       = NET_ROSE_RESTART_REQUEST_TIMEOUT,
                 .procname       = "restart_request_timeout",
                 .data           = &sysctl_rose_restart_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
         {
-                .ctl_name       = NET_ROSE_CALL_REQUEST_TIMEOUT,
                 .procname       = "call_request_timeout",
                 .data           = &sysctl_rose_call_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
         {
-                .ctl_name       = NET_ROSE_RESET_REQUEST_TIMEOUT,
                 .procname       = "reset_request_timeout",
                 .data           = &sysctl_rose_reset_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
         {
-                .ctl_name       = NET_ROSE_CLEAR_REQUEST_TIMEOUT,
                 .procname       = "clear_request_timeout",
                 .data           = &sysctl_rose_clear_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
         {
-                .ctl_name       = NET_ROSE_NO_ACTIVITY_TIMEOUT,
                 .procname       = "no_activity_timeout",
                 .data           = &sysctl_rose_no_activity_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_idle,
                 .extra2         = &max_idle
         },
         {
-                .ctl_name       = NET_ROSE_ACK_HOLD_BACK_TIMEOUT,
                 .procname       = "acknowledge_hold_back_timeout",
                 .data           = &sysctl_rose_ack_hold_back_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
         {
-                .ctl_name       = NET_ROSE_ROUTING_CONTROL,
                 .procname       = "routing_control",
                 .data           = &sysctl_rose_routing_control,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_route,
                 .extra2         = &max_route
         },
         {
-                .ctl_name       = NET_ROSE_LINK_FAIL_TIMEOUT,
                 .procname       = "link_fail_timeout",
                 .data           = &sysctl_rose_link_fail_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ftimer,
                 .extra2         = &max_ftimer
         },
         {
-                .ctl_name       = NET_ROSE_MAX_VCS,
                 .procname       = "maximum_virtual_circuits",
                 .data           = &sysctl_rose_maximum_vcs,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_maxvcs,
                 .extra2         = &max_maxvcs
         },
         {
-                .ctl_name       = NET_ROSE_WINDOW_SIZE,
                 .procname       = "window_size",
                 .data           = &sysctl_rose_window_size,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_window,
                 .extra2         = &max_window
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_path rose_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "rose", .ctl_name = NET_ROSE, },
+        { .procname = "net", },
+        { .procname = "rose", },
         { }
 };
 
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index a86afceaa94f..c060095b27ce 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -11,6 +11,7 @@
 
 #include <linux/module.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
@@ -608,14 +609,15 @@ static unsigned int rxrpc_poll(struct file *file, struct socket *sock,
 /*
  * create an RxRPC socket
  */
-static int rxrpc_create(struct net *net, struct socket *sock, int protocol)
+static int rxrpc_create(struct net *net, struct socket *sock, int protocol,
+                        int kern)
 {
         struct rxrpc_sock *rx;
         struct sock *sk;
 
         _enter("%p,%d", sock, protocol);
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         /* we support transport protocol UDP only */
@@ -777,7 +779,7 @@ static struct proto rxrpc_proto = {
         .max_header     = sizeof(struct rxrpc_header),
 };
 
-static struct net_proto_family rxrpc_family_ops = {
+static const struct net_proto_family rxrpc_family_ops = {
         .family = PF_RXRPC,
         .create = rxrpc_create,
         .owner  = THIS_MODULE,
diff --git a/net/rxrpc/ar-accept.c b/net/rxrpc/ar-accept.c
index 77228f28fa36..6d79310fcaae 100644
--- a/net/rxrpc/ar-accept.c
+++ b/net/rxrpc/ar-accept.c
@@ -17,6 +17,7 @@
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/icmp.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include <net/ip.h>
@@ -88,6 +89,11 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
 
         /* get a notification message to send to the server app */
         notification = alloc_skb(0, GFP_NOFS);
+        if (!notification) {
+                _debug("no memory");
+                ret = -ENOMEM;
+                goto error_nofree;
+        }
         rxrpc_new_skb(notification);
         notification->mark = RXRPC_SKB_MARK_NEW_CALL;
 
@@ -189,6 +195,7 @@ invalid_service:
         ret = -ECONNREFUSED;
 error:
         rxrpc_free_skb(notification);
+error_nofree:
         _leave(" = %d", ret);
         return ret;
 }
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index b4a220977031..2714da167fb8 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -13,6 +13,7 @@
 #include <linux/circ_buf.h>
 #include <linux/net.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/udp.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index bc0019f704fe..909d092de9f4 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -9,6 +9,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/circ_buf.h>
 #include <net/sock.h>
diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
index 9f1ce841a0bb..4106ca95ec86 100644
--- a/net/rxrpc/ar-connection.c
+++ b/net/rxrpc/ar-connection.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/net.h>
 #include <linux/skbuff.h>
 #include <linux/crypto.h>
diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
index f98c8027e5c1..89315009bab1 100644
--- a/net/rxrpc/ar-input.c
+++ b/net/rxrpc/ar-input.c
@@ -17,6 +17,7 @@
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/icmp.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include <net/ip.h>
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 74697b200496..5ee16f0353fe 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -18,6 +18,7 @@
 #include <linux/key-type.h>
 #include <linux/crypto.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include <keys/rxrpc-type.h>
diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
index 807535ff29b5..87f7135d238b 100644
--- a/net/rxrpc/ar-local.c
+++ b/net/rxrpc/ar-local.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/net.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
index cc9102c5b588..5f22e263eda7 100644
--- a/net/rxrpc/ar-output.c
+++ b/net/rxrpc/ar-output.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/net.h>
+#include <linux/gfp.h>
 #include <linux/skbuff.h>
 #include <linux/circ_buf.h>
 #include <net/sock.h>
diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
index edc026c1eb76..f0f85b0123f7 100644
--- a/net/rxrpc/ar-peer.c
+++ b/net/rxrpc/ar-peer.c
@@ -16,6 +16,7 @@
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/icmp.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include <net/ip.h>
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index a39bf97f8830..60c2b94e6b54 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -146,7 +146,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                                 memcpy(msg->msg_name,
                                        &call->conn->trans->peer->srx,
                                        sizeof(call->conn->trans->peer->srx));
-                        sock_recv_timestamp(msg, &rx->sk, skb);
+                        sock_recv_ts_and_drops(msg, &rx->sk, skb);
                 }
 
                 /* receive the message */
diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
index 0936e1acc30e..5e0226fe587e 100644
--- a/net/rxrpc/ar-transport.c
+++ b/net/rxrpc/ar-transport.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/net.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 713ac593e2e9..7635107726ce 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -16,6 +16,7 @@
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include <keys/rxrpc-type.h>
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 929218a47620..2f691fb180d1 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -328,13 +328,16 @@ config NET_CLS_FLOW
           module will be called cls_flow.
 
 config NET_CLS_CGROUP
-        bool "Control Group Classifier"
+        tristate "Control Group Classifier"
         select NET_CLS
         depends on CGROUPS
         ---help---
           Say Y here if you want to classify packets based on the control
           cgroup of their process.
 
+          To compile this code as a module, choose M here: the
+          module will be called cls_cgroup.
+
 config NET_EMATCH
         bool "Extended Matches"
         select NET_CLS
@@ -433,7 +436,7 @@ config NET_ACT_POLICE
           module.
 
           To compile this code as a module, choose M here: the
-          module will be called police.
+          module will be called act_police.
 
 config NET_ACT_GACT
         tristate "Generic actions"
@@ -443,7 +446,7 @@ config NET_ACT_GACT
           accepting packets.
 
           To compile this code as a module, choose M here: the
-          module will be called gact.
+          module will be called act_gact.
 
 config GACT_PROB
         bool "Probability support"
@@ -459,7 +462,7 @@ config NET_ACT_MIRRED
           other devices.
 
           To compile this code as a module, choose M here: the
-          module will be called mirred.
+          module will be called act_mirred.
 
 config NET_ACT_IPT
         tristate "IPtables targets"
@@ -469,7 +472,7 @@ config NET_ACT_IPT
           classification.
 
           To compile this code as a module, choose M here: the
-          module will be called ipt.
+          module will be called act_ipt.
 
 config NET_ACT_NAT
         tristate "Stateless NAT"
@@ -479,7 +482,7 @@ config NET_ACT_NAT
           netfilter for NAT unless you know what you are doing.
 
           To compile this code as a module, choose M here: the
-          module will be called nat.
+          module will be called act_nat.
 
 config NET_ACT_PEDIT
         tristate "Packet Editing"
@@ -488,7 +491,7 @@ config NET_ACT_PEDIT
           Say Y here if you want to mangle the content of packets.
 
           To compile this code as a module, choose M here: the
-          module will be called pedit.
+          module will be called act_pedit.
 
 config NET_ACT_SIMP
         tristate "Simple Example (Debug)"
@@ -502,7 +505,7 @@ config NET_ACT_SIMP
           If unsure, say N.
 
           To compile this code as a module, choose M here: the
-          module will be called simple.
+          module will be called act_simple.
 
 config NET_ACT_SKBEDIT
         tristate "SKB Editing"
@@ -513,7 +516,7 @@ config NET_ACT_SKBEDIT
           If unsure, say N.
 
           To compile this code as a module, choose M here: the
-          module will be called skbedit.
+          module will be called act_skbedit.
 
 config NET_CLS_IND
         bool "Incoming device classification"
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 2dfb3e7a040d..d8e0171d9a4b 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/kmod.h>
@@ -598,7 +599,7 @@ int tcf_action_copy_stats(struct sk_buff *skb, struct tc_action *a,
                 goto errout;
 
         /* compat_mode being true specifies a call that is supposed
-         * to add additional backward compatiblity statistic TLVs.
+         * to add additional backward compatibility statistic TLVs.
          */
         if (compat_mode) {
                 if (a->type == TCA_OLD_COMPAT)
@@ -618,7 +619,8 @@ int tcf_action_copy_stats(struct sk_buff *skb, struct tc_action *a,
                         goto errout;
 
         if (gnet_stats_copy_basic(&d, &h->tcf_bstats) < 0 ||
-            gnet_stats_copy_rate_est(&d, &h->tcf_rate_est) < 0 ||
+            gnet_stats_copy_rate_est(&d, &h->tcf_bstats,
+                                     &h->tcf_rate_est) < 0 ||
             gnet_stats_copy_queue(&d, &h->tcf_qstats) < 0)
                 goto errout;
 
@@ -968,7 +970,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         u32 pid = skb ? NETLINK_CB(skb).pid : 0;
         int ret = 0, ovr = 0;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         ret = nlmsg_parse(n, sizeof(struct tcamsg), tca, TCA_ACT_MAX, NULL);
@@ -1051,7 +1053,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
         struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
         struct nlattr *kind = find_dump_kind(cb->nlh);
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return 0;
 
         if (kind == NULL) {
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 082c520b0def..da27a170b6b7 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -19,6 +19,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 #include <linux/tc_act/tc_ipt.h>
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index b9aaab4e0354..c046682054eb 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -20,6 +20,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/gfp.h>
 #include <net/net_namespace.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
@@ -65,48 +66,53 @@ static int tcf_mirred_init(struct nlattr *nla, struct nlattr *est,
         struct tc_mirred *parm;
         struct tcf_mirred *m;
         struct tcf_common *pc;
-        struct net_device *dev = NULL;
-        int ret = 0, err;
-        int ok_push = 0;
+        struct net_device *dev;
+        int ret, ok_push = 0;
 
         if (nla == NULL)
                 return -EINVAL;
-
-        err = nla_parse_nested(tb, TCA_MIRRED_MAX, nla, mirred_policy);
-        if (err < 0)
-                return err;
-
+        ret = nla_parse_nested(tb, TCA_MIRRED_MAX, nla, mirred_policy);
+        if (ret < 0)
+                return ret;
         if (tb[TCA_MIRRED_PARMS] == NULL)
                 return -EINVAL;
         parm = nla_data(tb[TCA_MIRRED_PARMS]);
-
+        switch (parm->eaction) {
+        case TCA_EGRESS_MIRROR:
+        case TCA_EGRESS_REDIR:
+                break;
+        default:
+                return -EINVAL;
+        }
         if (parm->ifindex) {
                 dev = __dev_get_by_index(&init_net, parm->ifindex);
                 if (dev == NULL)
                         return -ENODEV;
                 switch (dev->type) {
-                        case ARPHRD_TUNNEL:
-                        case ARPHRD_TUNNEL6:
-                        case ARPHRD_SIT:
-                        case ARPHRD_IPGRE:
-                        case ARPHRD_VOID:
-                        case ARPHRD_NONE:
-                                ok_push = 0;
-                                break;
-                        default:
-                                ok_push = 1;
-                                break;
+                case ARPHRD_TUNNEL:
+                case ARPHRD_TUNNEL6:
+                case ARPHRD_SIT:
+                case ARPHRD_IPGRE:
+                case ARPHRD_VOID:
+                case ARPHRD_NONE:
+                        ok_push = 0;
+                        break;
+                default:
+                        ok_push = 1;
+                        break;
                 }
+        } else {
+                dev = NULL;
         }
 
         pc = tcf_hash_check(parm->index, a, bind, &mirred_hash_info);
         if (!pc) {
-                if (!parm->ifindex)
+                if (dev == NULL)
                         return -EINVAL;
                 pc = tcf_hash_create(parm->index, est, a, sizeof(*m), bind,
                                      &mirred_idx_gen, &mirred_hash_info);
                 if (IS_ERR(pc))
-                    return PTR_ERR(pc);
+                        return PTR_ERR(pc);
                 ret = ACT_P_CREATED;
         } else {
                 if (!ovr) {
@@ -119,12 +125,12 @@ static int tcf_mirred_init(struct nlattr *nla, struct nlattr *est,
         spin_lock_bh(&m->tcf_lock);
         m->tcf_action = parm->action;
         m->tcfm_eaction = parm->eaction;
-        if (parm->ifindex) {
+        if (dev != NULL) {
                 m->tcfm_ifindex = parm->ifindex;
                 if (ret != ACT_P_CREATED)
                         dev_put(m->tcfm_dev);
-                m->tcfm_dev = dev;
                 dev_hold(dev);
+                m->tcfm_dev = dev;
                 m->tcfm_ok_push = ok_push;
         }
         spin_unlock_bh(&m->tcf_lock);
@@ -148,57 +154,57 @@ static int tcf_mirred(struct sk_buff *skb, struct tc_action *a,
 {
         struct tcf_mirred *m = a->priv;
         struct net_device *dev;
-        struct sk_buff *skb2 = NULL;
-        u32 at = G_TC_AT(skb->tc_verd);
+        struct sk_buff *skb2;
+        u32 at;
+        int retval, err = 1;
 
         spin_lock(&m->tcf_lock);
-
-        dev = m->tcfm_dev;
         m->tcf_tm.lastuse = jiffies;
 
-        if (!(dev->flags&IFF_UP) ) {
+        dev = m->tcfm_dev;
+        if (!(dev->flags & IFF_UP)) {
                 if (net_ratelimit())
                         printk("mirred to Houston: device %s is gone!\n",
                                dev->name);
-bad_mirred:
-                if (skb2 != NULL)
-                        kfree_skb(skb2);
-                m->tcf_qstats.overlimits++;
-                m->tcf_bstats.bytes += qdisc_pkt_len(skb);
-                m->tcf_bstats.packets++;
-                spin_unlock(&m->tcf_lock);
-                /* should we be asking for packet to be dropped?
-                 * may make sense for redirect case only
-                */
-                return TC_ACT_SHOT;
+                goto out;
         }
 
         skb2 = skb_act_clone(skb, GFP_ATOMIC);
         if (skb2 == NULL)
-                goto bad_mirred;
-        if (m->tcfm_eaction != TCA_EGRESS_MIRROR &&
-            m->tcfm_eaction != TCA_EGRESS_REDIR) {
-                if (net_ratelimit())
-                        printk("tcf_mirred unknown action %d\n",
-                               m->tcfm_eaction);
-                goto bad_mirred;
-        }
+                goto out;
 
         m->tcf_bstats.bytes += qdisc_pkt_len(skb2);
         m->tcf_bstats.packets++;
-        if (!(at & AT_EGRESS))
+        at = G_TC_AT(skb->tc_verd);
+        if (!(at & AT_EGRESS)) {
                 if (m->tcfm_ok_push)
                         skb_push(skb2, skb2->dev->hard_header_len);
+        }
 
         /* mirror is always swallowed */
         if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
                 skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at);
 
         skb2->dev = dev;
-        skb2->iif = skb->dev->ifindex;
+        skb2->skb_iif = skb->dev->ifindex;
         dev_queue_xmit(skb2);
+        err = 0;
+
+out:
+        if (err) {
+                m->tcf_qstats.overlimits++;
+                m->tcf_bstats.bytes += qdisc_pkt_len(skb);
+                m->tcf_bstats.packets++;
+                /* should we be asking for packet to be dropped?
+                 * may make sense for redirect case only
+                 */
+                retval = TC_ACT_SHOT;
+        } else {
+                retval = m->tcf_action;
+        }
         spin_unlock(&m->tcf_lock);
-        return m->tcf_action;
+
+        return retval;
 }
 
 static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 6b0359a500e6..b7dcfedc802e 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -17,6 +17,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 #include <linux/tc_act/tc_pedit.h>
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 723964c3ee4f..654f73dff7c1 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -18,6 +18,7 @@
 #include <linux/skbuff.h>
 #include <linux/rtnetlink.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/act_api.h>
 #include <net/netlink.h>
 
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 8daa1ebc7413..622ca809c15c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 4ab916b8074b..e9607fe55b58 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -54,6 +54,8 @@ static int tcf_skbedit(struct sk_buff *skb, struct tc_action *a,
         if (d->flags & SKBEDIT_F_QUEUE_MAPPING &&
             skb->dev->real_num_tx_queues > d->queue_mapping)
                 skb_set_queue_mapping(skb, d->queue_mapping);
+        if (d->flags & SKBEDIT_F_MARK)
+                skb->mark = d->mark;
 
         spin_unlock(&d->tcf_lock);
         return d->tcf_action;
@@ -63,6 +65,7 @@ static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
         [TCA_SKBEDIT_PARMS]             = { .len = sizeof(struct tc_skbedit) },
         [TCA_SKBEDIT_PRIORITY]          = { .len = sizeof(u32) },
         [TCA_SKBEDIT_QUEUE_MAPPING]     = { .len = sizeof(u16) },
+        [TCA_SKBEDIT_MARK]              = { .len = sizeof(u32) },
 };
 
 static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
@@ -72,7 +75,7 @@ static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
         struct tc_skbedit *parm;
         struct tcf_skbedit *d;
         struct tcf_common *pc;
-        u32 flags = 0, *priority = NULL;
+        u32 flags = 0, *priority = NULL, *mark = NULL;
         u16 *queue_mapping = NULL;
         int ret = 0, err;
 
@@ -95,6 +98,12 @@ static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
                 flags |= SKBEDIT_F_QUEUE_MAPPING;
                 queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]);
         }
+
+        if (tb[TCA_SKBEDIT_MARK] != NULL) {
+                flags |= SKBEDIT_F_MARK;
+                mark = nla_data(tb[TCA_SKBEDIT_MARK]);
+        }
+
         if (!flags)
                 return -EINVAL;
 
@@ -124,6 +133,9 @@ static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
                 d->priority = *priority;
         if (flags & SKBEDIT_F_QUEUE_MAPPING)
                 d->queue_mapping = *queue_mapping;
+        if (flags & SKBEDIT_F_MARK)
+                d->mark = *mark;
+
         d->tcf_action = parm->action;
 
         spin_unlock_bh(&d->tcf_lock);
@@ -161,6 +173,9 @@ static inline int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
         if (d->flags & SKBEDIT_F_QUEUE_MAPPING)
                 NLA_PUT(skb, TCA_SKBEDIT_QUEUE_MAPPING,
                         sizeof(d->queue_mapping), &d->queue_mapping);
+        if (d->flags & SKBEDIT_F_MARK)
+                NLA_PUT(skb, TCA_SKBEDIT_MARK, sizeof(d->mark),
+                        &d->mark);
         t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - d->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(d->tcf_tm.expires);
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 7cf6c0fbc7a6..f082b27ff46d 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -24,6 +24,7 @@
 #include <linux/kmod.h>
 #include <linux/netlink.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/netlink.h>
@@ -137,7 +138,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         int err;
         int tp_created = 0;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
 replay:
@@ -404,6 +405,7 @@ static int tcf_node_dump(struct tcf_proto *tp, unsigned long n,
                              a->cb->nlh->nlmsg_seq, NLM_F_MULTI, RTM_NEWTFILTER);
 }
 
+/* called with RTNL */
 static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
@@ -417,12 +419,12 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
         const struct Qdisc_class_ops *cops;
         struct tcf_dump_args arg;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return 0;
 
         if (cb->nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*tcm)))
                 return skb->len;
-        if ((dev = dev_get_by_index(&init_net, tcm->tcm_ifindex)) == NULL)
+        if ((dev = __dev_get_by_index(&init_net, tcm->tcm_ifindex)) == NULL)
                 return skb->len;
 
         if (!tcm->tcm_parent)
@@ -484,7 +486,6 @@ errout:
         if (cl)
                 cops->put(q, cl);
 out:
-        dev_put(dev);
         return skb->len;
 }
 
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 4e2bda854119..efd4f95fd050 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index e4877ca6727c..221180384fd7 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/string.h>
 #include <linux/errno.h>
@@ -24,6 +25,25 @@ struct cgroup_cls_state
         u32 classid;
 };
 
+static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
+                                               struct cgroup *cgrp);
+static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp);
+static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp);
+
+struct cgroup_subsys net_cls_subsys = {
+        .name           = "net_cls",
+        .create         = cgrp_create,
+        .destroy        = cgrp_destroy,
+        .populate       = cgrp_populate,
+#ifdef CONFIG_NET_CLS_CGROUP
+        .subsys_id      = net_cls_subsys_id,
+#else
+#define net_cls_subsys_id net_cls_subsys.subsys_id
+#endif
+        .module         = THIS_MODULE,
+};
+
+
 static inline struct cgroup_cls_state *cgrp_cls_state(struct cgroup *cgrp)
 {
         return container_of(cgroup_subsys_state(cgrp, net_cls_subsys_id),
@@ -79,14 +99,6 @@ static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp)
         return cgroup_add_files(cgrp, ss, ss_files, ARRAY_SIZE(ss_files));
 }
 
-struct cgroup_subsys net_cls_subsys = {
-        .name           = "net_cls",
-        .create         = cgrp_create,
-        .destroy        = cgrp_destroy,
-        .populate       = cgrp_populate,
-        .subsys_id      = net_cls_subsys_id,
-};
-
 struct cls_cgroup_head
 {
         u32                     handle;
@@ -277,12 +289,19 @@ static struct tcf_proto_ops cls_cgroup_ops __read_mostly = {
 
 static int __init init_cgroup_cls(void)
 {
-        return register_tcf_proto_ops(&cls_cgroup_ops);
+        int ret = register_tcf_proto_ops(&cls_cgroup_ops);
+        if (ret)
+                return ret;
+        ret = cgroup_load_subsys(&net_cls_subsys);
+        if (ret)
+                unregister_tcf_proto_ops(&cls_cgroup_ops);
+        return ret;
 }
 
 static void __exit exit_cgroup_cls(void)
 {
         unregister_tcf_proto_ops(&cls_cgroup_ops);
+        cgroup_unload_subsys(&net_cls_subsys);
 }
 
 module_init(init_cgroup_cls);
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 9402a7fd3785..6ed61b10e002 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -20,6 +20,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/if_vlan.h>
+#include <linux/slab.h>
 
 #include <net/pkt_cls.h>
 #include <net/ip.h>
@@ -171,7 +172,7 @@ static u32 flow_get_proto_dst(const struct sk_buff *skb)
 
 static u32 flow_get_iif(const struct sk_buff *skb)
 {
-        return skb->iif;
+        return skb->skb_iif;
 }
 
 static u32 flow_get_priority(const struct sk_buff *skb)
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 6d6e87585fb1..93b0a7b6f9b4 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index dd872d5383ef..694dcd85dec8 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 7034ea4530e5..dd9414e44200 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -170,21 +170,23 @@ restart:
         for (s = sht[h1]; s; s = s->next) {
                 if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
                     protocol == s->protocol &&
-                    !(s->dpi.mask & (*(u32*)(xprt+s->dpi.offset)^s->dpi.key))
+                    !(s->dpi.mask &
+                      (*(u32*)(xprt+s->dpi.offset)^s->dpi.key)) &&
 #if RSVP_DST_LEN == 4
-                    && dst[0] == s->dst[0]
-                    && dst[1] == s->dst[1]
-                    && dst[2] == s->dst[2]
+                    dst[0] == s->dst[0] &&
+                    dst[1] == s->dst[1] &&
+                    dst[2] == s->dst[2] &&
 #endif
-                    && tunnelid == s->tunnelid) {
+                    tunnelid == s->tunnelid) {
 
                         for (f = s->ht[h2]; f; f = f->next) {
                                 if (src[RSVP_DST_LEN-1] == f->src[RSVP_DST_LEN-1] &&
                                     !(f->spi.mask & (*(u32*)(xprt+f->spi.offset)^f->spi.key))
 #if RSVP_DST_LEN == 4
-                                    && src[0] == f->src[0]
-                                    && src[1] == f->src[1]
-                                    && src[2] == f->src[2]
+                                    &&
+                                    src[0] == f->src[0] &&
+                                    src[1] == f->src[1] &&
+                                    src[2] == f->src[2]
 #endif
                                     ) {
                                         *res = f->res;
@@ -493,13 +495,13 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
         for (sp = &data->ht[h1]; (s=*sp) != NULL; sp = &s->next) {
                 if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
                     pinfo && pinfo->protocol == s->protocol &&
-                    memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0
+                    memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 &&
 #if RSVP_DST_LEN == 4
-                    && dst[0] == s->dst[0]
-                    && dst[1] == s->dst[1]
-                    && dst[2] == s->dst[2]
+                    dst[0] == s->dst[0] &&
+                    dst[1] == s->dst[1] &&
+                    dst[2] == s->dst[2] &&
 #endif
-                    && pinfo->tunnelid == s->tunnelid) {
+                    pinfo->tunnelid == s->tunnelid) {
 
 insert:
                         /* OK, we found appropriate session */
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index e806f2314b5e..20ef330bb918 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -9,6 +9,7 @@
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 #include <net/act_api.h>
 #include <net/netlink.h>
 #include <net/pkt_cls.h>
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 07372f60bee3..17c5dfc67320 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -31,6 +31,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 18d85d259104..3bcac8aa333c 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -58,6 +58,7 @@
  *            only available if that subsystem is enabled in the kernel.
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -303,17 +304,18 @@ META_COLLECTOR(var_sk_bound_if)
 {
         SKIP_NONLOCAL(skb);
 
-         if (skb->sk->sk_bound_dev_if == 0) {
+        if (skb->sk->sk_bound_dev_if == 0) {
                 dst->value = (unsigned long) "any";
                 dst->len = 3;
-         } else  {
+        } else {
                 struct net_device *dev;
 
-                dev = dev_get_by_index(&init_net, skb->sk->sk_bound_dev_if);
+                rcu_read_lock();
+                dev = dev_get_by_index_rcu(sock_net(skb->sk),
+                                           skb->sk->sk_bound_dev_if);
                 *err = var_dev(dev, dst);
-                if (dev)
-                        dev_put(dev);
-         }
+                rcu_read_unlock();
+        }
 }
 
 META_COLLECTOR(int_sk_refcnt)
diff --git a/net/sched/em_nbyte.c b/net/sched/em_nbyte.c
index 370a1b2ea317..1a4176aee6e5 100644
--- a/net/sched/em_nbyte.c
+++ b/net/sched/em_nbyte.c
@@ -9,6 +9,7 @@
  * Authors:     Thomas Graf <tgraf@suug.ch>
  */
 
+#include <linux/gfp.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
diff --git a/net/sched/em_text.c b/net/sched/em_text.c
index 853c5ead87fd..763253257411 100644
--- a/net/sched/em_text.c
+++ b/net/sched/em_text.c
@@ -9,6 +9,7 @@
  * Authors:     Thomas Graf <tgraf@suug.ch>
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index aab59409728b..e782bdeedc58 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -82,6 +82,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 903e4188b6ca..145268ca57cf 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -28,6 +28,7 @@
 #include <linux/list.h>
 #include <linux/hrtimer.h>
 #include <linux/lockdep.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -947,7 +948,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         struct Qdisc *p = NULL;
         int err;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         if ((dev = __dev_get_by_index(&init_net, tcm->tcm_ifindex)) == NULL)
@@ -1009,7 +1010,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         struct Qdisc *q, *p;
         int err;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
 replay:
@@ -1179,7 +1180,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
                 goto nla_put_failure;
 
         if (gnet_stats_copy_basic(&d, &q->bstats) < 0 ||
-            gnet_stats_copy_rate_est(&d, &q->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(&d, &q->bstats, &q->rate_est) < 0 ||
             gnet_stats_copy_queue(&d, &q->qstats) < 0)
                 goto nla_put_failure;
 
@@ -1274,14 +1275,15 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
         int s_idx, s_q_idx;
         struct net_device *dev;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return 0;
 
         s_idx = cb->args[0];
         s_q_idx = q_idx = cb->args[1];
-        read_lock(&dev_base_lock);
+
+        rcu_read_lock();
         idx = 0;
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev_rcu(&init_net, dev) {
                 struct netdev_queue *dev_queue;
 
                 if (idx < s_idx)
@@ -1302,7 +1304,7 @@ cont:
         }
 
 done:
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         cb->args[0] = idx;
         cb->args[1] = q_idx;
@@ -1333,7 +1335,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         u32 qid = TC_H_MAJ(clid);
         int err;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EINVAL;
 
         if ((dev = __dev_get_by_index(&init_net, tcm->tcm_ifindex)) == NULL)
@@ -1575,7 +1577,7 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         int t, s_t;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return 0;
 
         if (cb->nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*tcm)))
@@ -1706,6 +1708,7 @@ static int __init pktsched_init(void)
 {
         register_qdisc(&pfifo_qdisc_ops);
         register_qdisc(&bfifo_qdisc_ops);
+        register_qdisc(&pfifo_head_drop_qdisc_ops);
         register_qdisc(&mq_qdisc_ops);
         proc_net_fops_create(&init_net, "psched", 0, &psched_fops);
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index ab82f145f689..fcbb86a486a2 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -3,6 +3,7 @@
 /* Written 1998-2000 by Werner Almesberger, EPFL ICA */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/errno.h>
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 5b132c473264..28c01ef5abc8 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -1609,7 +1610,7 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
                 cl->xstats.undertime = cl->undertime - q->now;
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->bstats, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qstats) < 0)
                 return -1;
 
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 5a888af7e5da..b74046a95397 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
@@ -280,7 +281,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         }
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->bstats, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qdisc->qstats) < 0)
                 return -1;
 
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index d303daa45d49..63d41f86679c 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -5,6 +5,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/string.h>
 #include <linux/errno.h>
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 69188e8358b4..5948bafa8ce2 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
@@ -43,6 +44,26 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         return qdisc_reshape_fail(skb, sch);
 }
 
+static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc* sch)
+{
+        struct sk_buff *skb_head;
+        struct fifo_sched_data *q = qdisc_priv(sch);
+
+        if (likely(skb_queue_len(&sch->q) < q->limit))
+                return qdisc_enqueue_tail(skb, sch);
+
+        /* queue full, remove one skb to fulfill the limit */
+        skb_head = qdisc_dequeue_head(sch);
+        sch->bstats.bytes -= qdisc_pkt_len(skb_head);
+        sch->bstats.packets--;
+        sch->qstats.drops++;
+        kfree_skb(skb_head);
+
+        qdisc_enqueue_tail(skb, sch);
+
+        return NET_XMIT_CN;
+}
+
 static int fifo_init(struct Qdisc *sch, struct nlattr *opt)
 {
         struct fifo_sched_data *q = qdisc_priv(sch);
@@ -108,6 +129,20 @@ struct Qdisc_ops bfifo_qdisc_ops __read_mostly = {
 };
 EXPORT_SYMBOL(bfifo_qdisc_ops);
 
+struct Qdisc_ops pfifo_head_drop_qdisc_ops __read_mostly = {
+        .id             =       "pfifo_head_drop",
+        .priv_size      =       sizeof(struct fifo_sched_data),
+        .enqueue        =       pfifo_tail_enqueue,
+        .dequeue        =       qdisc_dequeue_head,
+        .peek           =       qdisc_peek_head,
+        .drop           =       qdisc_queue_drop_head,
+        .init           =       fifo_init,
+        .reset          =       qdisc_reset_queue,
+        .change         =       fifo_init,
+        .dump           =       fifo_dump,
+        .owner          =       THIS_MODULE,
+};
+
 /* Pass size change message down to embedded FIFO */
 int fifo_set_limit(struct Qdisc *q, unsigned int limit)
 {
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 4ae6aa562f2b..ff4dd53eeff0 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -24,6 +24,7 @@
 #include <linux/init.h>
 #include <linux/rcupdate.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/pkt_sched.h>
 
 /* Main transmission queue. */
@@ -119,32 +120,26 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
         spin_unlock(root_lock);
 
         HARD_TX_LOCK(dev, txq, smp_processor_id());
-        if (!netif_tx_queue_stopped(txq) &&
-            !netif_tx_queue_frozen(txq))
+        if (!netif_tx_queue_stopped(txq) && !netif_tx_queue_frozen(txq))
                 ret = dev_hard_start_xmit(skb, dev, txq);
+
         HARD_TX_UNLOCK(dev, txq);
 
         spin_lock(root_lock);
 
-        switch (ret) {
-        case NETDEV_TX_OK:
-                /* Driver sent out skb successfully */
+        if (dev_xmit_complete(ret)) {
+                /* Driver sent out skb successfully or skb was consumed */
                 ret = qdisc_qlen(q);
-                break;
-
-        case NETDEV_TX_LOCKED:
+        } else if (ret == NETDEV_TX_LOCKED) {
                 /* Driver try lock failed */
                 ret = handle_dev_cpu_collision(skb, txq, q);
-                break;
-
-        default:
+        } else {
                 /* Driver returned NETDEV_TX_BUSY - requeue skb */
                 if (unlikely (ret != NETDEV_TX_BUSY && net_ratelimit()))
                         printk(KERN_WARNING "BUG %s code %d qlen %d\n",
                                dev->name, ret, q->q.qlen);
 
                 ret = dev_requeue_skb(skb, q);
-                break;
         }
 
         if (ret && (netif_tx_queue_stopped(txq) ||
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 40408d595c08..51dcc2aa5c92 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -18,6 +18,7 @@
  *  For all the glorious comments look at include/net/red.h
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 2c5c76be18f8..b38b39c60752 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1375,7 +1375,7 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         xstats.rtwork  = cl->cl_cumul;
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->bstats, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qstats) < 0)
                 return -1;
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 85acab9dc6fd..0b52b8de562c 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -36,6 +36,7 @@
 #include <linux/compiler.h>
 #include <linux/rbtree.h>
 #include <linux/workqueue.h>
+#include <linux/slab.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 
@@ -1105,7 +1106,7 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
         cl->xstats.ctokens = cl->ctokens;
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, NULL, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qstats) < 0)
                 return -1;
 
@@ -1344,8 +1345,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                 };
 
                 /* check for valid classid */
-                if (!classid || TC_H_MAJ(classid ^ sch->handle)
-                    || htb_find(classid, sch))
+                if (!classid || TC_H_MAJ(classid ^ sch->handle) ||
+                    htb_find(classid, sch))
                         goto failure;
 
                 /* check maximal depth */
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index d1dea3d5dc92..b2aba3f5e6fa 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/errno.h>
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 7db2c88ce585..c50876cd8704 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 2b88295cb7b7..4714ff162bbd 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
@@ -199,9 +200,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
          * do it now in software before we mangle it.
          */
         if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
-                if (!(skb = skb_unshare(skb, GFP_ATOMIC))
-                    || (skb->ip_summed == CHECKSUM_PARTIAL
-                        && skb_checksum_help(skb))) {
+                if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
+                    (skb->ip_summed == CHECKSUM_PARTIAL &&
+                     skb_checksum_help(skb))) {
                         sch->qstats.drops++;
                         return NET_XMIT_DROP;
                 }
@@ -210,9 +211,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         cb = netem_skb_cb(skb);
-        if (q->gap == 0                 /* not doing reordering */
-            || q->counter < q->gap      /* inside last reordering gap */
-            || q->reorder < get_crandom(&q->reorder_cor)) {
+        if (q->gap == 0 ||              /* not doing reordering */
+            q->counter < q->gap ||      /* inside last reordering gap */
+            q->reorder < get_crandom(&q->reorder_cor)) {
                 psched_time_t now;
                 psched_tdiff_t delay;
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 93285cecb246..81672e0c1b25 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index cb21380c0605..c5a9ac566007 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -20,6 +20,7 @@
 #include <linux/ipv6.h>
 #include <linux/skbuff.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 5a002c247231..3415b6ce1c0a 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/if_arp.h>
@@ -190,10 +191,13 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt)
 
         if (m->slaves) {
                 if (m->dev->flags & IFF_UP) {
-                        if ((m->dev->flags&IFF_POINTOPOINT && !(dev->flags&IFF_POINTOPOINT))
-                            || (m->dev->flags&IFF_BROADCAST && !(dev->flags&IFF_BROADCAST))
-                            || (m->dev->flags&IFF_MULTICAST && !(dev->flags&IFF_MULTICAST))
-                            || dev->mtu < m->dev->mtu)
+                        if ((m->dev->flags & IFF_POINTOPOINT &&
+                             !(dev->flags & IFF_POINTOPOINT)) ||
+                            (m->dev->flags & IFF_BROADCAST &&
+                             !(dev->flags & IFF_BROADCAST)) ||
+                            (m->dev->flags & IFF_MULTICAST &&
+                             !(dev->flags & IFF_MULTICAST)) ||
+                            dev->mtu < m->dev->mtu)
                                 return -EINVAL;
                 } else {
                         if (!(dev->flags&IFF_POINTOPOINT))
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 7eed77a39d0d..99c93ee98ad9 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -63,6 +63,12 @@
 static void sctp_assoc_bh_rcv(struct work_struct *work);
 static void sctp_assoc_free_asconf_acks(struct sctp_association *asoc);
 
+/* Keep track of the new idr low so that we don't re-use association id
+ * numbers too fast.  It is protected by they idr spin lock is in the
+ * range of 1 - INT_MAX.
+ */
+static u32 idr_low = 1;
+
 
 /* 1st Level Abstractions. */
 
@@ -167,7 +173,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                sp->autoclose * HZ;
+                (unsigned long)sp->autoclose * HZ;
 
         /* Initilizes the timers */
         for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
@@ -512,7 +518,13 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
          * to this destination address earlier. The sender MUST set
          * CYCLING_CHANGEOVER to indicate that this switch is a
          * double switch to the same destination address.
+         *
+         * Really, only bother is we have data queued or outstanding on
+         * the association.
          */
+        if (!asoc->outqueue.outstanding_bytes && !asoc->outqueue.out_qlen)
+                return;
+
         if (transport->cacc.changeover_active)
                 transport->cacc.cycling_changeover = changeover;
 
@@ -732,6 +744,7 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
 
         peer->partial_bytes_acked = 0;
         peer->flight_size = 0;
+        peer->burst_limited = 0;
 
         /* Set the transport's RTO.initial value */
         peer->rto = asoc->rto_initial;
@@ -1181,8 +1194,10 @@ void sctp_assoc_update(struct sctp_association *asoc,
         /* Remove any peer addresses not present in the new association. */
         list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
                 trans = list_entry(pos, struct sctp_transport, transports);
-                if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
-                        sctp_assoc_del_peer(asoc, &trans->ipaddr);
+                if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) {
+                        sctp_assoc_rm_peer(asoc, trans);
+                        continue;
+                }
 
                 if (asoc->state >= SCTP_STATE_ESTABLISHED)
                         sctp_transport_reset(trans);
@@ -1377,8 +1392,9 @@ static inline int sctp_peer_needs_update(struct sctp_association *asoc)
         case SCTP_STATE_SHUTDOWN_RECEIVED:
         case SCTP_STATE_SHUTDOWN_SENT:
                 if ((asoc->rwnd > asoc->a_rwnd) &&
-                    ((asoc->rwnd - asoc->a_rwnd) >=
-                     min_t(__u32, (asoc->base.sk->sk_rcvbuf >> 1), asoc->pathmtu)))
+                    ((asoc->rwnd - asoc->a_rwnd) >= max_t(__u32,
+                           (asoc->base.sk->sk_rcvbuf >> sctp_rwnd_upd_shift),
+                           asoc->pathmtu)))
                         return 1;
                 break;
         default:
@@ -1545,7 +1561,12 @@ retry:
 
         spin_lock_bh(&sctp_assocs_id_lock);
         error = idr_get_new_above(&sctp_assocs_id, (void *)asoc,
-                                    1, &assoc_id);
+                                    idr_low, &assoc_id);
+        if (!error) {
+                idr_low = assoc_id + 1;
+                if (idr_low == INT_MAX)
+                        idr_low = 1;
+        }
         spin_unlock_bh(&sctp_assocs_id_lock);
         if (error == -EAGAIN)
                 goto retry;
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 56935bbc1496..86366390038a 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -34,6 +34,7 @@
  * be incorporated into the next SCTP release.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 13a6fba41077..faf71d179e46 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -43,6 +43,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <net/sock.h>
 #include <net/ipv6.h>
@@ -186,7 +187,6 @@ int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
         addr->valid = 1;
 
         INIT_LIST_HEAD(&addr->list);
-        INIT_RCU_HEAD(&addr->rcu);
 
         /* We always hold a socket lock when calling this function,
          * and that acts as a writer synchronizing lock.
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index acf7c4d128f7..3eab6db59a37 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -42,6 +42,7 @@
 #include <linux/net.h>
 #include <linux/inet.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
@@ -263,9 +264,18 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                 if (0 == i)
                         frag |= SCTP_DATA_FIRST_FRAG;
 
-                if ((i == (whole - 1)) && !over)
+                if ((i == (whole - 1)) && !over) {
                         frag |= SCTP_DATA_LAST_FRAG;
 
+                        /* The application requests to set the I-bit of the
+                         * last DATA chunk of a user message when providing
+                         * the user message to the SCTP implementation.
+                         */
+                        if ((sinfo->sinfo_flags & SCTP_EOF) ||
+                            (sinfo->sinfo_flags & SCTP_SACK_IMMEDIATELY))
+                                frag |= SCTP_DATA_SACK_IMM;
+                }
+
                 chunk = sctp_make_datafrag_empty(asoc, sinfo, len, frag, 0);
 
                 if (!chunk)
@@ -297,6 +307,10 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                 else
                         frag = SCTP_DATA_LAST_FRAG;
 
+                if ((sinfo->sinfo_flags & SCTP_EOF) ||
+                    (sinfo->sinfo_flags & SCTP_SACK_IMMEDIATELY))
+                        frag |= SCTP_DATA_SACK_IMM;
+
                 chunk = sctp_make_datafrag_empty(asoc, sinfo, over, frag, 0);
 
                 if (!chunk)
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 905fda582b92..7ec09ba03a1c 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -144,6 +144,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         /* Use SCTP specific send buffer space queues.  */
         ep->sndbuf_policy = sctp_sndbuf_policy;
 
+        sk->sk_data_ready = sctp_data_ready;
         sk->sk_write_space = sctp_write_space;
         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index c0c973e67add..ea2192444ce6 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -53,6 +53,7 @@
 #include <linux/socket.h>
 #include <linux/ip.h>
 #include <linux/time.h> /* For struct timeval */
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/icmp.h>
 #include <net/snmp.h>
@@ -75,7 +76,7 @@ static struct sctp_association *__sctp_lookup_association(
                                         const union sctp_addr *peer,
                                         struct sctp_transport **pt);
 
-static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
+static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
 
 
 /* Calculate the SCTP checksum of an SCTP packet.  */
@@ -265,8 +266,13 @@ int sctp_rcv(struct sk_buff *skb)
         }
 
         if (sock_owned_by_user(sk)) {
+                if (sctp_add_backlog(sk, skb)) {
+                        sctp_bh_unlock_sock(sk);
+                        sctp_chunk_free(chunk);
+                        skb = NULL; /* sctp_chunk_free already freed the skb */
+                        goto discard_release;
+                }
                 SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
-                sctp_add_backlog(sk, skb);
         } else {
                 SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_SOFTIRQ);
                 sctp_inq_push(&chunk->rcvr->inqueue, chunk);
@@ -336,8 +342,10 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
                 sctp_bh_lock_sock(sk);
 
                 if (sock_owned_by_user(sk)) {
-                        sk_add_backlog(sk, skb);
-                        backloged = 1;
+                        if (sk_add_backlog(sk, skb))
+                                sctp_chunk_free(chunk);
+                        else
+                                backloged = 1;
                 } else
                         sctp_inq_push(inqueue, chunk);
 
@@ -362,22 +370,27 @@ done:
         return 0;
 }
 
-static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
+static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
         struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
         struct sctp_ep_common *rcvr = chunk->rcvr;
+        int ret;
 
-        /* Hold the assoc/ep while hanging on the backlog queue.
-         * This way, we know structures we need will not disappear from us
-         */
-        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
-                sctp_association_hold(sctp_assoc(rcvr));
-        else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
-                sctp_endpoint_hold(sctp_ep(rcvr));
-        else
-                BUG();
+        ret = sk_add_backlog(sk, skb);
+        if (!ret) {
+                /* Hold the assoc/ep while hanging on the backlog queue.
+                 * This way, we know structures we need will not disappear
+                 * from us
+                 */
+                if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+                        sctp_association_hold(sctp_assoc(rcvr));
+                else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
+                        sctp_endpoint_hold(sctp_ep(rcvr));
+                else
+                        BUG();
+        }
+        return ret;
 
-        sk_add_backlog(sk, skb);
 }
 
 /* Handle icmp frag needed error. */
@@ -427,11 +440,25 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 {
         SCTP_DEBUG_PRINTK("%s\n",  __func__);
 
-        sctp_do_sm(SCTP_EVENT_T_OTHER,
-                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
-                   asoc->state, asoc->ep, asoc, t,
-                   GFP_ATOMIC);
+        if (sock_owned_by_user(sk)) {
+                if (timer_pending(&t->proto_unreach_timer))
+                        return;
+                else {
+                        if (!mod_timer(&t->proto_unreach_timer,
+                                                jiffies + (HZ/20)))
+                                sctp_association_hold(asoc);
+                }
+                        
+        } else {
+                if (timer_pending(&t->proto_unreach_timer) &&
+                    del_timer(&t->proto_unreach_timer))
+                        sctp_association_put(asoc);
 
+                sctp_do_sm(SCTP_EVENT_T_OTHER,
+                           SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                           asoc->state, asoc->ep, asoc, t,
+                           GFP_ATOMIC);
+        }
 }
 
 /* Common lookup code for icmp/icmpv6 error handler. */
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index bbf5dd2a97c4..ccb6dc48d15b 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -46,6 +46,7 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 
 /* Initialize an SCTP inqueue.  */
 void sctp_inq_init(struct sctp_inq *queue)
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index bb280e60e00a..9fb5d37c37ad 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -58,6 +58,7 @@
 #include <linux/netdevice.h>
 #include <linux/init.h>
 #include <linux/ipsec.h>
+#include <linux/slab.h>
 
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
@@ -381,7 +382,6 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
                         addr->a.v6.sin6_scope_id = dev->ifindex;
                         addr->valid = 1;
                         INIT_LIST_HEAD(&addr->list);
-                        INIT_RCU_HEAD(&addr->rcu);
                         list_add_tail(&addr->list, addrlist);
                 }
         }
@@ -837,15 +837,16 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
                 if (type & IPV6_ADDR_LINKLOCAL) {
                         if (!addr->v6.sin6_scope_id)
                                 return 0;
-                        dev = dev_get_by_index(&init_net, addr->v6.sin6_scope_id);
-                        if (!dev)
-                                return 0;
-                        if (!ipv6_chk_addr(&init_net, &addr->v6.sin6_addr,
+                        rcu_read_lock();
+                        dev = dev_get_by_index_rcu(&init_net,
+                                                   addr->v6.sin6_scope_id);
+                        if (!dev ||
+                            !ipv6_chk_addr(&init_net, &addr->v6.sin6_addr,
                                            dev, 0)) {
-                                dev_put(dev);
+                                rcu_read_unlock();
                                 return 0;
                         }
-                        dev_put(dev);
+                        rcu_read_unlock();
                 } else if (type == IPV6_ADDR_MAPPED) {
                         if (!opt->v4mapped)
                                 return 0;
@@ -873,10 +874,12 @@ static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
                 if (type & IPV6_ADDR_LINKLOCAL) {
                         if (!addr->v6.sin6_scope_id)
                                 return 0;
-                        dev = dev_get_by_index(&init_net, addr->v6.sin6_scope_id);
+                        rcu_read_lock();
+                        dev = dev_get_by_index_rcu(&init_net,
+                                                   addr->v6.sin6_scope_id);
+                        rcu_read_unlock();
                         if (!dev)
                                 return 0;
-                        dev_put(dev);
                 }
                 af = opt->pf->af;
         }
@@ -930,7 +933,6 @@ static struct inet_protosw sctpv6_seqpacket_protosw = {
         .protocol      = IPPROTO_SCTP,
         .prot          = &sctpv6_prot,
         .ops           = &inet6_seqpacket_ops,
-        .capability    = -1,
         .no_check      = 0,
         .flags         = SCTP_PROTOSW_FLAG
 };
@@ -939,7 +941,6 @@ static struct inet_protosw sctpv6_stream_protosw = {
         .protocol      = IPPROTO_SCTP,
         .prot          = &sctpv6_prot,
         .ops           = &inet6_seqpacket_ops,
-        .capability    = -1,
         .no_check      = 0,
         .flags         = SCTP_PROTOSW_FLAG,
 };
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 5cbda8f1ddfd..fad261d41ec2 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -48,6 +48,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -429,23 +430,22 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                 list_del_init(&chunk->list);
                 if (sctp_chunk_is_data(chunk)) {
 
-                        if (!chunk->has_tsn) {
-                                sctp_chunk_assign_ssn(chunk);
-                                sctp_chunk_assign_tsn(chunk);
+                        if (!chunk->resent) {
 
-                        /* 6.3.1 C4) When data is in flight and when allowed
-                         * by rule C5, a new RTT measurement MUST be made each
-                         * round trip.  Furthermore, new RTT measurements
-                         * SHOULD be made no more than once per round-trip
-                         * for a given destination transport address.
-                         */
+                                /* 6.3.1 C4) When data is in flight and when allowed
+                                 * by rule C5, a new RTT measurement MUST be made each
+                                 * round trip.  Furthermore, new RTT measurements
+                                 * SHOULD be made no more than once per round-trip
+                                 * for a given destination transport address.
+                                 */
 
                                 if (!tp->rto_pending) {
                                         chunk->rtt_in_progress = 1;
                                         tp->rto_pending = 1;
                                 }
-                        } else
-                                chunk->resent = 1;
+                        }
+
+                        chunk->resent = 1;
 
                         has_data = 1;
                 }
@@ -557,8 +557,6 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                 struct timer_list *timer;
                 unsigned long timeout;
 
-                tp->last_time_used = jiffies;
-
                 /* Restart the AUTOCLOSE timer when sending data. */
                 if (sctp_state(asoc, ESTABLISHED) && asoc->autoclose) {
                         timer = &asoc->timers[SCTP_EVENT_TIMEOUT_AUTOCLOSE];
@@ -617,7 +615,6 @@ static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
         sctp_xmit_t retval = SCTP_XMIT_OK;
         size_t datasize, rwnd, inflight, flight_size;
         struct sctp_transport *transport = packet->transport;
-        __u32 max_burst_bytes;
         struct sctp_association *asoc = transport->asoc;
         struct sctp_outq *q = &asoc->outqueue;
 
@@ -650,28 +647,6 @@ static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
                 }
         }
 
-        /* sctpimpguide-05 2.14.2
-         * D) When the time comes for the sender to
-         * transmit new DATA chunks, the protocol parameter Max.Burst MUST
-         * first be applied to limit how many new DATA chunks may be sent.
-         * The limit is applied by adjusting cwnd as follows:
-         *      if ((flightsize + Max.Burst * MTU) < cwnd)
-         *              cwnd = flightsize + Max.Burst * MTU
-         */
-        max_burst_bytes = asoc->max_burst * asoc->pathmtu;
-        if ((flight_size + max_burst_bytes) < transport->cwnd) {
-                transport->cwnd = flight_size + max_burst_bytes;
-                SCTP_DEBUG_PRINTK("%s: cwnd limited by max_burst: "
-                                  "transport: %p, cwnd: %d, "
-                                  "ssthresh: %d, flight_size: %d, "
-                                  "pba: %d\n",
-                                  __func__, transport,
-                                  transport->cwnd,
-                                  transport->ssthresh,
-                                  transport->flight_size,
-                                  transport->partial_bytes_acked);
-        }
-
         /* RFC 2960 6.1  Transmission of DATA Chunks
          *
          * B) At any given time, the sender MUST NOT transmit new data
@@ -747,6 +722,8 @@ static void sctp_packet_append_data(struct sctp_packet *packet,
         /* Has been accepted for transmission. */
         if (!asoc->peer.prsctp_capable)
                 chunk->msg->can_abandon = 0;
+        sctp_chunk_assign_tsn(chunk);
+        sctp_chunk_assign_ssn(chunk);
 }
 
 static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 23e5e97aa617..abfc0b8dee74 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -50,6 +50,7 @@
 #include <linux/list.h>   /* For struct list_head */
 #include <linux/socket.h>
 #include <linux/ip.h>
+#include <linux/slab.h>
 #include <net/sock.h>     /* For skb_set_owner_w */
 
 #include <net/sctp/sctp.h>
@@ -191,8 +192,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
                                  __u32 tsn)
 {
         if (primary->cacc.changeover_active &&
-            (sctp_cacc_skip_3_1(primary, transport, count_of_newacks)
-             || sctp_cacc_skip_3_2(primary, tsn)))
+            (sctp_cacc_skip_3_1(primary, transport, count_of_newacks) ||
+             sctp_cacc_skip_3_2(primary, tsn)))
                 return 1;
         return 0;
 }
@@ -921,6 +922,14 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                 goto sctp_flush_out;
                 }
 
+                /* Apply Max.Burst limitation to the current transport in
+                 * case it will be used for new data.  We are going to
+                 * rest it before we return, but we want to apply the limit
+                 * to the currently queued data.
+                 */
+                if (transport)
+                        sctp_transport_burst_limited(transport);
+
                 /* Finally, transmit new packets.  */
                 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
@@ -966,6 +975,10 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                 packet = &transport->packet;
                                 sctp_packet_config(packet, vtag,
                                                    asoc->peer.ecn_capable);
+                                /* We've switched transports, so apply the
+                                 * Burst limit to the new transport.
+                                 */
+                                sctp_transport_burst_limited(transport);
                         }
 
                         SCTP_DEBUG_PRINTK("sctp_outq_flush(%p, %p[%s]), ",
@@ -1001,6 +1014,13 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                 break;
 
                         case SCTP_XMIT_OK:
+                                /* The sender is in the SHUTDOWN-PENDING state,
+                                 * The sender MAY set the I-bit in the DATA
+                                 * chunk header.
+                                 */
+                                if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING)
+                                        chunk->chunk_hdr->flags |= SCTP_DATA_SACK_IMM;
+
                                 break;
 
                         default:
@@ -1053,6 +1073,9 @@ sctp_flush_out:
                 packet = &t->packet;
                 if (!sctp_packet_empty(packet))
                         error = sctp_packet_transmit(packet);
+
+                /* Clear the burst limited state, if any */
+                sctp_transport_burst_reset(t);
         }
 
         return error;
diff --git a/net/sctp/primitive.c b/net/sctp/primitive.c
index 8cb4f060bce6..534c7eae9d15 100644
--- a/net/sctp/primitive.c
+++ b/net/sctp/primitive.c
@@ -50,6 +50,7 @@
 #include <linux/socket.h>
 #include <linux/ip.h>
 #include <linux/time.h> /* For struct timeval */
+#include <linux/gfp.h>
 #include <net/sock.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index d093cbfeaac4..784bcc9a979d 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -40,7 +40,7 @@
 #include <net/sctp/sctp.h>
 #include <net/ip.h> /* for snmp_fold_field */
 
-static struct snmp_mib sctp_snmp_list[] = {
+static const struct snmp_mib sctp_snmp_list[] = {
         SNMP_MIB_ITEM("SctpCurrEstab", SCTP_MIB_CURRESTAB),
         SNMP_MIB_ITEM("SctpActiveEstabs", SCTP_MIB_ACTIVEESTABS),
         SNMP_MIB_ITEM("SctpPassiveEstabs", SCTP_MIB_PASSIVEESTABS),
@@ -83,7 +83,7 @@ static int sctp_snmp_seq_show(struct seq_file *seq, void *v)
 
         for (i = 0; sctp_snmp_list[i].name != NULL; i++)
                 seq_printf(seq, "%-32s\t%ld\n", sctp_snmp_list[i].name,
-                           snmp_fold_field((void **)sctp_statistics,
+                           snmp_fold_field((void __percpu **)sctp_statistics,
                                       sctp_snmp_list[i].entry));
 
         return 0;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 612dc878e05c..a56f98e82f92 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -54,6 +54,7 @@
 #include <linux/bootmem.h>
 #include <linux/highmem.h>
 #include <linux/swap.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
 #include <net/ip.h>
@@ -188,7 +189,6 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
                         addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
                         addr->valid = 1;
                         INIT_LIST_HEAD(&addr->list);
-                        INIT_RCU_HEAD(&addr->rcu);
                         list_add_tail(&addr->list, addrlist);
                 }
         }
@@ -205,14 +205,14 @@ static void sctp_get_local_addr_list(void)
         struct list_head *pos;
         struct sctp_af *af;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
                 __list_for_each(pos, &sctp_address_families) {
                         af = list_entry(pos, struct sctp_af, list);
                         af->copy_addrlist(&sctp_local_addr_list, dev);
                 }
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 /* Free the existing local addresses.  */
@@ -296,19 +296,19 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk)
 {
         addr->v4.sin_family = AF_INET;
         addr->v4.sin_port = 0;
-        addr->v4.sin_addr.s_addr = inet_sk(sk)->rcv_saddr;
+        addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr;
 }
 
 /* Initialize sk->sk_rcv_saddr from sctp_addr. */
 static void sctp_v4_to_sk_saddr(union sctp_addr *addr, struct sock *sk)
 {
-        inet_sk(sk)->rcv_saddr = addr->v4.sin_addr.s_addr;
+        inet_sk(sk)->inet_rcv_saddr = addr->v4.sin_addr.s_addr;
 }
 
 /* Initialize sk->sk_daddr from sctp_addr. */
 static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
 {
-        inet_sk(sk)->daddr = addr->v4.sin_addr.s_addr;
+        inet_sk(sk)->inet_daddr = addr->v4.sin_addr.s_addr;
 }
 
 /* Initialize a sctp_addr from an address parameter. */
@@ -598,7 +598,7 @@ static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
 
         newinet = inet_sk(newsk);
 
-        newinet->daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
+        newinet->inet_daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
 
         sk_refcnt_debug_inc(newsk);
 
@@ -909,7 +909,6 @@ static struct inet_protosw sctp_seqpacket_protosw = {
         .protocol   = IPPROTO_SCTP,
         .prot       = &sctp_prot,
         .ops        = &inet_seqpacket_ops,
-        .capability = -1,
         .no_check   = 0,
         .flags      = SCTP_PROTOSW_FLAG
 };
@@ -918,7 +917,6 @@ static struct inet_protosw sctp_stream_protosw = {
         .protocol   = IPPROTO_SCTP,
         .prot       = &sctp_prot,
         .ops        = &inet_seqpacket_ops,
-        .capability = -1,
         .no_check   = 0,
         .flags      = SCTP_PROTOSW_FLAG
 };
@@ -998,12 +996,13 @@ int sctp_register_pf(struct sctp_pf *pf, sa_family_t family)
 
 static inline int init_sctp_mibs(void)
 {
-        return snmp_mib_init((void**)sctp_statistics, sizeof(struct sctp_mib));
+        return snmp_mib_init((void __percpu **)sctp_statistics,
+                             sizeof(struct sctp_mib));
 }
 
 static inline void cleanup_sctp_mibs(void)
 {
-        snmp_mib_free((void**)sctp_statistics);
+        snmp_mib_free((void __percpu **)sctp_statistics);
 }
 
 static void sctp_v4_pf_init(void)
@@ -1260,6 +1259,9 @@ SCTP_STATIC __init int sctp_init(void)
         /* Set SCOPE policy to enabled */
         sctp_scope_policy = SCTP_SCOPE_POLICY_ENABLE;
 
+        /* Set the default rwnd update threshold */
+        sctp_rwnd_upd_shift             = SCTP_DEFAULT_RWND_SHIFT;
+
         sctp_sysctl_register();
 
         INIT_LIST_HEAD(&sctp_address_families);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 9d881a61ac02..30c1767186b8 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -58,6 +58,7 @@
 #include <linux/inet.h>
 #include <linux/scatterlist.h>
 #include <linux/crypto.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 
 #include <linux/skbuff.h>
@@ -107,7 +108,7 @@ static const struct sctp_paramhdr prsctp_param = {
         cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 
-/* A helper to initialize to initialize an op error inside a
+/* A helper to initialize an op error inside a
  * provided chunk, as most cause codes will be embedded inside an
  * abort chunk.
  */
@@ -124,6 +125,29 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
 }
 
+/* A helper to initialize an op error inside a
+ * provided chunk, as most cause codes will be embedded inside an
+ * abort chunk.  Differs from sctp_init_cause in that it won't oops
+ * if there isn't enough space in the op error chunk
+ */
+int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+                      size_t paylen)
+{
+        sctp_errhdr_t err;
+        __u16 len;
+
+        /* Cause code constants are now defined in network order.  */
+        err.cause = cause_code;
+        len = sizeof(sctp_errhdr_t) + paylen;
+        err.length  = htons(len);
+
+        if (skb_tailroom(chunk->skb) >  len)
+                return -ENOSPC;
+        chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+                                                     sizeof(sctp_errhdr_t),
+                                                     &err);
+        return 0;
+}
 /* 3.3.2 Initiation (INIT) (1)
  *
  * This chunk is used to initiate a SCTP association between two
@@ -207,7 +231,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         sp = sctp_sk(asoc->base.sk);
         num_types = sp->pf->supported_addrs(sp, types);
 
-        chunksize = sizeof(init) + addrs_len + SCTP_SAT_LEN(num_types);
+        chunksize = sizeof(init) + addrs_len;
+        chunksize += WORD_ROUND(SCTP_SAT_LEN(num_types));
         chunksize += sizeof(ecap_param);
 
         if (sctp_prsctp_enable)
@@ -237,14 +262,14 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                 /* Add HMACS parameter length if any were defined */
                 auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
                 if (auth_hmacs->length)
-                        chunksize += ntohs(auth_hmacs->length);
+                        chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
                 else
                         auth_hmacs = NULL;
 
                 /* Add CHUNKS parameter length */
                 auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
                 if (auth_chunks->length)
-                        chunksize += ntohs(auth_chunks->length);
+                        chunksize += WORD_ROUND(ntohs(auth_chunks->length));
                 else
                         auth_chunks = NULL;
 
@@ -254,7 +279,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
 
         /* If we have any extensions to report, account for that */
         if (num_ext)
-                chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
+                chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
+                                        num_ext);
 
         /* RFC 2960 3.3.2 Initiation (INIT) (1)
          *
@@ -396,13 +422,13 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
 
                 auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
                 if (auth_hmacs->length)
-                        chunksize += ntohs(auth_hmacs->length);
+                        chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
                 else
                         auth_hmacs = NULL;
 
                 auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
                 if (auth_chunks->length)
-                        chunksize += ntohs(auth_chunks->length);
+                        chunksize += WORD_ROUND(ntohs(auth_chunks->length));
                 else
                         auth_chunks = NULL;
 
@@ -411,7 +437,8 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         }
 
         if (num_ext)
-                chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
+                chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
+                                        num_ext);
 
         /* Now allocate and fill out the chunk.  */
         retval = sctp_make_chunk(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
@@ -987,7 +1014,10 @@ static void *sctp_addto_param(struct sctp_chunk *chunk, int len,
 
         target = skb_put(chunk->skb, len);
 
-        memcpy(target, data, len);
+        if (data)
+                memcpy(target, data, len);
+        else
+                memset(target, 0, len);
 
         /* Adjust the chunk length field.  */
         chunk->chunk_hdr->length = htons(chunklen + len);
@@ -1125,20 +1155,40 @@ nodata:
         return retval;
 }
 
+/* Create an Operation Error chunk of a fixed size,
+ * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
+ * This is a helper function to allocate an error chunk for
+ * for those invalid parameter codes in which we may not want
+ * to report all the errors, if the incomming chunk is large
+ */
+static inline struct sctp_chunk *sctp_make_op_error_fixed(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk)
+{
+        size_t size = asoc ? asoc->pathmtu : 0;
+
+        if (!size)
+                size = SCTP_DEFAULT_MAXSEGMENT;
+
+        return sctp_make_op_error_space(asoc, chunk, size);
+}
+
 /* Create an Operation Error chunk.  */
 struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
                                  const struct sctp_chunk *chunk,
                                  __be16 cause_code, const void *payload,
-                                 size_t paylen)
+                                 size_t paylen, size_t reserve_tail)
 {
         struct sctp_chunk *retval;
 
-        retval = sctp_make_op_error_space(asoc, chunk, paylen);
+        retval = sctp_make_op_error_space(asoc, chunk, paylen + reserve_tail);
         if (!retval)
                 goto nodata;
 
-        sctp_init_cause(retval, cause_code, paylen);
+        sctp_init_cause(retval, cause_code, paylen + reserve_tail);
         sctp_addto_chunk(retval, paylen, payload);
+        if (reserve_tail)
+                sctp_addto_param(retval, reserve_tail, NULL);
 
 nodata:
         return retval;
@@ -1365,6 +1415,18 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
         return target;
 }
 
+/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
+ * space in the chunk
+ */
+void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+                             int len, const void *data)
+{
+        if (skb_tailroom(chunk->skb) > len)
+                return sctp_addto_chunk(chunk, len, data);
+        else
+                return NULL;
+}
+
 /* Append bytes from user space to the end of a chunk.  Will panic if
  * chunk is not big enough.
  * Returns a kernel err value.
@@ -1968,13 +2030,12 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
                  * returning multiple unknown parameters.
                  */
                 if (NULL == *errp)
-                        *errp = sctp_make_op_error_space(asoc, chunk,
-                                        ntohs(chunk->chunk_hdr->length));
+                        *errp = sctp_make_op_error_fixed(asoc, chunk);
 
                 if (*errp) {
-                        sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                        sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
                                         WORD_ROUND(ntohs(param.p->length)));
-                        sctp_addto_chunk(*errp,
+                        sctp_addto_chunk_fixed(*errp,
                                         WORD_ROUND(ntohs(param.p->length)),
                                         param.v);
                 } else {
@@ -3309,21 +3370,6 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         sctp_chunk_free(asconf);
         asoc->addip_last_asconf = NULL;
 
-        /* Send the next asconf chunk from the addip chunk queue. */
-        if (!list_empty(&asoc->addip_chunk_list)) {
-                struct list_head *entry = asoc->addip_chunk_list.next;
-                asconf = list_entry(entry, struct sctp_chunk, list);
-
-                list_del_init(entry);
-
-                /* Hold the chunk until an ASCONF_ACK is received. */
-                sctp_chunk_hold(asconf);
-                if (sctp_primitive_ASCONF(asoc, asconf))
-                        sctp_chunk_free(asconf);
-                else
-                        asoc->addip_last_asconf = asconf;
-        }
-
         return retval;
 }
 
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index efa516b47e81..eb1f42f45fdd 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -51,6 +51,7 @@
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/ip.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
@@ -217,8 +218,7 @@ static int sctp_gen_sack(struct sctp_association *asoc, int force,
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
         } else {
-                if (asoc->a_rwnd > asoc->rwnd)
-                        asoc->a_rwnd = asoc->rwnd;
+                asoc->a_rwnd = asoc->rwnd;
                 sack = sctp_make_sack(asoc);
                 if (!sack)
                         goto nomem;
@@ -397,6 +397,41 @@ out_unlock:
         sctp_transport_put(transport);
 }
 
+/* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
+ * the correct state machine transition that will close the association.
+ */
+void sctp_generate_proto_unreach_event(unsigned long data)
+{
+        struct sctp_transport *transport = (struct sctp_transport *) data;
+        struct sctp_association *asoc = transport->asoc;
+        
+        sctp_bh_lock_sock(asoc->base.sk);
+        if (sock_owned_by_user(asoc->base.sk)) {
+                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+                /* Try again later.  */
+                if (!mod_timer(&transport->proto_unreach_timer,
+                                jiffies + (HZ/20)))
+                        sctp_association_hold(asoc);
+                goto out_unlock;
+        }
+
+        /* Is this structure just waiting around for us to actually
+         * get destroyed?
+         */
+        if (asoc->base.dead)
+                goto out_unlock;
+
+        sctp_do_sm(SCTP_EVENT_T_OTHER,
+                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
+
+out_unlock:
+        sctp_bh_unlock_sock(asoc->base.sk);
+        sctp_association_put(asoc);
+}
+
+
 /* Inject a SACK Timeout event into the state machine.  */
 static void sctp_generate_sack_event(unsigned long data)
 {
@@ -476,7 +511,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
          * used to provide an upper bound to this doubling operation.
          *
          * Special Case:  the first HB doesn't trigger exponential backoff.
-         * The first unacknowleged HB triggers it.  We do this with a flag
+         * The first unacknowledged HB triggers it.  We do this with a flag
          * that indicates that we have an outstanding HB.
          */
         if (!is_hb || transport->hb_sent) {
@@ -718,7 +753,7 @@ static void sctp_cmd_new_state(sctp_cmd_seq_t *cmds,
 
         if (sctp_style(sk, TCP)) {
                 /* Change the sk->sk_state of a TCP-style socket that has
-                 * sucessfully completed a connect() call.
+                 * successfully completed a connect() call.
                  */
                 if (sctp_state(asoc, ESTABLISHED) && sctp_sstate(sk, CLOSED))
                         sk->sk_state = SCTP_SS_ESTABLISHED;
@@ -962,6 +997,29 @@ static int sctp_cmd_send_msg(struct sctp_association *asoc,
 }
 
 
+/* Sent the next ASCONF packet currently stored in the association.
+ * This happens after the ASCONF_ACK was succeffully processed.
+ */
+static void sctp_cmd_send_asconf(struct sctp_association *asoc)
+{
+        /* Send the next asconf chunk from the addip chunk
+         * queue.
+         */
+        if (!list_empty(&asoc->addip_chunk_list)) {
+                struct list_head *entry = asoc->addip_chunk_list.next;
+                struct sctp_chunk *asconf = list_entry(entry,
+                                                struct sctp_chunk, list);
+                list_del_init(entry);
+
+                /* Hold the chunk until an ASCONF_ACK is received. */
+                sctp_chunk_hold(asconf);
+                if (sctp_primitive_ASCONF(asoc, asconf))
+                        sctp_chunk_free(asconf);
+                else
+                        asoc->addip_last_asconf = asconf;
+        }
+}
+
 
 /* These three macros allow us to pull the debugging code out of the
  * main flow of sctp_do_sm() to keep attention focused on the real
@@ -1417,6 +1475,8 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         asoc->init_last_sent_to = t;
                         chunk->transport = t;
                         t->init_sent_count++;
+                        /* Set the new transport as primary */
+                        sctp_assoc_set_primary(asoc, t);
                         break;
 
                 case SCTP_CMD_INIT_RESTART:
@@ -1615,6 +1675,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         }
                         error = sctp_cmd_send_msg(asoc, cmd->obj.msg);
                         break;
+                case SCTP_CMD_SEND_NEXT_ASCONF:
+                        sctp_cmd_send_asconf(asoc);
+                        break;
                 default:
                         printk(KERN_WARNING "Impossible command: %u, %p\n",
                                cmd->verb, cmd->obj.ptr);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index d4df45022ffa..24b2cd555637 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -56,6 +56,7 @@
 #include <linux/ipv6.h>
 #include <linux/net.h>
 #include <linux/inet.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/inet_ecn.h>
 #include <linux/skbuff.h>
@@ -996,14 +997,15 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
                                 sctp_sf_heartbeat(ep, asoc, type, arg,
                                                   commands))
                         return SCTP_DISPOSITION_NOMEM;
+
                 /* Set transport error counter and association error counter
                  * when sending heartbeat.
                  */
-                sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
-                                SCTP_TRANSPORT(transport));
                 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
                                 SCTP_TRANSPORT(transport));
         }
+        sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
+                        SCTP_TRANSPORT(transport));
         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
                         SCTP_TRANSPORT(transport));
 
@@ -1720,7 +1722,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
 
                 err = sctp_make_op_error(asoc, chunk,
                                          SCTP_ERROR_COOKIE_IN_SHUTDOWN,
-                                         NULL, 0);
+                                         NULL, 0, 0);
                 if (err)
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err));
@@ -2868,6 +2870,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
                                         sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *chunk = arg;
+        sctp_arg_t force = SCTP_NOFORCE();
         int error;
 
         if (!sctp_vtag_verify(chunk, asoc)) {
@@ -2901,6 +2904,9 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
                 BUG();
         }
 
+        if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
+                force = SCTP_FORCE();
+
         if (asoc->autoclose) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -2929,7 +2935,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
          * more aggressive than the following algorithms allow.
          */
         if (chunk->end_of_packet)
-                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
+                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
 
         return SCTP_DISPOSITION_CONSUME;
 
@@ -2954,7 +2960,7 @@ discard_force:
 
 discard_noforce:
         if (chunk->end_of_packet)
-                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
+                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
 
         return SCTP_DISPOSITION_DISCARD;
 consume:
@@ -3572,7 +3578,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
          * To do this properly, we'll set the destination address of the chunk
          * and at the transmit time, will try look up the transport to use.
          * Since ASCONFs may be bundled, the correct transport may not be
-         * created untill we process the entire packet, thus this workaround.
+         * created until we process the entire packet, thus this workaround.
          */
         asconf_ack->dest = chunk->source;
         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
@@ -3670,8 +3676,14 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
 
                 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
-                                             asconf_ack))
+                                             asconf_ack)) {
+                        /* Successfully processed ASCONF_ACK.  We can
+                         * release the next asconf if we have one.
+                         */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
+                                        SCTP_NULL());
                         return SCTP_DISPOSITION_CONSUME;
+                }
 
                 abort = sctp_make_abort(asoc, asconf_ack,
                                         sizeof(sctp_errhdr_t));
@@ -3973,7 +3985,7 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
                         err_chunk = sctp_make_op_error(asoc, chunk,
                                                         SCTP_ERROR_UNSUP_HMAC,
                                                         &auth_hdr->hmac_id,
-                                                        sizeof(__u16));
+                                                        sizeof(__u16), 0);
                         if (err_chunk) {
                                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                                 SCTP_CHUNK(err_chunk));
@@ -4065,7 +4077,8 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
                 hdr = unk_chunk->chunk_hdr;
                 err_chunk = sctp_make_op_error(asoc, unk_chunk,
                                                SCTP_ERROR_UNKNOWN_CHUNK, hdr,
-                                               WORD_ROUND(ntohs(hdr->length)));
+                                               WORD_ROUND(ntohs(hdr->length)),
+                                               0);
                 if (err_chunk) {
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err_chunk));
@@ -4084,7 +4097,8 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
                 hdr = unk_chunk->chunk_hdr;
                 err_chunk = sctp_make_op_error(asoc, unk_chunk,
                                                SCTP_ERROR_UNKNOWN_CHUNK, hdr,
-                                               WORD_ROUND(ntohs(hdr->length)));
+                                               WORD_ROUND(ntohs(hdr->length)),
+                                               0);
                 if (err_chunk) {
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err_chunk));
@@ -6048,7 +6062,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
 
                 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
                                          &data_hdr->stream,
-                                         sizeof(data_hdr->stream));
+                                         sizeof(data_hdr->stream),
+                                         sizeof(u16));
                 if (err)
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 3a95fcb17a9e..44a1ab03a3f0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -67,6 +67,7 @@
 #include <linux/poll.h>
 #include <linux/init.h>
 #include <linux/crypto.h>
+#include <linux/slab.h>
 
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -394,7 +395,7 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 
         /* Refresh ephemeral port.  */
         if (!bp->port)
-                bp->port = inet_sk(sk)->num;
+                bp->port = inet_sk(sk)->inet_num;
 
         /* Add the address to the bind address list.
          * Use GFP_ATOMIC since BHs will be disabled.
@@ -403,7 +404,7 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 
         /* Copy back into socket for getsockname() use. */
         if (!ret) {
-                inet_sk(sk)->sport = htons(inet_sk(sk)->num);
+                inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
                 af->to_sk_saddr(addr, sk);
         }
 
@@ -1117,7 +1118,7 @@ static int __sctp_connect(struct sock* sk,
         }
 
         /* Initialize sk's dport and daddr for getpeername() */
-        inet_sk(sk)->dport = htons(asoc->peer.port);
+        inet_sk(sk)->inet_dport = htons(asoc->peer.port);
         af = sctp_get_af_specific(sa_addr->sa.sa_family);
         af->to_sk_daddr(sa_addr, sk);
         sk->sk_err = 0;
@@ -1968,7 +1969,7 @@ SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (err)
                 goto out_free;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
         if (sctp_ulpevent_is_notification(event)) {
                 msg->msg_flags |= MSG_NOTIFICATION;
                 sp->pf->event_msgname(event, msg->msg_name, addr_len);
@@ -2086,6 +2087,8 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
                 return -EINVAL;
         if (copy_from_user(&sp->autoclose, optval, optlen))
                 return -EFAULT;
+        /* make sure it won't exceed MAX_SCHEDULE_TIMEOUT */
+        sp->autoclose = min_t(long, sp->autoclose, MAX_SCHEDULE_TIMEOUT / HZ);
 
         return 0;
 }
@@ -2311,11 +2314,10 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
                 }
         }
 
-        /* Note that unless the spp_flag is set to SPP_PMTUD_ENABLE the value
-         * of this field is ignored.  Note also that a value of zero
-         * indicates the current setting should be left unchanged.
+        /* Note that a value of zero indicates the current setting should be
+           left unchanged.
          */
-        if ((params->spp_flags & SPP_PMTUD_ENABLE) && params->spp_pathmaxrxt) {
+        if (params->spp_pathmaxrxt) {
                 if (trans) {
                         trans->pathmaxrxt = params->spp_pathmaxrxt;
                 } else if (asoc) {
@@ -2354,8 +2356,8 @@ static int sctp_setsockopt_peer_addr_params(struct sock *sk,
             pmtud_change     == SPP_PMTUD ||
             sackdelay_change == SPP_SACKDELAY ||
             params.spp_sackdelay > 500 ||
-            (params.spp_pathmtu
-            && params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT))
+            (params.spp_pathmtu &&
+             params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT))
                 return -EINVAL;
 
         /* If an address other than INADDR_ANY is specified, and
@@ -3717,9 +3719,12 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         sp->hmac = NULL;
 
         SCTP_DBG_OBJCNT_INC(sock);
-        percpu_counter_inc(&sctp_sockets_allocated);
+
+        /* Set socket backlog limit. */
+        sk->sk_backlog.limit = sysctl_sctp_rmem[1];
 
         local_bh_disable();
+        percpu_counter_inc(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         local_bh_enable();
 
@@ -3736,8 +3741,8 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
         /* Release our hold on the endpoint. */
         ep = sctp_sk(sk)->ep;
         sctp_endpoint_free(ep);
-        percpu_counter_dec(&sctp_sockets_allocated);
         local_bh_disable();
+        percpu_counter_dec(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
         local_bh_enable();
 }
@@ -4349,90 +4354,6 @@ static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval
         return 0;
 }
 
-static int sctp_getsockopt_peer_addrs_num_old(struct sock *sk, int len,
-                                              char __user *optval,
-                                              int __user *optlen)
-{
-        sctp_assoc_t id;
-        struct sctp_association *asoc;
-        struct list_head *pos;
-        int cnt = 0;
-
-        if (len < sizeof(sctp_assoc_t))
-                return -EINVAL;
-
-        if (copy_from_user(&id, optval, sizeof(sctp_assoc_t)))
-                return -EFAULT;
-
-        printk(KERN_WARNING "SCTP: Use of SCTP_GET_PEER_ADDRS_NUM_OLD "
-                            "socket option deprecated\n");
-        /* For UDP-style sockets, id specifies the association to query.  */
-        asoc = sctp_id2assoc(sk, id);
-        if (!asoc)
-                return -EINVAL;
-
-        list_for_each(pos, &asoc->peer.transport_addr_list) {
-                cnt ++;
-        }
-
-        return cnt;
-}
-
-/*
- * Old API for getting list of peer addresses. Does not work for 32-bit
- * programs running on a 64-bit kernel
- */
-static int sctp_getsockopt_peer_addrs_old(struct sock *sk, int len,
-                                          char __user *optval,
-                                          int __user *optlen)
-{
-        struct sctp_association *asoc;
-        int cnt = 0;
-        struct sctp_getaddrs_old getaddrs;
-        struct sctp_transport *from;
-        void __user *to;
-        union sctp_addr temp;
-        struct sctp_sock *sp = sctp_sk(sk);
-        int addrlen;
-
-        if (len < sizeof(struct sctp_getaddrs_old))
-                return -EINVAL;
-
-        len = sizeof(struct sctp_getaddrs_old);
-
-        if (copy_from_user(&getaddrs, optval, len))
-                return -EFAULT;
-
-        if (getaddrs.addr_num <= 0) return -EINVAL;
-
-        printk(KERN_WARNING "SCTP: Use of SCTP_GET_PEER_ADDRS_OLD "
-                            "socket option deprecated\n");
-
-        /* For UDP-style sockets, id specifies the association to query.  */
-        asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
-        if (!asoc)
-                return -EINVAL;
-
-        to = (void __user *)getaddrs.addrs;
-        list_for_each_entry(from, &asoc->peer.transport_addr_list,
-                                transports) {
-                memcpy(&temp, &from->ipaddr, sizeof(temp));
-                sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
-                addrlen = sctp_get_af_specific(sk->sk_family)->sockaddr_len;
-                if (copy_to_user(to, &temp, addrlen))
-                        return -EFAULT;
-                to += addrlen ;
-                cnt ++;
-                if (cnt >= getaddrs.addr_num) break;
-        }
-        getaddrs.addr_num = cnt;
-        if (put_user(len, optlen))
-                return -EFAULT;
-        if (copy_to_user(optval, &getaddrs, len))
-                return -EFAULT;
-
-        return 0;
-}
 
 static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
                                       char __user *optval, int __user *optlen)
@@ -4485,125 +4406,6 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
         return 0;
 }
 
-static int sctp_getsockopt_local_addrs_num_old(struct sock *sk, int len,
-                                               char __user *optval,
-                                               int __user *optlen)
-{
-        sctp_assoc_t id;
-        struct sctp_bind_addr *bp;
-        struct sctp_association *asoc;
-        struct sctp_sockaddr_entry *addr;
-        int cnt = 0;
-
-        if (len < sizeof(sctp_assoc_t))
-                return -EINVAL;
-
-        if (copy_from_user(&id, optval, sizeof(sctp_assoc_t)))
-                return -EFAULT;
-
-        printk(KERN_WARNING "SCTP: Use of SCTP_GET_LOCAL_ADDRS_NUM_OLD "
-                            "socket option deprecated\n");
-
-        /*
-         *  For UDP-style sockets, id specifies the association to query.
-         *  If the id field is set to the value '0' then the locally bound
-         *  addresses are returned without regard to any particular
-         *  association.
-         */
-        if (0 == id) {
-                bp = &sctp_sk(sk)->ep->base.bind_addr;
-        } else {
-                asoc = sctp_id2assoc(sk, id);
-                if (!asoc)
-                        return -EINVAL;
-                bp = &asoc->base.bind_addr;
-        }
-
-        /* If the endpoint is bound to 0.0.0.0 or ::0, count the valid
-         * addresses from the global local address list.
-         */
-        if (sctp_list_single_entry(&bp->address_list)) {
-                addr = list_entry(bp->address_list.next,
-                                  struct sctp_sockaddr_entry, list);
-                if (sctp_is_any(sk, &addr->a)) {
-                        rcu_read_lock();
-                        list_for_each_entry_rcu(addr,
-                                                &sctp_local_addr_list, list) {
-                                if (!addr->valid)
-                                        continue;
-
-                                if ((PF_INET == sk->sk_family) &&
-                                    (AF_INET6 == addr->a.sa.sa_family))
-                                        continue;
-
-                                if ((PF_INET6 == sk->sk_family) &&
-                                    inet_v6_ipv6only(sk) &&
-                                    (AF_INET == addr->a.sa.sa_family))
-                                        continue;
-
-                                cnt++;
-                        }
-                        rcu_read_unlock();
-                } else {
-                        cnt = 1;
-                }
-                goto done;
-        }
-
-        /* Protection on the bound address list is not needed,
-         * since in the socket option context we hold the socket lock,
-         * so there is no way that the bound address list can change.
-         */
-        list_for_each_entry(addr, &bp->address_list, list) {
-                cnt ++;
-        }
-done:
-        return cnt;
-}
-
-/* Helper function that copies local addresses to user and returns the number
- * of addresses copied.
- */
-static int sctp_copy_laddrs_old(struct sock *sk, __u16 port,
-                                        int max_addrs, void *to,
-                                        int *bytes_copied)
-{
-        struct sctp_sockaddr_entry *addr;
-        union sctp_addr temp;
-        int cnt = 0;
-        int addrlen;
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(addr, &sctp_local_addr_list, list) {
-                if (!addr->valid)
-                        continue;
-
-                if ((PF_INET == sk->sk_family) &&
-                    (AF_INET6 == addr->a.sa.sa_family))
-                        continue;
-                if ((PF_INET6 == sk->sk_family) &&
-                    inet_v6_ipv6only(sk) &&
-                    (AF_INET == addr->a.sa.sa_family))
-                        continue;
-                memcpy(&temp, &addr->a, sizeof(temp));
-                if (!temp.v4.sin_port)
-                        temp.v4.sin_port = htons(port);
-
-                sctp_get_pf_specific(sk->sk_family)->addr_v4map(sctp_sk(sk),
-                                                                &temp);
-                addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
-                memcpy(to, &temp, addrlen);
-
-                to += addrlen;
-                *bytes_copied += addrlen;
-                cnt ++;
-                if (cnt >= max_addrs) break;
-        }
-        rcu_read_unlock();
-
-        return cnt;
-}
-
 static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
                             size_t space_left, int *bytes_copied)
 {
@@ -4647,112 +4449,6 @@ static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
         return cnt;
 }
 
-/* Old API for getting list of local addresses. Does not work for 32-bit
- * programs running on a 64-bit kernel
- */
-static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
-                                           char __user *optval, int __user *optlen)
-{
-        struct sctp_bind_addr *bp;
-        struct sctp_association *asoc;
-        int cnt = 0;
-        struct sctp_getaddrs_old getaddrs;
-        struct sctp_sockaddr_entry *addr;
-        void __user *to;
-        union sctp_addr temp;
-        struct sctp_sock *sp = sctp_sk(sk);
-        int addrlen;
-        int err = 0;
-        void *addrs;
-        void *buf;
-        int bytes_copied = 0;
-
-        if (len < sizeof(struct sctp_getaddrs_old))
-                return -EINVAL;
-
-        len = sizeof(struct sctp_getaddrs_old);
-        if (copy_from_user(&getaddrs, optval, len))
-                return -EFAULT;
-
-        if (getaddrs.addr_num <= 0 ||
-            getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr)))
-                return -EINVAL;
-
-        printk(KERN_WARNING "SCTP: Use of SCTP_GET_LOCAL_ADDRS_OLD "
-                            "socket option deprecated\n");
-
-        /*
-         *  For UDP-style sockets, id specifies the association to query.
-         *  If the id field is set to the value '0' then the locally bound
-         *  addresses are returned without regard to any particular
-         *  association.
-         */
-        if (0 == getaddrs.assoc_id) {
-                bp = &sctp_sk(sk)->ep->base.bind_addr;
-        } else {
-                asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
-                if (!asoc)
-                        return -EINVAL;
-                bp = &asoc->base.bind_addr;
-        }
-
-        to = getaddrs.addrs;
-
-        /* Allocate space for a local instance of packed array to hold all
-         * the data.  We store addresses here first and then put write them
-         * to the user in one shot.
-         */
-        addrs = kmalloc(sizeof(union sctp_addr) * getaddrs.addr_num,
-                        GFP_KERNEL);
-        if (!addrs)
-                return -ENOMEM;
-
-        /* If the endpoint is bound to 0.0.0.0 or ::0, get the valid
-         * addresses from the global local address list.
-         */
-        if (sctp_list_single_entry(&bp->address_list)) {
-                addr = list_entry(bp->address_list.next,
-                                  struct sctp_sockaddr_entry, list);
-                if (sctp_is_any(sk, &addr->a)) {
-                        cnt = sctp_copy_laddrs_old(sk, bp->port,
-                                                   getaddrs.addr_num,
-                                                   addrs, &bytes_copied);
-                        goto copy_getaddrs;
-                }
-        }
-
-        buf = addrs;
-        /* Protection on the bound address list is not needed since
-         * in the socket option context we hold a socket lock and
-         * thus the bound address list can't change.
-         */
-        list_for_each_entry(addr, &bp->address_list, list) {
-                memcpy(&temp, &addr->a, sizeof(temp));
-                sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
-                addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
-                memcpy(buf, &temp, addrlen);
-                buf += addrlen;
-                bytes_copied += addrlen;
-                cnt ++;
-                if (cnt >= getaddrs.addr_num) break;
-        }
-
-copy_getaddrs:
-        /* copy the entire address list into the user provided space */
-        if (copy_to_user(to, addrs, bytes_copied)) {
-                err = -EFAULT;
-                goto error;
-        }
-
-        /* copy the leading structure back to user */
-        getaddrs.addr_num = cnt;
-        if (copy_to_user(optval, &getaddrs, len))
-                err = -EFAULT;
-
-error:
-        kfree(addrs);
-        return err;
-}
 
 static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
                                        char __user *optval, int __user *optlen)
@@ -5603,22 +5299,6 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
         case SCTP_INITMSG:
                 retval = sctp_getsockopt_initmsg(sk, len, optval, optlen);
                 break;
-        case SCTP_GET_PEER_ADDRS_NUM_OLD:
-                retval = sctp_getsockopt_peer_addrs_num_old(sk, len, optval,
-                                                            optlen);
-                break;
-        case SCTP_GET_LOCAL_ADDRS_NUM_OLD:
-                retval = sctp_getsockopt_local_addrs_num_old(sk, len, optval,
-                                                             optlen);
-                break;
-        case SCTP_GET_PEER_ADDRS_OLD:
-                retval = sctp_getsockopt_peer_addrs_old(sk, len, optval,
-                                                        optlen);
-                break;
-        case SCTP_GET_LOCAL_ADDRS_OLD:
-                retval = sctp_getsockopt_local_addrs_old(sk, len, optval,
-                                                         optlen);
-                break;
         case SCTP_GET_PEER_ADDRS:
                 retval = sctp_getsockopt_peer_addrs(sk, len, optval,
                                                     optlen);
@@ -5861,7 +5541,7 @@ pp_not_found:
          */
 success:
         if (!sctp_sk(sk)->bind_hash) {
-                inet_sk(sk)->num = snum;
+                inet_sk(sk)->inet_num = snum;
                 sk_add_bind_node(sk, &pp->owner);
                 sctp_sk(sk)->bind_hash = pp;
         }
@@ -5933,7 +5613,7 @@ SCTP_STATIC int sctp_listen_start(struct sock *sk, int backlog)
                 if (sctp_autobind(sk))
                         return -EAGAIN;
         } else {
-                if (sctp_get_port(sk, inet_sk(sk)->num)) {
+                if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
                         sk->sk_state = SCTP_SS_CLOSED;
                         return -EADDRINUSE;
                 }
@@ -6104,14 +5784,14 @@ static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
 static inline void __sctp_put_port(struct sock *sk)
 {
         struct sctp_bind_hashbucket *head =
-                &sctp_port_hashtable[sctp_phashfn(inet_sk(sk)->num)];
+                &sctp_port_hashtable[sctp_phashfn(inet_sk(sk)->inet_num)];
         struct sctp_bind_bucket *pp;
 
         sctp_spin_lock(&head->lock);
         pp = sctp_sk(sk)->bind_hash;
         __sk_del_bind_node(sk);
         sctp_sk(sk)->bind_hash = NULL;
-        inet_sk(sk)->num = 0;
+        inet_sk(sk)->inet_num = 0;
         sctp_bucket_destroy(pp);
         sctp_spin_unlock(&head->lock);
 }
@@ -6138,7 +5818,7 @@ static int sctp_autobind(struct sock *sk)
         /* Initialize a local sockaddr structure to INADDR_ANY. */
         af = sctp_sk(sk)->pf->af;
 
-        port = htons(inet_sk(sk)->num);
+        port = htons(inet_sk(sk)->inet_num);
         af->inaddr_any(&autoaddr, port);
 
         return sctp_do_bind(sk, &autoaddr, af->sockaddr_len);
@@ -6509,6 +6189,16 @@ do_nonblock:
         goto out;
 }
 
+void sctp_data_ready(struct sock *sk, int len)
+{
+        read_lock_bh(&sk->sk_callback_lock);
+        if (sk_has_sleeper(sk))
+                wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN |
+                                                POLLRDNORM | POLLRDBAND);
+        sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+        read_unlock_bh(&sk->sk_callback_lock);
+}
+
 /* If socket sndbuf has changed, wake up all per association waiters.  */
 void sctp_write_space(struct sock *sk)
 {
@@ -6683,7 +6373,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
                     struct sctp_association *asoc)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct inet_sock *newinet = inet_sk(newsk);
+        struct inet_sock *newinet;
 
         newsk->sk_type = sk->sk_type;
         newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
@@ -6707,12 +6397,12 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         /* Initialize sk's sport, dport, rcv_saddr and daddr for
          * getsockname() and getpeername()
          */
-        newinet->sport = inet->sport;
-        newinet->saddr = inet->saddr;
-        newinet->rcv_saddr = inet->rcv_saddr;
-        newinet->dport = htons(asoc->peer.port);
+        newinet->inet_sport = inet->inet_sport;
+        newinet->inet_saddr = inet->inet_saddr;
+        newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
+        newinet->inet_dport = htons(asoc->peer.port);
         newinet->pmtudisc = inet->pmtudisc;
-        newinet->id = asoc->next_tsn ^ jiffies;
+        newinet->inet_id = asoc->next_tsn ^ jiffies;
 
         newinet->uc_ttl = inet->uc_ttl;
         newinet->mc_loop = 1;
@@ -6751,13 +6441,13 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         newsp->hmac = NULL;
 
         /* Hook this new socket in to the bind_hash list. */
-        head = &sctp_port_hashtable[sctp_phashfn(inet_sk(oldsk)->num)];
+        head = &sctp_port_hashtable[sctp_phashfn(inet_sk(oldsk)->inet_num)];
         sctp_local_bh_disable();
         sctp_spin_lock(&head->lock);
         pp = sctp_sk(oldsk)->bind_hash;
         sk_add_bind_node(newsk, &pp->owner);
         sctp_sk(newsk)->bind_hash = pp;
-        inet_sk(newsk)->num = inet_sk(oldsk)->num;
+        inet_sk(newsk)->inet_num = inet_sk(oldsk)->inet_num;
         sctp_spin_unlock(&head->lock);
         sctp_local_bh_enable();
 
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index 737d330e5ffc..442ad4ed6315 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -37,6 +37,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index ab7151da120f..832590bbe0c0 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -52,6 +52,7 @@ static int int_max = INT_MAX;
 static int sack_timer_min = 1;
 static int sack_timer_max = 500;
 static int addr_scope_max = 3; /* check sctp_scope_policy_t in include/net/sctp/constants.h for max entries */
+static int rwnd_scale_max = 16;
 
 extern int sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
@@ -59,180 +60,145 @@ extern int sysctl_sctp_wmem[3];
 
 static ctl_table sctp_table[] = {
         {
-                .ctl_name       = NET_SCTP_RTO_INITIAL,
                 .procname       = "rto_initial",
                 .data           = &sctp_rto_initial,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
         {
-                .ctl_name       = NET_SCTP_RTO_MIN,
                 .procname       = "rto_min",
                 .data           = &sctp_rto_min,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
         {
-                .ctl_name       = NET_SCTP_RTO_MAX,
                 .procname       = "rto_max",
                 .data           = &sctp_rto_max,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
         {
-                .ctl_name       = NET_SCTP_VALID_COOKIE_LIFE,
                 .procname       = "valid_cookie_life",
                 .data           = &sctp_valid_cookie_life,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
         {
-                .ctl_name       = NET_SCTP_MAX_BURST,
                 .procname       = "max_burst",
                 .data           = &sctp_max_burst,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &zero,
                 .extra2         = &int_max
         },
         {
-                .ctl_name       = NET_SCTP_ASSOCIATION_MAX_RETRANS,
                 .procname       = "association_max_retrans",
                 .data           = &sctp_max_retrans_association,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &int_max
         },
         {
-                .ctl_name       = NET_SCTP_SNDBUF_POLICY,
                 .procname       = "sndbuf_policy",
                 .data           = &sctp_sndbuf_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_SCTP_RCVBUF_POLICY,
                 .procname       = "rcvbuf_policy",
                 .data           = &sctp_rcvbuf_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_SCTP_PATH_MAX_RETRANS,
                 .procname       = "path_max_retrans",
                 .data           = &sctp_max_retrans_path,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &int_max
         },
         {
-                .ctl_name       = NET_SCTP_MAX_INIT_RETRANSMITS,
                 .procname       = "max_init_retransmits",
                 .data           = &sctp_max_retrans_init,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &int_max
         },
         {
-                .ctl_name       = NET_SCTP_HB_INTERVAL,
                 .procname       = "hb_interval",
                 .data           = &sctp_hb_interval,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
         {
-                .ctl_name       = NET_SCTP_PRESERVE_ENABLE,
                 .procname       = "cookie_preserve_enable",
                 .data           = &sctp_cookie_preserve_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_SCTP_RTO_ALPHA,
                 .procname       = "rto_alpha_exp_divisor",
                 .data           = &sctp_rto_alpha,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_SCTP_RTO_BETA,
                 .procname       = "rto_beta_exp_divisor",
                 .data           = &sctp_rto_beta,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_SCTP_ADDIP_ENABLE,
                 .procname       = "addip_enable",
                 .data           = &sctp_addip_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_SCTP_PRSCTP_ENABLE,
                 .procname       = "prsctp_enable",
                 .data           = &sctp_prsctp_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = NET_SCTP_SACK_TIMEOUT,
                 .procname       = "sack_timeout",
                 .data           = &sctp_sack_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &sack_timer_min,
                 .extra2         = &sack_timer_max,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "sctp_mem",
                 .data           = &sysctl_sctp_mem,
                 .maxlen         = sizeof(sysctl_sctp_mem),
@@ -240,7 +206,6 @@ static ctl_table sctp_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "sctp_rmem",
                 .data           = &sysctl_sctp_rmem,
                 .maxlen         = sizeof(sysctl_sctp_rmem),
@@ -248,7 +213,6 @@ static ctl_table sctp_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "sctp_wmem",
                 .data           = &sysctl_sctp_wmem,
                 .maxlen         = sizeof(sysctl_sctp_wmem),
@@ -256,40 +220,44 @@ static ctl_table sctp_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "auth_enable",
                 .data           = &sctp_auth_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "addip_noauth_enable",
                 .data           = &sctp_addip_noauth,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
-                .strategy       = sysctl_intvec
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "addr_scope_policy",
                 .data           = &sctp_scope_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &zero,
                 .extra2         = &addr_scope_max,
         },
-        { .ctl_name = 0 }
+        {
+                .procname       = "rwnd_update_shift",
+                .data           = &sctp_rwnd_upd_shift,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .extra1         = &one,
+                .extra2         = &rwnd_scale_max,
+        },
+
+        { /* sentinel */ }
 };
 
 static struct ctl_path sctp_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "sctp", .ctl_name = NET_SCTP, },
+        { .procname = "net", },
+        { .procname = "sctp", },
         { }
 };
 
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 37a1184d789f..165d54e07fcd 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -48,6 +48,7 @@
  * be incorporated into the next SCTP release.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/random.h>
 #include <net/sctp/sctp.h>
@@ -83,7 +84,6 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
         peer->fast_recovery = 0;
 
         peer->last_time_heard = jiffies;
-        peer->last_time_used = jiffies;
         peer->last_time_ecne_reduced = jiffies;
 
         peer->init_sent_count = 0;
@@ -108,6 +108,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                         (unsigned long)peer);
         setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
                         (unsigned long)peer);
+        setup_timer(&peer->proto_unreach_timer,
+                    sctp_generate_proto_unreach_event, (unsigned long)peer);
 
         /* Initialize the 64-bit random nonce sent with heartbeat. */
         get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
@@ -171,6 +173,10 @@ void sctp_transport_free(struct sctp_transport *transport)
             del_timer(&transport->T3_rtx_timer))
                 sctp_transport_put(transport);
 
+        /* Delete the ICMP proto unreachable timer if it's active. */
+        if (timer_pending(&transport->proto_unreach_timer) &&
+            del_timer(&transport->proto_unreach_timer))
+                sctp_association_put(transport->asoc);
 
         sctp_transport_put(transport);
 }
@@ -564,10 +570,8 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                  * to be done every RTO interval, we do it every hearbeat
                  * interval.
                  */
-                if (time_after(jiffies, transport->last_time_used +
-                                        transport->rto))
-                        transport->cwnd = max(transport->cwnd/2,
-                                                 4*transport->asoc->pathmtu);
+                transport->cwnd = max(transport->cwnd/2,
+                                         4*transport->asoc->pathmtu);
                 break;
         }
 
@@ -578,6 +582,43 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                           transport->cwnd, transport->ssthresh);
 }
 
+/* Apply Max.Burst limit to the congestion window:
+ * sctpimpguide-05 2.14.2
+ * D) When the time comes for the sender to
+ * transmit new DATA chunks, the protocol parameter Max.Burst MUST
+ * first be applied to limit how many new DATA chunks may be sent.
+ * The limit is applied by adjusting cwnd as follows:
+ *      if ((flightsize+ Max.Burst * MTU) < cwnd)
+ *              cwnd = flightsize + Max.Burst * MTU
+ */
+
+void sctp_transport_burst_limited(struct sctp_transport *t)
+{
+        struct sctp_association *asoc = t->asoc;
+        u32 old_cwnd = t->cwnd;
+        u32 max_burst_bytes;
+
+        if (t->burst_limited)
+                return;
+
+        max_burst_bytes = t->flight_size + (asoc->max_burst * asoc->pathmtu);
+        if (max_burst_bytes < old_cwnd) {
+                t->cwnd = max_burst_bytes;
+                t->burst_limited = old_cwnd;
+        }
+}
+
+/* Restore the old cwnd congestion window, after the burst had it's
+ * desired effect.
+ */
+void sctp_transport_burst_reset(struct sctp_transport *t)
+{
+        if (t->burst_limited) {
+                t->cwnd = t->burst_limited;
+                t->burst_limited = 0;
+        }
+}
+
 /* What is the next timeout value for this transport? */
 unsigned long sctp_transport_timeout(struct sctp_transport *t)
 {
@@ -600,6 +641,7 @@ void sctp_transport_reset(struct sctp_transport *t)
          * (see Section 6.2.1)
          */
         t->cwnd = min(4*asoc->pathmtu, max_t(__u32, 2*asoc->pathmtu, 4380));
+        t->burst_limited = 0;
         t->ssthresh = asoc->peer.i.a_rwnd;
         t->rto = asoc->rto_initial;
         t->rtt = 0;
diff --git a/net/sctp/tsnmap.c b/net/sctp/tsnmap.c
index 9bd64565021a..747d5412c463 100644
--- a/net/sctp/tsnmap.c
+++ b/net/sctp/tsnmap.c
@@ -42,6 +42,7 @@
  * be incorporated into the next SCTP release.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/bitmap.h>
 #include <net/sctp/sctp.h>
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 8b3560fd876d..aa72e89c3ee1 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -43,6 +43,7 @@
  * be incorporated into the next SCTP release.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <net/sctp/structs.h>
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 7b23803343cc..3a448536f0b6 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -41,6 +41,7 @@
  * be incorporated into the next SCTP release.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
diff --git a/net/socket.c b/net/socket.c
index 75655365b5fd..5e8d0af3c0e7 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -87,6 +87,7 @@
 #include <linux/wireless.h>
 #include <linux/nsproxy.h>
 #include <linux/magic.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -97,6 +98,12 @@
 #include <net/sock.h>
 #include <linux/netfilter.h>
 
+#include <linux/if_tun.h>
+#include <linux/ipv6_route.h>
+#include <linux/route.h>
+#include <linux/sockios.h>
+#include <linux/atalk.h>
+
 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
                          unsigned long nr_segs, loff_t pos);
@@ -306,18 +313,6 @@ static struct file_system_type sock_fs_type = {
         .kill_sb =      kill_anon_super,
 };
 
-static int sockfs_delete_dentry(struct dentry *dentry)
-{
-        /*
-         * At creation time, we pretended this dentry was hashed
-         * (by clearing DCACHE_UNHASHED bit in d_flags)
-         * At delete time, we restore the truth : not hashed.
-         * (so that dput() can proceed correctly)
-         */
-        dentry->d_flags |= DCACHE_UNHASHED;
-        return 0;
-}
-
 /*
  * sockfs_dname() is called from d_path().
  */
@@ -328,7 +323,6 @@ static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
 }
 
 static const struct dentry_operations sockfs_dentry_operations = {
-        .d_delete = sockfs_delete_dentry,
         .d_dname  = sockfs_dname,
 };
 
@@ -349,68 +343,55 @@ static const struct dentry_operations sockfs_dentry_operations = {
  *      but we take care of internal coherence yet.
  */
 
-static int sock_alloc_fd(struct file **filep, int flags)
+static int sock_alloc_file(struct socket *sock, struct file **f, int flags)
 {
+        struct qstr name = { .name = "" };
+        struct path path;
+        struct file *file;
         int fd;
 
         fd = get_unused_fd_flags(flags);
-        if (likely(fd >= 0)) {
-                struct file *file = get_empty_filp();
-
-                *filep = file;
-                if (unlikely(!file)) {
-                        put_unused_fd(fd);
-                        return -ENFILE;
-                }
-        } else
-                *filep = NULL;
-        return fd;
-}
-
-static int sock_attach_fd(struct socket *sock, struct file *file, int flags)
-{
-        struct dentry *dentry;
-        struct qstr name = { .name = "" };
+        if (unlikely(fd < 0))
+                return fd;
 
-        dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
-        if (unlikely(!dentry))
+        path.dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
+        if (unlikely(!path.dentry)) {
+                put_unused_fd(fd);
                 return -ENOMEM;
+        }
+        path.mnt = mntget(sock_mnt);
 
-        dentry->d_op = &sockfs_dentry_operations;
-        /*
-         * We dont want to push this dentry into global dentry hash table.
-         * We pretend dentry is already hashed, by unsetting DCACHE_UNHASHED
-         * This permits a working /proc/$pid/fd/XXX on sockets
-         */
-        dentry->d_flags &= ~DCACHE_UNHASHED;
-        d_instantiate(dentry, SOCK_INODE(sock));
+        path.dentry->d_op = &sockfs_dentry_operations;
+        d_instantiate(path.dentry, SOCK_INODE(sock));
+        SOCK_INODE(sock)->i_fop = &socket_file_ops;
 
-        sock->file = file;
-        init_file(file, sock_mnt, dentry, FMODE_READ | FMODE_WRITE,
+        file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
                   &socket_file_ops);
-        SOCK_INODE(sock)->i_fop = &socket_file_ops;
+        if (unlikely(!file)) {
+                /* drop dentry, keep inode */
+                atomic_inc(&path.dentry->d_inode->i_count);
+                path_put(&path);
+                put_unused_fd(fd);
+                return -ENFILE;
+        }
+
+        sock->file = file;
         file->f_flags = O_RDWR | (flags & O_NONBLOCK);
         file->f_pos = 0;
         file->private_data = sock;
 
-        return 0;
+        *f = file;
+        return fd;
 }
 
 int sock_map_fd(struct socket *sock, int flags)
 {
         struct file *newfile;
-        int fd = sock_alloc_fd(&newfile, flags);
-
-        if (likely(fd >= 0)) {
-                int err = sock_attach_fd(sock, newfile, flags);
+        int fd = sock_alloc_file(sock, &newfile, flags);
 
-                if (unlikely(err < 0)) {
-                        put_filp(newfile);
-                        put_unused_fd(fd);
-                        return err;
-                }
+        if (likely(fd >= 0))
                 fd_install(fd, newfile);
-        }
+
         return fd;
 }
 
@@ -668,10 +649,24 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
 
 EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
 
-static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
-                                 struct msghdr *msg, size_t size, int flags)
+inline void sock_recv_drops(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
+{
+        if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
+                put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
+                        sizeof(__u32), &skb->dropcount);
+}
+
+void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+        struct sk_buff *skb)
+{
+        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_drops(msg, sk, skb);
+}
+EXPORT_SYMBOL_GPL(sock_recv_ts_and_drops);
+
+static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
+                                       struct msghdr *msg, size_t size, int flags)
 {
-        int err;
         struct sock_iocb *si = kiocb_to_siocb(iocb);
 
         si->sock = sock;
@@ -680,13 +675,17 @@ static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         si->size = size;
         si->flags = flags;
 
-        err = security_socket_recvmsg(sock, msg, size, flags);
-        if (err)
-                return err;
-
         return sock->ops->recvmsg(iocb, sock, msg, size, flags);
 }
 
+static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+                                 struct msghdr *msg, size_t size, int flags)
+{
+        int err = security_socket_recvmsg(sock, msg, size, flags);
+
+        return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
+}
+
 int sock_recvmsg(struct socket *sock, struct msghdr *msg,
                  size_t size, int flags)
 {
@@ -702,6 +701,21 @@ int sock_recvmsg(struct socket *sock, struct msghdr *msg,
         return ret;
 }
 
+static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
+                              size_t size, int flags)
+{
+        struct kiocb iocb;
+        struct sock_iocb siocb;
+        int ret;
+
+        init_sync_kiocb(&iocb, NULL);
+        iocb.private = &siocb;
+        ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
+        if (-EIOCBQUEUED == ret)
+                ret = wait_on_sync_kiocb(&iocb);
+        return ret;
+}
+
 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
                    struct kvec *vec, size_t num, size_t size, int flags)
 {
@@ -886,6 +900,24 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
 
 EXPORT_SYMBOL(dlci_ioctl_set);
 
+static long sock_do_ioctl(struct net *net, struct socket *sock,
+                                 unsigned int cmd, unsigned long arg)
+{
+        int err;
+        void __user *argp = (void __user *)arg;
+
+        err = sock->ops->ioctl(sock, cmd, arg);
+
+        /*
+         * If this ioctl is unknown try to hand it down
+         * to the NIC driver.
+         */
+        if (err == -ENOIOCTLCMD)
+                err = dev_ioctl(net, cmd, argp);
+
+        return err;
+}
+
 /*
  *      With an ioctl, arg may well be a user mode pointer, but we don't know
  *      what to do with it - that's up to the protocol still.
@@ -905,11 +937,11 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
         if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
                 err = dev_ioctl(net, cmd, argp);
         } else
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_WEXT_CORE
         if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
                 err = dev_ioctl(net, cmd, argp);
         } else
-#endif                          /* CONFIG_WIRELESS_EXT */
+#endif
                 switch (cmd) {
                 case FIOSETOWN:
                 case SIOCSPGRP:
@@ -959,14 +991,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
                         mutex_unlock(&dlci_ioctl_mutex);
                         break;
                 default:
-                        err = sock->ops->ioctl(sock, cmd, arg);
-
-                        /*
-                         * If this ioctl is unknown try to hand it down
-                         * to the NIC driver.
-                         */
-                        if (err == -ENOIOCTLCMD)
-                                err = dev_ioctl(net, cmd, argp);
+                        err = sock_do_ioctl(net, sock, cmd, arg);
                         break;
                 }
         return err;
@@ -1100,11 +1125,14 @@ static int sock_fasync(int fd, struct file *filp, int on)
                 fna->fa_next = sock->fasync_list;
                 write_lock_bh(&sk->sk_callback_lock);
                 sock->fasync_list = fna;
+                sock_set_flag(sk, SOCK_FASYNC);
                 write_unlock_bh(&sk->sk_callback_lock);
         } else {
                 if (fa != NULL) {
                         write_lock_bh(&sk->sk_callback_lock);
                         *prev = fa->fa_next;
+                        if (!sock->fasync_list)
+                                sock_reset_flag(sk, SOCK_FASYNC);
                         write_unlock_bh(&sk->sk_callback_lock);
                         kfree(fa);
                 }
@@ -1216,7 +1244,7 @@ static int __sock_create(struct net *net, int family, int type, int protocol,
         /* Now protected by module ref count */
         rcu_read_unlock();
 
-        err = pf->create(net, sock, protocol);
+        err = pf->create(net, sock, protocol, kern);
         if (err < 0)
                 goto out_module_put;
 
@@ -1337,29 +1365,19 @@ SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
         if (err < 0)
                 goto out_release_both;
 
-        fd1 = sock_alloc_fd(&newfile1, flags & O_CLOEXEC);
+        fd1 = sock_alloc_file(sock1, &newfile1, flags);
         if (unlikely(fd1 < 0)) {
                 err = fd1;
                 goto out_release_both;
         }
 
-        fd2 = sock_alloc_fd(&newfile2, flags & O_CLOEXEC);
+        fd2 = sock_alloc_file(sock2, &newfile2, flags);
         if (unlikely(fd2 < 0)) {
                 err = fd2;
-                put_filp(newfile1);
-                put_unused_fd(fd1);
-                goto out_release_both;
-        }
-
-        err = sock_attach_fd(sock1, newfile1, flags & O_NONBLOCK);
-        if (unlikely(err < 0)) {
-                goto out_fd2;
-        }
-
-        err = sock_attach_fd(sock2, newfile2, flags & O_NONBLOCK);
-        if (unlikely(err < 0)) {
                 fput(newfile1);
-                goto out_fd1;
+                put_unused_fd(fd1);
+                sock_release(sock2);
+                goto out;
         }
 
         audit_fd_pair(fd1, fd2);
@@ -1385,16 +1403,6 @@ out_release_1:
         sock_release(sock1);
 out:
         return err;
-
-out_fd2:
-        put_filp(newfile1);
-        sock_release(sock1);
-out_fd1:
-        put_filp(newfile2);
-        sock_release(sock2);
-        put_unused_fd(fd1);
-        put_unused_fd(fd2);
-        goto out;
 }
 
 /*
@@ -1498,17 +1506,13 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
          */
         __module_get(newsock->ops->owner);
 
-        newfd = sock_alloc_fd(&newfile, flags & O_CLOEXEC);
+        newfd = sock_alloc_file(newsock, &newfile, flags);
         if (unlikely(newfd < 0)) {
                 err = newfd;
                 sock_release(newsock);
                 goto out_put;
         }
 
-        err = sock_attach_fd(newsock, newfile, flags & O_NONBLOCK);
-        if (err < 0)
-                goto out_fd_simple;
-
         err = security_socket_accept(sock, newsock);
         if (err)
                 goto out_fd;
@@ -1538,11 +1542,6 @@ out_put:
         fput_light(sock->file, fput_needed);
 out:
         return err;
-out_fd_simple:
-        sock_release(newsock);
-        put_filp(newfile);
-        put_unused_fd(newfd);
-        goto out_put;
 out_fd:
         fput(newfile);
         put_unused_fd(newfd);
@@ -1965,22 +1964,15 @@ out:
         return err;
 }
 
-/*
- *      BSD recvmsg interface
- */
-
-SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
-                unsigned int, flags)
+static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+                         struct msghdr *msg_sys, unsigned flags, int nosec)
 {
         struct compat_msghdr __user *msg_compat =
             (struct compat_msghdr __user *)msg;
-        struct socket *sock;
         struct iovec iovstack[UIO_FASTIOV];
         struct iovec *iov = iovstack;
-        struct msghdr msg_sys;
         unsigned long cmsg_ptr;
         int err, iov_size, total_len, len;
-        int fput_needed;
 
         /* kernel mode address */
         struct sockaddr_storage addr;
@@ -1990,27 +1982,23 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
         int __user *uaddr_len;
 
         if (MSG_CMSG_COMPAT & flags) {
-                if (get_compat_msghdr(&msg_sys, msg_compat))
+                if (get_compat_msghdr(msg_sys, msg_compat))
                         return -EFAULT;
         }
-        else if (copy_from_user(&msg_sys, msg, sizeof(struct msghdr)))
+        else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
                 return -EFAULT;
 
-        sock = sockfd_lookup_light(fd, &err, &fput_needed);
-        if (!sock)
-                goto out;
-
         err = -EMSGSIZE;
-        if (msg_sys.msg_iovlen > UIO_MAXIOV)
-                goto out_put;
+        if (msg_sys->msg_iovlen > UIO_MAXIOV)
+                goto out;
 
         /* Check whether to allocate the iovec area */
         err = -ENOMEM;
-        iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
-        if (msg_sys.msg_iovlen > UIO_FASTIOV) {
+        iov_size = msg_sys->msg_iovlen * sizeof(struct iovec);
+        if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                 iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
                 if (!iov)
-                        goto out_put;
+                        goto out;
         }
 
         /*
@@ -2018,46 +2006,47 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
          *      kernel msghdr to use the kernel address space)
          */
 
-        uaddr = (__force void __user *)msg_sys.msg_name;
+        uaddr = (__force void __user *)msg_sys->msg_name;
         uaddr_len = COMPAT_NAMELEN(msg);
         if (MSG_CMSG_COMPAT & flags) {
-                err = verify_compat_iovec(&msg_sys, iov,
+                err = verify_compat_iovec(msg_sys, iov,
                                           (struct sockaddr *)&addr,
                                           VERIFY_WRITE);
         } else
-                err = verify_iovec(&msg_sys, iov,
+                err = verify_iovec(msg_sys, iov,
                                    (struct sockaddr *)&addr,
                                    VERIFY_WRITE);
         if (err < 0)
                 goto out_freeiov;
         total_len = err;
 
-        cmsg_ptr = (unsigned long)msg_sys.msg_control;
-        msg_sys.msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
+        cmsg_ptr = (unsigned long)msg_sys->msg_control;
+        msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
 
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
-        err = sock_recvmsg(sock, &msg_sys, total_len, flags);
+        err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
+                                                          total_len, flags);
         if (err < 0)
                 goto out_freeiov;
         len = err;
 
         if (uaddr != NULL) {
                 err = move_addr_to_user((struct sockaddr *)&addr,
-                                        msg_sys.msg_namelen, uaddr,
+                                        msg_sys->msg_namelen, uaddr,
                                         uaddr_len);
                 if (err < 0)
                         goto out_freeiov;
         }
-        err = __put_user((msg_sys.msg_flags & ~MSG_CMSG_COMPAT),
+        err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
                          COMPAT_FLAGS(msg));
         if (err)
                 goto out_freeiov;
         if (MSG_CMSG_COMPAT & flags)
-                err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
+                err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
                                  &msg_compat->msg_controllen);
         else
-                err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
+                err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
                                  &msg->msg_controllen);
         if (err)
                 goto out_freeiov;
@@ -2066,21 +2055,166 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
 out_freeiov:
         if (iov != iovstack)
                 sock_kfree_s(sock->sk, iov, iov_size);
-out_put:
+out:
+        return err;
+}
+
+/*
+ *      BSD recvmsg interface
+ */
+
+SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
+                unsigned int, flags)
+{
+        int fput_needed, err;
+        struct msghdr msg_sys;
+        struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
+
+        if (!sock)
+                goto out;
+
+        err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
+
         fput_light(sock->file, fput_needed);
 out:
         return err;
 }
 
-#ifdef __ARCH_WANT_SYS_SOCKETCALL
+/*
+ *     Linux recvmmsg interface
+ */
+
+int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+                   unsigned int flags, struct timespec *timeout)
+{
+        int fput_needed, err, datagrams;
+        struct socket *sock;
+        struct mmsghdr __user *entry;
+        struct compat_mmsghdr __user *compat_entry;
+        struct msghdr msg_sys;
+        struct timespec end_time;
+
+        if (timeout &&
+            poll_select_set_timeout(&end_time, timeout->tv_sec,
+                                    timeout->tv_nsec))
+                return -EINVAL;
+
+        datagrams = 0;
+
+        sock = sockfd_lookup_light(fd, &err, &fput_needed);
+        if (!sock)
+                return err;
+
+        err = sock_error(sock->sk);
+        if (err)
+                goto out_put;
+
+        entry = mmsg;
+        compat_entry = (struct compat_mmsghdr __user *)mmsg;
+
+        while (datagrams < vlen) {
+                /*
+                 * No need to ask LSM for more than the first datagram.
+                 */
+                if (MSG_CMSG_COMPAT & flags) {
+                        err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
+                                            &msg_sys, flags, datagrams);
+                        if (err < 0)
+                                break;
+                        err = __put_user(err, &compat_entry->msg_len);
+                        ++compat_entry;
+                } else {
+                        err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
+                                            &msg_sys, flags, datagrams);
+                        if (err < 0)
+                                break;
+                        err = put_user(err, &entry->msg_len);
+                        ++entry;
+                }
 
+                if (err)
+                        break;
+                ++datagrams;
+
+                /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
+                if (flags & MSG_WAITFORONE)
+                        flags |= MSG_DONTWAIT;
+
+                if (timeout) {
+                        ktime_get_ts(timeout);
+                        *timeout = timespec_sub(end_time, *timeout);
+                        if (timeout->tv_sec < 0) {
+                                timeout->tv_sec = timeout->tv_nsec = 0;
+                                break;
+                        }
+
+                        /* Timeout, return less than vlen datagrams */
+                        if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
+                                break;
+                }
+
+                /* Out of band data, return right away */
+                if (msg_sys.msg_flags & MSG_OOB)
+                        break;
+        }
+
+out_put:
+        fput_light(sock->file, fput_needed);
+
+        if (err == 0)
+                return datagrams;
+
+        if (datagrams != 0) {
+                /*
+                 * We may return less entries than requested (vlen) if the
+                 * sock is non block and there aren't enough datagrams...
+                 */
+                if (err != -EAGAIN) {
+                        /*
+                         * ... or  if recvmsg returns an error after we
+                         * received some datagrams, where we record the
+                         * error to return on the next call or if the
+                         * app asks about it using getsockopt(SO_ERROR).
+                         */
+                        sock->sk->sk_err = -err;
+                }
+
+                return datagrams;
+        }
+
+        return err;
+}
+
+SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
+                unsigned int, vlen, unsigned int, flags,
+                struct timespec __user *, timeout)
+{
+        int datagrams;
+        struct timespec timeout_sys;
+
+        if (!timeout)
+                return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
+
+        if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
+                return -EFAULT;
+
+        datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
+
+        if (datagrams > 0 &&
+            copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
+                datagrams = -EFAULT;
+
+        return datagrams;
+}
+
+#ifdef __ARCH_WANT_SYS_SOCKETCALL
 /* Argument list sizes for sys_socketcall */
 #define AL(x) ((x) * sizeof(unsigned long))
-static const unsigned char nargs[19]={
+static const unsigned char nargs[20] = {
         AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
         AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
         AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-        AL(4)
+        AL(4),AL(5)
 };
 
 #undef AL
@@ -2100,7 +2234,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         int err;
         unsigned int len;
 
-        if (call < 1 || call > SYS_ACCEPT4)
+        if (call < 1 || call > SYS_RECVMMSG)
                 return -EINVAL;
 
         len = nargs[call];
@@ -2178,6 +2312,10 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         case SYS_RECVMSG:
                 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                 break;
+        case SYS_RECVMMSG:
+                err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
+                                   (struct timespec __user *)a[4]);
+                break;
         case SYS_ACCEPT4:
                 err = sys_accept4(a0, (struct sockaddr __user *)a1,
                                   (int __user *)a[2], a[3]);
@@ -2300,6 +2438,552 @@ void socket_seq_show(struct seq_file *seq)
 #endif                          /* CONFIG_PROC_FS */
 
 #ifdef CONFIG_COMPAT
+static int do_siocgstamp(struct net *net, struct socket *sock,
+                         unsigned int cmd, struct compat_timeval __user *up)
+{
+        mm_segment_t old_fs = get_fs();
+        struct timeval ktv;
+        int err;
+
+        set_fs(KERNEL_DS);
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
+        set_fs(old_fs);
+        if (!err) {
+                err = put_user(ktv.tv_sec, &up->tv_sec);
+                err |= __put_user(ktv.tv_usec, &up->tv_usec);
+        }
+        return err;
+}
+
+static int do_siocgstampns(struct net *net, struct socket *sock,
+                         unsigned int cmd, struct compat_timespec __user *up)
+{
+        mm_segment_t old_fs = get_fs();
+        struct timespec kts;
+        int err;
+
+        set_fs(KERNEL_DS);
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
+        set_fs(old_fs);
+        if (!err) {
+                err = put_user(kts.tv_sec, &up->tv_sec);
+                err |= __put_user(kts.tv_nsec, &up->tv_nsec);
+        }
+        return err;
+}
+
+static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
+{
+        struct ifreq __user *uifr;
+        int err;
+
+        uifr = compat_alloc_user_space(sizeof(struct ifreq));
+        if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
+                return -EFAULT;
+
+        err = dev_ioctl(net, SIOCGIFNAME, uifr);
+        if (err)
+                return err;
+
+        if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
+{
+        struct compat_ifconf ifc32;
+        struct ifconf ifc;
+        struct ifconf __user *uifc;
+        struct compat_ifreq __user *ifr32;
+        struct ifreq __user *ifr;
+        unsigned int i, j;
+        int err;
+
+        if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
+                return -EFAULT;
+
+        if (ifc32.ifcbuf == 0) {
+                ifc32.ifc_len = 0;
+                ifc.ifc_len = 0;
+                ifc.ifc_req = NULL;
+                uifc = compat_alloc_user_space(sizeof(struct ifconf));
+        } else {
+                size_t len =((ifc32.ifc_len / sizeof (struct compat_ifreq)) + 1) *
+                        sizeof (struct ifreq);
+                uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
+                ifc.ifc_len = len;
+                ifr = ifc.ifc_req = (void __user *)(uifc + 1);
+                ifr32 = compat_ptr(ifc32.ifcbuf);
+                for (i = 0; i < ifc32.ifc_len; i += sizeof (struct compat_ifreq)) {
+                        if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
+                                return -EFAULT;
+                        ifr++;
+                        ifr32++;
+                }
+        }
+        if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
+                return -EFAULT;
+
+        err = dev_ioctl(net, SIOCGIFCONF, uifc);
+        if (err)
+                return err;
+
+        if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
+                return -EFAULT;
+
+        ifr = ifc.ifc_req;
+        ifr32 = compat_ptr(ifc32.ifcbuf);
+        for (i = 0, j = 0;
+             i + sizeof (struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
+             i += sizeof (struct compat_ifreq), j += sizeof (struct ifreq)) {
+                if (copy_in_user(ifr32, ifr, sizeof (struct compat_ifreq)))
+                        return -EFAULT;
+                ifr32++;
+                ifr++;
+        }
+
+        if (ifc32.ifcbuf == 0) {
+                /* Translate from 64-bit structure multiple to
+                 * a 32-bit one.
+                 */
+                i = ifc.ifc_len;
+                i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
+                ifc32.ifc_len = i;
+        } else {
+                ifc32.ifc_len = i;
+        }
+        if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+{
+        struct ifreq __user *ifr;
+        u32 data;
+        void __user *datap;
+
+        ifr = compat_alloc_user_space(sizeof(*ifr));
+
+        if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
+                return -EFAULT;
+
+        if (get_user(data, &ifr32->ifr_ifru.ifru_data))
+                return -EFAULT;
+
+        datap = compat_ptr(data);
+        if (put_user(datap, &ifr->ifr_ifru.ifru_data))
+                return -EFAULT;
+
+        return dev_ioctl(net, SIOCETHTOOL, ifr);
+}
+
+static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
+{
+        void __user *uptr;
+        compat_uptr_t uptr32;
+        struct ifreq __user *uifr;
+
+        uifr = compat_alloc_user_space(sizeof (*uifr));
+        if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
+                return -EFAULT;
+
+        if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
+                return -EFAULT;
+
+        uptr = compat_ptr(uptr32);
+
+        if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
+                return -EFAULT;
+
+        return dev_ioctl(net, SIOCWANDEV, uifr);
+}
+
+static int bond_ioctl(struct net *net, unsigned int cmd,
+                         struct compat_ifreq __user *ifr32)
+{
+        struct ifreq kifr;
+        struct ifreq __user *uifr;
+        mm_segment_t old_fs;
+        int err;
+        u32 data;
+        void __user *datap;
+
+        switch (cmd) {
+        case SIOCBONDENSLAVE:
+        case SIOCBONDRELEASE:
+        case SIOCBONDSETHWADDR:
+        case SIOCBONDCHANGEACTIVE:
+                if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
+                        return -EFAULT;
+
+                old_fs = get_fs();
+                set_fs (KERNEL_DS);
+                err = dev_ioctl(net, cmd, &kifr);
+                set_fs (old_fs);
+
+                return err;
+        case SIOCBONDSLAVEINFOQUERY:
+        case SIOCBONDINFOQUERY:
+                uifr = compat_alloc_user_space(sizeof(*uifr));
+                if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
+                        return -EFAULT;
+
+                if (get_user(data, &ifr32->ifr_ifru.ifru_data))
+                        return -EFAULT;
+
+                datap = compat_ptr(data);
+                if (put_user(datap, &uifr->ifr_ifru.ifru_data))
+                        return -EFAULT;
+
+                return dev_ioctl(net, cmd, uifr);
+        default:
+                return -EINVAL;
+        };
+}
+
+static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
+                                 struct compat_ifreq __user *u_ifreq32)
+{
+        struct ifreq __user *u_ifreq64;
+        char tmp_buf[IFNAMSIZ];
+        void __user *data64;
+        u32 data32;
+
+        if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
+                           IFNAMSIZ))
+                return -EFAULT;
+        if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
+                return -EFAULT;
+        data64 = compat_ptr(data32);
+
+        u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
+
+        /* Don't check these user accesses, just let that get trapped
+         * in the ioctl handler instead.
+         */
+        if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
+                         IFNAMSIZ))
+                return -EFAULT;
+        if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
+                return -EFAULT;
+
+        return dev_ioctl(net, cmd, u_ifreq64);
+}
+
+static int dev_ifsioc(struct net *net, struct socket *sock,
+                         unsigned int cmd, struct compat_ifreq __user *uifr32)
+{
+        struct ifreq __user *uifr;
+        int err;
+
+        uifr = compat_alloc_user_space(sizeof(*uifr));
+        if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
+                return -EFAULT;
+
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
+
+        if (!err) {
+                switch (cmd) {
+                case SIOCGIFFLAGS:
+                case SIOCGIFMETRIC:
+                case SIOCGIFMTU:
+                case SIOCGIFMEM:
+                case SIOCGIFHWADDR:
+                case SIOCGIFINDEX:
+                case SIOCGIFADDR:
+                case SIOCGIFBRDADDR:
+                case SIOCGIFDSTADDR:
+                case SIOCGIFNETMASK:
+                case SIOCGIFPFLAGS:
+                case SIOCGIFTXQLEN:
+                case SIOCGMIIPHY:
+                case SIOCGMIIREG:
+                        if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
+                                err = -EFAULT;
+                        break;
+                }
+        }
+        return err;
+}
+
+static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+                        struct compat_ifreq __user *uifr32)
+{
+        struct ifreq ifr;
+        struct compat_ifmap __user *uifmap32;
+        mm_segment_t old_fs;
+        int err;
+
+        uifmap32 = &uifr32->ifr_ifru.ifru_map;
+        err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
+        err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
+        err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
+        err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
+        err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
+        err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
+        err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
+        if (err)
+                return -EFAULT;
+
+        old_fs = get_fs();
+        set_fs (KERNEL_DS);
+        err = dev_ioctl(net, cmd, (void __user *)&ifr);
+        set_fs (old_fs);
+
+        if (cmd == SIOCGIFMAP && !err) {
+                err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
+                err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
+                err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
+                err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
+                err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
+                err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
+                err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
+                if (err)
+                        err = -EFAULT;
+        }
+        return err;
+}
+
+static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
+{
+        void __user *uptr;
+        compat_uptr_t uptr32;
+        struct ifreq __user *uifr;
+
+        uifr = compat_alloc_user_space(sizeof (*uifr));
+        if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
+                return -EFAULT;
+
+        if (get_user(uptr32, &uifr32->ifr_data))
+                return -EFAULT;
+
+        uptr = compat_ptr(uptr32);
+
+        if (put_user(uptr, &uifr->ifr_data))
+                return -EFAULT;
+
+        return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
+}
+
+struct rtentry32 {
+        u32             rt_pad1;
+        struct sockaddr rt_dst;         /* target address               */
+        struct sockaddr rt_gateway;     /* gateway addr (RTF_GATEWAY)   */
+        struct sockaddr rt_genmask;     /* target network mask (IP)     */
+        unsigned short  rt_flags;
+        short           rt_pad2;
+        u32             rt_pad3;
+        unsigned char   rt_tos;
+        unsigned char   rt_class;
+        short           rt_pad4;
+        short           rt_metric;      /* +1 for binary compatibility! */
+        /* char * */ u32 rt_dev;        /* forcing the device at add    */
+        u32             rt_mtu;         /* per route MTU/Window         */
+        u32             rt_window;      /* Window clamping              */
+        unsigned short  rt_irtt;        /* Initial RTT                  */
+};
+
+struct in6_rtmsg32 {
+        struct in6_addr         rtmsg_dst;
+        struct in6_addr         rtmsg_src;
+        struct in6_addr         rtmsg_gateway;
+        u32                     rtmsg_type;
+        u16                     rtmsg_dst_len;
+        u16                     rtmsg_src_len;
+        u32                     rtmsg_metric;
+        u32                     rtmsg_info;
+        u32                     rtmsg_flags;
+        s32                     rtmsg_ifindex;
+};
+
+static int routing_ioctl(struct net *net, struct socket *sock,
+                         unsigned int cmd, void __user *argp)
+{
+        int ret;
+        void *r = NULL;
+        struct in6_rtmsg r6;
+        struct rtentry r4;
+        char devname[16];
+        u32 rtdev;
+        mm_segment_t old_fs = get_fs();
+
+        if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
+                struct in6_rtmsg32 __user *ur6 = argp;
+                ret = copy_from_user (&r6.rtmsg_dst, &(ur6->rtmsg_dst),
+                        3 * sizeof(struct in6_addr));
+                ret |= __get_user (r6.rtmsg_type, &(ur6->rtmsg_type));
+                ret |= __get_user (r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
+                ret |= __get_user (r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
+                ret |= __get_user (r6.rtmsg_metric, &(ur6->rtmsg_metric));
+                ret |= __get_user (r6.rtmsg_info, &(ur6->rtmsg_info));
+                ret |= __get_user (r6.rtmsg_flags, &(ur6->rtmsg_flags));
+                ret |= __get_user (r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
+
+                r = (void *) &r6;
+        } else { /* ipv4 */
+                struct rtentry32 __user *ur4 = argp;
+                ret = copy_from_user (&r4.rt_dst, &(ur4->rt_dst),
+                                        3 * sizeof(struct sockaddr));
+                ret |= __get_user (r4.rt_flags, &(ur4->rt_flags));
+                ret |= __get_user (r4.rt_metric, &(ur4->rt_metric));
+                ret |= __get_user (r4.rt_mtu, &(ur4->rt_mtu));
+                ret |= __get_user (r4.rt_window, &(ur4->rt_window));
+                ret |= __get_user (r4.rt_irtt, &(ur4->rt_irtt));
+                ret |= __get_user (rtdev, &(ur4->rt_dev));
+                if (rtdev) {
+                        ret |= copy_from_user (devname, compat_ptr(rtdev), 15);
+                        r4.rt_dev = devname; devname[15] = 0;
+                } else
+                        r4.rt_dev = NULL;
+
+                r = (void *) &r4;
+        }
+
+        if (ret) {
+                ret = -EFAULT;
+                goto out;
+        }
+
+        set_fs (KERNEL_DS);
+        ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
+        set_fs (old_fs);
+
+out:
+        return ret;
+}
+
+/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
+ * for some operations; this forces use of the newer bridge-utils that
+ * use compatiable ioctls
+ */
+static int old_bridge_ioctl(compat_ulong_t __user *argp)
+{
+        compat_ulong_t tmp;
+
+        if (get_user(tmp, argp))
+                return -EFAULT;
+        if (tmp == BRCTL_GET_VERSION)
+                return BRCTL_VERSION + 1;
+        return -EINVAL;
+}
+
+static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
+                         unsigned int cmd, unsigned long arg)
+{
+        void __user *argp = compat_ptr(arg);
+        struct sock *sk = sock->sk;
+        struct net *net = sock_net(sk);
+
+        if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
+                return siocdevprivate_ioctl(net, cmd, argp);
+
+        switch (cmd) {
+        case SIOCSIFBR:
+        case SIOCGIFBR:
+                return old_bridge_ioctl(argp);
+        case SIOCGIFNAME:
+                return dev_ifname32(net, argp);
+        case SIOCGIFCONF:
+                return dev_ifconf(net, argp);
+        case SIOCETHTOOL:
+                return ethtool_ioctl(net, argp);
+        case SIOCWANDEV:
+                return compat_siocwandev(net, argp);
+        case SIOCGIFMAP:
+        case SIOCSIFMAP:
+                return compat_sioc_ifmap(net, cmd, argp);
+        case SIOCBONDENSLAVE:
+        case SIOCBONDRELEASE:
+        case SIOCBONDSETHWADDR:
+        case SIOCBONDSLAVEINFOQUERY:
+        case SIOCBONDINFOQUERY:
+        case SIOCBONDCHANGEACTIVE:
+                return bond_ioctl(net, cmd, argp);
+        case SIOCADDRT:
+        case SIOCDELRT:
+                return routing_ioctl(net, sock, cmd, argp);
+        case SIOCGSTAMP:
+                return do_siocgstamp(net, sock, cmd, argp);
+        case SIOCGSTAMPNS:
+                return do_siocgstampns(net, sock, cmd, argp);
+        case SIOCSHWTSTAMP:
+                return compat_siocshwtstamp(net, argp);
+
+        case FIOSETOWN:
+        case SIOCSPGRP:
+        case FIOGETOWN:
+        case SIOCGPGRP:
+        case SIOCBRADDBR:
+        case SIOCBRDELBR:
+        case SIOCGIFVLAN:
+        case SIOCSIFVLAN:
+        case SIOCADDDLCI:
+        case SIOCDELDLCI:
+                return sock_ioctl(file, cmd, arg);
+
+        case SIOCGIFFLAGS:
+        case SIOCSIFFLAGS:
+        case SIOCGIFMETRIC:
+        case SIOCSIFMETRIC:
+        case SIOCGIFMTU:
+        case SIOCSIFMTU:
+        case SIOCGIFMEM:
+        case SIOCSIFMEM:
+        case SIOCGIFHWADDR:
+        case SIOCSIFHWADDR:
+        case SIOCADDMULTI:
+        case SIOCDELMULTI:
+        case SIOCGIFINDEX:
+        case SIOCGIFADDR:
+        case SIOCSIFADDR:
+        case SIOCSIFHWBROADCAST:
+        case SIOCDIFADDR:
+        case SIOCGIFBRDADDR:
+        case SIOCSIFBRDADDR:
+        case SIOCGIFDSTADDR:
+        case SIOCSIFDSTADDR:
+        case SIOCGIFNETMASK:
+        case SIOCSIFNETMASK:
+        case SIOCSIFPFLAGS:
+        case SIOCGIFPFLAGS:
+        case SIOCGIFTXQLEN:
+        case SIOCSIFTXQLEN:
+        case SIOCBRADDIF:
+        case SIOCBRDELIF:
+        case SIOCSIFNAME:
+        case SIOCGMIIPHY:
+        case SIOCGMIIREG:
+        case SIOCSMIIREG:
+                return dev_ifsioc(net, sock, cmd, argp);
+
+        case SIOCSARP:
+        case SIOCGARP:
+        case SIOCDARP:
+        case SIOCATMARK:
+                return sock_do_ioctl(net, sock, cmd, arg);
+        }
+
+        /* Prevent warning from compat_sys_ioctl, these always
+         * result in -EINVAL in the native case anyway. */
+        switch (cmd) {
+        case SIOCRTMSG:
+        case SIOCGIFCOUNT:
+        case SIOCSRARP:
+        case SIOCGRARP:
+        case SIOCDRARP:
+        case SIOCSIFLINK:
+        case SIOCGIFSLAVE:
+        case SIOCSIFSLAVE:
+                return -EINVAL;
+        }
+
+        return -ENOIOCTLCMD;
+}
+
 static long compat_sock_ioctl(struct file *file, unsigned cmd,
                               unsigned long arg)
 {
@@ -2318,6 +3002,9 @@ static long compat_sock_ioctl(struct file *file, unsigned cmd,
             (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
                 ret = compat_wext_handle_ioctl(net, cmd, arg);
 
+        if (ret == -ENOIOCTLCMD)
+                ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
+
         return ret;
 }
 #endif
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index c7450c8f0a7c..1419d0cdbbac 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -18,6 +18,7 @@
 
 #include <net/ipv6.h>
 #include <linux/sunrpc/clnt.h>
+#include <linux/slab.h>
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 
@@ -55,16 +56,8 @@ static size_t rpc_ntop6_noscopeid(const struct sockaddr *sap,
 
         /*
          * RFC 4291, Section 2.2.1
-         *
-         * To keep the result as short as possible, especially
-         * since we don't shorthand, we don't want leading zeros
-         * in each halfword, so avoid %pI6.
          */
-        return snprintf(buf, buflen, "%x:%x:%x:%x:%x:%x:%x:%x",
-                ntohs(addr->s6_addr16[0]), ntohs(addr->s6_addr16[1]),
-                ntohs(addr->s6_addr16[2]), ntohs(addr->s6_addr16[3]),
-                ntohs(addr->s6_addr16[4]), ntohs(addr->s6_addr16[5]),
-                ntohs(addr->s6_addr16[6]), ntohs(addr->s6_addr16[7]));
+        return snprintf(buf, buflen, "%pI6c", addr);
 }
 
 static size_t rpc_ntop6(const struct sockaddr *sap,
@@ -79,8 +72,9 @@ static size_t rpc_ntop6(const struct sockaddr *sap,
         if (unlikely(len == 0))
                 return len;
 
-        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
-            !(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_SITELOCAL))
+        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL))
+                return len;
+        if (sin6->sin6_scope_id == 0)
                 return len;
 
         rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u",
@@ -173,8 +167,7 @@ static int rpc_parse_scope_id(const char *buf, const size_t buflen,
         if (*delim != IPV6_SCOPE_DELIMITER)
                 return 0;
 
-        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
-            !(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_SITELOCAL))
+        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL))
                 return 0;
 
         len = (buf + buflen) - delim - 1;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 54a4e042f104..95afe79dd9d7 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -123,16 +123,19 @@ rpcauth_unhash_cred_locked(struct rpc_cred *cred)
         clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags);
 }
 
-static void
+static int
 rpcauth_unhash_cred(struct rpc_cred *cred)
 {
         spinlock_t *cache_lock;
+        int ret;
 
         cache_lock = &cred->cr_auth->au_credcache->lock;
         spin_lock(cache_lock);
-        if (atomic_read(&cred->cr_count) == 0)
+        ret = atomic_read(&cred->cr_count) == 0;
+        if (ret)
                 rpcauth_unhash_cred_locked(cred);
         spin_unlock(cache_lock);
+        return ret;
 }
 
 /*
@@ -234,7 +237,7 @@ rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
         list_for_each_entry_safe(cred, next, &cred_unused, cr_lru) {
 
                 /* Enforce a 60 second garbage collection moratorium */
-                if (time_in_range_open(cred->cr_expire, expired, jiffies) &&
+                if (time_in_range(cred->cr_expire, expired, jiffies) &&
                     test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0)
                         continue;
 
@@ -332,9 +335,9 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
                 list_add_tail(&new->cr_lru, &free);
         spin_unlock(&cache->lock);
 found:
-        if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags)
-                        && cred->cr_ops->cr_init != NULL
-                        && !(flags & RPCAUTH_LOOKUP_NEW)) {
+        if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
+            cred->cr_ops->cr_init != NULL &&
+            !(flags & RPCAUTH_LOOKUP_NEW)) {
                 int res = cred->cr_ops->cr_init(auth, cred);
                 if (res < 0) {
                         put_rpccred(cred);
@@ -446,31 +449,35 @@ void
 put_rpccred(struct rpc_cred *cred)
 {
         /* Fast path for unhashed credentials */
-        if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0)
-                goto need_lock;
-
-        if (!atomic_dec_and_test(&cred->cr_count))
+        if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) == 0) {
+                if (atomic_dec_and_test(&cred->cr_count))
+                        cred->cr_ops->crdestroy(cred);
                 return;
-        goto out_destroy;
-need_lock:
+        }
+
         if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock))
                 return;
         if (!list_empty(&cred->cr_lru)) {
                 number_cred_unused--;
                 list_del_init(&cred->cr_lru);
         }
-        if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) == 0)
-                rpcauth_unhash_cred(cred);
         if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) {
-                cred->cr_expire = jiffies;
-                list_add_tail(&cred->cr_lru, &cred_unused);
-                number_cred_unused++;
-                spin_unlock(&rpc_credcache_lock);
-                return;
+                if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) {
+                        cred->cr_expire = jiffies;
+                        list_add_tail(&cred->cr_lru, &cred_unused);
+                        number_cred_unused++;
+                        goto out_nodestroy;
+                }
+                if (!rpcauth_unhash_cred(cred)) {
+                        /* We were hashed and someone looked us up... */
+                        goto out_nodestroy;
+                }
         }
         spin_unlock(&rpc_credcache_lock);
-out_destroy:
         cred->cr_ops->crdestroy(cred);
+        return;
+out_nodestroy:
+        spin_unlock(&rpc_credcache_lock);
 }
 EXPORT_SYMBOL_GPL(put_rpccred);
 
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index bf88bf8e9365..8f623b0f03dd 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -5,6 +5,7 @@
  */
 
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/module.h>
 #include <linux/sched.h>
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index fc6a43ccd950..c389ccf6437d 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -206,8 +206,14 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
         ctx->gc_win = window_size;
         /* gssd signals an error by passing ctx->gc_win = 0: */
         if (ctx->gc_win == 0) {
-                /* in which case, p points to  an error code which we ignore */
-                p = ERR_PTR(-EACCES);
+                /*
+                 * in which case, p points to an error code. Anything other
+                 * than -EKEYEXPIRED gets converted to -EACCES.
+                 */
+                p = simple_get_bytes(p, end, &ret, sizeof(ret));
+                if (!IS_ERR(p))
+                        p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
+                                                    ERR_PTR(-EACCES);
                 goto err;
         }
         /* copy the opaque wire context */
@@ -304,7 +310,7 @@ __gss_find_upcall(struct rpc_inode *rpci, uid_t uid)
  * to that upcall instead of adding the new upcall.
  */
 static inline struct gss_upcall_msg *
-gss_add_msg(struct gss_auth *gss_auth, struct gss_upcall_msg *gss_msg)
+gss_add_msg(struct gss_upcall_msg *gss_msg)
 {
         struct rpc_inode *rpci = gss_msg->inode;
         struct inode *inode = &rpci->vfs_inode;
@@ -445,7 +451,7 @@ gss_setup_upcall(struct rpc_clnt *clnt, struct gss_auth *gss_auth, struct rpc_cr
         gss_new = gss_alloc_msg(gss_auth, uid, clnt, gss_cred->gc_machine_cred);
         if (IS_ERR(gss_new))
                 return gss_new;
-        gss_msg = gss_add_msg(gss_auth, gss_new);
+        gss_msg = gss_add_msg(gss_new);
         if (gss_msg == gss_new) {
                 struct inode *inode = &gss_new->inode->vfs_inode;
                 int res = rpc_queue_upcall(inode, &gss_new->msg);
@@ -485,7 +491,7 @@ gss_refresh_upcall(struct rpc_task *task)
         dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid,
                                                                 cred->cr_uid);
         gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
-        if (IS_ERR(gss_msg) == -EAGAIN) {
+        if (PTR_ERR(gss_msg) == -EAGAIN) {
                 /* XXX: warning on the first, under the assumption we
                  * shouldn't normally hit this case on a refresh. */
                 warn_gssd();
@@ -644,7 +650,23 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
         if (IS_ERR(p)) {
                 err = PTR_ERR(p);
-                gss_msg->msg.errno = (err == -EAGAIN) ? -EAGAIN : -EACCES;
+                switch (err) {
+                case -EACCES:
+                case -EKEYEXPIRED:
+                        gss_msg->msg.errno = err;
+                        err = mlen;
+                        break;
+                case -EFAULT:
+                case -ENOMEM:
+                case -EINVAL:
+                case -ENOSYS:
+                        gss_msg->msg.errno = -EAGAIN;
+                        break;
+                default:
+                        printk(KERN_CRIT "%s: bad return from "
+                                "gss_fill_context: %zd\n", __func__, err);
+                        BUG();
+                }
                 goto err_release_msg;
         }
         gss_msg->ctx = gss_get_ctx(ctx);
@@ -1258,9 +1280,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
         rqstp->rq_release_snd_buf = priv_release_snd_buf;
         return 0;
 out_free:
-        for (i--; i >= 0; i--) {
-                __free_page(rqstp->rq_enc_pages[i]);
-        }
+        rqstp->rq_enc_pages_num = i;
+        priv_release_snd_buf(rqstp);
 out:
         return -EAGAIN;
 }
diff --git a/net/sunrpc/auth_gss/gss_generic_token.c b/net/sunrpc/auth_gss/gss_generic_token.c
index c0ba39c4f5f2..310b78e99456 100644
--- a/net/sunrpc/auth_gss/gss_generic_token.c
+++ b/net/sunrpc/auth_gss/gss_generic_token.c
@@ -33,7 +33,6 @@
 
 #include <linux/types.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/sunrpc/sched.h>
 #include <linux/sunrpc/gss_asn1.h>
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index c93fca204558..e9b636176687 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -37,7 +37,6 @@
 #include <linux/err.h>
 #include <linux/types.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/highmem.h>
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index ef45eba22485..2deb0ed72ff4 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -131,8 +131,10 @@ gss_import_sec_context_kerberos(const void *p,
         struct  krb5_ctx *ctx;
         int tmp;
 
-        if (!(ctx = kzalloc(sizeof(*ctx), GFP_NOFS)))
+        if (!(ctx = kzalloc(sizeof(*ctx), GFP_NOFS))) {
+                p = ERR_PTR(-ENOMEM);
                 goto out_err;
+        }
 
         p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate));
         if (IS_ERR(p))
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index b8f42ef7178e..88fe6e75ed7e 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -59,7 +59,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/jiffies.h>
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/random.h>
diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
index f160be6c1a46..6331cd6866ec 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
@@ -32,7 +32,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/crypto.h>
 
@@ -75,8 +74,8 @@ krb5_get_seq_num(struct crypto_blkcipher *key,
         if ((code = krb5_decrypt(key, cksum, buf, plain, 8)))
                 return code;
 
-        if ((plain[4] != plain[5]) || (plain[4] != plain[6])
-                                   || (plain[4] != plain[7]))
+        if ((plain[4] != plain[5]) || (plain[4] != plain[6]) ||
+            (plain[4] != plain[7]))
                 return (s32)KG_BAD_SEQ;
 
         *direction = plain[4];
diff --git a/net/sunrpc/auth_gss/gss_krb5_unseal.c b/net/sunrpc/auth_gss/gss_krb5_unseal.c
index 066ec73c84d6..ce6c247edad0 100644
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -58,7 +58,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/jiffies.h>
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/crypto.h>
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index ae8e69b59c4c..a6e905637e03 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -1,5 +1,4 @@
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/jiffies.h>
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/random.h>
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index 6efbb0cd3c7c..76e4c6f4ac3c 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -252,7 +252,7 @@ gss_import_sec_context(const void *input_token, size_t bufsize,
                        struct gss_ctx           **ctx_id)
 {
         if (!(*ctx_id = kzalloc(sizeof(**ctx_id), GFP_KERNEL)))
-                return GSS_S_FAILURE;
+                return -ENOMEM;
         (*ctx_id)->mech_type = gss_mech_get(mech);
 
         return mech->gm_ops
diff --git a/net/sunrpc/auth_gss/gss_spkm3_seal.c b/net/sunrpc/auth_gss/gss_spkm3_seal.c
index c832712f8d55..5a3a65a0e2b4 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_seal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_seal.c
@@ -34,7 +34,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/jiffies.h>
 #include <linux/sunrpc/gss_spkm3.h>
 #include <linux/random.h>
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index f6c51e562a02..b81e790ef9f4 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -37,6 +37,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/module.h>
 #include <linux/pagemap.h>
@@ -105,8 +106,8 @@ static int rsi_match(struct cache_head *a, struct cache_head *b)
 {
         struct rsi *item = container_of(a, struct rsi, h);
         struct rsi *tmp = container_of(b, struct rsi, h);
-        return netobj_equal(&item->in_handle, &tmp->in_handle)
-                && netobj_equal(&item->in_token, &tmp->in_token);
+        return netobj_equal(&item->in_handle, &tmp->in_handle) &&
+               netobj_equal(&item->in_token, &tmp->in_token);
 }
 
 static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len)
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 46b2647c5bd2..aac2f8b4ee21 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -6,6 +6,7 @@
  * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/sched.h>
 #include <linux/module.h>
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 553621fb2c41..cf06af3b63c6 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -22,6 +22,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ******************************************************************************/
 
 #include <linux/tcp.h>
+#include <linux/slab.h>
 #include <linux/sunrpc/xprt.h>
 
 #ifdef RPC_DEBUG
diff --git a/net/sunrpc/bc_svc.c b/net/sunrpc/bc_svc.c
index 13f214f53120..f0c05d3311c1 100644
--- a/net/sunrpc/bc_svc.c
+++ b/net/sunrpc/bc_svc.c
@@ -37,21 +37,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #define RPCDBG_FACILITY RPCDBG_SVCDSP
 
-void bc_release_request(struct rpc_task *task)
-{
-        struct rpc_rqst *req = task->tk_rqstp;
-
-        dprintk("RPC:       bc_release_request: task= %p\n", task);
-
-        /*
-         * Release this request only if it's a backchannel
-         * preallocated request
-         */
-        if (!bc_prealloc(req))
-                return;
-        xprt_free_bc_request(req);
-}
-
 /* Empty callback ops */
 static const struct rpc_call_ops nfs41_callback_ops = {
 };
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index d6eee291a0e2..39bddba53ba1 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -401,9 +401,8 @@ static int cache_clean(void)
                 for (; ch; cp= & ch->next, ch= *cp) {
                         if (current_detail->nextcheck > ch->expiry_time)
                                 current_detail->nextcheck = ch->expiry_time+1;
-                        if (ch->expiry_time >= get_seconds()
-                            && ch->last_refresh >= current_detail->flush_time
-                                )
+                        if (ch->expiry_time >= get_seconds() &&
+                            ch->last_refresh >= current_detail->flush_time)
                                 continue;
                         if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
                                 cache_dequeue(current_detail, ch);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 38829e20500b..19c9983d5360 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -79,7 +79,7 @@ static void	call_connect_status(struct rpc_task *task);
 
 static __be32   *rpc_encode_header(struct rpc_task *task);
 static __be32   *rpc_verify_header(struct rpc_task *task);
-static int      rpc_ping(struct rpc_clnt *clnt, int flags);
+static int      rpc_ping(struct rpc_clnt *clnt);
 
 static void rpc_register_client(struct rpc_clnt *clnt)
 {
@@ -340,7 +340,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                 return clnt;
 
         if (!(args->flags & RPC_CLNT_CREATE_NOPING)) {
-                int err = rpc_ping(clnt, RPC_TASK_SOFT);
+                int err = rpc_ping(clnt);
                 if (err != 0) {
                         rpc_shutdown_client(clnt);
                         return ERR_PTR(err);
@@ -528,7 +528,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
         clnt->cl_prog     = program->number;
         clnt->cl_vers     = version->number;
         clnt->cl_stats    = program->stats;
-        err = rpc_ping(clnt, RPC_TASK_SOFT);
+        err = rpc_ping(clnt);
         if (err != 0) {
                 rpc_shutdown_client(clnt);
                 clnt = ERR_PTR(err);
@@ -659,6 +659,7 @@ struct rpc_task *rpc_run_bc_task(struct rpc_rqst *req,
         task = rpc_new_task(&task_setup_data);
         if (!task) {
                 xprt_free_bc_request(req);
+                task = ERR_PTR(-ENOMEM);
                 goto out;
         }
         task->tk_rqstp = req;
@@ -1060,7 +1061,7 @@ call_bind_status(struct rpc_task *task)
                 goto retry_timeout;
         case -EPFNOSUPPORT:
                 /* server doesn't support any rpcbind version we know of */
-                dprintk("RPC: %5u remote rpcbind service unavailable\n",
+                dprintk("RPC: %5u unrecognized remote rpcbind service\n",
                                 task->tk_pid);
                 break;
         case -EPROTONOSUPPORT:
@@ -1069,6 +1070,21 @@ call_bind_status(struct rpc_task *task)
                 task->tk_status = 0;
                 task->tk_action = call_bind;
                 return;
+        case -ECONNREFUSED:             /* connection problems */
+        case -ECONNRESET:
+        case -ENOTCONN:
+        case -EHOSTDOWN:
+        case -EHOSTUNREACH:
+        case -ENETUNREACH:
+        case -EPIPE:
+                dprintk("RPC: %5u remote rpcbind unreachable: %d\n",
+                                task->tk_pid, task->tk_status);
+                if (!RPC_IS_SOFTCONN(task)) {
+                        rpc_delay(task, 5*HZ);
+                        goto retry_timeout;
+                }
+                status = task->tk_status;
+                break;
         default:
                 dprintk("RPC: %5u unrecognized rpcbind error (%d)\n",
                                 task->tk_pid, -task->tk_status);
@@ -1180,11 +1196,25 @@ static void
 call_transmit_status(struct rpc_task *task)
 {
         task->tk_action = call_status;
+
+        /*
+         * Common case: success.  Force the compiler to put this
+         * test first.
+         */
+        if (task->tk_status == 0) {
+                xprt_end_transmit(task);
+                rpc_task_force_reencode(task);
+                return;
+        }
+
         switch (task->tk_status) {
         case -EAGAIN:
                 break;
         default:
+                dprint_status(task);
                 xprt_end_transmit(task);
+                rpc_task_force_reencode(task);
+                break;
                 /*
                  * Special cases: if we've been waiting on the
                  * socket's write_space() callback, or if the
@@ -1192,11 +1222,16 @@ call_transmit_status(struct rpc_task *task)
                  * then hold onto the transport lock.
                  */
         case -ECONNREFUSED:
-        case -ECONNRESET:
-        case -ENOTCONN:
         case -EHOSTDOWN:
         case -EHOSTUNREACH:
         case -ENETUNREACH:
+                if (RPC_IS_SOFTCONN(task)) {
+                        xprt_end_transmit(task);
+                        rpc_exit(task, task->tk_status);
+                        break;
+                }
+        case -ECONNRESET:
+        case -ENOTCONN:
         case -EPIPE:
                 rpc_task_force_reencode(task);
         }
@@ -1346,6 +1381,10 @@ call_timeout(struct rpc_task *task)
         dprintk("RPC: %5u call_timeout (major)\n", task->tk_pid);
         task->tk_timeouts++;
 
+        if (RPC_IS_SOFTCONN(task)) {
+                rpc_exit(task, -ETIMEDOUT);
+                return;
+        }
         if (RPC_IS_SOFT(task)) {
                 if (clnt->cl_chatty)
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
@@ -1675,14 +1714,14 @@ static struct rpc_procinfo rpcproc_null = {
         .p_decode = rpcproc_decode_null,
 };
 
-static int rpc_ping(struct rpc_clnt *clnt, int flags)
+static int rpc_ping(struct rpc_clnt *clnt)
 {
         struct rpc_message msg = {
                 .rpc_proc = &rpcproc_null,
         };
         int err;
         msg.rpc_cred = authnull_ops.lookup_cred(NULL, NULL, 0);
-        err = rpc_call_sync(clnt, &msg, flags);
+        err = rpc_call_sync(clnt, &msg, RPC_TASK_SOFT | RPC_TASK_SOFTCONN);
         put_rpccred(msg.rpc_cred);
         return err;
 }
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 49278f830367..20e30c6f8355 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -78,7 +78,7 @@ rpc_timeout_upcall_queue(struct work_struct *work)
 }
 
 /**
- * rpc_queue_upcall
+ * rpc_queue_upcall - queue an upcall message to userspace
  * @inode: inode of upcall pipe on which to queue given message
  * @msg: message to queue
  *
@@ -587,6 +587,8 @@ static struct dentry *__rpc_lookup_create_exclusive(struct dentry *parent,
         struct dentry *dentry;
 
         dentry = __rpc_lookup_create(parent, name);
+        if (IS_ERR(dentry))
+                return dentry;
         if (dentry->d_inode == NULL)
                 return dentry;
         dput(dentry);
@@ -999,19 +1001,14 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
         inode = rpc_get_inode(sb, S_IFDIR | 0755);
         if (!inode)
                 return -ENOMEM;
-        root = d_alloc_root(inode);
+        sb->s_root = root = d_alloc_root(inode);
         if (!root) {
                 iput(inode);
                 return -ENOMEM;
         }
         if (rpc_populate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF, NULL))
-                goto out;
-        sb->s_root = root;
+                return -ENOMEM;
         return 0;
-out:
-        d_genocide(root);
-        dput(root);
-        return -ENOMEM;
 }
 
 static int
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 830faf4d9997..121105355f60 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -20,6 +20,8 @@
 #include <linux/in6.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 
 #include <linux/sunrpc/clnt.h>
@@ -110,6 +112,9 @@ static void			rpcb_getport_done(struct rpc_task *, void *);
 static void                     rpcb_map_release(void *data);
 static struct rpc_program       rpcb_program;
 
+static struct rpc_clnt *        rpcb_local_clnt;
+static struct rpc_clnt *        rpcb_local_clnt4;
+
 struct rpcbind_args {
         struct rpc_xprt *       r_xprt;
 
@@ -163,21 +168,60 @@ static const struct sockaddr_in rpcb_inaddr_loopback = {
         .sin_port               = htons(RPCBIND_PORT),
 };
 
-static struct rpc_clnt *rpcb_create_local(struct sockaddr *addr,
-                                          size_t addrlen, u32 version)
+static DEFINE_MUTEX(rpcb_create_local_mutex);
+
+/*
+ * Returns zero on success, otherwise a negative errno value
+ * is returned.
+ */
+static int rpcb_create_local(void)
 {
         struct rpc_create_args args = {
-                .protocol       = XPRT_TRANSPORT_UDP,
-                .address        = addr,
-                .addrsize       = addrlen,
+                .protocol       = XPRT_TRANSPORT_TCP,
+                .address        = (struct sockaddr *)&rpcb_inaddr_loopback,
+                .addrsize       = sizeof(rpcb_inaddr_loopback),
                 .servername     = "localhost",
                 .program        = &rpcb_program,
-                .version        = version,
+                .version        = RPCBVERS_2,
                 .authflavor     = RPC_AUTH_UNIX,
                 .flags          = RPC_CLNT_CREATE_NOPING,
         };
+        struct rpc_clnt *clnt, *clnt4;
+        int result = 0;
+
+        if (rpcb_local_clnt)
+                return result;
+
+        mutex_lock(&rpcb_create_local_mutex);
+        if (rpcb_local_clnt)
+                goto out;
+
+        clnt = rpc_create(&args);
+        if (IS_ERR(clnt)) {
+                dprintk("RPC:       failed to create local rpcbind "
+                                "client (errno %ld).\n", PTR_ERR(clnt));
+                result = -PTR_ERR(clnt);
+                goto out;
+        }
 
-        return rpc_create(&args);
+        /*
+         * This results in an RPC ping.  On systems running portmapper,
+         * the v4 ping will fail.  Proceed anyway, but disallow rpcb
+         * v4 upcalls.
+         */
+        clnt4 = rpc_bind_new_program(clnt, &rpcb_program, RPCBVERS_4);
+        if (IS_ERR(clnt4)) {
+                dprintk("RPC:       failed to create local rpcbind v4 "
+                                "cleint (errno %ld).\n", PTR_ERR(clnt4));
+                clnt4 = NULL;
+        }
+
+        rpcb_local_clnt = clnt;
+        rpcb_local_clnt4 = clnt4;
+
+out:
+        mutex_unlock(&rpcb_create_local_mutex);
+        return result;
 }
 
 static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
@@ -209,22 +253,13 @@ static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
         return rpc_create(&args);
 }
 
-static int rpcb_register_call(const u32 version, struct rpc_message *msg)
+static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
 {
-        struct sockaddr *addr = (struct sockaddr *)&rpcb_inaddr_loopback;
-        size_t addrlen = sizeof(rpcb_inaddr_loopback);
-        struct rpc_clnt *rpcb_clnt;
         int result, error = 0;
 
         msg->rpc_resp = &result;
 
-        rpcb_clnt = rpcb_create_local(addr, addrlen, version);
-        if (!IS_ERR(rpcb_clnt)) {
-                error = rpc_call_sync(rpcb_clnt, msg, 0);
-                rpc_shutdown_client(rpcb_clnt);
-        } else
-                error = PTR_ERR(rpcb_clnt);
-
+        error = rpc_call_sync(clnt, msg, RPC_TASK_SOFTCONN);
         if (error < 0) {
                 dprintk("RPC:       failed to contact local rpcbind "
                                 "server (errno %d).\n", -error);
@@ -279,6 +314,11 @@ int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port)
         struct rpc_message msg = {
                 .rpc_argp       = &map,
         };
+        int error;
+
+        error = rpcb_create_local();
+        if (error)
+                return error;
 
         dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
                         "rpcbind\n", (port ? "" : "un"),
@@ -288,7 +328,7 @@ int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port)
         if (port)
                 msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
 
-        return rpcb_register_call(RPCBVERS_2, &msg);
+        return rpcb_register_call(rpcb_local_clnt, &msg);
 }
 
 /*
@@ -313,7 +353,7 @@ static int rpcb_register_inet4(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        result = rpcb_register_call(RPCBVERS_4, msg);
+        result = rpcb_register_call(rpcb_local_clnt4, msg);
         kfree(map->r_addr);
         return result;
 }
@@ -340,7 +380,7 @@ static int rpcb_register_inet6(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        result = rpcb_register_call(RPCBVERS_4, msg);
+        result = rpcb_register_call(rpcb_local_clnt4, msg);
         kfree(map->r_addr);
         return result;
 }
@@ -356,7 +396,7 @@ static int rpcb_unregister_all_protofamilies(struct rpc_message *msg)
         map->r_addr = "";
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
 
-        return rpcb_register_call(RPCBVERS_4, msg);
+        return rpcb_register_call(rpcb_local_clnt4, msg);
 }
 
 /**
@@ -414,6 +454,13 @@ int rpcb_v4_register(const u32 program, const u32 version,
         struct rpc_message msg = {
                 .rpc_argp       = &map,
         };
+        int error;
+
+        error = rpcb_create_local();
+        if (error)
+                return error;
+        if (rpcb_local_clnt4 == NULL)
+                return -EPROTONOSUPPORT;
 
         if (address == NULL)
                 return rpcb_unregister_all_protofamilies(&msg);
@@ -491,7 +538,7 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
                 .rpc_message = &msg,
                 .callback_ops = &rpcb_getport_ops,
                 .callback_data = map,
-                .flags = RPC_TASK_ASYNC,
+                .flags = RPC_TASK_ASYNC | RPC_TASK_SOFTCONN,
         };
 
         return rpc_run_task(&task_setup_data);
@@ -1027,3 +1074,15 @@ static struct rpc_program rpcb_program = {
         .version        = rpcb_version,
         .stats          = &rpcb_stats,
 };
+
+/**
+ * cleanup_rpcb_clnt - remove xprtsock's sysctls, unregister
+ *
+ */
+void cleanup_rpcb_clnt(void)
+{
+        if (rpcb_local_clnt4)
+                rpc_shutdown_client(rpcb_local_clnt4);
+        if (rpcb_local_clnt)
+                rpc_shutdown_client(rpcb_local_clnt);
+}
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index cef74ba0666c..aae6907fd546 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -210,6 +210,7 @@ void rpc_init_priority_wait_queue(struct rpc_wait_queue *queue, const char *qnam
 {
         __rpc_init_priority_wait_queue(queue, qname, RPC_NR_PRIORITY);
 }
+EXPORT_SYMBOL_GPL(rpc_init_priority_wait_queue);
 
 void rpc_init_wait_queue(struct rpc_wait_queue *queue, const char *qname)
 {
@@ -385,6 +386,20 @@ static void rpc_wake_up_task_queue_locked(struct rpc_wait_queue *queue, struct r
 }
 
 /*
+ * Tests whether rpc queue is empty
+ */
+int rpc_queue_empty(struct rpc_wait_queue *queue)
+{
+        int res;
+
+        spin_lock_bh(&queue->lock);
+        res = queue->qlen;
+        spin_unlock_bh(&queue->lock);
+        return (res == 0);
+}
+EXPORT_SYMBOL_GPL(rpc_queue_empty);
+
+/*
  * Wake up a task on a specific queue
  */
 void rpc_wake_up_queued_task(struct rpc_wait_queue *queue, struct rpc_task *task)
diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c
index a661a3acb37e..10b4319ebbca 100644
--- a/net/sunrpc/socklib.c
+++ b/net/sunrpc/socklib.c
@@ -8,6 +8,7 @@
 
 #include <linux/compiler.h>
 #include <linux/netdevice.h>
+#include <linux/gfp.h>
 #include <linux/skbuff.h>
 #include <linux/types.h>
 #include <linux/pagemap.h>
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index 1b4e6791ecf3..5785d2037f45 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include <linux/init.h>
 #include <linux/kernel.h>
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 8cce92189019..f438347d817b 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -24,6 +24,8 @@
 
 extern struct cache_detail ip_map_cache, unix_gid_cache;
 
+extern void cleanup_rpcb_clnt(void);
+
 static int __init
 init_sunrpc(void)
 {
@@ -53,6 +55,7 @@ out:
 static void __exit
 cleanup_sunrpc(void)
 {
+        cleanup_rpcb_clnt();
         rpcauth_remove_module();
         cleanup_socket_xprt();
         svc_cleanup_xprt_sock();
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 952f206ff307..d9017d64597e 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -19,6 +19,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 
 #include <linux/sunrpc/types.h>
 #include <linux/sunrpc/xdr.h>
@@ -133,7 +134,7 @@ svc_pool_map_choose_mode(void)
                 return SVC_POOL_PERNODE;
         }
 
-        node = any_online_node(node_online_map);
+        node = first_online_node;
         if (nr_cpus_node(node) > 2) {
                 /*
                  * Non-trivial SMP, or CONFIG_NUMA on
@@ -506,6 +507,10 @@ svc_init_buffer(struct svc_rqst *rqstp, unsigned int size)
 {
         unsigned int pages, arghi;
 
+        /* bc_xprt uses fore channel allocated buffers */
+        if (svc_is_backchannel(rqstp))
+                return 1;
+
         pages = size / PAGE_SIZE + 1; /* extra page as we hold both request and reply.
                                        * We assume one is at most one page
                                        */
@@ -1103,8 +1108,9 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
                                 procp->pc_release(rqstp, NULL, rqstp->rq_resp);
                         goto dropit;
                 }
-                if (*statp == rpc_success && (xdr = procp->pc_encode)
-                 && !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
+                if (*statp == rpc_success &&
+                    (xdr = procp->pc_encode) &&
+                    !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
                         dprintk("svc: failed to encode reply\n");
                         /* serv->sv_stats->rpcsystemerr++; */
                         *statp = rpc_system_err;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index df124f78ee48..061b2e0f9118 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -9,6 +9,7 @@
 #include <linux/errno.h>
 #include <linux/freezer.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/sunrpc/stats.h>
 #include <linux/sunrpc/svc_xprt.h>
@@ -16,8 +17,6 @@
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
-#define SVC_MAX_WAKING 5
-
 static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt);
 static int svc_deferred_recv(struct svc_rqst *rqstp);
 static struct cache_deferred_req *svc_defer(struct cache_req *req);
@@ -129,8 +128,8 @@ static void svc_xprt_free(struct kref *kref)
         struct svc_xprt *xprt =
                 container_of(kref, struct svc_xprt, xpt_ref);
         struct module *owner = xprt->xpt_class->xcl_owner;
-        if (test_bit(XPT_CACHE_AUTH, &xprt->xpt_flags)
-            && xprt->xpt_auth_cache != NULL)
+        if (test_bit(XPT_CACHE_AUTH, &xprt->xpt_flags) &&
+            xprt->xpt_auth_cache != NULL)
                 svcauth_unix_info_release(xprt->xpt_auth_cache);
         xprt->xpt_ops->xpo_free(xprt);
         module_put(owner);
@@ -175,11 +174,13 @@ static struct svc_xprt *__svc_xpo_create(struct svc_xprt_class *xcl,
                 .sin_addr.s_addr        = htonl(INADDR_ANY),
                 .sin_port               = htons(port),
         };
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         struct sockaddr_in6 sin6 = {
                 .sin6_family            = AF_INET6,
                 .sin6_addr              = IN6ADDR_ANY_INIT,
                 .sin6_port              = htons(port),
         };
+#endif  /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
         struct sockaddr *sap;
         size_t len;
 
@@ -188,10 +189,12 @@ static struct svc_xprt *__svc_xpo_create(struct svc_xprt_class *xcl,
                 sap = (struct sockaddr *)&sin;
                 len = sizeof(sin);
                 break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         case PF_INET6:
                 sap = (struct sockaddr *)&sin6;
                 len = sizeof(sin6);
                 break;
+#endif  /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
         default:
                 return ERR_PTR(-EAFNOSUPPORT);
         }
@@ -233,7 +236,10 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
  err:
         spin_unlock(&svc_xprt_class_lock);
         dprintk("svc: transport %s not found\n", xprt_name);
-        return -ENOENT;
+
+        /* This errno is exposed to user space.  Provide a reasonable
+         * perror msg for a bad transport. */
+        return -EPROTONOSUPPORT;
 }
 EXPORT_SYMBOL_GPL(svc_create_xprt);
 
@@ -306,7 +312,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
         struct svc_pool *pool;
         struct svc_rqst *rqstp;
         int cpu;
-        int thread_avail;
 
         if (!(xprt->xpt_flags &
               ((1<<XPT_CONN)|(1<<XPT_DATA)|(1<<XPT_CLOSE)|(1<<XPT_DEFERRED))))
@@ -318,6 +323,12 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
 
         spin_lock_bh(&pool->sp_lock);
 
+        if (!list_empty(&pool->sp_threads) &&
+            !list_empty(&pool->sp_sockets))
+                printk(KERN_ERR
+                       "svc_xprt_enqueue: "
+                       "threads and transports both waiting??\n");
+
         if (test_bit(XPT_DEAD, &xprt->xpt_flags)) {
                 /* Don't enqueue dead transports */
                 dprintk("svc: transport %p is dead, not enqueued\n", xprt);
@@ -358,15 +369,7 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
         }
 
  process:
-        /* Work out whether threads are available */
-        thread_avail = !list_empty(&pool->sp_threads);  /* threads are asleep */
-        if (pool->sp_nwaking >= SVC_MAX_WAKING) {
-                /* too many threads are runnable and trying to wake up */
-                thread_avail = 0;
-                pool->sp_stats.overloads_avoided++;
-        }
-
-        if (thread_avail) {
+        if (!list_empty(&pool->sp_threads)) {
                 rqstp = list_entry(pool->sp_threads.next,
                                    struct svc_rqst,
                                    rq_list);
@@ -381,8 +384,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
                 svc_xprt_get(xprt);
                 rqstp->rq_reserved = serv->sv_max_mesg;
                 atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
-                rqstp->rq_waking = 1;
-                pool->sp_nwaking++;
                 pool->sp_stats.threads_woken++;
                 BUG_ON(xprt->xpt_pool != pool);
                 wake_up(&rqstp->rq_wait);
@@ -651,11 +652,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 return -EINTR;
 
         spin_lock_bh(&pool->sp_lock);
-        if (rqstp->rq_waking) {
-                rqstp->rq_waking = 0;
-                pool->sp_nwaking--;
-                BUG_ON(pool->sp_nwaking < 0);
-        }
         xprt = svc_xprt_dequeue(pool);
         if (xprt) {
                 rqstp->rq_xprt = xprt;
@@ -711,7 +707,10 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
         spin_unlock_bh(&pool->sp_lock);
 
         len = 0;
-        if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+                dprintk("svc_recv: found XPT_CLOSE\n");
+                svc_delete_xprt(xprt);
+        } else if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
                 struct svc_xprt *newxpt;
                 newxpt = xprt->xpt_ops->xpo_accept(xprt);
                 if (newxpt) {
@@ -737,7 +736,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                         svc_xprt_received(newxpt);
                 }
                 svc_xprt_received(xprt);
-        } else if (!test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+        } else {
                 dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
                         rqstp, pool->sp_id, xprt,
                         atomic_read(&xprt->xpt_ref.refcount));
@@ -750,11 +749,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 dprintk("svc: got len=%d\n", len);
         }
 
-        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
-                dprintk("svc_recv: found XPT_CLOSE\n");
-                svc_delete_xprt(xprt);
-        }
-
         /* No data, incomplete (TCP) read, or accept() */
         if (len == 0 || len == -EAGAIN) {
                 rqstp->rq_res.len = 0;
@@ -846,8 +840,8 @@ static void svc_age_temp_xprts(unsigned long closure)
                  * through, close it. */
                 if (!test_and_set_bit(XPT_OLD, &xprt->xpt_flags))
                         continue;
-                if (atomic_read(&xprt->xpt_ref.refcount) > 1
-                    || test_bit(XPT_BUSY, &xprt->xpt_flags))
+                if (atomic_read(&xprt->xpt_ref.refcount) > 1 ||
+                    test_bit(XPT_BUSY, &xprt->xpt_flags))
                         continue;
                 svc_xprt_get(xprt);
                 list_move(le, &to_be_aged);
@@ -900,11 +894,8 @@ void svc_delete_xprt(struct svc_xprt *xprt)
         if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                 serv->sv_tmpcnt--;
 
-        for (dr = svc_deferred_dequeue(xprt); dr;
-             dr = svc_deferred_dequeue(xprt)) {
-                svc_xprt_put(xprt);
+        while ((dr = svc_deferred_dequeue(xprt)) != NULL)
                 kfree(dr);
-        }
 
         svc_xprt_put(xprt);
         spin_unlock_bh(&serv->sv_lock);
@@ -1204,16 +1195,15 @@ static int svc_pool_stats_show(struct seq_file *m, void *p)
         struct svc_pool *pool = p;
 
         if (p == SEQ_START_TOKEN) {
-                seq_puts(m, "# pool packets-arrived sockets-enqueued threads-woken overloads-avoided threads-timedout\n");
+                seq_puts(m, "# pool packets-arrived sockets-enqueued threads-woken threads-timedout\n");
                 return 0;
         }
 
-        seq_printf(m, "%u %lu %lu %lu %lu %lu\n",
+        seq_printf(m, "%u %lu %lu %lu %lu\n",
                 pool->sp_id,
                 pool->sp_stats.packets,
                 pool->sp_stats.sockets_queued,
                 pool->sp_stats.threads_woken,
-                pool->sp_stats.overloads_avoided,
                 pool->sp_stats.threads_timedout);
 
         return 0;
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index e64109b02aee..4e9393c24687 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -46,8 +46,8 @@ svc_authenticate(struct svc_rqst *rqstp, __be32 *authp)
         dprintk("svc: svc_authenticate (%d)\n", flavor);
 
         spin_lock(&authtab_lock);
-        if (flavor >= RPC_AUTH_MAXFLAVOR || !(aops = authtab[flavor])
-                        || !try_module_get(aops->owner)) {
+        if (flavor >= RPC_AUTH_MAXFLAVOR || !(aops = authtab[flavor]) ||
+            !try_module_get(aops->owner)) {
                 spin_unlock(&authtab_lock);
                 *authp = rpc_autherr_badcred;
                 return SVC_DENIED;
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 117f68a8aa40..207311610988 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -10,11 +10,13 @@
 #include <linux/seq_file.h>
 #include <linux/hash.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/ipv6.h>
 #include <linux/kernel.h>
 #define RPCDBG_FACILITY RPCDBG_AUTH
 
+#include <linux/sunrpc/clnt.h>
 
 /*
  * AUTHUNIX and AUTHNULL credentials are both handled here.
@@ -125,8 +127,8 @@ static int ip_map_match(struct cache_head *corig, struct cache_head *cnew)
 {
         struct ip_map *orig = container_of(corig, struct ip_map, h);
         struct ip_map *new = container_of(cnew, struct ip_map, h);
-        return strcmp(orig->m_class, new->m_class) == 0
-                && ipv6_addr_equal(&orig->m_addr, &new->m_addr);
+        return strcmp(orig->m_class, new->m_class) == 0 &&
+               ipv6_addr_equal(&orig->m_addr, &new->m_addr);
 }
 static void ip_map_init(struct cache_head *cnew, struct cache_head *citem)
 {
@@ -187,10 +189,13 @@ static int ip_map_parse(struct cache_detail *cd,
          * for scratch: */
         char *buf = mesg;
         int len;
-        int b1, b2, b3, b4, b5, b6, b7, b8;
-        char c;
         char class[8];
-        struct in6_addr addr;
+        union {
+                struct sockaddr         sa;
+                struct sockaddr_in      s4;
+                struct sockaddr_in6     s6;
+        } address;
+        struct sockaddr_in6 sin6;
         int err;
 
         struct ip_map *ipmp;
@@ -209,24 +214,24 @@ static int ip_map_parse(struct cache_detail *cd,
         len = qword_get(&mesg, buf, mlen);
         if (len <= 0) return -EINVAL;
 
-        if (sscanf(buf, "%u.%u.%u.%u%c", &b1, &b2, &b3, &b4, &c) == 4) {
-                addr.s6_addr32[0] = 0;
-                addr.s6_addr32[1] = 0;
-                addr.s6_addr32[2] = htonl(0xffff);
-                addr.s6_addr32[3] =
-                        htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
-       } else if (sscanf(buf, "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x%c",
-                        &b1, &b2, &b3, &b4, &b5, &b6, &b7, &b8, &c) == 8) {
-                addr.s6_addr16[0] = htons(b1);
-                addr.s6_addr16[1] = htons(b2);
-                addr.s6_addr16[2] = htons(b3);
-                addr.s6_addr16[3] = htons(b4);
-                addr.s6_addr16[4] = htons(b5);
-                addr.s6_addr16[5] = htons(b6);
-                addr.s6_addr16[6] = htons(b7);
-                addr.s6_addr16[7] = htons(b8);
-       } else
+        if (rpc_pton(buf, len, &address.sa, sizeof(address)) == 0)
+                return -EINVAL;
+        switch (address.sa.sa_family) {
+        case AF_INET:
+                /* Form a mapped IPv4 address in sin6 */
+                memset(&sin6, 0, sizeof(sin6));
+                sin6.sin6_family = AF_INET6;
+                sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
+                sin6.sin6_addr.s6_addr32[3] = address.s4.sin_addr.s_addr;
+                break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case AF_INET6:
+                memcpy(&sin6, &address.s6, sizeof(sin6));
+                break;
+#endif
+        default:
                 return -EINVAL;
+        }
 
         expiry = get_expiry(&mesg);
         if (expiry ==0)
@@ -243,7 +248,8 @@ static int ip_map_parse(struct cache_detail *cd,
         } else
                 dom = NULL;
 
-        ipmp = ip_map_lookup(class, &addr);
+        /* IPv6 scope IDs are ignored for now */
+        ipmp = ip_map_lookup(class, &sin6.sin6_addr);
         if (ipmp) {
                 err = ip_map_update(ipmp,
                              container_of(dom, struct unix_domain, h),
@@ -619,7 +625,7 @@ static int unix_gid_show(struct seq_file *m,
         else
                 glen = 0;
 
-        seq_printf(m, "%d %d:", ug->uid, glen);
+        seq_printf(m, "%u %d:", ug->uid, glen);
         for (i = 0; i < glen; i++)
                 seq_printf(m, " %d", GROUP_AT(ug->gi, i));
         seq_printf(m, "\n");
@@ -655,23 +661,25 @@ static struct unix_gid *unix_gid_lookup(uid_t uid)
                 return NULL;
 }
 
-static int unix_gid_find(uid_t uid, struct group_info **gip,
-                         struct svc_rqst *rqstp)
+static struct group_info *unix_gid_find(uid_t uid, struct svc_rqst *rqstp)
 {
-        struct unix_gid *ug = unix_gid_lookup(uid);
+        struct unix_gid *ug;
+        struct group_info *gi;
+        int ret;
+
+        ug = unix_gid_lookup(uid);
         if (!ug)
-                return -EAGAIN;
-        switch (cache_check(&unix_gid_cache, &ug->h, &rqstp->rq_chandle)) {
+                return ERR_PTR(-EAGAIN);
+        ret = cache_check(&unix_gid_cache, &ug->h, &rqstp->rq_chandle);
+        switch (ret) {
         case -ENOENT:
-                *gip = NULL;
-                return 0;
+                return ERR_PTR(-ENOENT);
         case 0:
-                *gip = ug->gi;
-                get_group_info(*gip);
+                gi = get_group_info(ug->gi);
                 cache_put(&ug->h, &unix_gid_cache);
-                return 0;
+                return gi;
         default:
-                return -EAGAIN;
+                return ERR_PTR(-EAGAIN);
         }
 }
 
@@ -681,13 +689,14 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
         struct sockaddr_in *sin;
         struct sockaddr_in6 *sin6, sin6_storage;
         struct ip_map *ipm;
+        struct group_info *gi;
+        struct svc_cred *cred = &rqstp->rq_cred;
 
         switch (rqstp->rq_addr.ss_family) {
         case AF_INET:
                 sin = svc_addr_in(rqstp);
                 sin6 = &sin6_storage;
-                ipv6_addr_set(&sin6->sin6_addr, 0, 0,
-                                htonl(0x0000FFFF), sin->sin_addr.s_addr);
+                ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, &sin6->sin6_addr);
                 break;
         case AF_INET6:
                 sin6 = svc_addr_in6(rqstp);
@@ -722,6 +731,17 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
                         ip_map_cached_put(rqstp, ipm);
                         break;
         }
+
+        gi = unix_gid_find(cred->cr_uid, rqstp);
+        switch (PTR_ERR(gi)) {
+        case -EAGAIN:
+                return SVC_DROP;
+        case -ENOENT:
+                break;
+        default:
+                put_group_info(cred->cr_group_info);
+                cred->cr_group_info = gi;
+        }
         return SVC_OK;
 }
 
@@ -818,19 +838,11 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
         slen = svc_getnl(argv);                 /* gids length */
         if (slen > 16 || (len -= (slen + 2)*4) < 0)
                 goto badcred;
-        if (unix_gid_find(cred->cr_uid, &cred->cr_group_info, rqstp)
-            == -EAGAIN)
+        cred->cr_group_info = groups_alloc(slen);
+        if (cred->cr_group_info == NULL)
                 return SVC_DROP;
-        if (cred->cr_group_info == NULL) {
-                cred->cr_group_info = groups_alloc(slen);
-                if (cred->cr_group_info == NULL)
-                        return SVC_DROP;
-                for (i = 0; i < slen; i++)
-                        GROUP_AT(cred->cr_group_info, i) = svc_getnl(argv);
-        } else {
-                for (i = 0; i < slen ; i++)
-                        svc_getnl(argv);
-        }
+        for (i = 0; i < slen; i++)
+                GROUP_AT(cred->cr_group_info, i) = svc_getnl(argv);
         if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) {
                 *authp = rpc_autherr_badverf;
                 return SVC_DENIED;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 1c246a4f491e..a29f259204e6 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -272,14 +272,14 @@ static int svc_one_sock_name(struct svc_sock *svsk, char *buf, int remaining)
         case PF_INET:
                 len = snprintf(buf, remaining, "ipv4 %s %pI4 %d\n",
                                 proto_name,
-                                &inet_sk(sk)->rcv_saddr,
-                                inet_sk(sk)->num);
+                                &inet_sk(sk)->inet_rcv_saddr,
+                                inet_sk(sk)->inet_num);
                 break;
         case PF_INET6:
                 len = snprintf(buf, remaining, "ipv6 %s %pI6 %d\n",
                                 proto_name,
                                 &inet6_sk(sk)->rcv_saddr,
-                                inet_sk(sk)->num);
+                                inet_sk(sk)->inet_num);
                 break;
         default:
                 len = snprintf(buf, remaining, "*unknown-%d*\n",
@@ -968,6 +968,7 @@ static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
         return len;
  err_delete:
         set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
+        svc_xprt_received(&svsk->sk_xprt);
  err_again:
         return -EAGAIN;
 }
@@ -1311,7 +1312,7 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
         /* Register socket with portmapper */
         if (*errp >= 0 && pmap_register)
                 *errp = svc_register(serv, inet->sk_family, inet->sk_protocol,
-                                     ntohs(inet_sk(inet)->sport));
+                                     ntohs(inet_sk(inet)->inet_sport));
 
         if (*errp < 0) {
                 kfree(svsk);
@@ -1357,7 +1358,7 @@ int svc_addsock(struct svc_serv *serv, const int fd, char *name_return,
 
         if (!so)
                 return err;
-        if (so->sk->sk_family != AF_INET)
+        if ((so->sk->sk_family != PF_INET) && (so->sk->sk_family != PF_INET6))
                 err =  -EAFNOSUPPORT;
         else if (so->sk->sk_protocol != IPPROTO_TCP &&
             so->sk->sk_protocol != IPPROTO_UDP)
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index 42f9748ae093..e65dcc613339 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -139,46 +139,45 @@ static ctl_table debug_table[] = {
                 .data           = &rpc_debug,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dodebug
+                .proc_handler   = proc_dodebug
         },
         {
                 .procname       = "nfs_debug",
                 .data           = &nfs_debug,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dodebug
+                .proc_handler   = proc_dodebug
         },
         {
                 .procname       = "nfsd_debug",
                 .data           = &nfsd_debug,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dodebug
+                .proc_handler   = proc_dodebug
         },
         {
                 .procname       = "nlm_debug",
                 .data           = &nlm_debug,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dodebug
+                .proc_handler   = proc_dodebug
         },
         {
                 .procname       = "transports",
                 .maxlen         = 256,
                 .mode           = 0444,
-                .proc_handler   = &proc_do_xprt,
+                .proc_handler   = proc_do_xprt,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static ctl_table sunrpc_table[] = {
         {
-                .ctl_name       = CTL_SUNRPC,
                 .procname       = "sunrpc",
                 .mode           = 0555,
                 .child          = debug_table
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 #endif
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 8bd690c48b69..2763fde88499 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index fd46d42afa89..42f09ade0044 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -46,6 +46,7 @@
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/metrics.h>
+#include <linux/sunrpc/bc_xprt.h>
 
 #include "sunrpc.h"
 
@@ -700,6 +701,10 @@ void xprt_connect(struct rpc_task *task)
         }
         if (!xprt_lock_write(xprt, task))
                 return;
+
+        if (test_and_clear_bit(XPRT_CLOSE_WAIT, &xprt->state))
+                xprt->ops->close(xprt);
+
         if (xprt_connected(xprt))
                 xprt_release_write(xprt, task);
         else {
@@ -1028,21 +1033,16 @@ void xprt_release(struct rpc_task *task)
         if (req->rq_release_snd_buf)
                 req->rq_release_snd_buf(req);
 
-        /*
-         * Early exit if this is a backchannel preallocated request.
-         * There is no need to have it added to the RPC slot list.
-         */
-        if (is_bc_request)
-                return;
-
-        memset(req, 0, sizeof(*req));   /* mark unused */
-
         dprintk("RPC: %5u release request %p\n", task->tk_pid, req);
+        if (likely(!is_bc_request)) {
+                memset(req, 0, sizeof(*req));   /* mark unused */
 
-        spin_lock(&xprt->reserve_lock);
-        list_add(&req->rq_list, &xprt->free);
-        rpc_wake_up_next(&xprt->backlog);
-        spin_unlock(&xprt->reserve_lock);
+                spin_lock(&xprt->reserve_lock);
+                list_add(&req->rq_list, &xprt->free);
+                rpc_wake_up_next(&xprt->backlog);
+                spin_unlock(&xprt->reserve_lock);
+        } else
+                xprt_free_bc_request(req);
 }
 
 /**
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index 35fb68b9c8ec..d718b8fa9525 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -40,6 +40,7 @@
  */
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/sysctl.h>
 #include <linux/sunrpc/clnt.h>
@@ -120,8 +121,7 @@ static ctl_table svcrdma_parm_table[] = {
                 .data           = &svcrdma_max_requests,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &min_max_requests,
                 .extra2         = &max_max_requests
         },
@@ -130,8 +130,7 @@ static ctl_table svcrdma_parm_table[] = {
                 .data           = &svcrdma_max_req_size,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &min_max_inline,
                 .extra2         = &max_max_inline
         },
@@ -140,8 +139,7 @@ static ctl_table svcrdma_parm_table[] = {
                 .data           = &svcrdma_ord,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &min_ord,
                 .extra2         = &max_ord,
         },
@@ -151,67 +149,65 @@ static ctl_table svcrdma_parm_table[] = {
                 .data           = &rdma_stat_read,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_recv",
                 .data           = &rdma_stat_recv,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_write",
                 .data           = &rdma_stat_write,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_sq_starve",
                 .data           = &rdma_stat_sq_starve,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_rq_starve",
                 .data           = &rdma_stat_rq_starve,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_rq_poll",
                 .data           = &rdma_stat_rq_poll,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_rq_prod",
                 .data           = &rdma_stat_rq_prod,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_sq_poll",
                 .data           = &rdma_stat_sq_poll,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
+                .proc_handler   = read_reset_stat,
         },
         {
                 .procname       = "rdma_stat_sq_prod",
                 .data           = &rdma_stat_sq_prod,
                 .maxlen         = sizeof(atomic_t),
                 .mode           = 0644,
-                .proc_handler   = &read_reset_stat,
-        },
-        {
-                .ctl_name = 0,
+                .proc_handler   = read_reset_stat,
         },
+        { },
 };
 
 static ctl_table svcrdma_table[] = {
@@ -220,21 +216,16 @@ static ctl_table svcrdma_table[] = {
                 .mode           = 0555,
                 .child          = svcrdma_parm_table
         },
-        {
-                .ctl_name = 0,
-        },
+        { },
 };
 
 static ctl_table svcrdma_root_table[] = {
         {
-                .ctl_name       = CTL_SUNRPC,
                 .procname       = "sunrpc",
                 .mode           = 0555,
                 .child          = svcrdma_table
         },
-        {
-                .ctl_name = 0,
-        },
+        { },
 };
 
 void svc_rdma_cleanup(void)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 9e884383134f..f92e37eb413c 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -337,10 +337,9 @@ static int rdma_set_ctxt_sge(struct svcxprt_rdma *xprt,
 
 static int rdma_read_max_sge(struct svcxprt_rdma *xprt, int sge_count)
 {
-        if ((RDMA_TRANSPORT_IWARP ==
-             rdma_node_get_transport(xprt->sc_cm_id->
-                                     device->node_type))
-            && sge_count > 1)
+        if ((rdma_node_get_transport(xprt->sc_cm_id->device->node_type) ==
+             RDMA_TRANSPORT_IWARP) &&
+            sge_count > 1)
                 return 1;
         else
                 return min_t(int, sge_count, xprt->sc_max_sge);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index f11be72a1a80..b15e1ebb2bfa 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -54,7 +54,7 @@
  * Assumptions:
  * - head[0] is physically contiguous.
  * - tail[0] is physically contiguous.
- * - pages[] is not physically or virtually contigous and consists of
+ * - pages[] is not physically or virtually contiguous and consists of
  *   PAGE_SIZE elements.
  *
  * Output:
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 3fa5751af0ec..edea15a54e51 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -43,6 +43,7 @@
 #include <linux/sunrpc/debug.h>
 #include <linux/sunrpc/rpc_rdma.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
@@ -678,7 +679,10 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
         int ret;
 
         dprintk("svcrdma: Creating RDMA socket\n");
-
+        if (sa->sa_family != AF_INET) {
+                dprintk("svcrdma: Address family %d is not supported.\n", sa->sa_family);
+                return ERR_PTR(-EAFNOSUPPORT);
+        }
         cma_xprt = rdma_create_xprt(serv, 1);
         if (!cma_xprt)
                 return ERR_PTR(-ENOMEM);
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 9a63f669ece4..187257b1d880 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -49,6 +49,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/seq_file.h>
 
 #include "xprt_rdma.h"
@@ -86,79 +87,63 @@ static struct ctl_table_header *sunrpc_table_header;
 
 static ctl_table xr_tunables_table[] = {
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rdma_slot_table_entries",
                 .data           = &xprt_rdma_slot_table_entries,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &min_slot_table_size,
                 .extra2         = &max_slot_table_size
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rdma_max_inline_read",
                 .data           = &xprt_rdma_max_inline_read,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rdma_max_inline_write",
                 .data           = &xprt_rdma_max_inline_write,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rdma_inline_write_padding",
                 .data           = &xprt_rdma_inline_write_padding,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &zero,
                 .extra2         = &max_padding,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rdma_memreg_strategy",
                 .data           = &xprt_rdma_memreg_strategy,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &min_memreg,
                 .extra2         = &max_memreg,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rdma_pad_optimize",
                 .data           = &xprt_rdma_pad_optimize,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name = 0,
+                .proc_handler   = proc_dointvec,
         },
+        { },
 };
 
 static ctl_table sunrpc_table[] = {
         {
-                .ctl_name       = CTL_SUNRPC,
                 .procname       = "sunrpc",
                 .mode           = 0555,
                 .child          = xr_tunables_table
         },
-        {
-                .ctl_name = 0,
-        },
+        { },
 };
 
 #endif
@@ -176,16 +161,15 @@ xprt_rdma_format_addresses(struct rpc_xprt *xprt)
         (void)rpc_ntop(sap, buf, sizeof(buf));
         xprt->address_strings[RPC_DISPLAY_ADDR] = kstrdup(buf, GFP_KERNEL);
 
-        (void)snprintf(buf, sizeof(buf), "%u", rpc_get_port(sap));
+        snprintf(buf, sizeof(buf), "%u", rpc_get_port(sap));
         xprt->address_strings[RPC_DISPLAY_PORT] = kstrdup(buf, GFP_KERNEL);
 
         xprt->address_strings[RPC_DISPLAY_PROTO] = "rdma";
 
-        (void)snprintf(buf, sizeof(buf), "%02x%02x%02x%02x",
-                                NIPQUAD(sin->sin_addr.s_addr));
+        snprintf(buf, sizeof(buf), "%08x", ntohl(sin->sin_addr.s_addr));
         xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = kstrdup(buf, GFP_KERNEL);
 
-        (void)snprintf(buf, sizeof(buf), "%4hx", rpc_get_port(sap));
+        snprintf(buf, sizeof(buf), "%4hx", rpc_get_port(sap));
         xprt->address_strings[RPC_DISPLAY_HEX_PORT] = kstrdup(buf, GFP_KERNEL);
 
         /* netid */
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 465aafc2007f..27015c6d8eb5 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -48,6 +48,7 @@
  */
 
 #include <linux/pci.h>  /* for Tavor hack below */
+#include <linux/slab.h>
 
 #include "xprt_rdma.h"
 
@@ -878,8 +879,8 @@ if (strnicmp(ia->ri_id->device->dma_device->bus->name, "pci", 3) == 0) {
          * others indicate a transport condition which has already
          * undergone a best-effort.
          */
-        if (ep->rep_connected == -ECONNREFUSED
-            && ++retry_count <= RDMA_CONNECT_RETRY_MAX) {
+        if (ep->rep_connected == -ECONNREFUSED &&
+            ++retry_count <= RDMA_CONNECT_RETRY_MAX) {
                 dprintk("RPC:       %s: non-peer_reject, retry\n", __func__);
                 goto retry;
         }
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 37c5475ba258..9847c30b5001 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -81,46 +81,38 @@ static struct ctl_table_header *sunrpc_table_header;
  */
 static ctl_table xs_tunables_table[] = {
         {
-                .ctl_name       = CTL_SLOTTABLE_UDP,
                 .procname       = "udp_slot_table_entries",
                 .data           = &xprt_udp_slot_table_entries,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &min_slot_table_size,
                 .extra2         = &max_slot_table_size
         },
         {
-                .ctl_name       = CTL_SLOTTABLE_TCP,
                 .procname       = "tcp_slot_table_entries",
                 .data           = &xprt_tcp_slot_table_entries,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &min_slot_table_size,
                 .extra2         = &max_slot_table_size
         },
         {
-                .ctl_name       = CTL_MIN_RESVPORT,
                 .procname       = "min_resvport",
                 .data           = &xprt_min_resvport,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &xprt_min_resvport_limit,
                 .extra2         = &xprt_max_resvport_limit
         },
         {
-                .ctl_name       = CTL_MAX_RESVPORT,
                 .procname       = "max_resvport",
                 .data           = &xprt_max_resvport,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &xprt_min_resvport_limit,
                 .extra2         = &xprt_max_resvport_limit
         },
@@ -129,24 +121,18 @@ static ctl_table xs_tunables_table[] = {
                 .data           = &xs_tcp_fin_timeout,
                 .maxlen         = sizeof(xs_tcp_fin_timeout),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
-        },
-        {
-                .ctl_name = 0,
+                .proc_handler   = proc_dointvec_jiffies,
         },
+        { },
 };
 
 static ctl_table sunrpc_table[] = {
         {
-                .ctl_name       = CTL_SUNRPC,
                 .procname       = "sunrpc",
                 .mode           = 0555,
                 .child          = xs_tunables_table
         },
-        {
-                .ctl_name = 0,
-        },
+        { },
 };
 
 #endif
@@ -311,12 +297,11 @@ static void xs_format_common_peer_addresses(struct rpc_xprt *xprt)
         switch (sap->sa_family) {
         case AF_INET:
                 sin = xs_addr_in(xprt);
-                (void)snprintf(buf, sizeof(buf), "%02x%02x%02x%02x",
-                                        NIPQUAD(sin->sin_addr.s_addr));
+                snprintf(buf, sizeof(buf), "%08x", ntohl(sin->sin_addr.s_addr));
                 break;
         case AF_INET6:
                 sin6 = xs_addr_in6(xprt);
-                (void)snprintf(buf, sizeof(buf), "%pi6", &sin6->sin6_addr);
+                snprintf(buf, sizeof(buf), "%pi6", &sin6->sin6_addr);
                 break;
         default:
                 BUG();
@@ -329,10 +314,10 @@ static void xs_format_common_peer_ports(struct rpc_xprt *xprt)
         struct sockaddr *sap = xs_addr(xprt);
         char buf[128];
 
-        (void)snprintf(buf, sizeof(buf), "%u", rpc_get_port(sap));
+        snprintf(buf, sizeof(buf), "%u", rpc_get_port(sap));
         xprt->address_strings[RPC_DISPLAY_PORT] = kstrdup(buf, GFP_KERNEL);
 
-        (void)snprintf(buf, sizeof(buf), "%4hx", rpc_get_port(sap));
+        snprintf(buf, sizeof(buf), "%4hx", rpc_get_port(sap));
         xprt->address_strings[RPC_DISPLAY_HEX_PORT] = kstrdup(buf, GFP_KERNEL);
 }
 
@@ -563,8 +548,6 @@ static int xs_udp_send_request(struct rpc_task *task)
                 /* Still some bytes left; set up for a retry later. */
                 status = -EAGAIN;
         }
-        if (!transport->sock)
-                goto out;
 
         switch (status) {
         case -ENOTSOCK:
@@ -584,7 +567,7 @@ static int xs_udp_send_request(struct rpc_task *task)
                  * prompts ECONNREFUSED. */
                 clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
         }
-out:
+
         return status;
 }
 
@@ -666,8 +649,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
                 status = -EAGAIN;
                 break;
         }
-        if (!transport->sock)
-                goto out;
 
         switch (status) {
         case -ENOTSOCK:
@@ -687,7 +668,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
         case -ENOTCONN:
                 clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
         }
-out:
+
         return status;
 }
 
@@ -1926,6 +1907,11 @@ static void xs_tcp_setup_socket(struct rpc_xprt *xprt,
         case -EALREADY:
                 xprt_clear_connecting(xprt);
                 return;
+        case -EINVAL:
+                /* Happens, for instance, if the user specified a link
+                 * local IPv6 address without a scope-id.
+                 */
+                goto out;
         }
 out_eagain:
         status = -EAGAIN;
@@ -2033,7 +2019,7 @@ static void xs_connect(struct rpc_task *task)
         if (xprt_test_and_set_connecting(xprt))
                 return;
 
-        if (transport->sock != NULL) {
+        if (transport->sock != NULL && !RPC_IS_SOFTCONN(task)) {
                 dprintk("RPC:       xs_connect delayed xprt %p for %lu "
                                 "seconds\n",
                                 xprt, xprt->reestablish_timeout / HZ);
@@ -2114,7 +2100,7 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
  * we allocate pages instead doing a kmalloc like rpc_malloc is because we want
  * to use the server side send routines.
  */
-void *bc_malloc(struct rpc_task *task, size_t size)
+static void *bc_malloc(struct rpc_task *task, size_t size)
 {
         struct page *page;
         struct rpc_buffer *buf;
@@ -2134,7 +2120,7 @@ void *bc_malloc(struct rpc_task *task, size_t size)
 /*
  * Free the space allocated in the bc_alloc routine
  */
-void bc_free(void *buffer)
+static void bc_free(void *buffer)
 {
         struct rpc_buffer *buf;
 
@@ -2265,9 +2251,6 @@ static struct rpc_xprt_ops xs_tcp_ops = {
         .buf_free               = rpc_free,
         .send_request           = xs_tcp_send_request,
         .set_retrans_timeout    = xprt_set_retrans_timeout_def,
-#if defined(CONFIG_NFS_V4_1)
-        .release_request        = bc_release_request,
-#endif /* CONFIG_NFS_V4_1 */
         .close                  = xs_tcp_close,
         .destroy                = xs_destroy,
         .print_stats            = xs_tcp_print_stats,
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 0b15d7250c40..53196009160a 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -71,7 +71,7 @@ static struct ctl_table_root net_sysctl_ro_root = {
         .permissions = net_ctl_ro_header_perms,
 };
 
-static int sysctl_net_init(struct net *net)
+static int __net_init sysctl_net_init(struct net *net)
 {
         setup_sysctl_set(&net->sysctls,
                          &net_sysctl_ro_root.default_set,
@@ -79,7 +79,7 @@ static int sysctl_net_init(struct net *net)
         return 0;
 }
 
-static void sysctl_net_exit(struct net *net)
+static void __net_exit sysctl_net_exit(struct net *net)
 {
         WARN_ON(!list_empty(&net->sysctls.list));
         return;
diff --git a/net/tipc/Kconfig b/net/tipc/Kconfig
index 3b30d1130b61..b74f78d0c033 100644
--- a/net/tipc/Kconfig
+++ b/net/tipc/Kconfig
@@ -10,7 +10,7 @@ menuconfig TIPC
           specially designed for intra cluster communication. This protocol
           originates from Ericsson where it has been used in carrier grade
           cluster applications for many years.
-        
+
           For more information about TIPC, see http://tipc.sourceforge.net.
 
           This protocol support is also available as a module ( = code which
@@ -23,91 +23,76 @@ menuconfig TIPC
 if TIPC
 
 config TIPC_ADVANCED
-        bool "TIPC: Advanced configuration"
+        bool "Advanced TIPC configuration"
         default n
         help
-          Saying Y here will open some advanced configuration
-          for TIPC. Most users do not need to bother, so if
-          unsure, just say N.
+          Saying Y here will open some advanced configuration for TIPC.
+          Most users do not need to bother; if unsure, just say N.
 
 config TIPC_ZONES
-        int "Maximum number of zones in network"
+        int "Maximum number of zones in a network"
         depends on TIPC_ADVANCED
+        range 1 255
         default "3"
         help
-         Max number of zones inside TIPC network. Max supported value 
-         is 255 zones, minimum is 1
+          Specifies how many zones can be supported in a TIPC network.
+          Can range from 1 to 255 zones; default is 3.
 
-         Default is 3 zones in a network; setting this to higher
-         allows more zones but might use more memory.
+          Setting this to a smaller value saves some memory;
+          setting it to a higher value allows for more zones.
 
 config TIPC_CLUSTERS
         int "Maximum number of clusters in a zone"
         depends on TIPC_ADVANCED
+        range 1 1
         default "1"
         help
-          ***Only 1 (one cluster in a zone) is supported by current code.
-          Any value set here will be overridden.***
-
-          (Max number of clusters inside TIPC zone. Max supported 
-          value is 4095 clusters, minimum is 1.
+          Specifies how many clusters can be supported in a TIPC zone.
 
-          Default is 1; setting this to smaller value might save 
-          some memory, setting it to higher
-          allows more clusters and might consume more memory.)
+          *** Currently TIPC only supports a single cluster per zone. ***
 
 config TIPC_NODES
-        int "Maximum number of nodes in cluster"
+        int "Maximum number of nodes in a cluster"
         depends on TIPC_ADVANCED
+        range 8 2047
         default "255"
         help
-          Maximum number of nodes inside a TIPC cluster. Maximum 
-          supported value is 2047 nodes, minimum is 8. 
-
-          Setting this to a smaller value saves some memory, 
-          setting it to higher allows more nodes.
-
-config TIPC_SLAVE_NODES
-        int "Maximum number of slave nodes in cluster"
-        depends on TIPC_ADVANCED
-        default "0"
-        help
-          ***This capability is not supported by current code.***
-          
-          Maximum number of slave nodes inside a TIPC cluster. Maximum 
-          supported value is 2047 nodes, minimum is 0. 
+          Specifies how many nodes can be supported in a TIPC cluster.
+          Can range from 8 to 2047 nodes; default is 255.
 
-          Setting this to a smaller value saves some memory, 
-          setting it to higher allows more nodes.
+          Setting this to a smaller value saves some memory;
+          setting it to higher allows for more nodes.
 
 config TIPC_PORTS
         int "Maximum number of ports in a node"
         depends on TIPC_ADVANCED
+        range 127 65535
         default "8191"
         help
-          Maximum number of ports within a node. Maximum 
-          supported value is 64535 nodes, minimum is 127. 
+          Specifies how many ports can be supported by a node.
+          Can range from 127 to 65535 ports; default is 8191.
 
           Setting this to a smaller value saves some memory, 
-          setting it to higher allows more ports.
+          setting it to higher allows for more ports.
 
 config TIPC_LOG
         int "Size of log buffer"
         depends on TIPC_ADVANCED
-        default 0
+        range 0 32768
+        default "0"
         help
-          Size (in bytes) of TIPC's internal log buffer, which records the
-          occurrence of significant events.  Maximum supported value
-          is 32768 bytes, minimum is 0.
+          Size (in bytes) of TIPC's internal log buffer, which records the
+          occurrence of significant events.  Can range from 0 to 32768 bytes;
+          default is 0.
 
           There is no need to enable the log buffer unless the node will be
           managed remotely via TIPC.
 
 config TIPC_DEBUG
-        bool "Enable debugging support"
+        bool "Enable debug messages"
         default n
         help
-          This will enable debugging of TIPC.
+          This enables debugging of TIPC.
 
           Only say Y here if you are having trouble with TIPC.  It will
           enable the display of detailed information about what is going on.
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 327011fcc407..78091375ca12 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -45,10 +45,10 @@
 
 #define MAX_ADDR_STR 32
 
-static struct media *media_list = NULL;
+static struct media media_list[MAX_MEDIA];
 static u32 media_count = 0;
 
-struct bearer *tipc_bearers = NULL;
+struct bearer tipc_bearers[MAX_BEARERS];
 
 /**
  * media_name_valid - validate media name
@@ -108,9 +108,11 @@ int  tipc_register_media(u32 media_type,
         int res = -EINVAL;
 
         write_lock_bh(&tipc_net_lock);
-        if (!media_list)
-                goto exit;
 
+        if (tipc_mode != TIPC_NET_MODE) {
+                warn("Media <%s> rejected, not in networked mode yet\n", name);
+                goto exit;
+        }
         if (!media_name_valid(name)) {
                 warn("Media <%s> rejected, illegal name\n", name);
                 goto exit;
@@ -660,33 +662,10 @@ int tipc_disable_bearer(const char *name)
 
 
 
-int tipc_bearer_init(void)
-{
-        int res;
-
-        write_lock_bh(&tipc_net_lock);
-        tipc_bearers = kcalloc(MAX_BEARERS, sizeof(struct bearer), GFP_ATOMIC);
-        media_list = kcalloc(MAX_MEDIA, sizeof(struct media), GFP_ATOMIC);
-        if (tipc_bearers && media_list) {
-                res = 0;
-        } else {
-                kfree(tipc_bearers);
-                kfree(media_list);
-                tipc_bearers = NULL;
-                media_list = NULL;
-                res = -ENOMEM;
-        }
-        write_unlock_bh(&tipc_net_lock);
-        return res;
-}
-
 void tipc_bearer_stop(void)
 {
         u32 i;
 
-        if (!tipc_bearers)
-                return;
-
         for (i = 0; i < MAX_BEARERS; i++) {
                 if (tipc_bearers[i].active)
                         tipc_bearers[i].publ.blocked = 1;
@@ -695,10 +674,6 @@ void tipc_bearer_stop(void)
                 if (tipc_bearers[i].active)
                         bearer_disable(tipc_bearers[i].publ.name);
         }
-        kfree(tipc_bearers);
-        kfree(media_list);
-        tipc_bearers = NULL;
-        media_list = NULL;
         media_count = 0;
 }
 
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index ca5734892713..000228e93f9e 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -114,7 +114,7 @@ struct bearer_name {
 
 struct link;
 
-extern struct bearer *tipc_bearers;
+extern struct bearer tipc_bearers[];
 
 void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a);
 struct sk_buff *tipc_media_get_names(void);
diff --git a/net/tipc/cluster.c b/net/tipc/cluster.c
index 689fdefe9d04..a7eac00cd363 100644
--- a/net/tipc/cluster.c
+++ b/net/tipc/cluster.c
@@ -437,11 +437,11 @@ void tipc_cltr_recv_routing_table(struct sk_buff *buf)
                 break;
         case ROUTE_ADDITION:
                 if (!is_slave(tipc_own_addr)) {
-                        assert(!in_own_cluster(c_ptr->addr)
-                               || is_slave(rem_node));
+                        assert(!in_own_cluster(c_ptr->addr) ||
+                               is_slave(rem_node));
                 } else {
-                        assert(in_own_cluster(c_ptr->addr)
-                               && !is_slave(rem_node));
+                        assert(in_own_cluster(c_ptr->addr) &&
+                               !is_slave(rem_node));
                 }
                 n_ptr = c_ptr->nodes[tipc_node(rem_node)];
                 if (!n_ptr)
@@ -451,11 +451,11 @@ void tipc_cltr_recv_routing_table(struct sk_buff *buf)
                 break;
         case ROUTE_REMOVAL:
                 if (!is_slave(tipc_own_addr)) {
-                        assert(!in_own_cluster(c_ptr->addr)
-                               || is_slave(rem_node));
+                        assert(!in_own_cluster(c_ptr->addr) ||
+                               is_slave(rem_node));
                 } else {
-                        assert(in_own_cluster(c_ptr->addr)
-                               && !is_slave(rem_node));
+                        assert(in_own_cluster(c_ptr->addr) &&
+                               !is_slave(rem_node));
                 }
                 n_ptr = c_ptr->nodes[tipc_node(rem_node)];
                 if (n_ptr)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 3256bd7d398f..52c571fedbe0 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -189,11 +189,11 @@ static int __init tipc_init(void)
         tipc_remote_management = 1;
         tipc_max_publications = 10000;
         tipc_max_subscriptions = 2000;
-        tipc_max_ports = delimit(CONFIG_TIPC_PORTS, 127, 65536);
-        tipc_max_zones = delimit(CONFIG_TIPC_ZONES, 1, 255);
-        tipc_max_clusters = delimit(CONFIG_TIPC_CLUSTERS, 1, 1);
-        tipc_max_nodes = delimit(CONFIG_TIPC_NODES, 8, 2047);
-        tipc_max_slaves = delimit(CONFIG_TIPC_SLAVE_NODES, 0, 2047);
+        tipc_max_ports = CONFIG_TIPC_PORTS;
+        tipc_max_zones = CONFIG_TIPC_ZONES;
+        tipc_max_clusters = CONFIG_TIPC_CLUSTERS;
+        tipc_max_nodes = CONFIG_TIPC_NODES;
+        tipc_max_slaves = CONFIG_TIPC_SLAVE_NODES;
         tipc_net_id = 4711;
 
         if ((res = tipc_core_start()))
diff --git a/net/tipc/core.h b/net/tipc/core.h
index a881f92a8537..c58a1d16563a 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -56,6 +56,7 @@
 #include <linux/netdevice.h>
 #include <linux/in.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 
 /*
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 524ba5696d4d..6230d16020c4 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -38,6 +38,7 @@
 #include <net/tipc/tipc_bearer.h>
 #include <net/tipc/tipc_msg.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 
 #define MAX_ETH_BEARERS         2
diff --git a/net/tipc/link.c b/net/tipc/link.c
index dd4c18b9a35b..1a7e4665af80 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -378,8 +378,8 @@ static void link_timeout(struct link *l_ptr)
                 struct tipc_msg *msg = buf_msg(l_ptr->first_out);
                 u32 length = msg_size(msg);
 
-                if ((msg_user(msg) == MSG_FRAGMENTER)
-                    && (msg_type(msg) == FIRST_FRAGMENT)) {
+                if ((msg_user(msg) == MSG_FRAGMENTER) &&
+                    (msg_type(msg) == FIRST_FRAGMENT)) {
                         length = msg_size(msg_get_wrapped(msg));
                 }
                 if (length) {
@@ -1882,6 +1882,15 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
                              (msg_destnode(msg) != tipc_own_addr)))
                         goto cont;
 
+                /* Discard non-routeable messages destined for another node */
+
+                if (unlikely(!msg_isdata(msg) &&
+                             (msg_destnode(msg) != tipc_own_addr))) {
+                        if ((msg_user(msg) != CONN_MANAGER) &&
+                            (msg_user(msg) != MSG_FRAGMENTER))
+                                goto cont;
+                }
+
                 /* Locate unicast link endpoint that should handle message */
 
                 n_ptr = tipc_node_find(msg_prevnode(msg));
@@ -2788,8 +2797,8 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
 
         /* Is there an incomplete message waiting for this fragment? */
 
-        while (pbuf && ((msg_seqno(buf_msg(pbuf)) != long_msg_seq_no)
-                        || (msg_orignode(fragm) != msg_orignode(buf_msg(pbuf))))) {
+        while (pbuf && ((msg_seqno(buf_msg(pbuf)) != long_msg_seq_no) ||
+                        (msg_orignode(fragm) != msg_orignode(buf_msg(pbuf))))) {
                 prev = pbuf;
                 pbuf = pbuf->next;
         }
@@ -3325,8 +3334,8 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
                                       (l_ptr->last_out)), l_ptr->out_queue_size);
                 if ((mod(msg_seqno(buf_msg(l_ptr->last_out)) -
                          msg_seqno(buf_msg(l_ptr->first_out)))
-                     != (l_ptr->out_queue_size - 1))
-                    || (l_ptr->last_out->next != NULL)) {
+                     != (l_ptr->out_queue_size - 1)) ||
+                    (l_ptr->last_out->next != NULL)) {
                         tipc_printf(buf, "\nSend queue inconsistency\n");
                         tipc_printf(buf, "first_out= %x ", l_ptr->first_out);
                         tipc_printf(buf, "next_out= %x ", l_ptr->next_out);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 7906608bf510..f25b1cdb64eb 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -116,7 +116,8 @@
 */
 
 DEFINE_RWLOCK(tipc_net_lock);
-struct network tipc_net = { NULL };
+struct _zone *tipc_zones[256] = { NULL, };
+struct network tipc_net = { tipc_zones };
 
 struct tipc_node *tipc_net_select_remote_node(u32 addr, u32 ref)
 {
@@ -158,28 +159,12 @@ void tipc_net_send_external_routes(u32 dest)
         }
 }
 
-static int net_init(void)
-{
-        memset(&tipc_net, 0, sizeof(tipc_net));
-        tipc_net.zones = kcalloc(tipc_max_zones + 1, sizeof(struct _zone *), GFP_ATOMIC);
-        if (!tipc_net.zones) {
-                return -ENOMEM;
-        }
-        return 0;
-}
-
 static void net_stop(void)
 {
         u32 z_num;
 
-        if (!tipc_net.zones)
-                return;
-
-        for (z_num = 1; z_num <= tipc_max_zones; z_num++) {
+        for (z_num = 1; z_num <= tipc_max_zones; z_num++)
                 tipc_zone_delete(tipc_net.zones[z_num]);
-        }
-        kfree(tipc_net.zones);
-        tipc_net.zones = NULL;
 }
 
 static void net_route_named_msg(struct sk_buff *buf)
@@ -282,9 +267,7 @@ int tipc_net_start(u32 addr)
         tipc_named_reinit();
         tipc_port_reinit();
 
-        if ((res = tipc_bearer_init()) ||
-            (res = net_init()) ||
-            (res = tipc_cltr_init()) ||
+        if ((res = tipc_cltr_init()) ||
             (res = tipc_bclink_init())) {
                 return res;
         }
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index 414fc34b8bea..8dea66500cf5 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -153,11 +153,11 @@ void tipc_ref_table_stop(void)
 
 u32 tipc_ref_acquire(void *object, spinlock_t **lock)
 {
-        struct reference *entry;
         u32 index;
         u32 index_mask;
         u32 next_plus_upper;
         u32 ref;
+        struct reference *entry = NULL;
 
         if (!object) {
                 err("Attempt to acquire reference to non-existent object\n");
@@ -175,30 +175,36 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
                 index = tipc_ref_table.first_free;
                 entry = &(tipc_ref_table.entries[index]);
                 index_mask = tipc_ref_table.index_mask;
-                /* take lock in case a previous user of entry still holds it */
-                spin_lock_bh(&entry->lock);
                 next_plus_upper = entry->ref;
                 tipc_ref_table.first_free = next_plus_upper & index_mask;
                 ref = (next_plus_upper & ~index_mask) + index;
-                entry->ref = ref;
-                entry->object = object;
-                *lock = &entry->lock;
         }
         else if (tipc_ref_table.init_point < tipc_ref_table.capacity) {
                 index = tipc_ref_table.init_point++;
                 entry = &(tipc_ref_table.entries[index]);
                 spin_lock_init(&entry->lock);
-                spin_lock_bh(&entry->lock);
                 ref = tipc_ref_table.start_mask + index;
-                entry->ref = ref;
-                entry->object = object;
-                *lock = &entry->lock;
         }
         else {
                 ref = 0;
         }
         write_unlock_bh(&ref_table_lock);
 
+        /*
+         * Grab the lock so no one else can modify this entry
+         * While we assign its ref value & object pointer
+         */
+        if (entry) {
+                spin_lock_bh(&entry->lock);
+                entry->ref = ref;
+                entry->object = object;
+                *lock = &entry->lock;
+                /*
+                 * keep it locked, the caller is responsible
+                 * for unlocking this when they're done with it
+                 */
+        }
+
         return ref;
 }
 
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e6d9abf7440e..cfb20b80b3a1 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -40,9 +40,9 @@
 #include <linux/socket.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/poll.h>
 #include <linux/fcntl.h>
+#include <linux/gfp.h>
 #include <asm/string.h>
 #include <asm/atomic.h>
 #include <net/sock.h>
@@ -177,6 +177,7 @@ static void reject_rx_queue(struct sock *sk)
  * @net: network namespace (must be default network)
  * @sock: pre-allocated socket structure
  * @protocol: protocol indicator (must be 0)
+ * @kern: caused by kernel or by userspace?
  *
  * This routine creates additional data structures used by the TIPC socket,
  * initializes them, and links them together.
@@ -184,7 +185,8 @@ static void reject_rx_queue(struct sock *sk)
  * Returns 0 on success, errno otherwise
  */
 
-static int tipc_create(struct net *net, struct socket *sock, int protocol)
+static int tipc_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         const struct proto_ops *ops;
         socket_state state;
@@ -193,7 +195,7 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol)
 
         /* Validate arguments */
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         if (unlikely(protocol != 0))
@@ -1134,13 +1136,11 @@ restart:
 
         /* Loop around if more data is required */
 
-        if ((sz_copied < buf_len)    /* didn't get all requested data */
-            && (!skb_queue_empty(&sk->sk_receive_queue) ||
-                (flags & MSG_WAITALL))
-                                     /* ... and more is ready or required */
-            && (!(flags & MSG_PEEK)) /* ... and aren't just peeking at data */
-            && (!err)                /* ... and haven't reached a FIN */
-            )
+        if ((sz_copied < buf_len) &&    /* didn't get all requested data */
+            (!skb_queue_empty(&sk->sk_receive_queue) ||
+             (flags & MSG_WAITALL)) &&  /* and more is ready or required */
+            (!(flags & MSG_PEEK)) &&    /* and aren't just peeking at data */
+            (!err))                     /* and haven't reached a FIN */
                 goto restart;
 
 exit:
@@ -1322,8 +1322,10 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
         if (!sock_owned_by_user(sk)) {
                 res = filter_rcv(sk, buf);
         } else {
-                sk_add_backlog(sk, buf);
-                res = TIPC_OK;
+                if (sk_add_backlog(sk, buf))
+                        res = TIPC_ERR_OVERLOAD;
+                else
+                        res = TIPC_OK;
         }
         bh_unlock_sock(sk);
 
@@ -1528,7 +1530,7 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
 
         buf = skb_peek(&sk->sk_receive_queue);
 
-        res = tipc_create(sock_net(sock->sk), new_sock, 0);
+        res = tipc_create(sock_net(sock->sk), new_sock, 0, 0);
         if (!res) {
                 struct sock *new_sk = new_sock->sk;
                 struct tipc_sock *new_tsock = tipc_sk(new_sk);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 0747d8a9232f..ff123e56114a 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -76,19 +76,6 @@ struct top_srv {
 static struct top_srv topsrv = { 0 };
 
 /**
- * htohl - convert value to endianness used by destination
- * @in: value to convert
- * @swap: non-zero if endianness must be reversed
- *
- * Returns converted value
- */
-
-static u32 htohl(u32 in, int swap)
-{
-        return swap ? swab32(in) : in;
-}
-
-/**
  * subscr_send_event - send a message containing a tipc_event to the subscriber
  *
  * Note: Must not hold subscriber's server port lock, since tipc_send() will
@@ -107,11 +94,11 @@ static void subscr_send_event(struct subscription *sub,
         msg_sect.iov_base = (void *)&sub->evt;
         msg_sect.iov_len = sizeof(struct tipc_event);
 
-        sub->evt.event = htohl(event, sub->swap);
-        sub->evt.found_lower = htohl(found_lower, sub->swap);
-        sub->evt.found_upper = htohl(found_upper, sub->swap);
-        sub->evt.port.ref = htohl(port_ref, sub->swap);
-        sub->evt.port.node = htohl(node, sub->swap);
+        sub->evt.event = htonl(event);
+        sub->evt.found_lower = htonl(found_lower);
+        sub->evt.found_upper = htonl(found_upper);
+        sub->evt.port.ref = htonl(port_ref);
+        sub->evt.port.node = htonl(node);
         tipc_send(sub->server_ref, 1, &msg_sect);
 }
 
@@ -287,16 +274,23 @@ static void subscr_cancel(struct tipc_subscr *s,
 {
         struct subscription *sub;
         struct subscription *sub_temp;
+        __u32 type, lower, upper;
         int found = 0;
 
         /* Find first matching subscription, exit if not found */
 
+        type = ntohl(s->seq.type);
+        lower = ntohl(s->seq.lower);
+        upper = ntohl(s->seq.upper);
+
         list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
                                  subscription_list) {
-                if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
-                        found = 1;
-                        break;
-                }
+                        if ((type == sub->seq.type) &&
+                            (lower == sub->seq.lower) &&
+                            (upper == sub->seq.upper)) {
+                                found = 1;
+                                break;
+                        }
         }
         if (!found)
                 return;
@@ -325,16 +319,10 @@ static struct subscription *subscr_subscribe(struct tipc_subscr *s,
                                              struct subscriber *subscriber)
 {
         struct subscription *sub;
-        int swap;
-
-        /* Determine subscriber's endianness */
-
-        swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE));
 
         /* Detect & process a subscription cancellation request */
 
-        if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
-                s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
+        if (ntohl(s->filter) & TIPC_SUB_CANCEL) {
                 subscr_cancel(s, subscriber);
                 return NULL;
         }
@@ -359,14 +347,14 @@ static struct subscription *subscr_subscribe(struct tipc_subscr *s,
 
         /* Initialize subscription object */
 
-        sub->seq.type = htohl(s->seq.type, swap);
-        sub->seq.lower = htohl(s->seq.lower, swap);
-        sub->seq.upper = htohl(s->seq.upper, swap);
-        sub->timeout = htohl(s->timeout, swap);
-        sub->filter = htohl(s->filter, swap);
-        if ((!(sub->filter & TIPC_SUB_PORTS)
-             == !(sub->filter & TIPC_SUB_SERVICE))
-            || (sub->seq.lower > sub->seq.upper)) {
+        sub->seq.type = ntohl(s->seq.type);
+        sub->seq.lower = ntohl(s->seq.lower);
+        sub->seq.upper = ntohl(s->seq.upper);
+        sub->timeout = ntohl(s->timeout);
+        sub->filter = ntohl(s->filter);
+        if ((!(sub->filter & TIPC_SUB_PORTS) ==
+             !(sub->filter & TIPC_SUB_SERVICE)) ||
+            (sub->seq.lower > sub->seq.upper)) {
                 warn("Subscription rejected, illegal request\n");
                 kfree(sub);
                 subscr_terminate(subscriber);
@@ -376,7 +364,6 @@ static struct subscription *subscr_subscribe(struct tipc_subscr *s,
         INIT_LIST_HEAD(&sub->nameseq_list);
         list_add(&sub->subscription_list, &subscriber->subscription_list);
         sub->server_ref = subscriber->port_ref;
-        sub->swap = swap;
         memcpy(&sub->evt.s, s, sizeof(struct tipc_subscr));
         atomic_inc(&topsrv.subscription_count);
         if (sub->timeout != TIPC_WAIT_FOREVER) {
diff --git a/net/tipc/subscr.h b/net/tipc/subscr.h
index 45d89bf4d202..c20f496d95b2 100644
--- a/net/tipc/subscr.h
+++ b/net/tipc/subscr.h
@@ -53,7 +53,6 @@ typedef void (*tipc_subscr_event) (struct subscription *sub,
  * @nameseq_list: adjacent subscriptions in name sequence's subscription list
  * @subscription_list: adjacent subscriptions in subscriber's subscription list
  * @server_ref: object reference of server port associated with subscription
- * @swap: indicates if subscriber uses opposite endianness in its messages
  * @evt: template for events generated by subscription
  */
 
@@ -66,7 +65,6 @@ struct subscription {
         struct list_head nameseq_list;
         struct list_head subscription_list;
         u32 server_ref;
-        int swap;
         struct tipc_event evt;
 };
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index fc820cd75453..3d9122e78f41 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -144,7 +144,7 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
 /*
  *  SMP locking strategy:
  *    hash table is protected with spinlock unix_table_lock
- *    each socket state is protected by separate rwlock.
+ *    each socket state is protected by separate spin lock.
  */
 
 static inline unsigned unix_hash_fold(__wsum n)
@@ -621,7 +621,8 @@ out:
         return sk;
 }
 
-static int unix_create(struct net *net, struct socket *sock, int protocol)
+static int unix_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         if (protocol && protocol != PF_UNIX)
                 return -EPROTONOSUPPORT;
@@ -1032,8 +1033,8 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                 goto out;
         addr_len = err;
 
-        if (test_bit(SOCK_PASSCRED, &sock->flags)
-                && !u->addr && (err = unix_autobind(sock)) != 0)
+        if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr &&
+            (err = unix_autobind(sock)) != 0)
                 goto out;
 
         timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
@@ -1258,7 +1259,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
 {
         struct sock *sk = sock->sk;
         struct unix_sock *u;
-        struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);
         int err = 0;
 
         if (peer) {
@@ -1377,8 +1378,8 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                         goto out;
         }
 
-        if (test_bit(SOCK_PASSCRED, &sock->flags)
-                && !u->addr && (err = unix_autobind(sock)) != 0)
+        if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr
+            && (err = unix_autobind(sock)) != 0)
                 goto out;
 
         err = -EMSGSIZE;
@@ -2216,14 +2217,14 @@ static const struct file_operations unix_seq_fops = {
 
 #endif
 
-static struct net_proto_family unix_family_ops = {
+static const struct net_proto_family unix_family_ops = {
         .family = PF_UNIX,
         .create = unix_create,
         .owner  = THIS_MODULE,
 };
 
 
-static int unix_net_init(struct net *net)
+static int __net_init unix_net_init(struct net *net)
 {
         int error = -ENOMEM;
 
@@ -2242,7 +2243,7 @@ out:
         return error;
 }
 
-static void unix_net_exit(struct net *net)
+static void __net_exit unix_net_exit(struct net *net)
 {
         unix_sysctl_unregister(net);
         proc_net_remove(net, "unix");
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 19c17e4a0c8b..14c22c3768da 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -74,7 +74,6 @@
 #include <linux/un.h>
 #include <linux/net.h>
 #include <linux/fs.h>
-#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/file.h>
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 83c093077ebc..397cffebb3b6 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -10,29 +10,29 @@
  */
 
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 
 #include <net/af_unix.h>
 
 static ctl_table unix_table[] = {
         {
-                .ctl_name       = NET_UNIX_MAX_DGRAM_QLEN,
                 .procname       = "max_dgram_qlen",
                 .data           = &init_net.unx.sysctl_max_dgram_qlen,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_path unix_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "unix", .ctl_name = NET_UNIX, },
+        { .procname = "net", },
+        { .procname = "unix", },
         { },
 };
 
-int unix_sysctl_register(struct net *net)
+int __net_init unix_sysctl_register(struct net *net)
 {
         struct ctl_table *table;
 
diff --git a/net/wimax/op-msg.c b/net/wimax/op-msg.c
index d631a17186bc..d5b7c3779c43 100644
--- a/net/wimax/op-msg.c
+++ b/net/wimax/op-msg.c
@@ -72,6 +72,7 @@
  *   wimax_msg_send()
  */
 #include <linux/device.h>
+#include <linux/slab.h>
 #include <net/genetlink.h>
 #include <linux/netdevice.h>
 #include <linux/wimax.h>
@@ -320,8 +321,7 @@ int wimax_msg(struct wimax_dev *wimax_dev, const char *pipe_name,
 EXPORT_SYMBOL_GPL(wimax_msg);
 
 
-static const
-struct nla_policy wimax_gnl_msg_policy[WIMAX_GNL_ATTR_MAX + 1] = {
+static const struct nla_policy wimax_gnl_msg_policy[WIMAX_GNL_ATTR_MAX + 1] = {
         [WIMAX_GNL_MSG_IFIDX] = {
                 .type = NLA_U32,
         },
@@ -388,6 +388,8 @@ int wimax_gnl_doit_msg_from_user(struct sk_buff *skb, struct genl_info *info)
         }
         mutex_lock(&wimax_dev->mutex);
         result = wimax_dev_is_ready(wimax_dev);
+        if (result == -ENOMEDIUM)
+                result = 0;
         if (result < 0)
                 goto error_not_ready;
         result = -ENOSYS;
diff --git a/net/wimax/op-reset.c b/net/wimax/op-reset.c
index ca269178c4d4..4dc82a54ba30 100644
--- a/net/wimax/op-reset.c
+++ b/net/wimax/op-reset.c
@@ -62,7 +62,7 @@
  * Called when wanting to reset the device for any reason. Device is
  * taken back to power on status.
  *
- * This call blocks; on succesful return, the device has completed the
+ * This call blocks; on successful return, the device has completed the
  * reset process and is ready to operate.
  */
 int wimax_reset(struct wimax_dev *wimax_dev)
@@ -91,8 +91,7 @@ int wimax_reset(struct wimax_dev *wimax_dev)
 EXPORT_SYMBOL(wimax_reset);
 
 
-static const
-struct nla_policy wimax_gnl_reset_policy[WIMAX_GNL_ATTR_MAX + 1] = {
+static const struct nla_policy wimax_gnl_reset_policy[WIMAX_GNL_ATTR_MAX + 1] = {
         [WIMAX_GNL_RESET_IFIDX] = {
                 .type = NLA_U32,
         },
diff --git a/net/wimax/op-rfkill.c b/net/wimax/op-rfkill.c
index 70ef4df863b9..e978c7136c97 100644
--- a/net/wimax/op-rfkill.c
+++ b/net/wimax/op-rfkill.c
@@ -107,8 +107,8 @@ void wimax_report_rfkill_hw(struct wimax_dev *wimax_dev,
 
         if (state != wimax_dev->rf_hw) {
                 wimax_dev->rf_hw = state;
-                if (wimax_dev->rf_hw == WIMAX_RF_ON
-                    && wimax_dev->rf_sw == WIMAX_RF_ON)
+                if (wimax_dev->rf_hw == WIMAX_RF_ON &&
+                    wimax_dev->rf_sw == WIMAX_RF_ON)
                         wimax_state = WIMAX_ST_READY;
                 else
                         wimax_state = WIMAX_ST_RADIO_OFF;
@@ -163,8 +163,8 @@ void wimax_report_rfkill_sw(struct wimax_dev *wimax_dev,
 
         if (state != wimax_dev->rf_sw) {
                 wimax_dev->rf_sw = state;
-                if (wimax_dev->rf_hw == WIMAX_RF_ON
-                    && wimax_dev->rf_sw == WIMAX_RF_ON)
+                if (wimax_dev->rf_hw == WIMAX_RF_ON &&
+                    wimax_dev->rf_sw == WIMAX_RF_ON)
                         wimax_state = WIMAX_ST_READY;
                 else
                         wimax_state = WIMAX_ST_RADIO_OFF;
@@ -305,8 +305,15 @@ int wimax_rfkill(struct wimax_dev *wimax_dev, enum wimax_rf_state state)
         d_fnstart(3, dev, "(wimax_dev %p state %u)\n", wimax_dev, state);
         mutex_lock(&wimax_dev->mutex);
         result = wimax_dev_is_ready(wimax_dev);
-        if (result < 0)
+        if (result < 0) {
+                /* While initializing, < 1.4.3 wimax-tools versions use
+                 * this call to check if the device is a valid WiMAX
+                 * device; so we allow it to proceed always,
+                 * considering the radios are all off. */
+                if (result == -ENOMEDIUM && state == WIMAX_RF_QUERY)
+                        result = WIMAX_RF_OFF << 1 | WIMAX_RF_OFF;
                 goto error_not_ready;
+        }
         switch (state) {
         case WIMAX_RF_ON:
         case WIMAX_RF_OFF:
@@ -355,6 +362,7 @@ int wimax_rfkill_add(struct wimax_dev *wimax_dev)
 
         wimax_dev->rfkill = rfkill;
 
+        rfkill_init_sw_state(rfkill, 1);
         result = rfkill_register(wimax_dev->rfkill);
         if (result < 0)
                 goto error_rfkill_register;
@@ -402,8 +410,7 @@ void wimax_rfkill_rm(struct wimax_dev *wimax_dev)
  * just query).
  */
 
-static const
-struct nla_policy wimax_gnl_rfkill_policy[WIMAX_GNL_ATTR_MAX + 1] = {
+static const struct nla_policy wimax_gnl_rfkill_policy[WIMAX_GNL_ATTR_MAX + 1] = {
         [WIMAX_GNL_RFKILL_IFIDX] = {
                 .type = NLA_U32,
         },
diff --git a/net/wimax/op-state-get.c b/net/wimax/op-state-get.c
index a76b8fcb056d..11ad3356eb56 100644
--- a/net/wimax/op-state-get.c
+++ b/net/wimax/op-state-get.c
@@ -33,8 +33,7 @@
 #include "debug-levels.h"
 
 
-static const
-struct nla_policy wimax_gnl_state_get_policy[WIMAX_GNL_ATTR_MAX + 1] = {
+static const struct nla_policy wimax_gnl_state_get_policy[WIMAX_GNL_ATTR_MAX + 1] = {
         [WIMAX_GNL_STGET_IFIDX] = {
                 .type = NLA_U32,
         },
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index 79fb7d7c640f..1ed65dbdab03 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -51,6 +51,7 @@
  *   wimax_rfkill_rm()
  */
 #include <linux/device.h>
+#include <linux/gfp.h>
 #include <net/genetlink.h>
 #include <linux/netdevice.h>
 #include <linux/wimax.h>
@@ -60,6 +61,14 @@
 #define D_SUBMODULE stack
 #include "debug-levels.h"
 
+static char wimax_debug_params[128];
+module_param_string(debug, wimax_debug_params, sizeof(wimax_debug_params),
+                    0644);
+MODULE_PARM_DESC(debug,
+                 "String of space-separated NAME:VALUE pairs, where NAMEs "
+                 "are the different debug submodules and VALUE are the "
+                 "initial debug value to set.");
+
 /*
  * Authoritative source for the RE_STATE_CHANGE attribute policy
  *
@@ -67,8 +76,7 @@
  * close to where the data is generated.
  */
 /*
-static const
-struct nla_policy wimax_gnl_re_status_change[WIMAX_GNL_ATTR_MAX + 1] = {
+static const struct nla_policy wimax_gnl_re_status_change[WIMAX_GNL_ATTR_MAX + 1] = {
         [WIMAX_GNL_STCH_STATE_OLD] = { .type = NLA_U8 },
         [WIMAX_GNL_STCH_STATE_NEW] = { .type = NLA_U8 },
 };
@@ -562,6 +570,9 @@ int __init wimax_subsys_init(void)
         int result, cnt;
 
         d_fnstart(4, NULL, "()\n");
+        d_parse_params(D_LEVEL, D_LEVEL_SIZE, wimax_debug_params,
+                       "wimax.debug");
+
         snprintf(wimax_gnl_family.name, sizeof(wimax_gnl_family.name),
                  "WiMAX");
         result = genl_register_family(&wimax_gnl_family);
diff --git a/net/wireless/.gitignore b/net/wireless/.gitignore
new file mode 100644
index 000000000000..c33451b896d9
--- /dev/null
+++ b/net/wireless/.gitignore
@@ -0,0 +1 @@
+regdb.c
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index abf7ca3f9ff9..d0ee29063e5d 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -1,3 +1,21 @@
+config WIRELESS_EXT
+        bool
+
+config WEXT_CORE
+        def_bool y
+        depends on CFG80211_WEXT || WIRELESS_EXT
+
+config WEXT_PROC
+        def_bool y
+        depends on PROC_FS
+        depends on WEXT_CORE
+
+config WEXT_SPY
+        bool
+
+config WEXT_PRIV
+        bool
+
 config CFG80211
         tristate "cfg80211 - wireless configuration API"
         depends on RFKILL || !RFKILL
@@ -67,47 +85,44 @@ config CFG80211_DEFAULT_PS
           applications instead -- they need to register their network
           latency requirement, see Documentation/power/pm_qos_interface.txt.
 
-config CFG80211_DEFAULT_PS_VALUE
-        int
-        default 1 if CFG80211_DEFAULT_PS
-        default 0
-
 config CFG80211_DEBUGFS
         bool "cfg80211 DebugFS entries"
-        depends on CFG80211 && DEBUG_FS
+        depends on CFG80211
+        depends on DEBUG_FS
         ---help---
           You can enable this if you want to debugfs entries for cfg80211.
 
           If unsure, say N.
 
-config WIRELESS_OLD_REGULATORY
-        bool "Old wireless static regulatory definitions"
+config CFG80211_INTERNAL_REGDB
+        bool "use statically compiled regulatory rules database" if EMBEDDED
         default n
+        depends on CFG80211
         ---help---
-          This option enables the old static regulatory information
-          and uses it within the new framework. This option is available
-          for historical reasons and it is advised to leave it off.
+          This option generates an internal data structure representing
+          the wireless regulatory rules described in net/wireless/db.txt
+          and includes code to query that database.  This is an alternative
+          to using CRDA for defining regulatory rules for the kernel.
 
           For details see:
 
           http://wireless.kernel.org/en/developers/Regulatory
 
-          Say N and if you say Y, please tell us why. The default is N.
+          Most distributions have a CRDA package.  So if unsure, say N.
 
-config WIRELESS_EXT
-        bool "Wireless extensions"
+config CFG80211_WEXT
+        bool "cfg80211 wireless extensions compatibility"
+        depends on CFG80211
+        select WEXT_CORE
         default y
-        ---help---
-          This option enables the legacy wireless extensions
-          (wireless network interface configuration via ioctls.)
-
-          Say Y unless you've upgraded all your userspace to use
-          nl80211 instead of wireless extensions.
+        help
+          Enable this option if you need old userspace for wireless
+          extensions with cfg80211-based drivers.
 
 config WIRELESS_EXT_SYSFS
         bool "Wireless extensions sysfs files"
         default y
-        depends on WIRELESS_EXT && SYSFS
+        depends on WEXT_CORE && SYSFS
         help
           This option enables the deprecated wireless statistics
           files in /sys/class/net/*/wireless/. The same information
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 3ecaa9179977..e77e508126fa 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -1,13 +1,23 @@
-obj-$(CONFIG_WIRELESS_EXT) += wext.o
 obj-$(CONFIG_CFG80211) += cfg80211.o
 obj-$(CONFIG_LIB80211) += lib80211.o
 obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
+obj-$(CONFIG_WEXT_CORE) += wext-core.o
+obj-$(CONFIG_WEXT_PROC) += wext-proc.o
+obj-$(CONFIG_WEXT_SPY) += wext-spy.o
+obj-$(CONFIG_WEXT_PRIV) += wext-priv.o
+
 cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
-cfg80211-y += mlme.o ibss.o sme.o chan.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
-cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o wext-sme.o
+cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
+cfg80211-$(CONFIG_CFG80211_INTERNAL_REGDB) += regdb.o
 
 ccflags-y += -D__CHECK_ENDIAN__
+
+$(obj)/regdb.c: $(src)/db.txt $(src)/genregdb.awk
+        @$(AWK) -f $(srctree)/$(src)/genregdb.awk < $< > $@
+
+clean-files := regdb.c
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index a46ac6c9b365..bf1737fc9a7e 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -41,44 +41,57 @@ rdev_fixed_channel(struct cfg80211_registered_device *rdev,
         return result;
 }
 
-int rdev_set_freq(struct cfg80211_registered_device *rdev,
-                  struct wireless_dev *for_wdev,
+struct ieee80211_channel *
+rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
                   int freq, enum nl80211_channel_type channel_type)
 {
         struct ieee80211_channel *chan;
         struct ieee80211_sta_ht_cap *ht_cap;
-        int result;
-
-        if (rdev_fixed_channel(rdev, for_wdev))
-                return -EBUSY;
-
-        if (!rdev->ops->set_channel)
-                return -EOPNOTSUPP;
 
         chan = ieee80211_get_channel(&rdev->wiphy, freq);
 
         /* Primary channel not allowed */
         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
-                return -EINVAL;
+                return NULL;
 
         if (channel_type == NL80211_CHAN_HT40MINUS &&
             chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
-                return -EINVAL;
+                return NULL;
         else if (channel_type == NL80211_CHAN_HT40PLUS &&
                  chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                return -EINVAL;
+                return NULL;
 
         ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 
         if (channel_type != NL80211_CHAN_NO_HT) {
                 if (!ht_cap->ht_supported)
-                        return -EINVAL;
+                        return NULL;
 
                 if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
                     ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
-                        return -EINVAL;
+                        return NULL;
         }
 
+        return chan;
+}
+
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *chan;
+        int result;
+
+        if (rdev_fixed_channel(rdev, for_wdev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_channel)
+                return -EOPNOTSUPP;
+
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (!chan)
+                return -EINVAL;
+
         result = rdev->ops->set_channel(&rdev->wiphy, chan, channel_type);
         if (result)
                 return result;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a595f712b5bf..6ac70c101523 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1,13 +1,14 @@
 /*
  * This is the linux wireless configuration interface.
  *
- * Copyright 2006-2009          Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010          Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/nl80211.h>
 #include <linux/debugfs.h>
 #include <linux/notifier.h>
@@ -22,6 +23,7 @@
 #include "sysfs.h"
 #include "debugfs.h"
 #include "wext-compat.h"
+#include "ethtool.h"
 
 /* name for sysfs, %d is appended */
 #define PHY_NAME "phy"
@@ -30,20 +32,18 @@ MODULE_AUTHOR("Johannes Berg");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("wireless configuration support");
 
-/* RCU might be appropriate here since we usually
- * only read the list, and that can happen quite
- * often because we need to do it for each command */
+/* RCU-protected (and cfg80211_mutex for writers) */
 LIST_HEAD(cfg80211_rdev_list);
 int cfg80211_rdev_list_generation;
 
-/*
- * This is used to protect the cfg80211_rdev_list
- */
 DEFINE_MUTEX(cfg80211_mutex);
 
 /* for debugfs */
 static struct dentry *ieee80211_debugfs_dir;
 
+/* for the cleanup, scan and event works */
+struct workqueue_struct *cfg80211_wq;
+
 /* requires cfg80211_mutex to be held! */
 struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
@@ -230,7 +230,7 @@ int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev;
         int err = 0;
 
-        if (!rdev->wiphy.netnsok)
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK))
                 return -EOPNOTSUPP;
 
         list_for_each_entry(wdev, &rdev->netdev_list, list) {
@@ -359,11 +359,17 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         INIT_LIST_HEAD(&rdev->bss_list);
         INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
 
+#ifdef CONFIG_CFG80211_WEXT
+        rdev->wiphy.wext = &cfg80211_wext_handler;
+#endif
+
         device_initialize(&rdev->wiphy.dev);
         rdev->wiphy.dev.class = &ieee80211_class;
         rdev->wiphy.dev.platform_data = rdev;
 
-        rdev->wiphy.ps_default = CONFIG_CFG80211_DEFAULT_PS_VALUE;
+#ifdef CONFIG_CFG80211_DEFAULT_PS
+        rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#endif
 
         wiphy_net_set(&rdev->wiphy, &init_net);
 
@@ -392,6 +398,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.retry_long = 4;
         rdev->wiphy.frag_threshold = (u32) -1;
         rdev->wiphy.rts_threshold = (u32) -1;
+        rdev->wiphy.coverage_class = 0;
 
         return &rdev->wiphy;
 }
@@ -407,6 +414,18 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
+        if (WARN_ON(wiphy->addresses && !wiphy->n_addresses))
+                return -EINVAL;
+
+        if (WARN_ON(wiphy->addresses &&
+                    !is_zero_ether_addr(wiphy->perm_addr) &&
+                    memcmp(wiphy->perm_addr, wiphy->addresses[0].addr,
+                           ETH_ALEN)))
+                return -EINVAL;
+
+        if (wiphy->addresses)
+                memcpy(wiphy->perm_addr, wiphy->addresses[0].addr, ETH_ALEN);
+
         /* sanity check ifmodes */
         WARN_ON(!ifmodes);
         ifmodes &= ((1 << __NL80211_IFTYPE_AFTER_LAST) - 1) & ~1;
@@ -466,7 +485,7 @@ int wiphy_register(struct wiphy *wiphy)
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
 
-        list_add(&rdev->list, &cfg80211_rdev_list);
+        list_add_rcu(&rdev->list, &cfg80211_rdev_list);
         cfg80211_rdev_list_generation++;
 
         mutex_unlock(&cfg80211_mutex);
@@ -478,7 +497,7 @@ int wiphy_register(struct wiphy *wiphy)
         if (IS_ERR(rdev->wiphy.debugfsdir))
                 rdev->wiphy.debugfsdir = NULL;
 
-        if (wiphy->custom_regulatory) {
+        if (wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY) {
                 struct regulatory_request request;
 
                 request.wiphy_idx = get_wiphy_idx(wiphy);
@@ -542,8 +561,9 @@ void wiphy_unregister(struct wiphy *wiphy)
          * First remove the hardware from everywhere, this makes
          * it impossible to find from userspace.
          */
-        cfg80211_debugfs_rdev_del(rdev);
-        list_del(&rdev->list);
+        debugfs_remove_recursive(rdev->wiphy.debugfsdir);
+        list_del_rcu(&rdev->list);
+        synchronize_rcu();
 
         /*
          * Try to grab rdev->mtx. If a command is still in progress,
@@ -565,7 +585,6 @@ void wiphy_unregister(struct wiphy *wiphy)
 
         cfg80211_rdev_list_generation++;
         device_del(&rdev->wiphy.dev);
-        debugfs_remove(rdev->wiphy.debugfsdir);
 
         mutex_unlock(&cfg80211_mutex);
 
@@ -626,6 +645,10 @@ static void wdev_cleanup_work(struct work_struct *work)
         dev_put(wdev->netdev);
 }
 
+static struct device_type wiphy_type = {
+        .name   = "wlan",
+};
+
 static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                          unsigned long state,
                                          void *ndev)
@@ -642,6 +665,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
         WARN_ON(wdev->iftype == NL80211_IFTYPE_UNSPECIFIED);
 
         switch (state) {
+        case NETDEV_POST_INIT:
+                SET_NETDEV_DEVTYPE(dev, &wiphy_type);
+                break;
         case NETDEV_REGISTER:
                 /*
                  * NB: cannot take rdev->mtx here because this may be
@@ -652,8 +678,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 INIT_WORK(&wdev->cleanup_work, wdev_cleanup_work);
                 INIT_LIST_HEAD(&wdev->event_list);
                 spin_lock_init(&wdev->event_lock);
+                INIT_LIST_HEAD(&wdev->action_registrations);
+                spin_lock_init(&wdev->action_registrations_lock);
+
                 mutex_lock(&rdev->devlist_mtx);
-                list_add(&wdev->list, &rdev->netdev_list);
+                list_add_rcu(&wdev->list, &rdev->netdev_list);
                 rdev->devlist_generation++;
                 /* can only change netns with wiphy */
                 dev->features |= NETIF_F_NETNS_LOCAL;
@@ -666,22 +695,31 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 wdev->netdev = dev;
                 wdev->sme_state = CFG80211_SME_IDLE;
                 mutex_unlock(&rdev->devlist_mtx);
-#ifdef CONFIG_WIRELESS_EXT
-                if (!dev->wireless_handlers)
-                        dev->wireless_handlers = &cfg80211_wext_handler;
+#ifdef CONFIG_CFG80211_WEXT
                 wdev->wext.default_key = -1;
                 wdev->wext.default_mgmt_key = -1;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
-                wdev->wext.ps = wdev->wiphy->ps_default;
-                wdev->wext.ps_timeout = 100;
+#endif
+
+                if (wdev->wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT)
+                        wdev->ps = true;
+                else
+                        wdev->ps = false;
+                wdev->ps_timeout = 100;
                 if (rdev->ops->set_power_mgmt)
                         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
-                                                      wdev->wext.ps,
-                                                      wdev->wext.ps_timeout)) {
+                                                      wdev->ps,
+                                                      wdev->ps_timeout)) {
                                 /* assume this means it's off */
-                                wdev->wext.ps = false;
+                                wdev->ps = false;
                         }
-#endif
+
+                if (!dev->ethtool_ops)
+                        dev->ethtool_ops = &cfg80211_ethtool_ops;
+
+                if ((wdev->iftype == NL80211_IFTYPE_STATION ||
+                     wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
+                        dev->priv_flags |= IFF_DONT_BRIDGE;
                 break;
         case NETDEV_GOING_DOWN:
                 switch (wdev->iftype) {
@@ -690,7 +728,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 case NL80211_IFTYPE_STATION:
                         wdev_lock(wdev);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.ie);
                         wdev->wext.ie = NULL;
                         wdev->wext.ie_len = 0;
@@ -707,7 +745,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 break;
         case NETDEV_DOWN:
                 dev_hold(dev);
-                schedule_work(&wdev->cleanup_work);
+                queue_work(cfg80211_wq, &wdev->cleanup_work);
                 break;
         case NETDEV_UP:
                 /*
@@ -722,9 +760,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         mutex_unlock(&rdev->devlist_mtx);
                         dev_put(dev);
                 }
-#ifdef CONFIG_WIRELESS_EXT
                 cfg80211_lock_rdev(rdev);
                 mutex_lock(&rdev->devlist_mtx);
+#ifdef CONFIG_CFG80211_WEXT
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_ADHOC:
@@ -737,10 +775,10 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 }
                 wdev_unlock(wdev);
+#endif
                 rdev->opencount++;
                 mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
-#endif
                 break;
         case NETDEV_UNREGISTER:
                 /*
@@ -758,13 +796,22 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                  */
                 if (!list_empty(&wdev->list)) {
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
-                        list_del_init(&wdev->list);
+                        list_del_rcu(&wdev->list);
                         rdev->devlist_generation++;
-#ifdef CONFIG_WIRELESS_EXT
+                        cfg80211_mlme_purge_actions(wdev);
+#ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.keys);
 #endif
                 }
                 mutex_unlock(&rdev->devlist_mtx);
+                /*
+                 * synchronise (so that we won't find this netdev
+                 * from other code any more) and then clear the list
+                 * head so that the above code can safely check for
+                 * !list_empty() to avoid double-cleanup.
+                 */
+                synchronize_rcu();
+                INIT_LIST_HEAD(&wdev->list);
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
@@ -825,8 +872,14 @@ static int __init cfg80211_init(void)
         if (err)
                 goto out_fail_reg;
 
+        cfg80211_wq = create_singlethread_workqueue("cfg80211");
+        if (!cfg80211_wq)
+                goto out_fail_wq;
+
         return 0;
 
+out_fail_wq:
+        regulatory_exit();
 out_fail_reg:
         debugfs_remove(ieee80211_debugfs_dir);
 out_fail_nl80211:
@@ -848,5 +901,6 @@ static void cfg80211_exit(void)
         wiphy_sysfs_exit();
         regulatory_exit();
         unregister_pernet_device(&cfg80211_pernet_ops);
+        destroy_workqueue(cfg80211_wq);
 }
 module_exit(cfg80211_exit);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 68b321997d4c..d52da913145a 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -1,7 +1,7 @@
 /*
  * Wireless configuration interface internals.
  *
- * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
  */
 #ifndef __NET_WIRELESS_CORE_H
 #define __NET_WIRELESS_CORE_H
@@ -48,6 +48,7 @@ struct cfg80211_registered_device {
 
         /* associate netdev list */
         struct mutex devlist_mtx;
+        /* protected by devlist_mtx or RCU */
         struct list_head netdev_list;
         int devlist_generation;
         int opencount; /* also protected by devlist_mtx */
@@ -72,17 +73,6 @@ struct cfg80211_registered_device {
         /* current channel */
         struct ieee80211_channel *channel;
 
-#ifdef CONFIG_CFG80211_DEBUGFS
-        /* Debugfs entries */
-        struct wiphy_debugfsdentries {
-                struct dentry *rts_threshold;
-                struct dentry *fragmentation_threshold;
-                struct dentry *short_retry_limit;
-                struct dentry *long_retry_limit;
-                struct dentry *ht40allow_map;
-        } debugfs;
-#endif
-
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __attribute__((__aligned__(NETDEV_ALIGN)));
@@ -102,6 +92,8 @@ bool wiphy_idx_valid(int wiphy_idx)
         return (wiphy_idx >= 0);
 }
 
+
+extern struct workqueue_struct *cfg80211_wq;
 extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_rdev_list;
 extern int cfg80211_rdev_list_generation;
@@ -120,7 +112,8 @@ struct cfg80211_internal_bss {
         unsigned long ts;
         struct kref ref;
         atomic_t hold;
-        bool ies_allocated;
+        bool beacon_ies_allocated;
+        bool proberesp_ies_allocated;
 
         /* must be last because of priv member */
         struct cfg80211_bss pub;
@@ -284,6 +277,8 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                        struct cfg80211_ibss_params *params,
                        struct cfg80211_cached_keys *connkeys);
 void cfg80211_clear_ibss(struct net_device *dev, bool nowext);
+int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, bool nowext);
 int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, bool nowext);
 void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid);
@@ -334,6 +329,15 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *resp_ie, size_t resp_ie_len,
                                u16 status, bool wextev,
                                struct cfg80211_bss *bss);
+int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
+                                  const u8 *match_data, int match_len);
+void cfg80211_mlme_unregister_actions(struct wireless_dev *wdev, u32 nlpid);
+void cfg80211_mlme_purge_actions(struct wireless_dev *wdev);
+int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_channel_type channel_type,
+                         const u8 *buf, size_t len, u64 *cookie);
 
 /* SME */
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
@@ -381,10 +385,15 @@ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
 struct ieee80211_channel *
 rdev_fixed_channel(struct cfg80211_registered_device *rdev,
                    struct wireless_dev *for_wdev);
+struct ieee80211_channel *
+rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
+                  int freq, enum nl80211_channel_type channel_type);
 int rdev_set_freq(struct cfg80211_registered_device *rdev,
                   struct wireless_dev *for_wdev,
                   int freq, enum nl80211_channel_type channel_type);
 
+u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
 #define CFG80211_DEV_WARN_ON(cond)      WARN_ON(cond)
 #else
diff --git a/net/wireless/db.txt b/net/wireless/db.txt
new file mode 100644
index 000000000000..a2fc3a09ccdc
--- /dev/null
+++ b/net/wireless/db.txt
@@ -0,0 +1,17 @@
+#
+# This file is a placeholder to prevent accidental build breakage if someone
+# enables CONFIG_CFG80211_INTERNAL_REGDB.  Almost no one actually needs to
+# enable that build option.
+#
+# You should be using CRDA instead.  It is even better if you use the CRDA
+# package provided by your distribution, since they will probably keep it
+# up-to-date on your behalf.
+#
+# If you _really_ intend to use CONFIG_CFG80211_INTERNAL_REGDB then you will
+# need to replace this file with one containing appropriately formatted
+# regulatory rules that cover the regulatory domains you will be using.  Your
+# best option is to extract the db.txt file from the wireless-regdb git
+# repository:
+#
+#   git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-regdb.git
+#
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 13d93d84f902..a4991a3efec0 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/slab.h>
 #include "core.h"
 #include "debugfs.h"
 
@@ -104,11 +105,7 @@ static const struct file_operations ht40allow_map_ops = {
 };
 
 #define DEBUGFS_ADD(name)                                               \
-        rdev->debugfs.name = debugfs_create_file(#name, S_IRUGO, phyd,  \
-                                                  &rdev->wiphy, &name## _ops);
-#define DEBUGFS_DEL(name)                                               \
-        debugfs_remove(rdev->debugfs.name);                             \
-        rdev->debugfs.name = NULL;
+        debugfs_create_file(#name, S_IRUGO, phyd, &rdev->wiphy, &name## _ops);
 
 void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
 {
@@ -120,12 +117,3 @@ void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
         DEBUGFS_ADD(long_retry_limit);
         DEBUGFS_ADD(ht40allow_map);
 }
-
-void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev)
-{
-        DEBUGFS_DEL(rts_threshold);
-        DEBUGFS_DEL(fragmentation_threshold);
-        DEBUGFS_DEL(short_retry_limit);
-        DEBUGFS_DEL(long_retry_limit);
-        DEBUGFS_DEL(ht40allow_map);
-}
diff --git a/net/wireless/debugfs.h b/net/wireless/debugfs.h
index 6419b6d6ce3e..74fdd3811427 100644
--- a/net/wireless/debugfs.h
+++ b/net/wireless/debugfs.h
@@ -3,12 +3,9 @@
 
 #ifdef CONFIG_CFG80211_DEBUGFS
 void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev);
-void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev);
 #else
 static inline
 void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev) {}
-static inline
-void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev) {}
 #endif
 
 #endif /* __CFG80211_DEBUGFS_H */
diff --git a/net/wireless/ethtool.c b/net/wireless/ethtool.c
new file mode 100644
index 000000000000..ca4c825be93d
--- /dev/null
+++ b/net/wireless/ethtool.c
@@ -0,0 +1,45 @@
+#include <linux/utsname.h>
+#include <net/cfg80211.h>
+#include "ethtool.h"
+
+static void cfg80211_get_drvinfo(struct net_device *dev,
+                                        struct ethtool_drvinfo *info)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        strlcpy(info->driver, wiphy_dev(wdev->wiphy)->driver->name,
+                sizeof(info->driver));
+
+        strlcpy(info->version, init_utsname()->release, sizeof(info->version));
+
+        if (wdev->wiphy->fw_version[0])
+                strncpy(info->fw_version, wdev->wiphy->fw_version,
+                        sizeof(info->fw_version));
+        else
+                strncpy(info->fw_version, "N/A", sizeof(info->fw_version));
+
+        strlcpy(info->bus_info, dev_name(wiphy_dev(wdev->wiphy)),
+                sizeof(info->bus_info));
+}
+
+static int cfg80211_get_regs_len(struct net_device *dev)
+{
+        /* For now, return 0... */
+        return 0;
+}
+
+static void cfg80211_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                        void *data)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        regs->version = wdev->wiphy->hw_version;
+        regs->len = 0;
+}
+
+const struct ethtool_ops cfg80211_ethtool_ops = {
+        .get_drvinfo = cfg80211_get_drvinfo,
+        .get_regs_len = cfg80211_get_regs_len,
+        .get_regs = cfg80211_get_regs,
+        .get_link = ethtool_op_get_link,
+};
diff --git a/net/wireless/ethtool.h b/net/wireless/ethtool.h
new file mode 100644
index 000000000000..695ecad20bd6
--- /dev/null
+++ b/net/wireless/ethtool.h
@@ -0,0 +1,6 @@
+#ifndef __CFG80211_ETHTOOL__
+#define __CFG80211_ETHTOOL__
+
+extern const struct ethtool_ops cfg80211_ethtool_ops;
+
+#endif /* __CFG80211_ETHTOOL__ */
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
new file mode 100644
index 000000000000..3cc9e69880a8
--- /dev/null
+++ b/net/wireless/genregdb.awk
@@ -0,0 +1,118 @@
+#!/usr/bin/awk -f
+#
+# genregdb.awk -- generate regdb.c from db.txt
+#
+# Actually, it reads from stdin (presumed to be db.txt) and writes
+# to stdout (presumed to be regdb.c), but close enough...
+#
+# Copyright 2009 John W. Linville <linville@tuxdriver.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+
+BEGIN {
+        active = 0
+        rules = 0;
+        print "/*"
+        print " * DO NOT EDIT -- file generated from data in db.txt"
+        print " */"
+        print ""
+        print "#include <linux/nl80211.h>"
+        print "#include <net/cfg80211.h>"
+        print ""
+        regdb = "const struct ieee80211_regdomain *reg_regdb[] = {\n"
+}
+
+/^[ \t]*#/ {
+        # Ignore
+}
+
+!active && /^[ \t]*$/ {
+        # Ignore
+}
+
+!active && /country/ {
+        country=$2
+        sub(/:/, "", country)
+        printf "static const struct ieee80211_regdomain regdom_%s = {\n", country
+        printf "\t.alpha2 = \"%s\",\n", country
+        printf "\t.reg_rules = {\n"
+        active = 1
+        regdb = regdb "\t&regdom_" country ",\n"
+}
+
+active && /^[ \t]*\(/ {
+        start = $1
+        sub(/\(/, "", start)
+        end = $3
+        bw = $5
+        sub(/\),/, "", bw)
+        gain = $6
+        sub(/\(/, "", gain)
+        sub(/,/, "", gain)
+        power = $7
+        sub(/\)/, "", power)
+        sub(/,/, "", power)
+        # power might be in mW...
+        units = $8
+        sub(/\)/, "", units)
+        sub(/,/, "", units)
+        if (units == "mW") {
+                if (power == 100) {
+                        power = 20
+                } else if (power == 200) {
+                        power = 23
+                } else if (power == 500) {
+                        power = 27
+                } else if (power == 1000) {
+                        power = 30
+                } else {
+                        print "Unknown power value in database!"
+                }
+        }
+        flagstr = ""
+        for (i=8; i<=NF; i++)
+                flagstr = flagstr $i
+        split(flagstr, flagarray, ",")
+        flags = ""
+        for (arg in flagarray) {
+                if (flagarray[arg] == "NO-OFDM") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_OFDM | "
+                } else if (flagarray[arg] == "NO-CCK") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_CCK | "
+                } else if (flagarray[arg] == "NO-INDOOR") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_INDOOR | "
+                } else if (flagarray[arg] == "NO-OUTDOOR") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_OUTDOOR | "
+                } else if (flagarray[arg] == "DFS") {
+                        flags = flags "\n\t\t\tNL80211_RRF_DFS | "
+                } else if (flagarray[arg] == "PTP-ONLY") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PTP_ONLY | "
+                } else if (flagarray[arg] == "PTMP-ONLY") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PTMP_ONLY | "
+                } else if (flagarray[arg] == "PASSIVE-SCAN") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PASSIVE_SCAN | "
+                } else if (flagarray[arg] == "NO-IBSS") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_IBSS | "
+                }
+        }
+        flags = flags "0"
+        printf "\t\tREG_RULE(%d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, flags
+        rules++
+}
+
+active && /^[ \t]*$/ {
+        active = 0
+        printf "\t},\n"
+        printf "\t.n_reg_rules = %d\n", rules
+        printf "};\n\n"
+        rules = 0;
+}
+
+END {
+        print regdb "};"
+        print ""
+        print "int reg_regdb_size = ARRAY_SIZE(reg_regdb);"
+}
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index c88338911979..6a5acf750174 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -6,6 +6,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <net/cfg80211.h>
 #include "wext-compat.h"
 #include "nl80211.h"
@@ -15,7 +16,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -44,7 +45,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 
         nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
                                 GFP_KERNEL);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         memset(&wrqu, 0, sizeof(wrqu));
         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
@@ -70,7 +71,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_ibss_joined);
 
@@ -96,7 +97,7 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                 kfree(wdev->connect_keys);
         wdev->connect_keys = connkeys;
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.channel = params->channel;
 #endif
         err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
@@ -154,7 +155,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 
         wdev->current_bss = NULL;
         wdev->ssid_len = 0;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!nowext)
                 wdev->wext.ibss.ssid_len = 0;
 #endif
@@ -169,8 +170,8 @@ void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
         wdev_unlock(wdev);
 }
 
-static int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
-                                 struct net_device *dev, bool nowext)
+int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, bool nowext)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
@@ -203,7 +204,7 @@ int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
         return err;
 }
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
 int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                             struct wireless_dev *wdev)
 {
diff --git a/net/wireless/lib80211_crypt_ccmp.c b/net/wireless/lib80211_crypt_ccmp.c
index 2301dc1edc4c..b7fa31d5fd13 100644
--- a/net/wireless/lib80211_crypt_ccmp.c
+++ b/net/wireless/lib80211_crypt_ccmp.c
@@ -237,7 +237,6 @@ static int lib80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 return -1;
 
         pos = skb->data + hdr_len + CCMP_HDR_LEN;
-        mic = skb_put(skb, CCMP_MIC_LEN);
         hdr = (struct ieee80211_hdr *)skb->data;
         ccmp_init_blocks(key->tfm, hdr, key->tx_pn, data_len, b0, b, s0);
 
@@ -257,6 +256,7 @@ static int lib80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 pos += len;
         }
 
+        mic = skb_put(skb, CCMP_MIC_LEN);
         for (i = 0; i < CCMP_MIC_LEN; i++)
                 mic[i] = b[i] ^ s0[i];
 
diff --git a/net/wireless/lib80211_crypt_tkip.c b/net/wireless/lib80211_crypt_tkip.c
index c36287399d7e..8cbdb32ff316 100644
--- a/net/wireless/lib80211_crypt_tkip.c
+++ b/net/wireless/lib80211_crypt_tkip.c
@@ -36,6 +36,8 @@ MODULE_AUTHOR("Jouni Malinen");
 MODULE_DESCRIPTION("lib80211 crypt: TKIP");
 MODULE_LICENSE("GPL");
 
+#define TKIP_HDR_LEN 8
+
 struct lib80211_tkip_data {
 #define TKIP_KEY_LEN 32
         u8 key[TKIP_KEY_LEN];
@@ -314,13 +316,12 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
                               u8 * rc4key, int keylen, void *priv)
 {
         struct lib80211_tkip_data *tkey = priv;
-        int len;
         u8 *pos;
         struct ieee80211_hdr *hdr;
 
         hdr = (struct ieee80211_hdr *)skb->data;
 
-        if (skb_headroom(skb) < 8 || skb->len < hdr_len)
+        if (skb_headroom(skb) < TKIP_HDR_LEN || skb->len < hdr_len)
                 return -1;
 
         if (rc4key == NULL || keylen < 16)
@@ -333,9 +334,8 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
         }
         tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
 
-        len = skb->len - hdr_len;
-        pos = skb_push(skb, 8);
-        memmove(pos, pos + 8, hdr_len);
+        pos = skb_push(skb, TKIP_HDR_LEN);
+        memmove(pos, pos + TKIP_HDR_LEN, hdr_len);
         pos += hdr_len;
 
         *pos++ = *rc4key;
@@ -353,7 +353,7 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
                 tkey->tx_iv32++;
         }
 
-        return 8;
+        return TKIP_HDR_LEN;
 }
 
 static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
@@ -384,9 +384,8 @@ static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         if ((lib80211_tkip_hdr(skb, hdr_len, rc4key, 16, priv)) < 0)
                 return -1;
 
-        icv = skb_put(skb, 4);
-
         crc = ~crc32_le(~0, pos, len);
+        icv = skb_put(skb, 4);
         icv[0] = crc;
         icv[1] = crc >> 8;
         icv[2] = crc >> 16;
@@ -434,7 +433,7 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 return -1;
         }
 
-        if (skb->len < hdr_len + 8 + 4)
+        if (skb->len < hdr_len + TKIP_HDR_LEN + 4)
                 return -1;
 
         pos = skb->data + hdr_len;
@@ -462,7 +461,7 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         }
         iv16 = (pos[0] << 8) | pos[2];
         iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
-        pos += 8;
+        pos += TKIP_HDR_LEN;
 
         if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) {
 #ifdef CONFIG_LIB80211_DEBUG
@@ -523,8 +522,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         tkey->rx_iv16_new = iv16;
 
         /* Remove IV and ICV */
-        memmove(skb->data + 8, skb->data, hdr_len);
-        skb_pull(skb, 8);
+        memmove(skb->data + TKIP_HDR_LEN, skb->data, hdr_len);
+        skb_pull(skb, TKIP_HDR_LEN);
         skb_trim(skb, skb->len - 4);
 
         return keyidx;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 0a6b7a0eca6b..22139fa46115 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/nl80211.h>
+#include <linux/slab.h>
 #include <linux/wireless.h>
 #include <net/cfg80211.h>
 #include <net/iw_handler.h>
@@ -62,7 +63,6 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
         u8 *ie = mgmt->u.assoc_resp.variable;
         int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
         struct cfg80211_internal_bss *bss = NULL;
-        bool need_connect_result = true;
 
         wdev_lock(wdev);
 
@@ -94,10 +94,20 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                         }
                 }
 
-                WARN_ON(!bss);
+                /*
+                 * We might be coming here because the driver reported
+                 * a successful association at the same time as the
+                 * user requested a deauth. In that case, we will have
+                 * removed the BSS from the auth_bsses list due to the
+                 * deauth request when the assoc response makes it. If
+                 * the two code paths acquire the lock the other way
+                 * around, that's just the standard situation of a
+                 * deauth being requested while connected.
+                 */
+                if (!bss)
+                        goto out;
         } else if (wdev->conn) {
                 cfg80211_sme_failed_assoc(wdev);
-                need_connect_result = false;
                 /*
                  * do not call connect_result() now because the
                  * sme will schedule work that does it later.
@@ -130,7 +140,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 
-static void __cfg80211_send_deauth(struct net_device *dev,
+void __cfg80211_send_deauth(struct net_device *dev,
                                    const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -139,25 +149,23 @@ static void __cfg80211_send_deauth(struct net_device *dev,
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
         int i;
-        bool done = false;
+        bool found = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
-        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
-
         if (wdev->current_bss &&
             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
-                done = true;
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(&wdev->current_bss->pub);
                 wdev->current_bss = NULL;
+                found = true;
         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
                 if (wdev->auth_bsses[i] &&
                     memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
                         wdev->auth_bsses[i] = NULL;
-                        done = true;
+                        found = true;
                         break;
                 }
                 if (wdev->authtry_bsses[i] &&
@@ -165,12 +173,15 @@ static void __cfg80211_send_deauth(struct net_device *dev,
                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
                         wdev->authtry_bsses[i] = NULL;
-                        done = true;
+                        found = true;
                         break;
                 }
         }
 
-        WARN_ON(!done);
+        if (!found)
+                return;
+
+        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 
         if (wdev->sme_state == CFG80211_SME_CONNECTED) {
                 u16 reason_code;
@@ -186,27 +197,19 @@ static void __cfg80211_send_deauth(struct net_device *dev,
                                           false, NULL);
         }
 }
+EXPORT_SYMBOL(__cfg80211_send_deauth);
 
-
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len,
-                          void *cookie)
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        BUG_ON(cookie && wdev != cookie);
-
-        if (cookie) {
-                /* called within callback */
-                __cfg80211_send_deauth(dev, buf, len);
-        } else {
-                wdev_lock(wdev);
-                __cfg80211_send_deauth(dev, buf, len);
-                wdev_unlock(wdev);
-        }
+        wdev_lock(wdev);
+        __cfg80211_send_deauth(dev, buf, len);
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_deauth);
 
-static void __cfg80211_send_disassoc(struct net_device *dev,
+void __cfg80211_send_disassoc(struct net_device *dev,
                                      const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -247,40 +250,24 @@ static void __cfg80211_send_disassoc(struct net_device *dev,
         from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
+EXPORT_SYMBOL(__cfg80211_send_disassoc);
 
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len,
-                            void *cookie)
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        BUG_ON(cookie && wdev != cookie);
-
-        if (cookie) {
-                /* called within callback */
-                __cfg80211_send_disassoc(dev, buf, len);
-        } else {
-                wdev_lock(wdev);
-                __cfg80211_send_disassoc(dev, buf, len);
-                wdev_unlock(wdev);
-        }
+        wdev_lock(wdev);
+        __cfg80211_send_disassoc(dev, buf, len);
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_disassoc);
 
-void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
+static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
 {
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         int i;
         bool done = false;
 
-        wdev_lock(wdev);
-
-        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
-        if (wdev->sme_state == CFG80211_SME_CONNECTING)
-                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
-                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false, NULL);
+        ASSERT_WDEV_LOCK(wdev);
 
         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
                 if (wdev->authtry_bsses[i] &&
@@ -295,6 +282,29 @@ void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
         }
 
         WARN_ON(!done);
+}
+
+void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
+{
+        __cfg80211_auth_remove(dev->ieee80211_ptr, addr);
+}
+EXPORT_SYMBOL(__cfg80211_auth_canceled);
+
+void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        wdev_lock(wdev);
+
+        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
+        if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false, NULL);
+
+        __cfg80211_auth_remove(wdev, addr);
 
         wdev_unlock(wdev);
 }
@@ -340,7 +350,7 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
         char *buf = kmalloc(128, gfp);
 
@@ -469,12 +479,23 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
         struct cfg80211_assoc_request req;
         struct cfg80211_internal_bss *bss;
         int i, err, slot = -1;
+        bool was_connected = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
         memset(&req, 0, sizeof(req));
 
-        if (wdev->current_bss)
+        if (wdev->current_bss && prev_bssid &&
+            memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
+                /*
+                 * Trying to reassociate: Allow this to proceed and let the old
+                 * association to be dropped when the new one is completed.
+                 */
+                if (wdev->sme_state == CFG80211_SME_CONNECTED) {
+                        was_connected = true;
+                        wdev->sme_state = CFG80211_SME_CONNECTING;
+                }
+        } else if (wdev->current_bss)
                 return -EALREADY;
 
         req.ie = ie;
@@ -484,8 +505,11 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
         req.prev_bssid = prev_bssid;
         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-        if (!req.bss)
+        if (!req.bss) {
+                if (was_connected)
+                        wdev->sme_state = CFG80211_SME_CONNECTED;
                 return -ENOENT;
+        }
 
         bss = bss_from_pub(req.bss);
 
@@ -503,6 +527,8 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 
         err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
  out:
+        if (err && was_connected)
+                wdev->sme_state = CFG80211_SME_CONNECTED;
         /* still a reference in wdev->auth_bsses[slot] */
         cfg80211_put_bss(req.bss);
         return err;
@@ -666,3 +692,206 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
                 }
         }
 }
+
+void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
+                               struct ieee80211_channel *chan,
+                               enum nl80211_channel_type channel_type,
+                               unsigned int duration, gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
+                                       duration, gfp);
+}
+EXPORT_SYMBOL(cfg80211_ready_on_channel);
+
+void cfg80211_remain_on_channel_expired(struct net_device *dev,
+                                        u64 cookie,
+                                        struct ieee80211_channel *chan,
+                                        enum nl80211_channel_type channel_type,
+                                        gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
+                                              channel_type, gfp);
+}
+EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
+
+void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
+                      struct station_info *sinfo, gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
+}
+EXPORT_SYMBOL(cfg80211_new_sta);
+
+struct cfg80211_action_registration {
+        struct list_head list;
+
+        u32 nlpid;
+
+        int match_len;
+
+        u8 match[];
+};
+
+int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
+                                  const u8 *match_data, int match_len)
+{
+        struct cfg80211_action_registration *reg, *nreg;
+        int err = 0;
+
+        nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
+        if (!nreg)
+                return -ENOMEM;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry(reg, &wdev->action_registrations, list) {
+                int mlen = min(match_len, reg->match_len);
+
+                if (memcmp(reg->match, match_data, mlen) == 0) {
+                        err = -EALREADY;
+                        break;
+                }
+        }
+
+        if (err) {
+                kfree(nreg);
+                goto out;
+        }
+
+        memcpy(nreg->match, match_data, match_len);
+        nreg->match_len = match_len;
+        nreg->nlpid = snd_pid;
+        list_add(&nreg->list, &wdev->action_registrations);
+
+ out:
+        spin_unlock_bh(&wdev->action_registrations_lock);
+        return err;
+}
+
+void cfg80211_mlme_unregister_actions(struct wireless_dev *wdev, u32 nlpid)
+{
+        struct cfg80211_action_registration *reg, *tmp;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
+                if (reg->nlpid == nlpid) {
+                        list_del(&reg->list);
+                        kfree(reg);
+                }
+        }
+
+        spin_unlock_bh(&wdev->action_registrations_lock);
+}
+
+void cfg80211_mlme_purge_actions(struct wireless_dev *wdev)
+{
+        struct cfg80211_action_registration *reg, *tmp;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
+                list_del(&reg->list);
+                kfree(reg);
+        }
+
+        spin_unlock_bh(&wdev->action_registrations_lock);
+}
+
+int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_channel_type channel_type,
+                         const u8 *buf, size_t len, u64 *cookie)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        const struct ieee80211_mgmt *mgmt;
+
+        if (rdev->ops->action == NULL)
+                return -EOPNOTSUPP;
+        if (len < 24 + 1)
+                return -EINVAL;
+
+        mgmt = (const struct ieee80211_mgmt *) buf;
+        if (!ieee80211_is_action(mgmt->frame_control))
+                return -EINVAL;
+        if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
+                /* Verify that we are associated with the destination AP */
+                if (!wdev->current_bss ||
+                    memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
+                           ETH_ALEN) != 0 ||
+                    memcmp(wdev->current_bss->pub.bssid, mgmt->da,
+                           ETH_ALEN) != 0)
+                        return -ENOTCONN;
+        }
+
+        if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
+                return -EINVAL;
+
+        /* Transmit the Action frame as requested by user space */
+        return rdev->ops->action(&rdev->wiphy, dev, chan, channel_type,
+                                 buf, len, cookie);
+}
+
+bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
+                        size_t len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_action_registration *reg;
+        const u8 *action_data;
+        int action_data_len;
+        bool result = false;
+
+        /* frame length - min size excluding category */
+        action_data_len = len - (IEEE80211_MIN_ACTION_SIZE - 1);
+
+        /* action data starts with category */
+        action_data = buf + IEEE80211_MIN_ACTION_SIZE - 1;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry(reg, &wdev->action_registrations, list) {
+                if (reg->match_len > action_data_len)
+                        continue;
+
+                if (memcmp(reg->match, action_data, reg->match_len))
+                        continue;
+
+                /* found match! */
+
+                /* Indicate the received Action frame to user space */
+                if (nl80211_send_action(rdev, dev, reg->nlpid, freq,
+                                        buf, len, gfp))
+                        continue;
+
+                result = true;
+                break;
+        }
+
+        spin_unlock_bh(&wdev->action_registrations_lock);
+
+        return result;
+}
+EXPORT_SYMBOL(cfg80211_rx_action);
+
+void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
+                               const u8 *buf, size_t len, bool ack, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        /* Indicate TX status of the Action frame to user space */
+        nl80211_send_action_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
+}
+EXPORT_SYMBOL(cfg80211_action_tx_status);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ca3c92a0a14f..030cf153bea2 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1,12 +1,13 @@
 /*
  * This is the new netlink-based wireless configuration interface.
  *
- * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/if_ether.h>
 #include <linux/ieee80211.h>
@@ -58,7 +59,7 @@ static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
 }
 
 /* policy for the attributes */
-static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
+static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
                                       .len = 20-1 },
@@ -69,6 +70,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 
         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
@@ -138,11 +140,20 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
         [NL80211_ATTR_PID] = { .type = NLA_U32 },
+        [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
+        [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
+                                 .len = WLAN_PMKID_LEN },
+        [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
+        [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
+        [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
+        [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
+                                 .len = IEEE80211_MAX_DATA_LEN },
+        [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
+        [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 };
 
 /* policy for the attributes */
-static struct nla_policy
-nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
+static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
         [NL80211_KEY_IDX] = { .type = NLA_U8 },
         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
@@ -151,6 +162,26 @@ nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 };
 
+/* ifidx get helper */
+static int nl80211_get_ifidx(struct netlink_callback *cb)
+{
+        int res;
+
+        res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                          nl80211_fam.attrbuf, nl80211_fam.maxattr,
+                          nl80211_policy);
+        if (res)
+                return res;
+
+        if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                return -EINVAL;
+
+        res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+        if (!res)
+                return -EINVAL;
+        return res;
+}
+
 /* IE validation */
 static bool is_valid_ie_attr(const struct nlattr *attr)
 {
@@ -419,6 +450,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                     dev->wiphy.frag_threshold);
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
                     dev->wiphy.rts_threshold);
+        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
+                    dev->wiphy.coverage_class);
 
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                    dev->wiphy.max_scan_ssids);
@@ -429,6 +462,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 sizeof(u32) * dev->wiphy.n_cipher_suites,
                 dev->wiphy.cipher_suites);
 
+        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
+                   dev->wiphy.max_num_pmkids);
+
         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
         if (!nl_modes)
                 goto nla_put_failure;
@@ -540,7 +576,13 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(deauth, DEAUTHENTICATE);
         CMD(disassoc, DISASSOCIATE);
         CMD(join_ibss, JOIN_IBSS);
-        if (dev->wiphy.netnsok) {
+        CMD(set_pmksa, SET_PMKSA);
+        CMD(del_pmksa, DEL_PMKSA);
+        CMD(flush_pmksa, FLUSH_PMKSA);
+        CMD(remain_on_channel, REMAIN_ON_CHANNEL);
+        CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
+        CMD(action, ACTION);
+        if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                 i++;
                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
         }
@@ -652,6 +694,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         u32 changed;
         u8 retry_short = 0, retry_long = 0;
         u32 frag_threshold = 0, rts_threshold = 0;
+        u8 coverage_class = 0;
 
         rtnl_lock();
 
@@ -774,9 +817,16 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
         }
 
+        if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
+                coverage_class = nla_get_u8(
+                        info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
+                changed |= WIPHY_PARAM_COVERAGE_CLASS;
+        }
+
         if (changed) {
                 u8 old_retry_short, old_retry_long;
                 u32 old_frag_threshold, old_rts_threshold;
+                u8 old_coverage_class;
 
                 if (!rdev->ops->set_wiphy_params) {
                         result = -EOPNOTSUPP;
@@ -787,6 +837,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 old_retry_long = rdev->wiphy.retry_long;
                 old_frag_threshold = rdev->wiphy.frag_threshold;
                 old_rts_threshold = rdev->wiphy.rts_threshold;
+                old_coverage_class = rdev->wiphy.coverage_class;
 
                 if (changed & WIPHY_PARAM_RETRY_SHORT)
                         rdev->wiphy.retry_short = retry_short;
@@ -796,6 +847,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         rdev->wiphy.frag_threshold = frag_threshold;
                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
                         rdev->wiphy.rts_threshold = rts_threshold;
+                if (changed & WIPHY_PARAM_COVERAGE_CLASS)
+                        rdev->wiphy.coverage_class = coverage_class;
 
                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
                 if (result) {
@@ -803,6 +856,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         rdev->wiphy.retry_long = old_retry_long;
                         rdev->wiphy.frag_threshold = old_frag_threshold;
                         rdev->wiphy.rts_threshold = old_rts_threshold;
+                        rdev->wiphy.coverage_class = old_coverage_class;
                 }
         }
 
@@ -947,6 +1001,32 @@ static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
         return 0;
 }
 
+static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, u8 use_4addr,
+                               enum nl80211_iftype iftype)
+{
+        if (!use_4addr) {
+                if (netdev && netdev->br_port)
+                        return -EBUSY;
+                return 0;
+        }
+
+        switch (iftype) {
+        case NL80211_IFTYPE_AP_VLAN:
+                if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
+                        return 0;
+                break;
+        case NL80211_IFTYPE_STATION:
+                if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
+                        return 0;
+                break;
+        default:
+                break;
+        }
+
+        return -EOPNOTSUPP;
+}
+
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
@@ -987,6 +1067,16 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
+        if (info->attrs[NL80211_ATTR_4ADDR]) {
+                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
+                change = true;
+                err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
+                if (err)
+                        goto unlock;
+        } else {
+                params.use_4addr = -1;
+        }
+
         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
                 if (ntype != NL80211_IFTYPE_MONITOR) {
                         err = -EINVAL;
@@ -1006,6 +1096,9 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         else
                 err = 0;
 
+        if (!err && params.use_4addr != -1)
+                dev->ieee80211_ptr->use_4addr = params.use_4addr;
+
  unlock:
         dev_put(dev);
         cfg80211_unlock_rdev(rdev);
@@ -1053,6 +1146,13 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
         }
 
+        if (info->attrs[NL80211_ATTR_4ADDR]) {
+                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
+                err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
+                if (err)
+                        goto unlock;
+        }
+
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
@@ -1264,7 +1364,7 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
         if (!err)
                 err = func(&rdev->wiphy, dev, key.idx);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!err) {
                 if (func == rdev->ops->set_default_key)
                         dev->ieee80211_ptr->wext.default_key = key.idx;
@@ -1365,7 +1465,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         if (!err)
                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!err) {
                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
                         dev->ieee80211_ptr->wext.default_key = -1;
@@ -1562,42 +1662,9 @@ static int parse_station_flags(struct genl_info *info,
         return 0;
 }
 
-static u16 nl80211_calculate_bitrate(struct rate_info *rate)
-{
-        int modulation, streams, bitrate;
-
-        if (!(rate->flags & RATE_INFO_FLAGS_MCS))
-                return rate->legacy;
-
-        /* the formula below does only work for MCS values smaller than 32 */
-        if (rate->mcs >= 32)
-                return 0;
-
-        modulation = rate->mcs & 7;
-        streams = (rate->mcs >> 3) + 1;
-
-        bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
-                        13500000 : 6500000;
-
-        if (modulation < 4)
-                bitrate *= (modulation + 1);
-        else if (modulation == 4)
-                bitrate *= (modulation + 2);
-        else
-                bitrate *= (modulation + 3);
-
-        bitrate *= streams;
-
-        if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
-                bitrate = (bitrate / 9) * 10;
-
-        /* do NOT round down here */
-        return (bitrate + 50000) / 100000;
-}
-
 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                                 int flags, struct net_device *dev,
-                                u8 *mac_addr, struct station_info *sinfo)
+                                const u8 *mac_addr, struct station_info *sinfo)
 {
         void *hdr;
         struct nlattr *sinfoattr, *txrate;
@@ -1641,8 +1708,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                 if (!txrate)
                         goto nla_put_failure;
 
-                /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
-                bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
+                /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
+                bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
                 if (bitrate > 0)
                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
 
@@ -1682,20 +1749,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
         int sta_idx = cb->args[1];
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
 
         rtnl_lock();
 
@@ -1800,7 +1857,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 }
 
 /*
- * Get vlan interface making sure it is on the right wiphy.
+ * Get vlan interface making sure it is running and on the right wiphy.
  */
 static int get_vlan(struct genl_info *info,
                     struct cfg80211_registered_device *rdev,
@@ -1818,6 +1875,8 @@ static int get_vlan(struct genl_info *info,
                         return -EINVAL;
                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
                         return -EINVAL;
+                if (!netif_running(*vlan))
+                        return -ENETDOWN;
         }
         return 0;
 }
@@ -1956,6 +2015,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
                 return -EINVAL;
 
+        if (!info->attrs[NL80211_ATTR_STA_AID])
+                return -EINVAL;
+
         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
         params.supported_rates =
                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
@@ -1964,11 +2026,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 
-        if (info->attrs[NL80211_ATTR_STA_AID]) {
-                params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
-                if (!params.aid || params.aid > IEEE80211_MAX_AID)
-                        return -EINVAL;
-        }
+        params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        if (!params.aid || params.aid > IEEE80211_MAX_AID)
+                return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
                 params.ht_capa =
@@ -1983,6 +2043,12 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out_rtnl;
 
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
+                err = -EINVAL;
+                goto out;
+        }
+
         err = get_vlan(info, rdev, &params.vlan);
         if (err)
                 goto out;
@@ -1990,35 +2056,6 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         /* validate settings */
         err = 0;
 
-        switch (dev->ieee80211_ptr->iftype) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_AP_VLAN:
-                /* all ok but must have AID */
-                if (!params.aid)
-                        err = -EINVAL;
-                break;
-        case NL80211_IFTYPE_MESH_POINT:
-                /* disallow things mesh doesn't support */
-                if (params.vlan)
-                        err = -EINVAL;
-                if (params.aid)
-                        err = -EINVAL;
-                if (params.ht_capa)
-                        err = -EINVAL;
-                if (params.listen_interval >= 0)
-                        err = -EINVAL;
-                if (params.supported_rates)
-                        err = -EINVAL;
-                if (params.sta_flags_mask)
-                        err = -EINVAL;
-                break;
-        default:
-                err = -EINVAL;
-        }
-
-        if (err)
-                goto out;
-
         if (!rdev->ops->add_station) {
                 err = -EOPNOTSUPP;
                 goto out;
@@ -2059,8 +2096,7 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
                 goto out_rtnl;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
                 err = -EINVAL;
                 goto out;
         }
@@ -2105,9 +2141,9 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
                             pinfo->frame_qlen);
-        if (pinfo->filled & MPATH_INFO_DSN)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
-                            pinfo->dsn);
+        if (pinfo->filled & MPATH_INFO_SN)
+                NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
+                            pinfo->sn);
         if (pinfo->filled & MPATH_INFO_METRIC)
                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
                             pinfo->metric);
@@ -2145,20 +2181,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         int path_idx = cb->args[1];
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
 
         rtnl_lock();
 
@@ -2457,8 +2483,7 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static const struct nla_policy
-        reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
+static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
@@ -2526,12 +2551,6 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 
         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-        /* We ignore world regdom requests with the old regdom setup */
-        if (is_world_regdom(data))
-                return -EINVAL;
-#endif
-
         r = regulatory_hint_user(data);
 
         return r;
@@ -2605,6 +2624,8 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
                         cur_params.dot11MeshHWMPpreqMinInterval);
         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
+        NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
+                        cur_params.dot11MeshHWMPRootMode);
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
         err = genlmsg_reply(msg, info);
@@ -2631,8 +2652,7 @@ do {\
         } \
 } while (0);\
 
-static struct nla_policy
-nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
+static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
@@ -2715,6 +2735,10 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
                         dot11MeshHWMPnetDiameterTraversalTime,
                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                         nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
+                        dot11MeshHWMPRootMode, mask,
+                        NL80211_MESHCONF_HWMP_ROOTMODE,
+                        nla_get_u8);
 
         /* Apply changes */
         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
@@ -2988,7 +3012,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        request->n_channels = n_channels;
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
         request->n_ssids = n_ssids;
@@ -2999,32 +3022,53 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                         request->ie = (void *)(request->channels + n_channels);
         }
 
+        i = 0;
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
                 /* user specified, bail out if channel not found */
-                request->n_channels = n_channels;
-                i = 0;
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
-                        request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
-                        if (!request->channels[i]) {
+                        struct ieee80211_channel *chan;
+
+                        chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
+
+                        if (!chan) {
                                 err = -EINVAL;
                                 goto out_free;
                         }
+
+                        /* ignore disabled channels */
+                        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                continue;
+
+                        request->channels[i] = chan;
                         i++;
                 }
         } else {
                 /* all channels */
-                i = 0;
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         int j;
                         if (!wiphy->bands[band])
                                 continue;
                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
-                                request->channels[i] = &wiphy->bands[band]->channels[j];
+                                struct ieee80211_channel *chan;
+
+                                chan = &wiphy->bands[band]->channels[j];
+
+                                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                        continue;
+
+                                request->channels[i] = chan;
                                 i++;
                         }
                 }
         }
 
+        if (!i) {
+                err = -EINVAL;
+                goto out_free;
+        }
+
+        request->n_channels = i;
+
         i = 0;
         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
@@ -3099,12 +3143,18 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
                         res->len_information_elements,
                         res->information_elements);
+        if (res->beacon_ies && res->len_beacon_ies &&
+            res->beacon_ies != res->information_elements)
+                NLA_PUT(msg, NL80211_BSS_BEACON_IES,
+                        res->len_beacon_ies, res->beacon_ies);
         if (res->tsf)
                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
         if (res->beacon_interval)
                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
+        NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
+                jiffies_to_msecs(jiffies - intbss->ts));
 
         switch (rdev->wiphy.signal_type) {
         case CFG80211_SIGNAL_TYPE_MBM:
@@ -3159,21 +3209,11 @@ static int nl80211_dump_scan(struct sk_buff *skb,
         int start = cb->args[1], idx = 0;
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-                cb->args[0] = ifidx;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
+        cb->args[0] = ifidx;
 
         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
         if (!dev)
@@ -3216,6 +3256,106 @@ static int nl80211_dump_scan(struct sk_buff *skb,
         return err;
 }
 
+static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
+                                int flags, struct net_device *dev,
+                                struct survey_info *survey)
+{
+        void *hdr;
+        struct nlattr *infoattr;
+
+        /* Survey without a channel doesn't make sense */
+        if (!survey->channel)
+                return -EINVAL;
+
+        hdr = nl80211hdr_put(msg, pid, seq, flags,
+                             NL80211_CMD_NEW_SURVEY_RESULTS);
+        if (!hdr)
+                return -ENOMEM;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+
+        infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
+        if (!infoattr)
+                goto nla_put_failure;
+
+        NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
+                    survey->channel->center_freq);
+        if (survey->filled & SURVEY_INFO_NOISE_DBM)
+                NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
+                            survey->noise);
+
+        nla_nest_end(msg, infoattr);
+
+        return genlmsg_end(msg, hdr);
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
+static int nl80211_dump_survey(struct sk_buff *skb,
+                        struct netlink_callback *cb)
+{
+        struct survey_info survey;
+        struct cfg80211_registered_device *dev;
+        struct net_device *netdev;
+        int ifidx = cb->args[0];
+        int survey_idx = cb->args[1];
+        int res;
+
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
+        cb->args[0] = ifidx;
+
+        rtnl_lock();
+
+        netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
+        if (!netdev) {
+                res = -ENODEV;
+                goto out_rtnl;
+        }
+
+        dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
+        if (IS_ERR(dev)) {
+                res = PTR_ERR(dev);
+                goto out_rtnl;
+        }
+
+        if (!dev->ops->dump_survey) {
+                res = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        while (1) {
+                res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
+                                            &survey);
+                if (res == -ENOENT)
+                        break;
+                if (res)
+                        goto out_err;
+
+                if (nl80211_send_survey(skb,
+                                NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                netdev,
+                                &survey) < 0)
+                        goto out;
+                survey_idx++;
+        }
+
+ out:
+        cb->args[1] = survey_idx;
+        res = skb->len;
+ out_err:
+        cfg80211_unlock_rdev(dev);
+ out_rtnl:
+        rtnl_unlock();
+
+        return res;
+}
+
 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
 {
         return auth_type <= NL80211_AUTHTYPE_MAX;
@@ -3411,6 +3551,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
         struct net_device *dev;
+        struct wireless_dev *wdev;
         struct cfg80211_crypto_settings crypto;
         struct ieee80211_channel *chan, *fixedchan;
         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
@@ -3456,7 +3597,8 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         }
 
         mutex_lock(&rdev->devlist_mtx);
-        fixedchan = rdev_fixed_channel(rdev, NULL);
+        wdev = dev->ieee80211_ptr;
+        fixedchan = rdev_fixed_channel(rdev, wdev);
         if (fixedchan && chan != fixedchan) {
                 err = -EBUSY;
                 mutex_unlock(&rdev->devlist_mtx);
@@ -4054,6 +4196,589 @@ static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
+                        struct cfg80211_pmksa *pmksa) = NULL;
+        int err;
+        struct net_device *dev;
+        struct cfg80211_pmksa pmksa;
+
+        memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_PMKID])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto out_rtnl;
+
+        pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
+        pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        switch (info->genlhdr->cmd) {
+        case NL80211_CMD_SET_PMKSA:
+                rdev_ops = rdev->ops->set_pmksa;
+                break;
+        case NL80211_CMD_DEL_PMKSA:
+                rdev_ops = rdev->ops->del_pmksa;
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+
+        if (!rdev_ops) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        err = rdev_ops(&rdev->wiphy, dev, &pmksa);
+
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ out_rtnl:
+        rtnl_unlock();
+
+        return err;
+}
+
+static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        int err;
+        struct net_device *dev;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto out_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!rdev->ops->flush_pmksa) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
+
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ out_rtnl:
+        rtnl_unlock();
+
+        return err;
+
+}
+
+static int nl80211_remain_on_channel(struct sk_buff *skb,
+                                     struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        struct ieee80211_channel *chan;
+        struct sk_buff *msg;
+        void *hdr;
+        u64 cookie;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        u32 freq, duration;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
+            !info->attrs[NL80211_ATTR_DURATION])
+                return -EINVAL;
+
+        duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
+
+        /*
+         * We should be on that channel for at least one jiffie,
+         * and more than 5 seconds seems excessive.
+         */
+        if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->remain_on_channel) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
+                channel_type = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
+                if (channel_type != NL80211_CHAN_NO_HT &&
+                    channel_type != NL80211_CHAN_HT20 &&
+                    channel_type != NL80211_CHAN_HT40PLUS &&
+                    channel_type != NL80211_CHAN_HT40MINUS)
+                        err = -EINVAL;
+                        goto out;
+        }
+
+        freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (chan == NULL) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_REMAIN_ON_CHANNEL);
+
+        if (IS_ERR(hdr)) {
+                err = PTR_ERR(hdr);
+                goto free_msg;
+        }
+
+        err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
+                                           channel_type, duration, &cookie);
+
+        if (err)
+                goto free_msg;
+
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_reply(msg, info);
+        goto out;
+
+ nla_put_failure:
+        err = -ENOBUFS;
+ free_msg:
+        nlmsg_free(msg);
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
+                                            struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        u64 cookie;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_COOKIE])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->cancel_remain_on_channel) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
+
+        err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
+
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
+                           u8 *rates, u8 rates_len)
+{
+        u8 i;
+        u32 mask = 0;
+
+        for (i = 0; i < rates_len; i++) {
+                int rate = (rates[i] & 0x7f) * 5;
+                int ridx;
+                for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
+                        struct ieee80211_rate *srate =
+                                &sband->bitrates[ridx];
+                        if (rate == srate->bitrate) {
+                                mask |= 1 << ridx;
+                                break;
+                        }
+                }
+                if (ridx == sband->n_bitrates)
+                        return 0; /* rate not found */
+        }
+
+        return mask;
+}
+
+static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
+        [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
+                                    .len = NL80211_MAX_SUPP_RATES },
+};
+
+static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
+                                       struct genl_info *info)
+{
+        struct nlattr *tb[NL80211_TXRATE_MAX + 1];
+        struct cfg80211_registered_device *rdev;
+        struct cfg80211_bitrate_mask mask;
+        int err, rem, i;
+        struct net_device *dev;
+        struct nlattr *tx_rates;
+        struct ieee80211_supported_band *sband;
+
+        if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->set_bitrate_mask) {
+                err = -EOPNOTSUPP;
+                goto unlock;
+        }
+
+        memset(&mask, 0, sizeof(mask));
+        /* Default to all rates enabled */
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                sband = rdev->wiphy.bands[i];
+                mask.control[i].legacy =
+                        sband ? (1 << sband->n_bitrates) - 1 : 0;
+        }
+
+        /*
+         * The nested attribute uses enum nl80211_band as the index. This maps
+         * directly to the enum ieee80211_band values used in cfg80211.
+         */
+        nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
+        {
+                enum ieee80211_band band = nla_type(tx_rates);
+                if (band < 0 || band >= IEEE80211_NUM_BANDS) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
+                sband = rdev->wiphy.bands[band];
+                if (sband == NULL) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
+                nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
+                          nla_len(tx_rates), nl80211_txattr_policy);
+                if (tb[NL80211_TXRATE_LEGACY]) {
+                        mask.control[band].legacy = rateset_to_mask(
+                                sband,
+                                nla_data(tb[NL80211_TXRATE_LEGACY]),
+                                nla_len(tb[NL80211_TXRATE_LEGACY]));
+                        if (mask.control[band].legacy == 0) {
+                                err = -EINVAL;
+                                goto unlock;
+                        }
+                }
+        }
+
+        err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
+
+ unlock:
+        dev_put(dev);
+        cfg80211_unlock_rdev(rdev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
+                return -EINVAL;
+
+        if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        /* not much point in registering if we can't reply */
+        if (!rdev->ops->action) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
+                        nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
+                        nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        struct ieee80211_channel *chan;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        u32 freq;
+        int err;
+        void *hdr;
+        u64 cookie;
+        struct sk_buff *msg;
+
+        if (!info->attrs[NL80211_ATTR_FRAME] ||
+            !info->attrs[NL80211_ATTR_WIPHY_FREQ])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->action) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
+                channel_type = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
+                if (channel_type != NL80211_CHAN_NO_HT &&
+                    channel_type != NL80211_CHAN_HT20 &&
+                    channel_type != NL80211_CHAN_HT40PLUS &&
+                    channel_type != NL80211_CHAN_HT40MINUS)
+                        err = -EINVAL;
+                        goto out;
+        }
+
+        freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (chan == NULL) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_ACTION);
+
+        if (IS_ERR(hdr)) {
+                err = PTR_ERR(hdr);
+                goto free_msg;
+        }
+        err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
+                                   nla_data(info->attrs[NL80211_ATTR_FRAME]),
+                                   nla_len(info->attrs[NL80211_ATTR_FRAME]),
+                                   &cookie);
+        if (err)
+                goto free_msg;
+
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_reply(msg, info);
+        goto out;
+
+ nla_put_failure:
+        err = -ENOBUFS;
+ free_msg:
+        nlmsg_free(msg);
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        struct net_device *dev;
+        u8 ps_state;
+        bool state;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_PS_STATE]) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
+
+        if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rdev;
+
+        wdev = dev->ieee80211_ptr;
+
+        if (!rdev->ops->set_power_mgmt) {
+                err = -EOPNOTSUPP;
+                goto unlock_rdev;
+        }
+
+        state = (ps_state == NL80211_PS_ENABLED) ? true : false;
+
+        if (state == wdev->ps)
+                goto unlock_rdev;
+
+        wdev->ps = state;
+
+        if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
+                                      wdev->ps_timeout))
+                /* assume this means it's off */
+                wdev->ps = false;
+
+unlock_rdev:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+        rtnl_unlock();
+
+out:
+        return err;
+}
+
+static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        enum nl80211_ps_state ps_state;
+        struct wireless_dev *wdev;
+        struct net_device *dev;
+        struct sk_buff *msg;
+        void *hdr;
+        int err;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        wdev = dev->ieee80211_ptr;
+
+        if (!rdev->ops->set_power_mgmt) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_GET_POWER_SAVE);
+        if (!hdr) {
+                err = -ENOMEM;
+                goto free_msg;
+        }
+
+        if (wdev->ps)
+                ps_state = NL80211_PS_ENABLED;
+        else
+                ps_state = NL80211_PS_DISABLED;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_reply(msg, info);
+        goto out;
+
+nla_put_failure:
+        err = -ENOBUFS;
+
+free_msg:
+        nlmsg_free(msg);
+
+out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+
+unlock_rtnl:
+        rtnl_unlock();
+
+        return err;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -4293,7 +5018,73 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_GET_SURVEY,
+                .policy = nl80211_policy,
+                .dumpit = nl80211_dump_survey,
+        },
+        {
+                .cmd = NL80211_CMD_SET_PMKSA,
+                .doit = nl80211_setdel_pmksa,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_DEL_PMKSA,
+                .doit = nl80211_setdel_pmksa,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_FLUSH_PMKSA,
+                .doit = nl80211_flush_pmksa,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
+                .doit = nl80211_remain_on_channel,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
+                .doit = nl80211_cancel_remain_on_channel,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
+                .doit = nl80211_set_tx_bitrate_mask,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_REGISTER_ACTION,
+                .doit = nl80211_register_action,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_ACTION,
+                .doit = nl80211_action,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_SET_POWER_SAVE,
+                .doit = nl80211_set_power_save,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_GET_POWER_SAVE,
+                .doit = nl80211_get_power_save,
+                .policy = nl80211_policy,
+                /* can be retrieved by unprivileged users */
+        },
 };
+
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
         .name = "mlme",
 };
@@ -4881,6 +5672,193 @@ nla_put_failure:
         nlmsg_free(msg);
 }
 
+static void nl80211_send_remain_on_chan_event(
+        int cmd, struct cfg80211_registered_device *rdev,
+        struct net_device *netdev, u64 cookie,
+        struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type,
+        unsigned int duration, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
+                NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev, u64 cookie,
+                                    struct ieee80211_channel *chan,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int duration, gfp_t gfp)
+{
+        nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
+                                          rdev, netdev, cookie, chan,
+                                          channel_type, duration, gfp);
+}
+
+void nl80211_send_remain_on_channel_cancel(
+        struct cfg80211_registered_device *rdev, struct net_device *netdev,
+        u64 cookie, struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type, gfp_t gfp)
+{
+        nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
+                                          rdev, netdev, cookie, chan,
+                                          channel_type, 0, gfp);
+}
+
+void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
+                            struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+}
+
+int nl80211_send_action(struct cfg80211_registered_device *rdev,
+                        struct net_device *netdev, u32 nlpid,
+                        int freq, const u8 *buf, size_t len, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        int err;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return -ENOMEM;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
+        NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
+
+        err = genlmsg_end(msg, hdr);
+        if (err < 0) {
+                nlmsg_free(msg);
+                return err;
+        }
+
+        err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
+        if (err < 0)
+                return err;
+        return 0;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+
+void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
+                                   struct net_device *netdev, u64 cookie,
+                                   const u8 *buf, size_t len, bool ack,
+                                   gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+        if (ack)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+static int nl80211_netlink_notify(struct notifier_block * nb,
+                                  unsigned long state,
+                                  void *_notify)
+{
+        struct netlink_notify *notify = _notify;
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+
+        if (state != NETLINK_URELEASE)
+                return NOTIFY_DONE;
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
+                list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
+                        cfg80211_mlme_unregister_actions(wdev, notify->pid);
+
+        rcu_read_unlock();
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block nl80211_netlink_notifier = {
+        .notifier_call = nl80211_netlink_notify,
+};
+
 /* initialisation/exit functions */
 
 int nl80211_init(void)
@@ -4914,6 +5892,10 @@ int nl80211_init(void)
                 goto err_out;
 #endif
 
+        err = netlink_register_notifier(&nl80211_netlink_notifier);
+        if (err)
+                goto err_out;
+
         return 0;
  err_out:
         genl_unregister_family(&nl80211_fam);
@@ -4922,5 +5904,6 @@ int nl80211_init(void)
 
 void nl80211_exit(void)
 {
+        netlink_unregister_notifier(&nl80211_netlink_notifier);
         genl_unregister_family(&nl80211_fam);
 }
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 44cc2a76a1b0..4ca511102c6c 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -59,4 +59,27 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev, const u8 *bssid,
                              gfp_t gfp);
 
+void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev,
+                                    u64 cookie,
+                                    struct ieee80211_channel *chan,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int duration, gfp_t gfp);
+void nl80211_send_remain_on_channel_cancel(
+        struct cfg80211_registered_device *rdev, struct net_device *netdev,
+        u64 cookie, struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type, gfp_t gfp);
+
+void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
+                            struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp);
+
+int nl80211_send_action(struct cfg80211_registered_device *rdev,
+                        struct net_device *netdev, u32 nlpid, int freq,
+                        const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
+                                   struct net_device *netdev, u64 cookie,
+                                   const u8 *buf, size_t len, bool ack,
+                                   gfp_t gfp);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index f591871a7b4f..1332c445d1c7 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -2,6 +2,16 @@
  * Radiotap parser
  *
  * Copyright 2007               Andy Green <andy@warmcat.com>
+ * Copyright 2009               Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See COPYING for more details.
  */
 
 #include <net/cfg80211.h>
@@ -10,6 +20,35 @@
 
 /* function prototypes and related defs are in include/net/cfg80211.h */
 
+static const struct radiotap_align_size rtap_namespace_sizes[] = {
+        [IEEE80211_RADIOTAP_TSFT] = { .align = 8, .size = 8, },
+        [IEEE80211_RADIOTAP_FLAGS] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_RATE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_CHANNEL] = { .align = 2, .size = 4, },
+        [IEEE80211_RADIOTAP_FHSS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DBM_ANTNOISE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_LOCK_QUALITY] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_TX_ATTENUATION] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DBM_TX_POWER] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_ANTENNA] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DB_ANTNOISE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_RX_FLAGS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
+        /*
+         * add more here as they are defined in radiotap.h
+         */
+};
+
+static const struct ieee80211_radiotap_namespace radiotap_ns = {
+        .n_bits = sizeof(rtap_namespace_sizes) / sizeof(rtap_namespace_sizes[0]),
+        .align_size = rtap_namespace_sizes,
+};
+
 /**
  * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
  * @iterator: radiotap_iterator to initialize
@@ -50,9 +89,9 @@
  */
 
 int ieee80211_radiotap_iterator_init(
-    struct ieee80211_radiotap_iterator *iterator,
-    struct ieee80211_radiotap_header *radiotap_header,
-    int max_length)
+        struct ieee80211_radiotap_iterator *iterator,
+        struct ieee80211_radiotap_header *radiotap_header,
+        int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
         /* Linux only supports version 0 radiotap format */
         if (radiotap_header->it_version)
@@ -62,19 +101,24 @@ int ieee80211_radiotap_iterator_init(
         if (max_length < get_unaligned_le16(&radiotap_header->it_len))
                 return -EINVAL;
 
-        iterator->rtheader = radiotap_header;
-        iterator->max_length = get_unaligned_le16(&radiotap_header->it_len);
-        iterator->arg_index = 0;
-        iterator->bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
-        iterator->arg = (u8 *)radiotap_header + sizeof(*radiotap_header);
-        iterator->this_arg = NULL;
+        iterator->_rtheader = radiotap_header;
+        iterator->_max_length = get_unaligned_le16(&radiotap_header->it_len);
+        iterator->_arg_index = 0;
+        iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
+        iterator->_arg = (uint8_t *)radiotap_header + sizeof(*radiotap_header);
+        iterator->_reset_on_ext = 0;
+        iterator->_next_bitmap = &radiotap_header->it_present;
+        iterator->_next_bitmap++;
+        iterator->_vns = vns;
+        iterator->current_namespace = &radiotap_ns;
+        iterator->is_radiotap_ns = 1;
 
         /* find payload start allowing for extended bitmap(s) */
 
-        if (unlikely(iterator->bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT))) {
-                while (get_unaligned_le32(iterator->arg) &
-                       (1 << IEEE80211_RADIOTAP_EXT)) {
-                        iterator->arg += sizeof(u32);
+        if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
+                while (get_unaligned_le32(iterator->_arg) &
+                                        (1 << IEEE80211_RADIOTAP_EXT)) {
+                        iterator->_arg += sizeof(uint32_t);
 
                         /*
                          * check for insanity where the present bitmaps
@@ -82,12 +126,13 @@ int ieee80211_radiotap_iterator_init(
                          * stated radiotap header length
                          */
 
-                        if (((ulong)iterator->arg -
-                             (ulong)iterator->rtheader) > iterator->max_length)
+                        if ((unsigned long)iterator->_arg -
+                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_max_length)
                                 return -EINVAL;
                 }
 
-                iterator->arg += sizeof(u32);
+                iterator->_arg += sizeof(uint32_t);
 
                 /*
                  * no need to check again for blowing past stated radiotap
@@ -96,12 +141,36 @@ int ieee80211_radiotap_iterator_init(
                  */
         }
 
+        iterator->this_arg = iterator->_arg;
+
         /* we are all initialized happily */
 
         return 0;
 }
 EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
 
+static void find_ns(struct ieee80211_radiotap_iterator *iterator,
+                    uint32_t oui, uint8_t subns)
+{
+        int i;
+
+        iterator->current_namespace = NULL;
+
+        if (!iterator->_vns)
+                return;
+
+        for (i = 0; i < iterator->_vns->n_ns; i++) {
+                if (iterator->_vns->ns[i].oui != oui)
+                        continue;
+                if (iterator->_vns->ns[i].subns != subns)
+                        continue;
+
+                iterator->current_namespace = &iterator->_vns->ns[i];
+                break;
+        }
+}
+
+
 
 /**
  * ieee80211_radiotap_iterator_next - return next radiotap parser iterator arg
@@ -127,99 +196,80 @@ EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
  */
 
 int ieee80211_radiotap_iterator_next(
-    struct ieee80211_radiotap_iterator *iterator)
+        struct ieee80211_radiotap_iterator *iterator)
 {
-
-        /*
-         * small length lookup table for all radiotap types we heard of
-         * starting from b0 in the bitmap, so we can walk the payload
-         * area of the radiotap header
-         *
-         * There is a requirement to pad args, so that args
-         * of a given length must begin at a boundary of that length
-         * -- but note that compound args are allowed (eg, 2 x u16
-         * for IEEE80211_RADIOTAP_CHANNEL) so total arg length is not
-         * a reliable indicator of alignment requirement.
-         *
-         * upper nybble: content alignment for arg
-         * lower nybble: content length for arg
-         */
-
-        static const u8 rt_sizes[] = {
-                [IEEE80211_RADIOTAP_TSFT] = 0x88,
-                [IEEE80211_RADIOTAP_FLAGS] = 0x11,
-                [IEEE80211_RADIOTAP_RATE] = 0x11,
-                [IEEE80211_RADIOTAP_CHANNEL] = 0x24,
-                [IEEE80211_RADIOTAP_FHSS] = 0x22,
-                [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = 0x11,
-                [IEEE80211_RADIOTAP_DBM_ANTNOISE] = 0x11,
-                [IEEE80211_RADIOTAP_LOCK_QUALITY] = 0x22,
-                [IEEE80211_RADIOTAP_TX_ATTENUATION] = 0x22,
-                [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = 0x22,
-                [IEEE80211_RADIOTAP_DBM_TX_POWER] = 0x11,
-                [IEEE80211_RADIOTAP_ANTENNA] = 0x11,
-                [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = 0x11,
-                [IEEE80211_RADIOTAP_DB_ANTNOISE] = 0x11,
-                [IEEE80211_RADIOTAP_RX_FLAGS] = 0x22,
-                [IEEE80211_RADIOTAP_TX_FLAGS] = 0x22,
-                [IEEE80211_RADIOTAP_RTS_RETRIES] = 0x11,
-                [IEEE80211_RADIOTAP_DATA_RETRIES] = 0x11,
-                /*
-                 * add more here as they are defined in
-                 * include/net/ieee80211_radiotap.h
-                 */
-        };
-
-        /*
-         * for every radiotap entry we can at
-         * least skip (by knowing the length)...
-         */
-
-        while (iterator->arg_index < sizeof(rt_sizes)) {
+        while (1) {
                 int hit = 0;
-                int pad;
+                int pad, align, size, subns, vnslen;
+                uint32_t oui;
 
-                if (!(iterator->bitmap_shifter & 1))
+                /* if no more EXT bits, that's it */
+                if ((iterator->_arg_index % 32) == IEEE80211_RADIOTAP_EXT &&
+                    !(iterator->_bitmap_shifter & 1))
+                        return -ENOENT;
+
+                if (!(iterator->_bitmap_shifter & 1))
                         goto next_entry; /* arg not present */
 
+                /* get alignment/size of data */
+                switch (iterator->_arg_index % 32) {
+                case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+                case IEEE80211_RADIOTAP_EXT:
+                        align = 1;
+                        size = 0;
+                        break;
+                case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+                        align = 2;
+                        size = 6;
+                        break;
+                default:
+                        if (!iterator->current_namespace ||
+                            iterator->_arg_index >= iterator->current_namespace->n_bits) {
+                                if (iterator->current_namespace == &radiotap_ns)
+                                        return -ENOENT;
+                                align = 0;
+                        } else {
+                                align = iterator->current_namespace->align_size[iterator->_arg_index].align;
+                                size = iterator->current_namespace->align_size[iterator->_arg_index].size;
+                        }
+                        if (!align) {
+                                /* skip all subsequent data */
+                                iterator->_arg = iterator->_next_ns_data;
+                                /* give up on this namespace */
+                                iterator->current_namespace = NULL;
+                                goto next_entry;
+                        }
+                        break;
+                }
+
                 /*
                  * arg is present, account for alignment padding
-                 *  8-bit args can be at any alignment
-                 * 16-bit args must start on 16-bit boundary
-                 * 32-bit args must start on 32-bit boundary
-                 * 64-bit args must start on 64-bit boundary
                  *
-                 * note that total arg size can differ from alignment of
-                 * elements inside arg, so we use upper nybble of length
-                 * table to base alignment on
-                 *
-                 * also note: these alignments are ** relative to the
-                 * start of the radiotap header **.  There is no guarantee
+                 * Note that these alignments are relative to the start
+                 * of the radiotap header.  There is no guarantee
                  * that the radiotap header itself is aligned on any
                  * kind of boundary.
                  *
-                 * the above is why get_unaligned() is used to dereference
-                 * multibyte elements from the radiotap area
+                 * The above is why get_unaligned() is used to dereference
+                 * multibyte elements from the radiotap area.
                  */
 
-                pad = (((ulong)iterator->arg) -
-                        ((ulong)iterator->rtheader)) &
-                        ((rt_sizes[iterator->arg_index] >> 4) - 1);
+                pad = ((unsigned long)iterator->_arg -
+                       (unsigned long)iterator->_rtheader) & (align - 1);
 
                 if (pad)
-                        iterator->arg +=
-                                (rt_sizes[iterator->arg_index] >> 4) - pad;
+                        iterator->_arg += align - pad;
 
                 /*
                  * this is what we will return to user, but we need to
                  * move on first so next call has something fresh to test
                  */
-                iterator->this_arg_index = iterator->arg_index;
-                iterator->this_arg = iterator->arg;
-                hit = 1;
+                iterator->this_arg_index = iterator->_arg_index;
+                iterator->this_arg = iterator->_arg;
+                iterator->this_arg_size = size;
 
                 /* internally move on the size of this arg */
-                iterator->arg += rt_sizes[iterator->arg_index] & 0x0f;
+                iterator->_arg += size;
 
                 /*
                  * check for insanity where we are given a bitmap that
@@ -228,32 +278,73 @@ int ieee80211_radiotap_iterator_next(
                  * max_length on the last arg, never exceeding it.
                  */
 
-                if (((ulong)iterator->arg - (ulong)iterator->rtheader) >
-                    iterator->max_length)
+                if ((unsigned long)iterator->_arg -
+                    (unsigned long)iterator->_rtheader >
+                    (unsigned long)iterator->_max_length)
                         return -EINVAL;
 
-        next_entry:
-                iterator->arg_index++;
-                if (unlikely((iterator->arg_index & 31) == 0)) {
-                        /* completed current u32 bitmap */
-                        if (iterator->bitmap_shifter & 1) {
-                                /* b31 was set, there is more */
-                                /* move to next u32 bitmap */
-                                iterator->bitmap_shifter =
-                                    get_unaligned_le32(iterator->next_bitmap);
-                                iterator->next_bitmap++;
-                        } else
-                                /* no more bitmaps: end */
-                                iterator->arg_index = sizeof(rt_sizes);
-                } else /* just try the next bit */
-                        iterator->bitmap_shifter >>= 1;
+                /* these special ones are valid in each bitmap word */
+                switch (iterator->_arg_index % 32) {
+                case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+
+                        iterator->_reset_on_ext = 1;
+
+                        vnslen = get_unaligned_le16(iterator->this_arg + 4);
+                        iterator->_next_ns_data = iterator->_arg + vnslen;
+                        oui = (*iterator->this_arg << 16) |
+                                (*(iterator->this_arg + 1) << 8) |
+                                *(iterator->this_arg + 2);
+                        subns = *(iterator->this_arg + 3);
+
+                        find_ns(iterator, oui, subns);
+
+                        iterator->is_radiotap_ns = 0;
+                        /* allow parsers to show this information */
+                        iterator->this_arg_index =
+                                IEEE80211_RADIOTAP_VENDOR_NAMESPACE;
+                        iterator->this_arg_size += vnslen;
+                        if ((unsigned long)iterator->this_arg +
+                            iterator->this_arg_size -
+                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)(unsigned long)iterator->_max_length)
+                                return -EINVAL;
+                        hit = 1;
+                        break;
+                case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+
+                        iterator->_reset_on_ext = 1;
+                        iterator->current_namespace = &radiotap_ns;
+                        iterator->is_radiotap_ns = 1;
+                        break;
+                case IEEE80211_RADIOTAP_EXT:
+                        /*
+                         * bit 31 was set, there is more
+                         * -- move to next u32 bitmap
+                         */
+                        iterator->_bitmap_shifter =
+                                get_unaligned_le32(iterator->_next_bitmap);
+                        iterator->_next_bitmap++;
+                        if (iterator->_reset_on_ext)
+                                iterator->_arg_index = 0;
+                        else
+                                iterator->_arg_index++;
+                        iterator->_reset_on_ext = 0;
+                        break;
+                default:
+                        /* we've got a hit! */
+                        hit = 1;
+ next_entry:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+                }
 
                 /* if we found a valid arg earlier, return it now */
                 if (hit)
                         return 0;
         }
-
-        /* we don't know how to handle any more args, we're done */
-        return -ENOENT;
 }
 EXPORT_SYMBOL(ieee80211_radiotap_iterator_next);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f256dfffbf46..422da20d1e5b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -33,6 +33,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/random.h>
 #include <linux/nl80211.h>
@@ -40,8 +41,18 @@
 #include <net/cfg80211.h>
 #include "core.h"
 #include "reg.h"
+#include "regdb.h"
 #include "nl80211.h"
 
+#ifdef CONFIG_CFG80211_REG_DEBUG
+#define REG_DBG_PRINT(format, args...) \
+        do { \
+                printk(KERN_DEBUG format , ## args); \
+        } while (0)
+#else
+#define REG_DBG_PRINT(args...)
+#endif
+
 /* Receipt of information from last regulatory request */
 static struct regulatory_request *last_request;
 
@@ -124,107 +135,11 @@ static const struct ieee80211_regdomain *cfg80211_world_regdom =
         &world_regdom;
 
 static char *ieee80211_regdom = "00";
+static char user_alpha2[2];
 
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-/*
- * We assume 40 MHz bandwidth for the old regulatory work.
- * We make emphasis we are using the exact same frequencies
- * as before
- */
-
-static const struct ieee80211_regdomain us_regdom = {
-        .n_reg_rules = 6,
-        .alpha2 =  "US",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..11 */
-                REG_RULE(2412-10, 2462+10, 40, 6, 27, 0),
-                /* IEEE 802.11a, channel 36 */
-                REG_RULE(5180-10, 5180+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channel 40 */
-                REG_RULE(5200-10, 5200+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channel 44 */
-                REG_RULE(5220-10, 5220+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channels 48..64 */
-                REG_RULE(5240-10, 5320+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channels 149..165, outdoor */
-                REG_RULE(5745-10, 5825+10, 40, 6, 30, 0),
-        }
-};
-
-static const struct ieee80211_regdomain jp_regdom = {
-        .n_reg_rules = 3,
-        .alpha2 =  "JP",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..14 */
-                REG_RULE(2412-10, 2484+10, 40, 6, 20, 0),
-                /* IEEE 802.11a, channels 34..48 */
-                REG_RULE(5170-10, 5240+10, 40, 6, 20,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channels 52..64 */
-                REG_RULE(5260-10, 5320+10, 40, 6, 20,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-        }
-};
-
-static const struct ieee80211_regdomain eu_regdom = {
-        .n_reg_rules = 6,
-        /*
-         * This alpha2 is bogus, we leave it here just for stupid
-         * backward compatibility
-         */
-        .alpha2 =  "EU",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..13 */
-                REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
-                /* IEEE 802.11a, channel 36 */
-                REG_RULE(5180-10, 5180+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channel 40 */
-                REG_RULE(5200-10, 5200+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channel 44 */
-                REG_RULE(5220-10, 5220+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channels 48..64 */
-                REG_RULE(5240-10, 5320+10, 40, 6, 20,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-                /* IEEE 802.11a, channels 100..140 */
-                REG_RULE(5500-10, 5700+10, 40, 6, 30,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-        }
-};
-
-static const struct ieee80211_regdomain *static_regdom(char *alpha2)
-{
-        if (alpha2[0] == 'U' && alpha2[1] == 'S')
-                return &us_regdom;
-        if (alpha2[0] == 'J' && alpha2[1] == 'P')
-                return &jp_regdom;
-        if (alpha2[0] == 'E' && alpha2[1] == 'U')
-                return &eu_regdom;
-        /* Default, as per the old rules */
-        return &us_regdom;
-}
-
-static bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
-{
-        if (rd == &us_regdom || rd == &jp_regdom || rd == &eu_regdom)
-                return true;
-        return false;
-}
-#else
-static inline bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
-{
-        return false;
-}
-#endif
-
 static void reset_regdomains(void)
 {
         /* avoid freeing static information or freeing something twice */
@@ -234,8 +149,6 @@ static void reset_regdomains(void)
                 cfg80211_world_regdom = NULL;
         if (cfg80211_regdomain == &world_regdom)
                 cfg80211_regdomain = NULL;
-        if (is_old_static_regdom(cfg80211_regdomain))
-                cfg80211_regdomain = NULL;
 
         kfree(cfg80211_regdomain);
         kfree(cfg80211_world_regdom);
@@ -341,6 +254,27 @@ static bool regdom_changes(const char *alpha2)
         return true;
 }
 
+/*
+ * The NL80211_REGDOM_SET_BY_USER regdom alpha2 is cached, this lets
+ * you know if a valid regulatory hint with NL80211_REGDOM_SET_BY_USER
+ * has ever been issued.
+ */
+static bool is_user_regdom_saved(void)
+{
+        if (user_alpha2[0] == '9' && user_alpha2[1] == '7')
+                return false;
+
+        /* This would indicate a mistake on the design */
+        if (WARN((!is_world_regdom(user_alpha2) &&
+                  !is_an_alpha2(user_alpha2)),
+                 "Unexpected user alpha2: %c%c\n",
+                 user_alpha2[0],
+                 user_alpha2[1]))
+                return false;
+
+        return true;
+}
+
 /**
  * country_ie_integrity_changes - tells us if the country IE has changed
  * @checksum: checksum of country IE of fields we are interested in
@@ -360,6 +294,96 @@ static bool country_ie_integrity_changes(u32 checksum)
         return false;
 }
 
+static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
+                         const struct ieee80211_regdomain *src_regd)
+{
+        struct ieee80211_regdomain *regd;
+        int size_of_regd = 0;
+        unsigned int i;
+
+        size_of_regd = sizeof(struct ieee80211_regdomain) +
+          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
+
+        regd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (!regd)
+                return -ENOMEM;
+
+        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
+
+        for (i = 0; i < src_regd->n_reg_rules; i++)
+                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
+                        sizeof(struct ieee80211_reg_rule));
+
+        *dst_regd = regd;
+        return 0;
+}
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+struct reg_regdb_search_request {
+        char alpha2[2];
+        struct list_head list;
+};
+
+static LIST_HEAD(reg_regdb_search_list);
+static DEFINE_MUTEX(reg_regdb_search_mutex);
+
+static void reg_regdb_search(struct work_struct *work)
+{
+        struct reg_regdb_search_request *request;
+        const struct ieee80211_regdomain *curdom, *regdom;
+        int i, r;
+
+        mutex_lock(&reg_regdb_search_mutex);
+        while (!list_empty(&reg_regdb_search_list)) {
+                request = list_first_entry(&reg_regdb_search_list,
+                                           struct reg_regdb_search_request,
+                                           list);
+                list_del(&request->list);
+
+                for (i=0; i<reg_regdb_size; i++) {
+                        curdom = reg_regdb[i];
+
+                        if (!memcmp(request->alpha2, curdom->alpha2, 2)) {
+                                r = reg_copy_regd(&regdom, curdom);
+                                if (r)
+                                        break;
+                                mutex_lock(&cfg80211_mutex);
+                                set_regdom(regdom);
+                                mutex_unlock(&cfg80211_mutex);
+                                break;
+                        }
+                }
+
+                kfree(request);
+        }
+        mutex_unlock(&reg_regdb_search_mutex);
+}
+
+static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
+
+static void reg_regdb_query(const char *alpha2)
+{
+        struct reg_regdb_search_request *request;
+
+        if (!alpha2)
+                return;
+
+        request = kzalloc(sizeof(struct reg_regdb_search_request), GFP_KERNEL);
+        if (!request)
+                return;
+
+        memcpy(request->alpha2, alpha2, 2);
+
+        mutex_lock(&reg_regdb_search_mutex);
+        list_add_tail(&request->list, &reg_regdb_search_list);
+        mutex_unlock(&reg_regdb_search_mutex);
+
+        schedule_work(&reg_regdb_work);
+}
+#else
+static inline void reg_regdb_query(const char *alpha2) {}
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
 /*
  * This lets us keep regulatory code which is updated on a regulatory
  * basis in userspace.
@@ -379,6 +403,9 @@ static int call_crda(const char *alpha2)
                 printk(KERN_INFO "cfg80211: Calling CRDA to update world "
                         "regulatory domain\n");
 
+        /* query internal regulatory database (if it exists) */
+        reg_regdb_query(alpha2);
+
         country_env[8] = alpha2[0];
         country_env[9] = alpha2[1];
 
@@ -479,12 +506,212 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
 }
 
 /*
+ * This is a work around for sanity checking ieee80211_channel_to_frequency()'s
+ * work. ieee80211_channel_to_frequency() can for example currently provide a
+ * 2 GHz channel when in fact a 5 GHz channel was desired. An example would be
+ * an AP providing channel 8 on a country IE triplet when it sent this on the
+ * 5 GHz band, that channel is designed to be channel 8 on 5 GHz, not a 2 GHz
+ * channel.
+ *
+ * This can be removed once ieee80211_channel_to_frequency() takes in a band.
+ */
+static bool chan_in_band(int chan, enum ieee80211_band band)
+{
+        int center_freq = ieee80211_channel_to_frequency(chan);
+
+        switch (band) {
+        case IEEE80211_BAND_2GHZ:
+                if (center_freq <= 2484)
+                        return true;
+                return false;
+        case IEEE80211_BAND_5GHZ:
+                if (center_freq >= 5005)
+                        return true;
+                return false;
+        default:
+                return false;
+        }
+}
+
+/*
+ * Some APs may send a country IE triplet for each channel they
+ * support and while this is completely overkill and silly we still
+ * need to support it. We avoid making a single rule for each channel
+ * though and to help us with this we use this helper to find the
+ * actual subband end channel. These type of country IE triplet
+ * scenerios are handled then, all yielding two regulaotry rules from
+ * parsing a country IE:
+ *
+ * [1]
+ * [2]
+ * [36]
+ * [40]
+ *
+ * [1]
+ * [2-4]
+ * [5-12]
+ * [36]
+ * [40-44]
+ *
+ * [1-4]
+ * [5-7]
+ * [36-44]
+ * [48-64]
+ *
+ * [36-36]
+ * [40-40]
+ * [44-44]
+ * [48-48]
+ * [52-52]
+ * [56-56]
+ * [60-60]
+ * [64-64]
+ * [100-100]
+ * [104-104]
+ * [108-108]
+ * [112-112]
+ * [116-116]
+ * [120-120]
+ * [124-124]
+ * [128-128]
+ * [132-132]
+ * [136-136]
+ * [140-140]
+ *
+ * Returns 0 if the IE has been found to be invalid in the middle
+ * somewhere.
+ */
+static int max_subband_chan(enum ieee80211_band band,
+                            int orig_cur_chan,
+                            int orig_end_channel,
+                            s8 orig_max_power,
+                            u8 **country_ie,
+                            u8 *country_ie_len)
+{
+        u8 *triplets_start = *country_ie;
+        u8 len_at_triplet = *country_ie_len;
+        int end_subband_chan = orig_end_channel;
+
+        /*
+         * We'll deal with padding for the caller unless
+         * its not immediate and we don't process any channels
+         */
+        if (*country_ie_len == 1) {
+                *country_ie += 1;
+                *country_ie_len -= 1;
+                return orig_end_channel;
+        }
+
+        /* Move to the next triplet and then start search */
+        *country_ie += 3;
+        *country_ie_len -= 3;
+
+        if (!chan_in_band(orig_cur_chan, band))
+                return 0;
+
+        while (*country_ie_len >= 3) {
+                int end_channel = 0;
+                struct ieee80211_country_ie_triplet *triplet =
+                        (struct ieee80211_country_ie_triplet *) *country_ie;
+                int cur_channel = 0, next_expected_chan;
+
+                /* means last triplet is completely unrelated to this one */
+                if (triplet->ext.reg_extension_id >=
+                                IEEE80211_COUNTRY_EXTENSION_ID) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                if (triplet->chans.first_channel == 0) {
+                        *country_ie += 1;
+                        *country_ie_len -= 1;
+                        if (*country_ie_len != 0)
+                                return 0;
+                        break;
+                }
+
+                if (triplet->chans.num_channels == 0)
+                        return 0;
+
+                /* Monitonically increasing channel order */
+                if (triplet->chans.first_channel <= end_subband_chan)
+                        return 0;
+
+                if (!chan_in_band(triplet->chans.first_channel, band))
+                        return 0;
+
+                /* 2 GHz */
+                if (triplet->chans.first_channel <= 14) {
+                        end_channel = triplet->chans.first_channel +
+                                triplet->chans.num_channels - 1;
+                }
+                else {
+                        end_channel =  triplet->chans.first_channel +
+                                (4 * (triplet->chans.num_channels - 1));
+                }
+
+                if (!chan_in_band(end_channel, band))
+                        return 0;
+
+                if (orig_max_power != triplet->chans.max_power) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                cur_channel = triplet->chans.first_channel;
+
+                /* The key is finding the right next expected channel */
+                if (band == IEEE80211_BAND_2GHZ)
+                        next_expected_chan = end_subband_chan + 1;
+                 else
+                        next_expected_chan = end_subband_chan + 4;
+
+                if (cur_channel != next_expected_chan) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                end_subband_chan = end_channel;
+
+                /* Move to the next one */
+                *country_ie += 3;
+                *country_ie_len -= 3;
+
+                /*
+                 * Padding needs to be dealt with if we processed
+                 * some channels.
+                 */
+                if (*country_ie_len == 1) {
+                        *country_ie += 1;
+                        *country_ie_len -= 1;
+                        break;
+                }
+
+                /* If seen, the IE is invalid */
+                if (*country_ie_len == 2)
+                        return 0;
+        }
+
+        if (end_subband_chan == orig_end_channel) {
+                *country_ie = triplets_start;
+                *country_ie_len = len_at_triplet;
+                return orig_end_channel;
+        }
+
+        return end_subband_chan;
+}
+
+/*
  * Converts a country IE to a regulatory domain. A regulatory domain
  * structure has a lot of information which the IE doesn't yet have,
  * so for the other values we use upper max values as we will intersect
  * with our userspace regulatory agent to get lower bounds.
  */
 static struct ieee80211_regdomain *country_ie_2_rd(
+                                enum ieee80211_band band,
                                 u8 *country_ie,
                                 u8 country_ie_len,
                                 u32 *checksum)
@@ -546,10 +773,29 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         continue;
                 }
 
+                /*
+                 * APs can add padding to make length divisible
+                 * by two, required by the spec.
+                 */
+                if (triplet->chans.first_channel == 0) {
+                        country_ie++;
+                        country_ie_len--;
+                        /* This is expected to be at the very end only */
+                        if (country_ie_len != 0)
+                                return NULL;
+                        break;
+                }
+
+                if (triplet->chans.num_channels == 0)
+                        return NULL;
+
+                if (!chan_in_band(triplet->chans.first_channel, band))
+                        return NULL;
+
                 /* 2 GHz */
-                if (triplet->chans.first_channel <= 14)
+                if (band == IEEE80211_BAND_2GHZ)
                         end_channel = triplet->chans.first_channel +
-                                triplet->chans.num_channels;
+                                triplet->chans.num_channels - 1;
                 else
                         /*
                          * 5 GHz -- For example in country IEs if the first
@@ -564,6 +810,24 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                                 (4 * (triplet->chans.num_channels - 1));
 
                 cur_channel = triplet->chans.first_channel;
+
+                /*
+                 * Enhancement for APs that send a triplet for every channel
+                 * or for whatever reason sends triplets with multiple channels
+                 * separated when in fact they should be together.
+                 */
+                end_channel = max_subband_chan(band,
+                                               cur_channel,
+                                               end_channel,
+                                               triplet->chans.max_power,
+                                               &country_ie,
+                                               &country_ie_len);
+                if (!end_channel)
+                        return NULL;
+
+                if (!chan_in_band(end_channel, band))
+                        return NULL;
+
                 cur_sub_max_channel = end_channel;
 
                 /* Basic sanity check */
@@ -594,10 +858,13 @@ static struct ieee80211_regdomain *country_ie_2_rd(
 
                 last_sub_max_channel = cur_sub_max_channel;
 
-                country_ie += 3;
-                country_ie_len -= 3;
                 num_rules++;
 
+                if (country_ie_len >= 3) {
+                        country_ie += 3;
+                        country_ie_len -= 3;
+                }
+
                 /*
                  * Note: this is not a IEEE requirement but
                  * simply a memory requirement
@@ -640,6 +907,12 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         continue;
                 }
 
+                if (triplet->chans.first_channel == 0) {
+                        country_ie++;
+                        country_ie_len--;
+                        break;
+                }
+
                 reg_rule = &rd->reg_rules[i];
                 freq_range = &reg_rule->freq_range;
                 power_rule = &reg_rule->power_rule;
@@ -647,13 +920,20 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                 reg_rule->flags = flags;
 
                 /* 2 GHz */
-                if (triplet->chans.first_channel <= 14)
+                if (band == IEEE80211_BAND_2GHZ)
                         end_channel = triplet->chans.first_channel +
-                                triplet->chans.num_channels;
+                                triplet->chans.num_channels -1;
                 else
                         end_channel =  triplet->chans.first_channel +
                                 (4 * (triplet->chans.num_channels - 1));
 
+                end_channel = max_subband_chan(band,
+                                               triplet->chans.first_channel,
+                                               end_channel,
+                                               triplet->chans.max_power,
+                                               &country_ie,
+                                               &country_ie_len);
+
                 /*
                  * The +10 is since the regulatory domain expects
                  * the actual band edge, not the center of freq for
@@ -674,12 +954,15 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                  */
                 freq_range->max_bandwidth_khz = MHZ_TO_KHZ(40);
                 power_rule->max_antenna_gain = DBI_TO_MBI(100);
-                power_rule->max_eirp = DBM_TO_MBM(100);
+                power_rule->max_eirp = DBM_TO_MBM(triplet->chans.max_power);
 
-                country_ie += 3;
-                country_ie_len -= 3;
                 i++;
 
+                if (country_ie_len >= 3) {
+                        country_ie += 3;
+                        country_ie_len -= 3;
+                }
+
                 BUG_ON(i > NL80211_MAX_SUPP_REG_RULES);
         }
 
@@ -975,25 +1258,21 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                 if (r == -ERANGE &&
                     last_request->initiator ==
                     NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-#ifdef CONFIG_CFG80211_REG_DEBUG
-                        printk(KERN_DEBUG "cfg80211: Leaving channel %d MHz "
+                        REG_DBG_PRINT("cfg80211: Leaving channel %d MHz "
                                 "intact on %s - no rule found in band on "
                                 "Country IE\n",
-                                chan->center_freq, wiphy_name(wiphy));
-#endif
+                        chan->center_freq, wiphy_name(wiphy));
                 } else {
                 /*
                  * In this case we know the country IE has at least one reg rule
                  * for the band so we respect its band definitions
                  */
-#ifdef CONFIG_CFG80211_REG_DEBUG
                         if (last_request->initiator ==
                             NL80211_REGDOM_SET_BY_COUNTRY_IE)
-                                printk(KERN_DEBUG "cfg80211: Disabling "
+                                REG_DBG_PRINT("cfg80211: Disabling "
                                         "channel %d MHz on %s due to "
                                         "Country IE\n",
                                         chan->center_freq, wiphy_name(wiphy));
-#endif
                         flags |= IEEE80211_CHAN_DISABLED;
                         chan->flags = flags;
                 }
@@ -1008,7 +1287,7 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
 
         if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
             request_wiphy && request_wiphy == wiphy &&
-            request_wiphy->strict_regulatory) {
+            request_wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
                 /*
                  * This gaurantees the driver's requested regulatory domain
                  * will always be used as a base for further regulatory
@@ -1051,13 +1330,13 @@ static bool ignore_reg_update(struct wiphy *wiphy,
         if (!last_request)
                 return true;
         if (initiator == NL80211_REGDOM_SET_BY_CORE &&
-                  wiphy->custom_regulatory)
+            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
                 return true;
         /*
          * wiphy->regd will be set once the device has its own
          * desired regulatory domain set
          */
-        if (wiphy->strict_regulatory && !wiphy->regd &&
+        if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
             !is_world_regdom(last_request->alpha2))
                 return true;
         return false;
@@ -1093,7 +1372,7 @@ static void handle_reg_beacon(struct wiphy *wiphy,
 
         chan->beacon_found = true;
 
-        if (wiphy->disable_beacon_hints)
+        if (wiphy->flags & WIPHY_FLAG_DISABLE_BEACON_HINTS)
                 return;
 
         chan_before.center_freq = chan->center_freq;
@@ -1164,7 +1443,7 @@ static bool reg_is_world_roaming(struct wiphy *wiphy)
                 return true;
         if (last_request &&
             last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            wiphy->custom_regulatory)
+            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
                 return true;
         return false;
 }
@@ -1367,30 +1646,6 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
 
-static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
-                         const struct ieee80211_regdomain *src_regd)
-{
-        struct ieee80211_regdomain *regd;
-        int size_of_regd = 0;
-        unsigned int i;
-
-        size_of_regd = sizeof(struct ieee80211_regdomain) +
-          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
-
-        regd = kzalloc(size_of_regd, GFP_KERNEL);
-        if (!regd)
-                return -ENOMEM;
-
-        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
-
-        for (i = 0; i < src_regd->n_reg_rules; i++)
-                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
-                        sizeof(struct ieee80211_reg_rule));
-
-        *dst_regd = regd;
-        return 0;
-}
-
 /*
  * Return value which can be used by ignore_request() to indicate
  * it has been determined we should intersect two regulatory domains
@@ -1412,7 +1667,7 @@ static int ignore_request(struct wiphy *wiphy,
 
         switch (pending_request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
-                return -EINVAL;
+                return 0;
         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
 
                 last_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
@@ -1443,8 +1698,6 @@ static int ignore_request(struct wiphy *wiphy,
                 return REG_INTERSECT;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE) {
-                        if (is_old_static_regdom(cfg80211_regdomain))
-                                return 0;
                         if (regdom_changes(pending_request->alpha2))
                                 return 0;
                         return -EALREADY;
@@ -1481,8 +1734,7 @@ static int ignore_request(struct wiphy *wiphy,
                                 return -EAGAIN;
                 }
 
-                if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    !regdom_changes(pending_request->alpha2))
+                if (!regdom_changes(pending_request->alpha2))
                         return -EALREADY;
 
                 return 0;
@@ -1554,6 +1806,11 @@ new_request:
 
         pending_request = NULL;
 
+        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER) {
+                user_alpha2[0] = last_request->alpha2[0];
+                user_alpha2[1] = last_request->alpha2[1];
+        }
+
         /* When r == REG_INTERSECT we do need to call CRDA */
         if (r < 0) {
                 /*
@@ -1591,7 +1848,8 @@ static void reg_process_hint(struct regulatory_request *reg_request)
 
         r = __regulatory_hint(wiphy, reg_request);
         /* This is required so that the orig_* parameters are saved */
-        if (r == -EALREADY && wiphy && wiphy->strict_regulatory)
+        if (r == -EALREADY && wiphy &&
+            wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
                 wiphy_update_regulatory(wiphy, reg_request->initiator);
 out:
         mutex_unlock(&reg_mutex);
@@ -1672,12 +1930,16 @@ static void queue_regulatory_request(struct regulatory_request *request)
         schedule_work(&reg_work);
 }
 
-/* Core regulatory hint -- happens once during cfg80211_init() */
+/*
+ * Core regulatory hint -- happens during cfg80211_init()
+ * and when we restore regulatory settings.
+ */
 static int regulatory_hint_core(const char *alpha2)
 {
         struct regulatory_request *request;
 
-        BUG_ON(last_request);
+        kfree(last_request);
+        last_request = NULL;
 
         request = kzalloc(sizeof(struct regulatory_request),
                           GFP_KERNEL);
@@ -1688,14 +1950,12 @@ static int regulatory_hint_core(const char *alpha2)
         request->alpha2[1] = alpha2[1];
         request->initiator = NL80211_REGDOM_SET_BY_CORE;
 
-        queue_regulatory_request(request);
-
         /*
          * This ensures last_request is populated once modules
          * come swinging in and calling regulatory hints and
          * wiphy_apply_custom_regulatory().
          */
-        flush_scheduled_work();
+        reg_process_hint(request);
 
         return 0;
 }
@@ -1714,7 +1974,7 @@ int regulatory_hint_user(const char *alpha2)
         request->wiphy_idx = WIPHY_IDX_STALE;
         request->alpha2[0] = alpha2[0];
         request->alpha2[1] = alpha2[1];
-        request->initiator = NL80211_REGDOM_SET_BY_USER,
+        request->initiator = NL80211_REGDOM_SET_BY_USER;
 
         queue_regulatory_request(request);
 
@@ -1782,8 +2042,9 @@ static bool reg_same_country_ie_hint(struct wiphy *wiphy,
  * therefore cannot iterate over the rdev list here.
  */
 void regulatory_hint_11d(struct wiphy *wiphy,
-                        u8 *country_ie,
-                        u8 country_ie_len)
+                         enum ieee80211_band band,
+                         u8 *country_ie,
+                         u8 country_ie_len)
 {
         struct ieee80211_regdomain *rd = NULL;
         char alpha2[2];
@@ -1829,9 +2090,11 @@ void regulatory_hint_11d(struct wiphy *wiphy,
             wiphy_idx_valid(last_request->wiphy_idx)))
                 goto out;
 
-        rd = country_ie_2_rd(country_ie, country_ie_len, &checksum);
-        if (!rd)
+        rd = country_ie_2_rd(band, country_ie, country_ie_len, &checksum);
+        if (!rd) {
+                REG_DBG_PRINT("cfg80211: Ignoring bogus country IE\n");
                 goto out;
+        }
 
         /*
          * This will not happen right now but we leave it here for the
@@ -1874,6 +2137,123 @@ out:
         mutex_unlock(&reg_mutex);
 }
 
+static void restore_alpha2(char *alpha2, bool reset_user)
+{
+        /* indicates there is no alpha2 to consider for restoration */
+        alpha2[0] = '9';
+        alpha2[1] = '7';
+
+        /* The user setting has precedence over the module parameter */
+        if (is_user_regdom_saved()) {
+                /* Unless we're asked to ignore it and reset it */
+                if (reset_user) {
+                        REG_DBG_PRINT("cfg80211: Restoring regulatory settings "
+                               "including user preference\n");
+                        user_alpha2[0] = '9';
+                        user_alpha2[1] = '7';
+
+                        /*
+                         * If we're ignoring user settings, we still need to
+                         * check the module parameter to ensure we put things
+                         * back as they were for a full restore.
+                         */
+                        if (!is_world_regdom(ieee80211_regdom)) {
+                                REG_DBG_PRINT("cfg80211: Keeping preference on "
+                                       "module parameter ieee80211_regdom: %c%c\n",
+                                       ieee80211_regdom[0],
+                                       ieee80211_regdom[1]);
+                                alpha2[0] = ieee80211_regdom[0];
+                                alpha2[1] = ieee80211_regdom[1];
+                        }
+                } else {
+                        REG_DBG_PRINT("cfg80211: Restoring regulatory settings "
+                               "while preserving user preference for: %c%c\n",
+                               user_alpha2[0],
+                               user_alpha2[1]);
+                        alpha2[0] = user_alpha2[0];
+                        alpha2[1] = user_alpha2[1];
+                }
+        } else if (!is_world_regdom(ieee80211_regdom)) {
+                REG_DBG_PRINT("cfg80211: Keeping preference on "
+                       "module parameter ieee80211_regdom: %c%c\n",
+                       ieee80211_regdom[0],
+                       ieee80211_regdom[1]);
+                alpha2[0] = ieee80211_regdom[0];
+                alpha2[1] = ieee80211_regdom[1];
+        } else
+                REG_DBG_PRINT("cfg80211: Restoring regulatory settings\n");
+}
+
+/*
+ * Restoring regulatory settings involves ingoring any
+ * possibly stale country IE information and user regulatory
+ * settings if so desired, this includes any beacon hints
+ * learned as we could have traveled outside to another country
+ * after disconnection. To restore regulatory settings we do
+ * exactly what we did at bootup:
+ *
+ *   - send a core regulatory hint
+ *   - send a user regulatory hint if applicable
+ *
+ * Device drivers that send a regulatory hint for a specific country
+ * keep their own regulatory domain on wiphy->regd so that does does
+ * not need to be remembered.
+ */
+static void restore_regulatory_settings(bool reset_user)
+{
+        char alpha2[2];
+        struct reg_beacon *reg_beacon, *btmp;
+
+        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
+
+        reset_regdomains();
+        restore_alpha2(alpha2, reset_user);
+
+        /* Clear beacon hints */
+        spin_lock_bh(&reg_pending_beacons_lock);
+        if (!list_empty(&reg_pending_beacons)) {
+                list_for_each_entry_safe(reg_beacon, btmp,
+                                         &reg_pending_beacons, list) {
+                        list_del(&reg_beacon->list);
+                        kfree(reg_beacon);
+                }
+        }
+        spin_unlock_bh(&reg_pending_beacons_lock);
+
+        if (!list_empty(&reg_beacon_list)) {
+                list_for_each_entry_safe(reg_beacon, btmp,
+                                         &reg_beacon_list, list) {
+                        list_del(&reg_beacon->list);
+                        kfree(reg_beacon);
+                }
+        }
+
+        /* First restore to the basic regulatory settings */
+        cfg80211_regdomain = cfg80211_world_regdom;
+
+        mutex_unlock(&reg_mutex);
+        mutex_unlock(&cfg80211_mutex);
+
+        regulatory_hint_core(cfg80211_regdomain->alpha2);
+
+        /*
+         * This restores the ieee80211_regdom module parameter
+         * preference or the last user requested regulatory
+         * settings, user regulatory settings takes precedence.
+         */
+        if (is_an_alpha2(alpha2))
+                regulatory_hint_user(user_alpha2);
+}
+
+
+void regulatory_hint_disconnect(void)
+{
+        REG_DBG_PRINT("cfg80211: All devices are disconnected, going to "
+                      "restore regulatory settings\n");
+        restore_regulatory_settings(false);
+}
+
 static bool freq_is_chan_12_13_14(u16 freq)
 {
         if (freq == ieee80211_channel_to_frequency(12) ||
@@ -1899,13 +2279,12 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
         if (!reg_beacon)
                 return -ENOMEM;
 
-#ifdef CONFIG_CFG80211_REG_DEBUG
-        printk(KERN_DEBUG "cfg80211: Found new beacon on "
-                "frequency: %d MHz (Ch %d) on %s\n",
-                beacon_chan->center_freq,
-                ieee80211_frequency_to_channel(beacon_chan->center_freq),
-                wiphy_name(wiphy));
-#endif
+        REG_DBG_PRINT("cfg80211: Found new beacon on "
+                      "frequency: %d MHz (Ch %d) on %s\n",
+                      beacon_chan->center_freq,
+                      ieee80211_frequency_to_channel(beacon_chan->center_freq),
+                      wiphy_name(wiphy));
+
         memcpy(&reg_beacon->chan, beacon_chan,
                 sizeof(struct ieee80211_channel));
 
@@ -1930,7 +2309,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
         const struct ieee80211_freq_range *freq_range = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
 
-        printk(KERN_INFO "\t(start_freq - end_freq @ bandwidth), "
+        printk(KERN_INFO "    (start_freq - end_freq @ bandwidth), "
                 "(max_antenna_gain, max_eirp)\n");
 
         for (i = 0; i < rd->n_reg_rules; i++) {
@@ -1943,7 +2322,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                  * in certain regions
                  */
                 if (power_rule->max_antenna_gain)
-                        printk(KERN_INFO "\t(%d KHz - %d KHz @ %d KHz), "
+                        printk(KERN_INFO "    (%d KHz - %d KHz @ %d KHz), "
                                 "(%d mBi, %d mBm)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
@@ -1951,7 +2330,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                                 power_rule->max_antenna_gain,
                                 power_rule->max_eirp);
                 else
-                        printk(KERN_INFO "\t(%d KHz - %d KHz @ %d KHz), "
+                        printk(KERN_INFO "    (%d KHz - %d KHz @ %d KHz), "
                                 "(N/A, %d mBm)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
@@ -2063,8 +2442,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                  * If someone else asked us to change the rd lets only bother
                  * checking if the alpha2 changes if CRDA was already called
                  */
-                if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    !regdom_changes(rd->alpha2))
+                if (!regdom_changes(rd->alpha2))
                         return -EINVAL;
         }
 
@@ -2263,15 +2641,11 @@ int regulatory_init(void)
         spin_lock_init(&reg_requests_lock);
         spin_lock_init(&reg_pending_beacons_lock);
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-        cfg80211_regdomain = static_regdom(ieee80211_regdom);
-
-        printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
-        print_regdomain_info(cfg80211_regdomain);
-#else
         cfg80211_regdomain = cfg80211_world_regdom;
 
-#endif
+        user_alpha2[0] = '9';
+        user_alpha2[1] = '7';
+
         /* We always try to get an update for the static regdomain */
         err = regulatory_hint_core(cfg80211_regdomain->alpha2);
         if (err) {
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 3362c7c069b2..b26224a9f3bc 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -41,15 +41,44 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
  * regulatory_hint_11d - hints a country IE as a regulatory domain
  * @wiphy: the wireless device giving the hint (used only for reporting
  *      conflicts)
+ * @band: the band on which the country IE was received on. This determines
+ *      the band we'll process the country IE channel triplets for.
  * @country_ie: pointer to the country IE
  * @country_ie_len: length of the country IE
  *
  * We will intersect the rd with the what CRDA tells us should apply
  * for the alpha2 this country IE belongs to, this prevents APs from
  * sending us incorrect or outdated information against a country.
+ *
+ * The AP is expected to provide Country IE channel triplets for the
+ * band it is on. It is technically possible for APs to send channel
+ * country IE triplets even for channels outside of the band they are
+ * in but for that they would have to use the regulatory extension
+ * in combination with a triplet but this behaviour is currently
+ * not observed. For this reason if a triplet is seen with channel
+ * information for a band the BSS is not present in it will be ignored.
  */
 void regulatory_hint_11d(struct wiphy *wiphy,
+                         enum ieee80211_band band,
                          u8 *country_ie,
                          u8 country_ie_len);
 
+/**
+ * regulatory_hint_disconnect - informs all devices have been disconneted
+ *
+ * Regulotory rules can be enhanced further upon scanning and upon
+ * connection to an AP. These rules become stale if we disconnect
+ * and go to another country, whether or not we suspend and resume.
+ * If we suspend, go to another country and resume we'll automatically
+ * get disconnected shortly after resuming and things will be reset as well.
+ * This routine is a helper to restore regulatory settings to how they were
+ * prior to our first connect attempt. This includes ignoring country IE and
+ * beacon regulatory hints. The ieee80211_regdom module parameter will always
+ * be respected but if a user had set the regulatory domain that will take
+ * precedence.
+ *
+ * Must be called from process context.
+ */
+void regulatory_hint_disconnect(void);
+
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/regdb.h b/net/wireless/regdb.h
new file mode 100644
index 000000000000..818222c92513
--- /dev/null
+++ b/net/wireless/regdb.h
@@ -0,0 +1,7 @@
+#ifndef __REGDB_H__
+#define __REGDB_H__
+
+extern const struct ieee80211_regdomain *reg_regdb[];
+extern int reg_regdb_size;
+
+#endif /* __REGDB_H__ */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e5f92ee758f4..a026c6d56bd3 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -4,6 +4,7 @@
  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
@@ -22,7 +23,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
         struct cfg80211_scan_request *request;
         struct net_device *dev;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -47,7 +48,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         else
                 nl80211_send_scan_done(rdev, dev);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
 
@@ -88,7 +89,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
 
         request->aborted = aborted;
-        schedule_work(&wiphy_to_dev(request->wiphy)->scan_done_wk);
+        queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
 
@@ -100,8 +101,10 @@ static void bss_release(struct kref *ref)
         if (bss->pub.free_priv)
                 bss->pub.free_priv(&bss->pub);
 
-        if (bss->ies_allocated)
-                kfree(bss->pub.information_elements);
+        if (bss->beacon_ies_allocated)
+                kfree(bss->pub.beacon_ies);
+        if (bss->proberesp_ies_allocated)
+                kfree(bss->pub.proberesp_ies);
 
         BUG_ON(atomic_read(&bss->hold));
 
@@ -141,9 +144,9 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
                 dev->bss_generation++;
 }
 
-static u8 *find_ie(u8 num, u8 *ies, int len)
+const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
 {
-        while (len > 2 && ies[0] != num) {
+        while (len > 2 && ies[0] != eid) {
                 len -= ies[1] + 2;
                 ies += ies[1] + 2;
         }
@@ -153,11 +156,12 @@ static u8 *find_ie(u8 num, u8 *ies, int len)
                 return NULL;
         return ies;
 }
+EXPORT_SYMBOL(cfg80211_find_ie);
 
 static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 {
-        const u8 *ie1 = find_ie(num, ies1, len1);
-        const u8 *ie2 = find_ie(num, ies2, len2);
+        const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
+        const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
         int r;
 
         if (!ie1 && !ie2)
@@ -183,9 +187,9 @@ static bool is_bss(struct cfg80211_bss *a,
         if (!ssid)
                 return true;
 
-        ssidie = find_ie(WLAN_EID_SSID,
-                         a->information_elements,
-                         a->len_information_elements);
+        ssidie = cfg80211_find_ie(WLAN_EID_SSID,
+                                  a->information_elements,
+                                  a->len_information_elements);
         if (!ssidie)
                 return false;
         if (ssidie[1] != ssid_len)
@@ -202,9 +206,9 @@ static bool is_mesh(struct cfg80211_bss *a,
         if (!is_zero_ether_addr(a->bssid))
                 return false;
 
-        ie = find_ie(WLAN_EID_MESH_ID,
-                     a->information_elements,
-                     a->len_information_elements);
+        ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                              a->information_elements,
+                              a->len_information_elements);
         if (!ie)
                 return false;
         if (ie[1] != meshidlen)
@@ -212,12 +216,12 @@ static bool is_mesh(struct cfg80211_bss *a,
         if (memcmp(ie + 2, meshid, meshidlen))
                 return false;
 
-        ie = find_ie(WLAN_EID_MESH_CONFIG,
-                     a->information_elements,
-                     a->len_information_elements);
+        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                              a->information_elements,
+                              a->len_information_elements);
         if (!ie)
                 return false;
-        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
                 return false;
 
         /*
@@ -225,7 +229,8 @@ static bool is_mesh(struct cfg80211_bss *a,
          * comparing since that may differ between stations taking
          * part in the same mesh.
          */
-        return memcmp(ie + 2, meshcfg, IEEE80211_MESH_CONFIG_LEN - 2) == 0;
+        return memcmp(ie + 2, meshcfg,
+            sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
 }
 
 static int cmp_bss(struct cfg80211_bss *a,
@@ -374,8 +379,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
 
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
-                    struct cfg80211_internal_bss *res,
-                    bool overwrite)
+                    struct cfg80211_internal_bss *res)
 {
         struct cfg80211_internal_bss *found = NULL;
         const u8 *meshid, *meshcfg;
@@ -393,13 +397,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
         if (is_zero_ether_addr(res->pub.bssid)) {
                 /* must be mesh, verify */
-                meshid = find_ie(WLAN_EID_MESH_ID, res->pub.information_elements,
-                                 res->pub.len_information_elements);
-                meshcfg = find_ie(WLAN_EID_MESH_CONFIG,
-                                  res->pub.information_elements,
-                                  res->pub.len_information_elements);
+                meshid = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                          res->pub.information_elements,
+                                          res->pub.len_information_elements);
+                meshcfg = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                           res->pub.information_elements,
+                                           res->pub.len_information_elements);
                 if (!meshid || !meshcfg ||
-                    meshcfg[1] != IEEE80211_MESH_CONFIG_LEN) {
+                    meshcfg[1] != sizeof(struct ieee80211_meshconf_ie)) {
                         /* bogus mesh */
                         kref_put(&res->ref, bss_release);
                         return NULL;
@@ -417,28 +422,64 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 found->pub.capability = res->pub.capability;
                 found->ts = res->ts;
 
-                /* overwrite IEs */
-                if (overwrite) {
+                /* Update IEs */
+                if (res->pub.proberesp_ies) {
                         size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
-                        size_t ielen = res->pub.len_information_elements;
+                        size_t ielen = res->pub.len_proberesp_ies;
+
+                        if (found->pub.proberesp_ies &&
+                            !found->proberesp_ies_allocated &&
+                            ksize(found) >= used + ielen) {
+                                memcpy(found->pub.proberesp_ies,
+                                       res->pub.proberesp_ies, ielen);
+                                found->pub.len_proberesp_ies = ielen;
+                        } else {
+                                u8 *ies = found->pub.proberesp_ies;
+
+                                if (found->proberesp_ies_allocated)
+                                        ies = krealloc(ies, ielen, GFP_ATOMIC);
+                                else
+                                        ies = kmalloc(ielen, GFP_ATOMIC);
 
-                        if (!found->ies_allocated && ksize(found) >= used + ielen) {
-                                memcpy(found->pub.information_elements,
-                                       res->pub.information_elements, ielen);
-                                found->pub.len_information_elements = ielen;
+                                if (ies) {
+                                        memcpy(ies, res->pub.proberesp_ies,
+                                               ielen);
+                                        found->proberesp_ies_allocated = true;
+                                        found->pub.proberesp_ies = ies;
+                                        found->pub.len_proberesp_ies = ielen;
+                                }
+                        }
+
+                        /* Override possible earlier Beacon frame IEs */
+                        found->pub.information_elements =
+                                found->pub.proberesp_ies;
+                        found->pub.len_information_elements =
+                                found->pub.len_proberesp_ies;
+                }
+                if (res->pub.beacon_ies) {
+                        size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
+                        size_t ielen = res->pub.len_beacon_ies;
+
+                        if (found->pub.beacon_ies &&
+                            !found->beacon_ies_allocated &&
+                            ksize(found) >= used + ielen) {
+                                memcpy(found->pub.beacon_ies,
+                                       res->pub.beacon_ies, ielen);
+                                found->pub.len_beacon_ies = ielen;
                         } else {
-                                u8 *ies = found->pub.information_elements;
+                                u8 *ies = found->pub.beacon_ies;
 
-                                if (found->ies_allocated)
+                                if (found->beacon_ies_allocated)
                                         ies = krealloc(ies, ielen, GFP_ATOMIC);
                                 else
                                         ies = kmalloc(ielen, GFP_ATOMIC);
 
                                 if (ies) {
-                                        memcpy(ies, res->pub.information_elements, ielen);
-                                        found->ies_allocated = true;
-                                        found->pub.information_elements = ies;
-                                        found->pub.len_information_elements = ielen;
+                                        memcpy(ies, res->pub.beacon_ies,
+                                               ielen);
+                                        found->beacon_ies_allocated = true;
+                                        found->pub.beacon_ies = ies;
+                                        found->pub.len_beacon_ies = ielen;
                                 }
                         }
                 }
@@ -488,14 +529,26 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         res->pub.tsf = timestamp;
         res->pub.beacon_interval = beacon_interval;
         res->pub.capability = capability;
-        /* point to after the private area */
-        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
-        memcpy(res->pub.information_elements, ie, ielen);
-        res->pub.len_information_elements = ielen;
+        /*
+         * Since we do not know here whether the IEs are from a Beacon or Probe
+         * Response frame, we need to pick one of the options and only use it
+         * with the driver that does not provide the full Beacon/Probe Response
+         * frame. Use Beacon frame pointer to avoid indicating that this should
+         * override the information_elements pointer should we have received an
+         * earlier indication of Probe Response data.
+         *
+         * The initial buffer for the IEs is allocated with the BSS entry and
+         * is located after the private area.
+         */
+        res->pub.beacon_ies = (u8 *)res + sizeof(*res) + privsz;
+        memcpy(res->pub.beacon_ies, ie, ielen);
+        res->pub.len_beacon_ies = ielen;
+        res->pub.information_elements = res->pub.beacon_ies;
+        res->pub.len_information_elements = res->pub.len_beacon_ies;
 
         kref_init(&res->ref);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, 0);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
         if (!res)
                 return NULL;
 
@@ -516,7 +569,6 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         struct cfg80211_internal_bss *res;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                       u.probe_resp.variable);
-        bool overwrite;
         size_t privsz = wiphy->bss_priv_size;
 
         if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
@@ -537,16 +589,28 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
-        /* point to after the private area */
-        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
-        memcpy(res->pub.information_elements, mgmt->u.probe_resp.variable, ielen);
-        res->pub.len_information_elements = ielen;
+        /*
+         * The initial buffer for the IEs is allocated with the BSS entry and
+         * is located after the private area.
+         */
+        if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+                res->pub.proberesp_ies = (u8 *) res + sizeof(*res) + privsz;
+                memcpy(res->pub.proberesp_ies, mgmt->u.probe_resp.variable,
+                       ielen);
+                res->pub.len_proberesp_ies = ielen;
+                res->pub.information_elements = res->pub.proberesp_ies;
+                res->pub.len_information_elements = res->pub.len_proberesp_ies;
+        } else {
+                res->pub.beacon_ies = (u8 *) res + sizeof(*res) + privsz;
+                memcpy(res->pub.beacon_ies, mgmt->u.beacon.variable, ielen);
+                res->pub.len_beacon_ies = ielen;
+                res->pub.information_elements = res->pub.beacon_ies;
+                res->pub.len_information_elements = res->pub.len_beacon_ies;
+        }
 
         kref_init(&res->ref);
 
-        overwrite = ieee80211_is_probe_resp(mgmt->frame_control);
-
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, overwrite);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
         if (!res)
                 return NULL;
 
@@ -592,7 +656,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
@@ -600,7 +664,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         struct cfg80211_registered_device *rdev;
         struct wiphy *wiphy;
         struct iw_scan_req *wreq = NULL;
-        struct cfg80211_scan_request *creq;
+        struct cfg80211_scan_request *creq = NULL;
         int i, err, n_channels = 0;
         enum ieee80211_band band;
 
@@ -650,9 +714,15 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         i = 0;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 int j;
+
                 if (!wiphy->bands[band])
                         continue;
+
                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+                        /* ignore disabled channels */
+                        if (wiphy->bands[band]->channels[j].flags &
+                                                IEEE80211_CHAN_DISABLED)
+                                continue;
 
                         /* If we have a wireless request structure and the
                          * wireless request specifies frequencies, then search
@@ -687,8 +757,10 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         /* translate "Scan for SSID" request */
         if (wreq) {
                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
-                                return -EINVAL;
+                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
+                                err = -EINVAL;
+                                goto out;
+                        }
                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
                         creq->ssids[0].ssid_len = wreq->essid_len;
                 }
@@ -700,12 +772,15 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         err = rdev->ops->scan(wiphy, dev, creq);
         if (err) {
                 rdev->scan_req = NULL;
-                kfree(creq);
+                /* creq will be freed below */
         } else {
                 nl80211_send_scan_start(rdev, dev);
+                /* creq now owned by driver */
+                creq = NULL;
                 dev_hold(dev);
         }
  out:
+        kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
 }
@@ -859,7 +934,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                         break;
                 case WLAN_EID_MESH_CONFIG:
                         ismesh = true;
-                        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+                        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
                                 break;
                         buf = kmalloc(50, GFP_ATOMIC);
                         if (!buf)
@@ -867,35 +942,40 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                         cfg = ie + 2;
                         memset(&iwe, 0, sizeof(iwe));
                         iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
+                        sprintf(buf, "Mesh Network Path Selection Protocol ID: "
+                                "0x%02X", cfg[0]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Path Selection Metric ID: 0x%02X",
+                                cfg[1]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Congestion Control Mode ID: 0x%02X",
+                                cfg[2]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Path Selection Protocol ID: "
-                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
-                                                        cfg[4]);
+                        sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Path Selection Metric ID: "
-                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
-                                                        cfg[8]);
+                        sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Congestion Control Mode ID: "
-                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
-                                                        cfg[11], cfg[12]);
+                        sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Channel Precedence: "
-                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
-                                                        cfg[15], cfg[16]);
+                        sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
@@ -925,8 +1005,8 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                 ie += ie[1] + 2;
         }
 
-        if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
-            || ismesh) {
+        if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
+            ismesh) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = SIOCGIWMODE;
                 if (ismesh)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 9f0b2800a9d7..f4dfd5f5f2ea 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -7,6 +7,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/wireless.h>
 #include <net/iw_handler.h>
@@ -34,6 +35,44 @@ struct cfg80211_conn {
         bool auto_auth, prev_bssid_valid;
 };
 
+bool cfg80211_is_all_idle(void)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        bool is_all_idle = true;
+
+        mutex_lock(&cfg80211_mutex);
+
+        /*
+         * All devices must be idle as otherwise if you are actively
+         * scanning some new beacon hints could be learned and would
+         * count as new regulatory hints.
+         */
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                cfg80211_lock_rdev(rdev);
+                list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                        wdev_lock(wdev);
+                        if (wdev->sme_state != CFG80211_SME_IDLE)
+                                is_all_idle = false;
+                        wdev_unlock(wdev);
+                }
+                cfg80211_unlock_rdev(rdev);
+        }
+
+        mutex_unlock(&cfg80211_mutex);
+
+        return is_all_idle;
+}
+
+static void disconnect_work(struct work_struct *work)
+{
+        if (!cfg80211_is_all_idle())
+                return;
+
+        regulatory_hint_disconnect();
+}
+
+static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
 
 static int cfg80211_conn_scan(struct wireless_dev *wdev)
 {
@@ -365,7 +404,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         u8 *country_ie;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -382,7 +421,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                     resp_ie, resp_ie_len,
                                     status, GFP_KERNEL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (wextev) {
                 if (req_ie && status == WLAN_STATUS_SUCCESS) {
                         memset(&wrqu, 0, sizeof(wrqu));
@@ -454,6 +493,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
          * - and country_ie[1] which is the IE length
          */
         regulatory_hint_11d(wdev->wiphy,
+                            bss->channel->band,
                             country_ie + 2,
                             country_ie[1]);
 }
@@ -488,7 +528,7 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_connect_result);
 
@@ -497,7 +537,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
                        const u8 *resp_ie, size_t resp_ie_len)
 {
         struct cfg80211_bss *bss;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -532,7 +572,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
                             req_ie, req_ie_len, resp_ie, resp_ie_len,
                             GFP_KERNEL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (req_ie) {
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.data.length = req_ie_len;
@@ -583,7 +623,7 @@ void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_roamed);
 
@@ -593,7 +633,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         int i;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -651,11 +691,14 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                 for (i = 0; i < 6; i++)
                         rdev->ops->del_key(wdev->wiphy, dev, i, NULL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         memset(&wrqu, 0, sizeof(wrqu));
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+        wdev->wext.connect.ssid_len = 0;
 #endif
+
+        schedule_work(&cfg80211_disconnect_work);
 }
 
 void cfg80211_disconnected(struct net_device *dev, u16 reason,
@@ -681,7 +724,7 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_disconnected);
 
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index efe3c5c92b2d..9f2cef3e0ca0 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -33,10 +33,30 @@ static ssize_t name ## _show(struct device *dev,			\
 
 SHOW_FMT(index, "%d", wiphy_idx);
 SHOW_FMT(macaddress, "%pM", wiphy.perm_addr);
+SHOW_FMT(address_mask, "%pM", wiphy.addr_mask);
+
+static ssize_t addresses_show(struct device *dev,
+                              struct device_attribute *attr,
+                              char *buf)
+{
+        struct wiphy *wiphy = &dev_to_rdev(dev)->wiphy;
+        char *start = buf;
+        int i;
+
+        if (!wiphy->addresses)
+                return sprintf(buf, "%pM\n", wiphy->perm_addr);
+
+        for (i = 0; i < wiphy->n_addresses; i++)
+                buf += sprintf(buf, "%pM\n", &wiphy->addresses[i].addr);
+
+        return buf - start;
+}
 
 static struct device_attribute ieee80211_dev_attrs[] = {
         __ATTR_RO(index),
         __ATTR_RO(macaddress),
+        __ATTR_RO(address_mask),
+        __ATTR_RO(addresses),
         {}
 };
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 3fc2df86278f..d3574a4eb3ba 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -5,6 +5,7 @@
  */
 #include <linux/bitops.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <net/cfg80211.h>
 #include <net/ip.h>
 #include "core.h"
@@ -227,8 +228,11 @@ unsigned int ieee80211_hdrlen(__le16 fc)
         if (ieee80211_is_data(fc)) {
                 if (ieee80211_has_a4(fc))
                         hdrlen = 30;
-                if (ieee80211_is_data_qos(fc))
+                if (ieee80211_is_data_qos(fc)) {
                         hdrlen += IEEE80211_QOS_CTL_LEN;
+                        if (ieee80211_has_order(fc))
+                                hdrlen += IEEE80211_HT_CTL_LEN;
+                }
                 goto out;
         }
 
@@ -285,7 +289,7 @@ static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
         }
 }
 
-int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                            enum nl80211_iftype iftype)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -320,7 +324,9 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
                 break;
         case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
                 if (unlikely(iftype != NL80211_IFTYPE_WDS &&
-                             iftype != NL80211_IFTYPE_MESH_POINT))
+                             iftype != NL80211_IFTYPE_MESH_POINT &&
+                             iftype != NL80211_IFTYPE_AP_VLAN &&
+                             iftype != NL80211_IFTYPE_STATION))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =
@@ -381,7 +387,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
 }
 EXPORT_SYMBOL(ieee80211_data_to_8023);
 
-int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                              enum nl80211_iftype iftype, u8 *bssid, bool qos)
 {
         struct ieee80211_hdr hdr;
@@ -495,6 +501,101 @@ int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
 }
 EXPORT_SYMBOL(ieee80211_data_from_8023);
 
+
+void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+                              const u8 *addr, enum nl80211_iftype iftype,
+                              const unsigned int extra_headroom)
+{
+        struct sk_buff *frame = NULL;
+        u16 ethertype;
+        u8 *payload;
+        const struct ethhdr *eth;
+        int remaining, err;
+        u8 dst[ETH_ALEN], src[ETH_ALEN];
+
+        err = ieee80211_data_to_8023(skb, addr, iftype);
+        if (err)
+                goto out;
+
+        /* skip the wrapping header */
+        eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
+        if (!eth)
+                goto out;
+
+        while (skb != frame) {
+                u8 padding;
+                __be16 len = eth->h_proto;
+                unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
+
+                remaining = skb->len;
+                memcpy(dst, eth->h_dest, ETH_ALEN);
+                memcpy(src, eth->h_source, ETH_ALEN);
+
+                padding = (4 - subframe_len) & 0x3;
+                /* the last MSDU has no padding */
+                if (subframe_len > remaining)
+                        goto purge;
+
+                skb_pull(skb, sizeof(struct ethhdr));
+                /* reuse skb for the last subframe */
+                if (remaining <= subframe_len + padding)
+                        frame = skb;
+                else {
+                        unsigned int hlen = ALIGN(extra_headroom, 4);
+                        /*
+                         * Allocate and reserve two bytes more for payload
+                         * alignment since sizeof(struct ethhdr) is 14.
+                         */
+                        frame = dev_alloc_skb(hlen + subframe_len + 2);
+                        if (!frame)
+                                goto purge;
+
+                        skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
+                        memcpy(skb_put(frame, ntohs(len)), skb->data,
+                                ntohs(len));
+
+                        eth = (struct ethhdr *)skb_pull(skb, ntohs(len) +
+                                                        padding);
+                        if (!eth) {
+                                dev_kfree_skb(frame);
+                                goto purge;
+                        }
+                }
+
+                skb_reset_network_header(frame);
+                frame->dev = skb->dev;
+                frame->priority = skb->priority;
+
+                payload = frame->data;
+                ethertype = (payload[6] << 8) | payload[7];
+
+                if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
+                            ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+                           compare_ether_addr(payload,
+                                              bridge_tunnel_header) == 0)) {
+                        /* remove RFC1042 or Bridge-Tunnel
+                         * encapsulation and replace EtherType */
+                        skb_pull(frame, 6);
+                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
+                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
+                } else {
+                        memcpy(skb_push(frame, sizeof(__be16)), &len,
+                                sizeof(__be16));
+                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
+                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
+                }
+                __skb_queue_tail(list, frame);
+        }
+
+        return;
+
+ purge:
+        __skb_queue_purge(list);
+ out:
+        dev_kfree_skb(skb);
+}
+EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
+
 /* Given a data frame determine the 802.1p/1d tag to use. */
 unsigned int cfg80211_classify8021d(struct sk_buff *skb)
 {
@@ -656,7 +757,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
             !(rdev->wiphy.interface_modes & (1 << ntype)))
                 return -EOPNOTSUPP;
 
+        /* if it's part of a bridge, reject changing type to station/ibss */
+        if (dev->br_port && (ntype == NL80211_IFTYPE_ADHOC ||
+                             ntype == NL80211_IFTYPE_STATION))
+                return -EBUSY;
+
         if (ntype != otype) {
+                dev->ieee80211_ptr->use_4addr = false;
+
                 switch (otype) {
                 case NL80211_IFTYPE_ADHOC:
                         cfg80211_leave_ibss(rdev, dev, false);
@@ -680,5 +788,67 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 
         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 
+        if (!err && params && params->use_4addr != -1)
+                dev->ieee80211_ptr->use_4addr = params->use_4addr;
+
+        if (!err) {
+                dev->priv_flags &= ~IFF_DONT_BRIDGE;
+                switch (ntype) {
+                case NL80211_IFTYPE_STATION:
+                        if (dev->ieee80211_ptr->use_4addr)
+                                break;
+                        /* fall through */
+                case NL80211_IFTYPE_ADHOC:
+                        dev->priv_flags |= IFF_DONT_BRIDGE;
+                        break;
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_WDS:
+                case NL80211_IFTYPE_MESH_POINT:
+                        /* bridging OK */
+                        break;
+                case NL80211_IFTYPE_MONITOR:
+                        /* monitor can't bridge anyway */
+                        break;
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case __NL80211_IFTYPE_AFTER_LAST:
+                        /* not happening */
+                        break;
+                }
+        }
+
         return err;
 }
+
+u16 cfg80211_calculate_bitrate(struct rate_info *rate)
+{
+        int modulation, streams, bitrate;
+
+        if (!(rate->flags & RATE_INFO_FLAGS_MCS))
+                return rate->legacy;
+
+        /* the formula below does only work for MCS values smaller than 32 */
+        if (rate->mcs >= 32)
+                return 0;
+
+        modulation = rate->mcs & 7;
+        streams = (rate->mcs >> 3) + 1;
+
+        bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
+                        13500000 : 6500000;
+
+        if (modulation < 4)
+                bitrate *= (modulation + 1);
+        else if (modulation == 4)
+                bitrate *= (modulation + 2);
+        else
+                bitrate *= (modulation + 3);
+
+        bitrate *= streams;
+
+        if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
+                bitrate = (bitrate / 9) * 10;
+
+        /* do NOT round down here */
+        return (bitrate + 50000) / 100000;
+}
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 561a45cf2a6a..a60a2773b497 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -12,6 +12,7 @@
 #include <linux/nl80211.h>
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <net/iw_handler.h>
 #include <net/cfg80211.h>
 #include "wext-compat.h"
@@ -437,6 +438,7 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err, i;
+        bool rejoin = false;
 
         if (!wdev->wext.keys) {
                 wdev->wext.keys = kzalloc(sizeof(*wdev->wext.keys),
@@ -466,8 +468,25 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 
         if (remove) {
                 err = 0;
-                if (wdev->current_bss)
+                if (wdev->current_bss) {
+                        /*
+                         * If removing the current TX key, we will need to
+                         * join a new IBSS without the privacy bit clear.
+                         */
+                        if (idx == wdev->wext.default_key &&
+                            wdev->iftype == NL80211_IFTYPE_ADHOC) {
+                                __cfg80211_leave_ibss(rdev, wdev->netdev, true);
+                                rejoin = true;
+                        }
                         err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
+                }
+                wdev->wext.connect.privacy = false;
+                /*
+                 * Applications using wireless extensions expect to be
+                 * able to delete keys that don't exist, so allow that.
+                 */
+                if (err == -ENOENT)
+                        err = 0;
                 if (!err) {
                         if (!addr) {
                                 wdev->wext.keys->params[idx].key_len = 0;
@@ -478,12 +497,9 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
                         else if (idx == wdev->wext.default_mgmt_key)
                                 wdev->wext.default_mgmt_key = -1;
                 }
-                /*
-                 * Applications using wireless extensions expect to be
-                 * able to delete keys that don't exist, so allow that.
-                 */
-                if (err == -ENOENT)
-                        return 0;
+
+                if (!err && rejoin)
+                        err = cfg80211_ibss_wext_join(rdev, wdev);
 
                 return err;
         }
@@ -511,11 +527,25 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
         if ((params->cipher == WLAN_CIPHER_SUITE_WEP40 ||
              params->cipher == WLAN_CIPHER_SUITE_WEP104) &&
             (tx_key || (!addr && wdev->wext.default_key == -1))) {
-                if (wdev->current_bss)
+                if (wdev->current_bss) {
+                        /*
+                         * If we are getting a new TX key from not having
+                         * had one before we need to join a new IBSS with
+                         * the privacy bit set.
+                         */
+                        if (wdev->iftype == NL80211_IFTYPE_ADHOC &&
+                            wdev->wext.default_key == -1) {
+                                __cfg80211_leave_ibss(rdev, wdev->netdev, true);
+                                rejoin = true;
+                        }
                         err = rdev->ops->set_default_key(&rdev->wiphy,
                                                          dev, idx);
-                if (!err)
+                }
+                if (!err) {
                         wdev->wext.default_key = idx;
+                        if (rejoin)
+                                err = cfg80211_ibss_wext_join(rdev, wdev);
+                }
                 return err;
         }
 
@@ -539,10 +569,13 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 {
         int err;
 
+        /* devlist mutex needed for possible IBSS re-join */
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_set_encryption(rdev, dev, addr, remove,
                                         tx_key, idx, params);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -904,8 +937,6 @@ static int cfg80211_set_auth_alg(struct wireless_dev *wdev,
 
 static int cfg80211_set_wpa_version(struct wireless_dev *wdev, u32 wpa_versions)
 {
-        wdev->wext.connect.crypto.wpa_versions = 0;
-
         if (wpa_versions & ~(IW_AUTH_WPA_VERSION_WPA |
                              IW_AUTH_WPA_VERSION_WPA2|
                              IW_AUTH_WPA_VERSION_DISABLED))
@@ -933,8 +964,6 @@ static int cfg80211_set_wpa_version(struct wireless_dev *wdev, u32 wpa_versions)
 
 static int cfg80211_set_cipher_group(struct wireless_dev *wdev, u32 cipher)
 {
-        wdev->wext.connect.crypto.cipher_group = 0;
-
         if (cipher & IW_AUTH_CIPHER_WEP40)
                 wdev->wext.connect.crypto.cipher_group =
                         WLAN_CIPHER_SUITE_WEP40;
@@ -950,6 +979,8 @@ static int cfg80211_set_cipher_group(struct wireless_dev *wdev, u32 cipher)
         else if (cipher & IW_AUTH_CIPHER_AES_CMAC)
                 wdev->wext.connect.crypto.cipher_group =
                         WLAN_CIPHER_SUITE_AES_CMAC;
+        else if (cipher & IW_AUTH_CIPHER_NONE)
+                wdev->wext.connect.crypto.cipher_group = 0;
         else
                 return -EINVAL;
 
@@ -1069,8 +1100,8 @@ int cfg80211_wext_siwpower(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        bool ps = wdev->wext.ps;
-        int timeout = wdev->wext.ps_timeout;
+        bool ps = wdev->ps;
+        int timeout = wdev->ps_timeout;
         int err;
 
         if (wdev->iftype != NL80211_IFTYPE_STATION)
@@ -1103,8 +1134,8 @@ int cfg80211_wext_siwpower(struct net_device *dev,
         if (err)
                 return err;
 
-        wdev->wext.ps = ps;
-        wdev->wext.ps_timeout = timeout;
+        wdev->ps = ps;
+        wdev->ps_timeout = timeout;
 
         return 0;
 
@@ -1117,7 +1148,7 @@ int cfg80211_wext_giwpower(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        wrq->disabled = !wdev->wext.ps;
+        wrq->disabled = !wdev->ps;
 
         return 0;
 }
@@ -1174,21 +1205,47 @@ int cfg80211_wext_siwrate(struct net_device *dev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct cfg80211_bitrate_mask mask;
+        u32 fixed, maxrate;
+        struct ieee80211_supported_band *sband;
+        int band, ridx;
+        bool match = false;
 
         if (!rdev->ops->set_bitrate_mask)
                 return -EOPNOTSUPP;
 
-        mask.fixed = 0;
-        mask.maxrate = 0;
+        memset(&mask, 0, sizeof(mask));
+        fixed = 0;
+        maxrate = (u32)-1;
 
         if (rate->value < 0) {
                 /* nothing */
         } else if (rate->fixed) {
-                mask.fixed = rate->value / 1000; /* kbps */
+                fixed = rate->value / 100000;
         } else {
-                mask.maxrate = rate->value / 1000; /* kbps */
+                maxrate = rate->value / 100000;
         }
 
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                sband = wdev->wiphy->bands[band];
+                if (sband == NULL)
+                        continue;
+                for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
+                        struct ieee80211_rate *srate = &sband->bitrates[ridx];
+                        if (fixed == srate->bitrate) {
+                                mask.control[band].legacy = 1 << ridx;
+                                match = true;
+                                break;
+                        }
+                        if (srate->bitrate <= maxrate) {
+                                mask.control[band].legacy |= 1 << ridx;
+                                match = true;
+                        }
+                }
+        }
+
+        if (!match)
+                return -EINVAL;
+
         return rdev->ops->set_bitrate_mask(wdev->wiphy, dev, NULL, &mask);
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwrate);
@@ -1227,10 +1284,7 @@ int cfg80211_wext_giwrate(struct net_device *dev,
         if (!(sinfo.filled & STATION_INFO_TX_BITRATE))
                 return -EOPNOTSUPP;
 
-        rate->value = 0;
-
-        if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS))
-                rate->value = 100000 * sinfo.txrate.legacy;
+        rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);
 
         return 0;
 }
@@ -1372,6 +1426,47 @@ int cfg80211_wext_giwessid(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwessid);
 
+int cfg80211_wext_siwpmksa(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_pmksa cfg_pmksa;
+        struct iw_pmksa *pmksa = (struct iw_pmksa *)extra;
+
+        memset(&cfg_pmksa, 0, sizeof(struct cfg80211_pmksa));
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        cfg_pmksa.bssid = pmksa->bssid.sa_data;
+        cfg_pmksa.pmkid = pmksa->pmkid;
+
+        switch (pmksa->cmd) {
+        case IW_PMKSA_ADD:
+                if (!rdev->ops->set_pmksa)
+                        return -EOPNOTSUPP;
+
+                return rdev->ops->set_pmksa(&rdev->wiphy, dev, &cfg_pmksa);
+
+        case IW_PMKSA_REMOVE:
+                if (!rdev->ops->del_pmksa)
+                        return -EOPNOTSUPP;
+
+                return rdev->ops->del_pmksa(&rdev->wiphy, dev, &cfg_pmksa);
+
+        case IW_PMKSA_FLUSH:
+                if (!rdev->ops->flush_pmksa)
+                        return -EOPNOTSUPP;
+
+                return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
+
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
 static const iw_handler cfg80211_handlers[] = {
         [IW_IOCTL_IDX(SIOCGIWNAME)]     = (iw_handler) cfg80211_wext_giwname,
         [IW_IOCTL_IDX(SIOCSIWFREQ)]     = (iw_handler) cfg80211_wext_siwfreq,
@@ -1404,6 +1499,7 @@ static const iw_handler cfg80211_handlers[] = {
         [IW_IOCTL_IDX(SIOCSIWAUTH)]     = (iw_handler) cfg80211_wext_siwauth,
         [IW_IOCTL_IDX(SIOCGIWAUTH)]     = (iw_handler) cfg80211_wext_giwauth,
         [IW_IOCTL_IDX(SIOCSIWENCODEEXT)]= (iw_handler) cfg80211_wext_siwencodeext,
+        [IW_IOCTL_IDX(SIOCSIWPMKSA)]    = (iw_handler) cfg80211_wext_siwpmksa,
 };
 
 const struct iw_handler_def cfg80211_wext_handler = {
diff --git a/net/wireless/wext.c b/net/wireless/wext-core.c
index 60fe57761ca9..4f5a47091fde 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext-core.c
@@ -1,112 +1,29 @@
 /*
- * This file implement the Wireless Extensions APIs.
+ * This file implement the Wireless Extensions core API.
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
  * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
  *
  * (As all part of the Linux kernel, this file is GPL)
  */
-
-/************************** DOCUMENTATION **************************/
-/*
- * API definition :
- * --------------
- * See <linux/wireless.h> for details of the APIs and the rest.
- *
- * History :
- * -------
- *
- * v1 - 5.12.01 - Jean II
- *      o Created this file.
- *
- * v2 - 13.12.01 - Jean II
- *      o Move /proc/net/wireless stuff from net/core/dev.c to here
- *      o Make Wireless Extension IOCTLs go through here
- *      o Added iw_handler handling ;-)
- *      o Added standard ioctl description
- *      o Initial dumb commit strategy based on orinoco.c
- *
- * v3 - 19.12.01 - Jean II
- *      o Make sure we don't go out of standard_ioctl[] in ioctl_standard_call
- *      o Add event dispatcher function
- *      o Add event description
- *      o Propagate events as rtnetlink IFLA_WIRELESS option
- *      o Generate event on selected SET requests
- *
- * v4 - 18.04.02 - Jean II
- *      o Fix stupid off by one in iw_ioctl_description : IW_ESSID_MAX_SIZE + 1
- *
- * v5 - 21.06.02 - Jean II
- *      o Add IW_PRIV_TYPE_ADDR in priv_type_size (+cleanup)
- *      o Reshuffle IW_HEADER_TYPE_XXX to map IW_PRIV_TYPE_XXX changes
- *      o Add IWEVCUSTOM for driver specific event/scanning token
- *      o Turn on WE_STRICT_WRITE by default + kernel warning
- *      o Fix WE_STRICT_WRITE in ioctl_export_private() (32 => iw_num)
- *      o Fix off-by-one in test (extra_size <= IFNAMSIZ)
- *
- * v6 - 9.01.03 - Jean II
- *      o Add common spy support : iw_handler_set_spy(), wireless_spy_update()
- *      o Add enhanced spy support : iw_handler_set_thrspy() and event.
- *      o Add WIRELESS_EXT version display in /proc/net/wireless
- *
- * v6 - 18.06.04 - Jean II
- *      o Change get_spydata() method for added safety
- *      o Remove spy #ifdef, they are always on -> cleaner code
- *      o Allow any size GET request if user specifies length > max
- *              and if request has IW_DESCR_FLAG_NOMAX flag or is SIOCGIWPRIV
- *      o Start migrating get_wireless_stats to struct iw_handler_def
- *      o Add wmb() in iw_handler_set_spy() for non-coherent archs/cpus
- * Based on patch from Pavel Roskin <proski@gnu.org> :
- *      o Fix kernel data leak to user space in private handler handling
- *
- * v7 - 18.3.05 - Jean II
- *      o Remove (struct iw_point *)->pointer from events and streams
- *      o Remove spy_offset from struct iw_handler_def
- *      o Start deprecating dev->get_wireless_stats, output a warning
- *      o If IW_QUAL_DBM is set, show dBm values in /proc/net/wireless
- *      o Don't lose INVALID/DBM flags when clearing UPDATED flags (iwstats)
- *
- * v8 - 17.02.06 - Jean II
- *      o RtNetlink requests support (SET/GET)
- *
- * v8b - 03.08.06 - Herbert Xu
- *      o Fix Wireless Event locking issues.
- *
- * v9 - 14.3.06 - Jean II
- *      o Change length in ESSID and NICK to strlen() instead of strlen()+1
- *      o Make standard_ioctl_num and standard_event_num unsigned
- *      o Remove (struct net_device *)->get_wireless_stats()
- *
- * v10 - 16.3.07 - Jean II
- *      o Prevent leaking of kernel space in stream on 64 bits.
- */
-
-/***************************** INCLUDES *****************************/
-
-#include <linux/module.h>
-#include <linux/types.h>                /* off_t */
-#include <linux/netdevice.h>            /* struct ifreq, dev_get_by_name() */
-#include <linux/proc_fs.h>
-#include <linux/rtnetlink.h>            /* rtnetlink stuff */
-#include <linux/seq_file.h>
-#include <linux/init.h>                 /* for __init */
-#include <linux/if_arp.h>               /* ARPHRD_ETHER */
-#include <linux/etherdevice.h>          /* compare_ether_addr */
-#include <linux/interrupt.h>
-#include <net/net_namespace.h>
-
-#include <linux/wireless.h>             /* Pretty obvious */
-#include <net/iw_handler.h>             /* New driver API */
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/slab.h>
+#include <linux/wireless.h>
+#include <linux/uaccess.h>
+#include <net/cfg80211.h>
+#include <net/iw_handler.h>
 #include <net/netlink.h>
 #include <net/wext.h>
+#include <net/net_namespace.h>
+
+typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
+                               unsigned int, struct iw_request_info *,
+                               iw_handler);
 
-#include <asm/uaccess.h>                /* copy_to_user() */
 
-/************************* GLOBAL VARIABLES *************************/
-/*
- * You should not use global variables, because of re-entrancy.
- * On our case, it's only const, so it's OK...
- */
 /*
  * Meta-data about all the standard Wireless Extension request we
  * know about.
@@ -390,18 +307,6 @@ static const struct iw_ioctl_description standard_event[] = {
 };
 static const unsigned standard_event_num = ARRAY_SIZE(standard_event);
 
-/* Size (in bytes) of the various private data types */
-static const char iw_priv_type_size[] = {
-        0,                              /* IW_PRIV_TYPE_NONE */
-        1,                              /* IW_PRIV_TYPE_BYTE */
-        1,                              /* IW_PRIV_TYPE_CHAR */
-        0,                              /* Not defined */
-        sizeof(__u32),                  /* IW_PRIV_TYPE_INT */
-        sizeof(struct iw_freq),         /* IW_PRIV_TYPE_FLOAT */
-        sizeof(struct sockaddr),        /* IW_PRIV_TYPE_ADDR */
-        0,                              /* Not defined */
-};
-
 /* Size (in bytes) of various events */
 static const int event_type_size[] = {
         IW_EV_LCP_LEN,                  /* IW_HEADER_TYPE_NULL */
@@ -433,323 +338,346 @@ static const int compat_event_type_size[] = {
 };
 #endif
 
-/************************ COMMON SUBROUTINES ************************/
-/*
- * Stuff that may be used in various place or doesn't fit in one
- * of the section below.
- */
-
-/* ---------------------------------------------------------------- */
-/*
- * Return the driver handler associated with a specific Wireless Extension.
- */
-static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
-{
-        /* Don't "optimise" the following variable, it will crash */
-        unsigned int    index;          /* *MUST* be unsigned */
 
-        /* Check if we have some wireless handlers defined */
-        if (dev->wireless_handlers == NULL)
-                return NULL;
-
-        /* Try as a standard command */
-        index = cmd - SIOCIWFIRST;
-        if (index < dev->wireless_handlers->num_standard)
-                return dev->wireless_handlers->standard[index];
-
-        /* Try as a private command */
-        index = cmd - SIOCIWFIRSTPRIV;
-        if (index < dev->wireless_handlers->num_private)
-                return dev->wireless_handlers->private[index];
+/* IW event code */
 
-        /* Not found */
-        return NULL;
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Get statistics out of the driver
- */
-struct iw_statistics *get_wireless_stats(struct net_device *dev)
+static int __net_init wext_pernet_init(struct net *net)
 {
-        /* New location */
-        if ((dev->wireless_handlers != NULL) &&
-           (dev->wireless_handlers->get_wireless_stats != NULL))
-                return dev->wireless_handlers->get_wireless_stats(dev);
-
-        /* Not found */
-        return NULL;
+        skb_queue_head_init(&net->wext_nlevents);
+        return 0;
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Call the commit handler in the driver
- * (if exist and if conditions are right)
- *
- * Note : our current commit strategy is currently pretty dumb,
- * but we will be able to improve on that...
- * The goal is to try to agreagate as many changes as possible
- * before doing the commit. Drivers that will define a commit handler
- * are usually those that need a reset after changing parameters, so
- * we want to minimise the number of reset.
- * A cool idea is to use a timer : at each "set" command, we re-set the
- * timer, when the timer eventually fires, we call the driver.
- * Hopefully, more on that later.
- *
- * Also, I'm waiting to see how many people will complain about the
- * netif_running(dev) test. I'm open on that one...
- * Hopefully, the driver will remember to do a commit in "open()" ;-)
- */
-static int call_commit_handler(struct net_device *dev)
+static void __net_exit wext_pernet_exit(struct net *net)
 {
-        if ((netif_running(dev)) &&
-           (dev->wireless_handlers->standard[0] != NULL))
-                /* Call the commit handler on the driver */
-                return dev->wireless_handlers->standard[0](dev, NULL,
-                                                           NULL, NULL);
-        else
-                return 0;               /* Command completed successfully */
+        skb_queue_purge(&net->wext_nlevents);
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Calculate size of private arguments
- */
-static int get_priv_size(__u16 args)
-{
-        int     num = args & IW_PRIV_SIZE_MASK;
-        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+static struct pernet_operations wext_pernet_ops = {
+        .init = wext_pernet_init,
+        .exit = wext_pernet_exit,
+};
 
-        return num * iw_priv_type_size[type];
+static int __init wireless_nlevent_init(void)
+{
+        return register_pernet_subsys(&wext_pernet_ops);
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Re-calculate the size of private arguments
- */
-static int adjust_priv_size(__u16 args, struct iw_point *iwp)
+subsys_initcall(wireless_nlevent_init);
+
+/* Process events generated by the wireless layer or the driver. */
+static void wireless_nlevent_process(struct work_struct *work)
 {
-        int     num = iwp->length;
-        int     max = args & IW_PRIV_SIZE_MASK;
-        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+        struct sk_buff *skb;
+        struct net *net;
 
-        /* Make sure the driver doesn't goof up */
-        if (max < num)
-                num = max;
+        rtnl_lock();
+
+        for_each_net(net) {
+                while ((skb = skb_dequeue(&net->wext_nlevents)))
+                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+                                    GFP_KERNEL);
+        }
 
-        return num * iw_priv_type_size[type];
+        rtnl_unlock();
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Standard Wireless Handler : get wireless stats
- *      Allow programatic access to /proc/net/wireless even if /proc
- *      doesn't exist... Also more efficient...
- */
-static int iw_handler_get_iwstats(struct net_device *           dev,
-                                  struct iw_request_info *      info,
-                                  union iwreq_data *            wrqu,
-                                  char *                        extra)
+static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
+
+static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
+                                              struct sk_buff *skb)
 {
-        /* Get stats from the driver */
-        struct iw_statistics *stats;
+        struct ifinfomsg *r;
+        struct nlmsghdr  *nlh;
 
-        stats = get_wireless_stats(dev);
-        if (stats) {
-                /* Copy statistics to extra */
-                memcpy(extra, stats, sizeof(struct iw_statistics));
-                wrqu->data.length = sizeof(struct iw_statistics);
+        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
+        if (!nlh)
+                return NULL;
 
-                /* Check if we need to clear the updated flag */
-                if (wrqu->data.flags != 0)
-                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
-                return 0;
-        } else
-                return -EOPNOTSUPP;
+        r = nlmsg_data(nlh);
+        r->ifi_family = AF_UNSPEC;
+        r->__ifi_pad = 0;
+        r->ifi_type = dev->type;
+        r->ifi_index = dev->ifindex;
+        r->ifi_flags = dev_get_flags(dev);
+        r->ifi_change = 0;      /* Wireless changes don't affect those flags */
+
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
+
+        return nlh;
+ nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return NULL;
 }
 
-/* ---------------------------------------------------------------- */
+
 /*
- * Standard Wireless Handler : get iwpriv definitions
- * Export the driver private handler definition
- * They will be picked up by tools like iwpriv...
+ * Main event dispatcher. Called from other parts and drivers.
+ * Send the event on the appropriate channels.
+ * May be called from interrupt context.
  */
-static int iw_handler_get_private(struct net_device *           dev,
-                                  struct iw_request_info *      info,
-                                  union iwreq_data *            wrqu,
-                                  char *                        extra)
+void wireless_send_event(struct net_device *    dev,
+                         unsigned int           cmd,
+                         union iwreq_data *     wrqu,
+                         const char *           extra)
 {
-        /* Check if the driver has something to export */
-        if ((dev->wireless_handlers->num_private_args == 0) ||
-           (dev->wireless_handlers->private_args == NULL))
-                return -EOPNOTSUPP;
+        const struct iw_ioctl_description *     descr = NULL;
+        int extra_len = 0;
+        struct iw_event  *event;                /* Mallocated whole event */
+        int event_len;                          /* Its size */
+        int hdr_len;                            /* Size of the event header */
+        int wrqu_off = 0;                       /* Offset in wrqu */
+        /* Don't "optimise" the following variable, it will crash */
+        unsigned        cmd_index;              /* *MUST* be unsigned */
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+        struct nlattr *nla;
+#ifdef CONFIG_COMPAT
+        struct __compat_iw_event *compat_event;
+        struct compat_iw_point compat_wrqu;
+        struct sk_buff *compskb;
+#endif
 
-        /* Check if there is enough buffer up there */
-        if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
-                /* User space can't know in advance how large the buffer
-                 * needs to be. Give it a hint, so that we can support
-                 * any size buffer we want somewhat efficiently... */
-                wrqu->data.length = dev->wireless_handlers->num_private_args;
-                return -E2BIG;
+        /*
+         * Nothing in the kernel sends scan events with data, be safe.
+         * This is necessary because we cannot fix up scan event data
+         * for compat, due to being contained in 'extra', but normally
+         * applications are required to retrieve the scan data anyway
+         * and no data is included in the event, this codifies that
+         * practice.
+         */
+        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
+                extra = NULL;
+
+        /* Get the description of the Event */
+        if (cmd <= SIOCIWLAST) {
+                cmd_index = cmd - SIOCIWFIRST;
+                if (cmd_index < standard_ioctl_num)
+                        descr = &(standard_ioctl[cmd_index]);
+        } else {
+                cmd_index = cmd - IWEVFIRST;
+                if (cmd_index < standard_event_num)
+                        descr = &(standard_event[cmd_index]);
+        }
+        /* Don't accept unknown events */
+        if (descr == NULL) {
+                /* Note : we don't return an error to the driver, because
+                 * the driver would not know what to do about it. It can't
+                 * return an error to the user, because the event is not
+                 * initiated by a user request.
+                 * The best the driver could do is to log an error message.
+                 * We will do it ourselves instead...
+                 */
+                printk(KERN_ERR "%s (WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
+                       dev->name, cmd);
+                return;
         }
 
-        /* Set the number of available ioctls. */
-        wrqu->data.length = dev->wireless_handlers->num_private_args;
+        /* Check extra parameters and set extra_len */
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                /* Check if number of token fits within bounds */
+                if (wrqu->data.length > descr->max_tokens) {
+                        printk(KERN_ERR "%s (WE) : Wireless Event too big (%d)\n", dev->name, wrqu->data.length);
+                        return;
+                }
+                if (wrqu->data.length < descr->min_tokens) {
+                        printk(KERN_ERR "%s (WE) : Wireless Event too small (%d)\n", dev->name, wrqu->data.length);
+                        return;
+                }
+                /* Calculate extra_len - extra is NULL for restricted events */
+                if (extra != NULL)
+                        extra_len = wrqu->data.length * descr->token_size;
+                /* Always at an offset in wrqu */
+                wrqu_off = IW_EV_POINT_OFF;
+        }
 
-        /* Copy structure to the user buffer. */
-        memcpy(extra, dev->wireless_handlers->private_args,
-               sizeof(struct iw_priv_args) * wrqu->data.length);
+        /* Total length of the event */
+        hdr_len = event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
 
-        return 0;
-}
+        /*
+         * The problem for 64/32 bit.
+         *
+         * On 64-bit, a regular event is laid out as follows:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | wrqu data ... (with the correct size)         |
+         *
+         * This padding exists because we manipulate event->u,
+         * and 'event' is not packed.
+         *
+         * An iw_point event is laid out like this instead:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
+         *      | extra data  ...
+         *
+         * The second padding exists because struct iw_point is extended,
+         * but this depends on the platform...
+         *
+         * On 32-bit, all the padding shouldn't be there.
+         */
 
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!skb)
+                return;
 
-/******************** /proc/net/wireless SUPPORT ********************/
-/*
- * The /proc/net/wireless file is a human readable user-space interface
- * exporting various wireless specific statistics from the wireless devices.
- * This is the most popular part of the Wireless Extensions ;-)
- *
- * This interface is a pure clone of /proc/net/dev (in net/core/dev.c).
- * The content of the file is basically the content of "struct iw_statistics".
- */
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, skb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                return;
+        }
 
-#ifdef CONFIG_PROC_FS
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                return;
+        }
+        event = nla_data(nla);
 
-/* ---------------------------------------------------------------- */
-/*
- * Print one entry (line) of /proc/net/wireless
- */
-static void wireless_seq_printf_stats(struct seq_file *seq,
-                                      struct net_device *dev)
-{
-        /* Get stats from the driver */
-        struct iw_statistics *stats = get_wireless_stats(dev);
-        static struct iw_statistics nullstats = {};
+        /* Fill event - first clear to avoid data leaking */
+        memset(event, 0, hdr_len);
+        event->len = event_len;
+        event->cmd = cmd;
+        memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
+        if (extra_len)
+                memcpy(((char *) event) + hdr_len, extra, extra_len);
 
-        /* show device if it's wireless regardless of current stats */
-        if (!stats && dev->wireless_handlers)
-                stats = &nullstats;
+        nlmsg_end(skb, nlh);
+#ifdef CONFIG_COMPAT
+        hdr_len = compat_event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
 
-        if (stats) {
-                seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
-                                "%6d %6d   %6d\n",
-                           dev->name, stats->status, stats->qual.qual,
-                           stats->qual.updated & IW_QUAL_QUAL_UPDATED
-                           ? '.' : ' ',
-                           ((__s32) stats->qual.level) -
-                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
-                           stats->qual.updated & IW_QUAL_LEVEL_UPDATED
-                           ? '.' : ' ',
-                           ((__s32) stats->qual.noise) -
-                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
-                           stats->qual.updated & IW_QUAL_NOISE_UPDATED
-                           ? '.' : ' ',
-                           stats->discard.nwid, stats->discard.code,
-                           stats->discard.fragment, stats->discard.retries,
-                           stats->discard.misc, stats->miss.beacon);
-
-                if (stats != &nullstats)
-                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!compskb) {
+                kfree_skb(skb);
+                return;
         }
-}
 
-/* ---------------------------------------------------------------- */
-/*
- * Print info for /proc/net/wireless (print all entries)
- */
-static int wireless_dev_seq_show(struct seq_file *seq, void *v)
-{
-        might_sleep();
-
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "Inter-| sta-|   Quality        |   Discarded "
-                                "packets               | Missed | WE\n"
-                                " face | tus | link level noise |  nwid  "
-                                "crypt   frag  retry   misc | beacon | %d\n",
-                           WIRELESS_EXT);
-        else
-                wireless_seq_printf_stats(seq, v);
-        return 0;
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, compskb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+        compat_event = nla_data(nla);
+
+        compat_event->len = event_len;
+        compat_event->cmd = cmd;
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                compat_wrqu.length = wrqu->data.length;
+                compat_wrqu.flags = wrqu->data.flags;
+                memcpy(&compat_event->pointer,
+                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+                if (extra_len)
+                        memcpy(((char *) compat_event) + hdr_len,
+                                extra, extra_len);
+        } else {
+                /* extra_len must be zero, so no if (extra) needed */
+                memcpy(&compat_event->pointer, wrqu,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+        }
+
+        nlmsg_end(compskb, nlh);
+
+        skb_shinfo(skb)->frag_list = compskb;
+#endif
+        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
+        schedule_work(&wireless_nlevent_work);
 }
+EXPORT_SYMBOL(wireless_send_event);
+
+
+
+/* IW handlers */
 
-static void *wireless_dev_seq_start(struct seq_file *seq, loff_t *pos)
+struct iw_statistics *get_wireless_stats(struct net_device *dev)
 {
-        struct net *net = seq_file_net(seq);
-        loff_t off;
-        struct net_device *dev;
+#ifdef CONFIG_WIRELESS_EXT
+        if ((dev->wireless_handlers != NULL) &&
+           (dev->wireless_handlers->get_wireless_stats != NULL))
+                return dev->wireless_handlers->get_wireless_stats(dev);
+#endif
 
-        rtnl_lock();
-        if (!*pos)
-                return SEQ_START_TOKEN;
+#ifdef CONFIG_CFG80211_WEXT
+        if (dev->ieee80211_ptr && dev->ieee80211_ptr &&
+            dev->ieee80211_ptr->wiphy &&
+            dev->ieee80211_ptr->wiphy->wext &&
+            dev->ieee80211_ptr->wiphy->wext->get_wireless_stats)
+                return dev->ieee80211_ptr->wiphy->wext->get_wireless_stats(dev);
+#endif
 
-        off = 1;
-        for_each_netdev(net, dev)
-                if (off++ == *pos)
-                        return dev;
+        /* not found */
         return NULL;
 }
 
-static void *wireless_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static int iw_handler_get_iwstats(struct net_device *           dev,
+                                  struct iw_request_info *      info,
+                                  union iwreq_data *            wrqu,
+                                  char *                        extra)
 {
-        struct net *net = seq_file_net(seq);
+        /* Get stats from the driver */
+        struct iw_statistics *stats;
 
-        ++*pos;
+        stats = get_wireless_stats(dev);
+        if (stats) {
+                /* Copy statistics to extra */
+                memcpy(extra, stats, sizeof(struct iw_statistics));
+                wrqu->data.length = sizeof(struct iw_statistics);
 
-        return v == SEQ_START_TOKEN ?
-                first_net_device(net) : next_net_device(v);
+                /* Check if we need to clear the updated flag */
+                if (wrqu->data.flags != 0)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+                return 0;
+        } else
+                return -EOPNOTSUPP;
 }
 
-static void wireless_dev_seq_stop(struct seq_file *seq, void *v)
+static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
 {
-        rtnl_unlock();
-}
-
-static const struct seq_operations wireless_seq_ops = {
-        .start = wireless_dev_seq_start,
-        .next  = wireless_dev_seq_next,
-        .stop  = wireless_dev_seq_stop,
-        .show  = wireless_dev_seq_show,
-};
+        /* Don't "optimise" the following variable, it will crash */
+        unsigned int    index;          /* *MUST* be unsigned */
+        const struct iw_handler_def *handlers = NULL;
 
-static int seq_open_wireless(struct inode *inode, struct file *file)
-{
-        return seq_open_net(inode, file, &wireless_seq_ops,
-                            sizeof(struct seq_net_private));
-}
+#ifdef CONFIG_CFG80211_WEXT
+        if (dev->ieee80211_ptr && dev->ieee80211_ptr->wiphy)
+                handlers = dev->ieee80211_ptr->wiphy->wext;
+#endif
+#ifdef CONFIG_WIRELESS_EXT
+        if (dev->wireless_handlers)
+                handlers = dev->wireless_handlers;
+#endif
 
-static const struct file_operations wireless_seq_fops = {
-        .owner   = THIS_MODULE,
-        .open    = seq_open_wireless,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = seq_release_net,
-};
+        if (!handlers)
+                return NULL;
 
-int wext_proc_init(struct net *net)
-{
-        /* Create /proc/net/wireless entry */
-        if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
-                return -ENOMEM;
+        /* Try as a standard command */
+        index = cmd - SIOCIWFIRST;
+        if (index < handlers->num_standard)
+                return handlers->standard[index];
 
-        return 0;
-}
+#ifdef CONFIG_WEXT_PRIV
+        /* Try as a private command */
+        index = cmd - SIOCIWFIRSTPRIV;
+        if (index < handlers->num_private)
+                return handlers->private[index];
+#endif
 
-void wext_proc_exit(struct net *net)
-{
-        proc_net_remove(net, "wireless");
+        /* Not found */
+        return NULL;
 }
-#endif  /* CONFIG_PROC_FS */
 
-/************************** IOCTL SUPPORT **************************/
-/*
- * The original user space API to configure all those Wireless Extensions
- * is through IOCTLs.
- * In there, we check if we need to call the new driver API (iw_handler)
- * or just call the driver ioctl handler.
- */
-
-/* ---------------------------------------------------------------- */
 static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                                    const struct iw_ioctl_description *descr,
                                    iw_handler handler, struct net_device *dev,
@@ -875,7 +803,8 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
         }
 
         /* Generate an event to notify listeners of the change */
-        if ((descr->flags & IW_DESCR_FLAG_EVENT) && err == -EIWCOMMIT) {
+        if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
+            ((err == 0) || (err == -EIWCOMMIT))) {
                 union iwreq_data *data = (union iwreq_data *) iwp;
 
                 if (descr->flags & IW_DESCR_FLAG_RESTRICT)
@@ -893,188 +822,39 @@ out:
 }
 
 /*
- * Wrapper to call a standard Wireless Extension handler.
- * We do various checks and also take care of moving data between
- * user space and kernel space.
- */
-static int ioctl_standard_call(struct net_device *      dev,
-                               struct iwreq             *iwr,
-                               unsigned int             cmd,
-                               struct iw_request_info   *info,
-                               iw_handler               handler)
-{
-        const struct iw_ioctl_description *     descr;
-        int                                     ret = -EINVAL;
-
-        /* Get the description of the IOCTL */
-        if ((cmd - SIOCIWFIRST) >= standard_ioctl_num)
-                return -EOPNOTSUPP;
-        descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
-
-        /* Check if we have a pointer to user space data or not */
-        if (descr->header_type != IW_HEADER_TYPE_POINT) {
-
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), NULL);
-
-                /* Generate an event to notify listeners of the change */
-                if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
-                   ((ret == 0) || (ret == -EIWCOMMIT)))
-                        wireless_send_event(dev, cmd, &(iwr->u), NULL);
-        } else {
-                ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr,
-                                              handler, dev, info);
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        /* Here, we will generate the appropriate event if needed */
-
-        return ret;
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Wrapper to call a private Wireless Extension handler.
- * We do various checks and also take care of moving data between
- * user space and kernel space.
- * It's not as nice and slimline as the standard wrapper. The cause
- * is struct iw_priv_args, which was not really designed for the
- * job we are going here.
+ * Call the commit handler in the driver
+ * (if exist and if conditions are right)
+ *
+ * Note : our current commit strategy is currently pretty dumb,
+ * but we will be able to improve on that...
+ * The goal is to try to agreagate as many changes as possible
+ * before doing the commit. Drivers that will define a commit handler
+ * are usually those that need a reset after changing parameters, so
+ * we want to minimise the number of reset.
+ * A cool idea is to use a timer : at each "set" command, we re-set the
+ * timer, when the timer eventually fires, we call the driver.
+ * Hopefully, more on that later.
  *
- * IMPORTANT : This function prevent to set and get data on the same
- * IOCTL and enforce the SET/GET convention. Not doing it would be
- * far too hairy...
- * If you need to set and get data at the same time, please don't use
- * a iw_handler but process it in your ioctl handler (i.e. use the
- * old driver API).
+ * Also, I'm waiting to see how many people will complain about the
+ * netif_running(dev) test. I'm open on that one...
+ * Hopefully, the driver will remember to do a commit in "open()" ;-)
  */
-static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
-                                   const struct iw_priv_args **descrp)
-{
-        const struct iw_priv_args *descr;
-        int i, extra_size;
-
-        descr = NULL;
-        for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
-                if (cmd == dev->wireless_handlers->private_args[i].cmd) {
-                        descr = &dev->wireless_handlers->private_args[i];
-                        break;
-                }
-        }
-
-        extra_size = 0;
-        if (descr) {
-                if (IW_IS_SET(cmd)) {
-                        int     offset = 0;     /* For sub-ioctls */
-                        /* Check for sub-ioctl handler */
-                        if (descr->name[0] == '\0')
-                                /* Reserve one int for sub-ioctl index */
-                                offset = sizeof(__u32);
-
-                        /* Size of set arguments */
-                        extra_size = get_priv_size(descr->set_args);
-
-                        /* Does it fits in iwr ? */
-                        if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
-                           ((extra_size + offset) <= IFNAMSIZ))
-                                extra_size = 0;
-                } else {
-                        /* Size of get arguments */
-                        extra_size = get_priv_size(descr->get_args);
-
-                        /* Does it fits in iwr ? */
-                        if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
-                           (extra_size <= IFNAMSIZ))
-                                extra_size = 0;
-                }
-        }
-        *descrp = descr;
-        return extra_size;
-}
-
-static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
-                                  const struct iw_priv_args *descr,
-                                  iw_handler handler, struct net_device *dev,
-                                  struct iw_request_info *info, int extra_size)
-{
-        char *extra;
-        int err;
-
-        /* Check what user space is giving us */
-        if (IW_IS_SET(cmd)) {
-                if (!iwp->pointer && iwp->length != 0)
-                        return -EFAULT;
-
-                if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
-                        return -E2BIG;
-        } else if (!iwp->pointer)
-                return -EFAULT;
-
-        extra = kmalloc(extra_size, GFP_KERNEL);
-        if (!extra)
-                return -ENOMEM;
-
-        /* If it is a SET, get all the extra data in here */
-        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
-                if (copy_from_user(extra, iwp->pointer, extra_size)) {
-                        err = -EFAULT;
-                        goto out;
-                }
-        }
-
-        /* Call the handler */
-        err = handler(dev, info, (union iwreq_data *) iwp, extra);
-
-        /* If we have something to return to the user */
-        if (!err && IW_IS_GET(cmd)) {
-                /* Adjust for the actual length if it's variable,
-                 * avoid leaking kernel bits outside.
-                 */
-                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
-                        extra_size = adjust_priv_size(descr->get_args, iwp);
-
-                if (copy_to_user(iwp->pointer, extra, extra_size))
-                        err =  -EFAULT;
-        }
-
-out:
-        kfree(extra);
-        return err;
-}
-
-static int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
-                              unsigned int cmd, struct iw_request_info *info,
-                              iw_handler handler)
+int call_commit_handler(struct net_device *dev)
 {
-        int extra_size = 0, ret = -EINVAL;
-        const struct iw_priv_args *descr;
-
-        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
-
-        /* Check if we have a pointer to user space data or not. */
-        if (extra_size == 0) {
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
-        } else {
-                ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
-                                             handler, dev, info, extra_size);
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        return ret;
+#ifdef CONFIG_WIRELESS_EXT
+        if ((netif_running(dev)) &&
+           (dev->wireless_handlers->standard[0] != NULL))
+                /* Call the commit handler on the driver */
+                return dev->wireless_handlers->standard[0](dev, NULL,
+                                                           NULL, NULL);
+        else
+                return 0;               /* Command completed successfully */
+#else
+        /* cfg80211 has no commit */
+        return 0;
+#endif
 }
 
-/* ---------------------------------------------------------------- */
-typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
-                               unsigned int, struct iw_request_info *,
-                               iw_handler);
-
 /*
  * Main IOCTl dispatcher.
  * Check the type of IOCTL and call the appropriate wrapper...
@@ -1103,9 +883,11 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 return standard(dev, iwr, cmd, info,
                                 &iw_handler_get_iwstats);
 
+#ifdef CONFIG_WEXT_PRIV
         if (cmd == SIOCGIWPRIV && dev->wireless_handlers)
                 return standard(dev, iwr, cmd, info,
-                                &iw_handler_get_private);
+                                iw_handler_get_private);
+#endif
 
         /* Basic check */
         if (!netif_device_present(dev))
@@ -1117,7 +899,7 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 /* Standard and private are not the same */
                 if (cmd < SIOCIWFIRSTPRIV)
                         return standard(dev, iwr, cmd, info, handler);
-                else
+                else if (private)
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
@@ -1131,8 +913,9 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
  */
 static int wext_permission_check(unsigned int cmd)
 {
-        if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE || cmd == SIOCGIWENCODEEXT)
-            && !capable(CAP_NET_ADMIN))
+        if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE ||
+             cmd == SIOCGIWENCODEEXT) &&
+            !capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         return 0;
@@ -1157,6 +940,50 @@ static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
         return ret;
 }
 
+/*
+ * Wrapper to call a standard Wireless Extension handler.
+ * We do various checks and also take care of moving data between
+ * user space and kernel space.
+ */
+static int ioctl_standard_call(struct net_device *      dev,
+                               struct iwreq             *iwr,
+                               unsigned int             cmd,
+                               struct iw_request_info   *info,
+                               iw_handler               handler)
+{
+        const struct iw_ioctl_description *     descr;
+        int                                     ret = -EINVAL;
+
+        /* Get the description of the IOCTL */
+        if ((cmd - SIOCIWFIRST) >= standard_ioctl_num)
+                return -EOPNOTSUPP;
+        descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
+
+        /* Check if we have a pointer to user space data or not */
+        if (descr->header_type != IW_HEADER_TYPE_POINT) {
+
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), NULL);
+
+                /* Generate an event to notify listeners of the change */
+                if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
+                   ((ret == 0) || (ret == -EIWCOMMIT)))
+                        wireless_send_event(dev, cmd, &(iwr->u), NULL);
+        } else {
+                ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr,
+                                              handler, dev, info);
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        /* Here, we will generate the appropriate event if needed */
+
+        return ret;
+}
+
+
 int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
                       void __user *arg)
 {
@@ -1205,43 +1032,6 @@ static int compat_standard_call(struct net_device	*dev,
         return err;
 }
 
-static int compat_private_call(struct net_device *dev, struct iwreq *iwr,
-                               unsigned int cmd, struct iw_request_info *info,
-                               iw_handler handler)
-{
-        const struct iw_priv_args *descr;
-        int ret, extra_size;
-
-        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
-
-        /* Check if we have a pointer to user space data or not. */
-        if (extra_size == 0) {
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
-        } else {
-                struct compat_iw_point *iwp_compat;
-                struct iw_point iwp;
-
-                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
-                iwp.pointer = compat_ptr(iwp_compat->pointer);
-                iwp.length = iwp_compat->length;
-                iwp.flags = iwp_compat->flags;
-
-                ret = ioctl_private_iw_point(&iwp, cmd, descr,
-                                             handler, dev, info, extra_size);
-
-                iwp_compat->pointer = ptr_to_compat(iwp.pointer);
-                iwp_compat->length = iwp.length;
-                iwp_compat->flags = iwp.flags;
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        return ret;
-}
-
 int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
                              unsigned long arg)
 {
@@ -1274,502 +1064,3 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
         return ret;
 }
 #endif
-
-static int __net_init wext_pernet_init(struct net *net)
-{
-        skb_queue_head_init(&net->wext_nlevents);
-        return 0;
-}
-
-static void __net_exit wext_pernet_exit(struct net *net)
-{
-        skb_queue_purge(&net->wext_nlevents);
-}
-
-static struct pernet_operations wext_pernet_ops = {
-        .init = wext_pernet_init,
-        .exit = wext_pernet_exit,
-};
-
-static int __init wireless_nlevent_init(void)
-{
-        return register_pernet_subsys(&wext_pernet_ops);
-}
-
-subsys_initcall(wireless_nlevent_init);
-
-/* Process events generated by the wireless layer or the driver. */
-static void wireless_nlevent_process(struct work_struct *work)
-{
-        struct sk_buff *skb;
-        struct net *net;
-
-        rtnl_lock();
-
-        for_each_net(net) {
-                while ((skb = skb_dequeue(&net->wext_nlevents)))
-                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
-                                    GFP_KERNEL);
-        }
-
-        rtnl_unlock();
-}
-
-static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
-
-static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
-                                              struct sk_buff *skb)
-{
-        struct ifinfomsg *r;
-        struct nlmsghdr  *nlh;
-
-        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
-        if (!nlh)
-                return NULL;
-
-        r = nlmsg_data(nlh);
-        r->ifi_family = AF_UNSPEC;
-        r->__ifi_pad = 0;
-        r->ifi_type = dev->type;
-        r->ifi_index = dev->ifindex;
-        r->ifi_flags = dev_get_flags(dev);
-        r->ifi_change = 0;      /* Wireless changes don't affect those flags */
-
-        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-
-        return nlh;
- nla_put_failure:
-        nlmsg_cancel(skb, nlh);
-        return NULL;
-}
-
-
-/*
- * Main event dispatcher. Called from other parts and drivers.
- * Send the event on the appropriate channels.
- * May be called from interrupt context.
- */
-void wireless_send_event(struct net_device *    dev,
-                         unsigned int           cmd,
-                         union iwreq_data *     wrqu,
-                         const char *           extra)
-{
-        const struct iw_ioctl_description *     descr = NULL;
-        int extra_len = 0;
-        struct iw_event  *event;                /* Mallocated whole event */
-        int event_len;                          /* Its size */
-        int hdr_len;                            /* Size of the event header */
-        int wrqu_off = 0;                       /* Offset in wrqu */
-        /* Don't "optimise" the following variable, it will crash */
-        unsigned        cmd_index;              /* *MUST* be unsigned */
-        struct sk_buff *skb;
-        struct nlmsghdr *nlh;
-        struct nlattr *nla;
-#ifdef CONFIG_COMPAT
-        struct __compat_iw_event *compat_event;
-        struct compat_iw_point compat_wrqu;
-        struct sk_buff *compskb;
-#endif
-
-        /*
-         * Nothing in the kernel sends scan events with data, be safe.
-         * This is necessary because we cannot fix up scan event data
-         * for compat, due to being contained in 'extra', but normally
-         * applications are required to retrieve the scan data anyway
-         * and no data is included in the event, this codifies that
-         * practice.
-         */
-        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
-                extra = NULL;
-
-        /* Get the description of the Event */
-        if (cmd <= SIOCIWLAST) {
-                cmd_index = cmd - SIOCIWFIRST;
-                if (cmd_index < standard_ioctl_num)
-                        descr = &(standard_ioctl[cmd_index]);
-        } else {
-                cmd_index = cmd - IWEVFIRST;
-                if (cmd_index < standard_event_num)
-                        descr = &(standard_event[cmd_index]);
-        }
-        /* Don't accept unknown events */
-        if (descr == NULL) {
-                /* Note : we don't return an error to the driver, because
-                 * the driver would not know what to do about it. It can't
-                 * return an error to the user, because the event is not
-                 * initiated by a user request.
-                 * The best the driver could do is to log an error message.
-                 * We will do it ourselves instead...
-                 */
-                printk(KERN_ERR "%s (WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
-                       dev->name, cmd);
-                return;
-        }
-
-        /* Check extra parameters and set extra_len */
-        if (descr->header_type == IW_HEADER_TYPE_POINT) {
-                /* Check if number of token fits within bounds */
-                if (wrqu->data.length > descr->max_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too big (%d)\n", dev->name, wrqu->data.length);
-                        return;
-                }
-                if (wrqu->data.length < descr->min_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too small (%d)\n", dev->name, wrqu->data.length);
-                        return;
-                }
-                /* Calculate extra_len - extra is NULL for restricted events */
-                if (extra != NULL)
-                        extra_len = wrqu->data.length * descr->token_size;
-                /* Always at an offset in wrqu */
-                wrqu_off = IW_EV_POINT_OFF;
-        }
-
-        /* Total length of the event */
-        hdr_len = event_type_size[descr->header_type];
-        event_len = hdr_len + extra_len;
-
-        /*
-         * The problem for 64/32 bit.
-         *
-         * On 64-bit, a regular event is laid out as follows:
-         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
-         *      | event.len | event.cmd |     p a d d i n g     |
-         *      | wrqu data ... (with the correct size)         |
-         *
-         * This padding exists because we manipulate event->u,
-         * and 'event' is not packed.
-         *
-         * An iw_point event is laid out like this instead:
-         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
-         *      | event.len | event.cmd |     p a d d i n g     |
-         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
-         *      | extra data  ...
-         *
-         * The second padding exists because struct iw_point is extended,
-         * but this depends on the platform...
-         *
-         * On 32-bit, all the padding shouldn't be there.
-         */
-
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!skb)
-                return;
-
-        /* Send via the RtNetlink event channel */
-        nlh = rtnetlink_ifinfo_prep(dev, skb);
-        if (WARN_ON(!nlh)) {
-                kfree_skb(skb);
-                return;
-        }
-
-        /* Add the wireless events in the netlink packet */
-        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
-        if (!nla) {
-                kfree_skb(skb);
-                return;
-        }
-        event = nla_data(nla);
-
-        /* Fill event - first clear to avoid data leaking */
-        memset(event, 0, hdr_len);
-        event->len = event_len;
-        event->cmd = cmd;
-        memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
-        if (extra_len)
-                memcpy(((char *) event) + hdr_len, extra, extra_len);
-
-        nlmsg_end(skb, nlh);
-#ifdef CONFIG_COMPAT
-        hdr_len = compat_event_type_size[descr->header_type];
-        event_len = hdr_len + extra_len;
-
-        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!compskb) {
-                kfree_skb(skb);
-                return;
-        }
-
-        /* Send via the RtNetlink event channel */
-        nlh = rtnetlink_ifinfo_prep(dev, compskb);
-        if (WARN_ON(!nlh)) {
-                kfree_skb(skb);
-                kfree_skb(compskb);
-                return;
-        }
-
-        /* Add the wireless events in the netlink packet */
-        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
-        if (!nla) {
-                kfree_skb(skb);
-                kfree_skb(compskb);
-                return;
-        }
-        compat_event = nla_data(nla);
-
-        compat_event->len = event_len;
-        compat_event->cmd = cmd;
-        if (descr->header_type == IW_HEADER_TYPE_POINT) {
-                compat_wrqu.length = wrqu->data.length;
-                compat_wrqu.flags = wrqu->data.flags;
-                memcpy(&compat_event->pointer,
-                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
-                        hdr_len - IW_EV_COMPAT_LCP_LEN);
-                if (extra_len)
-                        memcpy(((char *) compat_event) + hdr_len,
-                                extra, extra_len);
-        } else {
-                /* extra_len must be zero, so no if (extra) needed */
-                memcpy(&compat_event->pointer, wrqu,
-                        hdr_len - IW_EV_COMPAT_LCP_LEN);
-        }
-
-        nlmsg_end(compskb, nlh);
-
-        skb_shinfo(skb)->frag_list = compskb;
-#endif
-        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
-        schedule_work(&wireless_nlevent_work);
-}
-EXPORT_SYMBOL(wireless_send_event);
-
-/********************** ENHANCED IWSPY SUPPORT **********************/
-/*
- * In the old days, the driver was handling spy support all by itself.
- * Now, the driver can delegate this task to Wireless Extensions.
- * It needs to use those standard spy iw_handler in struct iw_handler_def,
- * push data to us via wireless_spy_update() and include struct iw_spy_data
- * in its private part (and export it in net_device->wireless_data->spy_data).
- * One of the main advantage of centralising spy support here is that
- * it becomes much easier to improve and extend it without having to touch
- * the drivers. One example is the addition of the Spy-Threshold events.
- */
-
-/* ---------------------------------------------------------------- */
-/*
- * Return the pointer to the spy data in the driver.
- * Because this is called on the Rx path via wireless_spy_update(),
- * we want it to be efficient...
- */
-static inline struct iw_spy_data *get_spydata(struct net_device *dev)
-{
-        /* This is the new way */
-        if (dev->wireless_data)
-                return dev->wireless_data->spy_data;
-        return NULL;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : set Spy List
- */
-int iw_handler_set_spy(struct net_device *      dev,
-                       struct iw_request_info * info,
-                       union iwreq_data *       wrqu,
-                       char *                   extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct sockaddr *       address = (struct sockaddr *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Disable spy collection while we copy the addresses.
-         * While we copy addresses, any call to wireless_spy_update()
-         * will NOP. This is OK, as anyway the addresses are changing. */
-        spydata->spy_number = 0;
-
-        /* We want to operate without locking, because wireless_spy_update()
-         * most likely will happen in the interrupt handler, and therefore
-         * have its own locking constraints and needs performance.
-         * The rtnl_lock() make sure we don't race with the other iw_handlers.
-         * This make sure wireless_spy_update() "see" that the spy list
-         * is temporarily disabled. */
-        smp_wmb();
-
-        /* Are there are addresses to copy? */
-        if (wrqu->data.length > 0) {
-                int i;
-
-                /* Copy addresses */
-                for (i = 0; i < wrqu->data.length; i++)
-                        memcpy(spydata->spy_address[i], address[i].sa_data,
-                               ETH_ALEN);
-                /* Reset stats */
-                memset(spydata->spy_stat, 0,
-                       sizeof(struct iw_quality) * IW_MAX_SPY);
-        }
-
-        /* Make sure above is updated before re-enabling */
-        smp_wmb();
-
-        /* Enable addresses */
-        spydata->spy_number = wrqu->data.length;
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_set_spy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : get Spy List
- */
-int iw_handler_get_spy(struct net_device *      dev,
-                       struct iw_request_info * info,
-                       union iwreq_data *       wrqu,
-                       char *                   extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct sockaddr *       address = (struct sockaddr *) extra;
-        int                     i;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        wrqu->data.length = spydata->spy_number;
-
-        /* Copy addresses. */
-        for (i = 0; i < spydata->spy_number; i++)       {
-                memcpy(address[i].sa_data, spydata->spy_address[i], ETH_ALEN);
-                address[i].sa_family = AF_UNIX;
-        }
-        /* Copy stats to the user buffer (just after). */
-        if (spydata->spy_number > 0)
-                memcpy(extra  + (sizeof(struct sockaddr) *spydata->spy_number),
-                       spydata->spy_stat,
-                       sizeof(struct iw_quality) * spydata->spy_number);
-        /* Reset updated flags. */
-        for (i = 0; i < spydata->spy_number; i++)
-                spydata->spy_stat[i].updated &= ~IW_QUAL_ALL_UPDATED;
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_get_spy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : set spy threshold
- */
-int iw_handler_set_thrspy(struct net_device *   dev,
-                          struct iw_request_info *info,
-                          union iwreq_data *    wrqu,
-                          char *                extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Just do it */
-        memcpy(&(spydata->spy_thr_low), &(threshold->low),
-               2 * sizeof(struct iw_quality));
-
-        /* Clear flag */
-        memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_set_thrspy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : get spy threshold
- */
-int iw_handler_get_thrspy(struct net_device *   dev,
-                          struct iw_request_info *info,
-                          union iwreq_data *    wrqu,
-                          char *                extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Just do it */
-        memcpy(&(threshold->low), &(spydata->spy_thr_low),
-               2 * sizeof(struct iw_quality));
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_get_thrspy);
-
-/*------------------------------------------------------------------*/
-/*
- * Prepare and send a Spy Threshold event
- */
-static void iw_send_thrspy_event(struct net_device *    dev,
-                                 struct iw_spy_data *   spydata,
-                                 unsigned char *        address,
-                                 struct iw_quality *    wstats)
-{
-        union iwreq_data        wrqu;
-        struct iw_thrspy        threshold;
-
-        /* Init */
-        wrqu.data.length = 1;
-        wrqu.data.flags = 0;
-        /* Copy address */
-        memcpy(threshold.addr.sa_data, address, ETH_ALEN);
-        threshold.addr.sa_family = ARPHRD_ETHER;
-        /* Copy stats */
-        memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
-        /* Copy also thresholds */
-        memcpy(&(threshold.low), &(spydata->spy_thr_low),
-               2 * sizeof(struct iw_quality));
-
-        /* Send event to user space */
-        wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Call for the driver to update the spy data.
- * For now, the spy data is a simple array. As the size of the array is
- * small, this is good enough. If we wanted to support larger number of
- * spy addresses, we should use something more efficient...
- */
-void wireless_spy_update(struct net_device *    dev,
-                         unsigned char *        address,
-                         struct iw_quality *    wstats)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        int                     i;
-        int                     match = -1;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return;
-
-        /* Update all records that match */
-        for (i = 0; i < spydata->spy_number; i++)
-                if (!compare_ether_addr(address, spydata->spy_address[i])) {
-                        memcpy(&(spydata->spy_stat[i]), wstats,
-                               sizeof(struct iw_quality));
-                        match = i;
-                }
-
-        /* Generate an event if we cross the spy threshold.
-         * To avoid event storms, we have a simple hysteresis : we generate
-         * event only when we go under the low threshold or above the
-         * high threshold. */
-        if (match >= 0) {
-                if (spydata->spy_thr_under[match]) {
-                        if (wstats->level > spydata->spy_thr_high.level) {
-                                spydata->spy_thr_under[match] = 0;
-                                iw_send_thrspy_event(dev, spydata,
-                                                     address, wstats);
-                        }
-                } else {
-                        if (wstats->level < spydata->spy_thr_low.level) {
-                                spydata->spy_thr_under[match] = 1;
-                                iw_send_thrspy_event(dev, spydata,
-                                                     address, wstats);
-                        }
-                }
-        }
-}
-EXPORT_SYMBOL(wireless_spy_update);
diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c
new file mode 100644
index 000000000000..3feb28e41c53
--- /dev/null
+++ b/net/wireless/wext-priv.c
@@ -0,0 +1,249 @@
+/*
+ * This file implement the Wireless Extensions priv API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+#include <linux/slab.h>
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <net/iw_handler.h>
+#include <net/wext.h>
+
+int iw_handler_get_private(struct net_device *          dev,
+                           struct iw_request_info *     info,
+                           union iwreq_data *           wrqu,
+                           char *                       extra)
+{
+        /* Check if the driver has something to export */
+        if ((dev->wireless_handlers->num_private_args == 0) ||
+           (dev->wireless_handlers->private_args == NULL))
+                return -EOPNOTSUPP;
+
+        /* Check if there is enough buffer up there */
+        if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
+                /* User space can't know in advance how large the buffer
+                 * needs to be. Give it a hint, so that we can support
+                 * any size buffer we want somewhat efficiently... */
+                wrqu->data.length = dev->wireless_handlers->num_private_args;
+                return -E2BIG;
+        }
+
+        /* Set the number of available ioctls. */
+        wrqu->data.length = dev->wireless_handlers->num_private_args;
+
+        /* Copy structure to the user buffer. */
+        memcpy(extra, dev->wireless_handlers->private_args,
+               sizeof(struct iw_priv_args) * wrqu->data.length);
+
+        return 0;
+}
+
+/* Size (in bytes) of the various private data types */
+static const char iw_priv_type_size[] = {
+        0,                              /* IW_PRIV_TYPE_NONE */
+        1,                              /* IW_PRIV_TYPE_BYTE */
+        1,                              /* IW_PRIV_TYPE_CHAR */
+        0,                              /* Not defined */
+        sizeof(__u32),                  /* IW_PRIV_TYPE_INT */
+        sizeof(struct iw_freq),         /* IW_PRIV_TYPE_FLOAT */
+        sizeof(struct sockaddr),        /* IW_PRIV_TYPE_ADDR */
+        0,                              /* Not defined */
+};
+
+static int get_priv_size(__u16 args)
+{
+        int     num = args & IW_PRIV_SIZE_MASK;
+        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+
+        return num * iw_priv_type_size[type];
+}
+
+static int adjust_priv_size(__u16 args, struct iw_point *iwp)
+{
+        int     num = iwp->length;
+        int     max = args & IW_PRIV_SIZE_MASK;
+        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+
+        /* Make sure the driver doesn't goof up */
+        if (max < num)
+                num = max;
+
+        return num * iw_priv_type_size[type];
+}
+
+/*
+ * Wrapper to call a private Wireless Extension handler.
+ * We do various checks and also take care of moving data between
+ * user space and kernel space.
+ * It's not as nice and slimline as the standard wrapper. The cause
+ * is struct iw_priv_args, which was not really designed for the
+ * job we are going here.
+ *
+ * IMPORTANT : This function prevent to set and get data on the same
+ * IOCTL and enforce the SET/GET convention. Not doing it would be
+ * far too hairy...
+ * If you need to set and get data at the same time, please don't use
+ * a iw_handler but process it in your ioctl handler (i.e. use the
+ * old driver API).
+ */
+static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
+                                   const struct iw_priv_args **descrp)
+{
+        const struct iw_priv_args *descr;
+        int i, extra_size;
+
+        descr = NULL;
+        for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
+                if (cmd == dev->wireless_handlers->private_args[i].cmd) {
+                        descr = &dev->wireless_handlers->private_args[i];
+                        break;
+                }
+        }
+
+        extra_size = 0;
+        if (descr) {
+                if (IW_IS_SET(cmd)) {
+                        int     offset = 0;     /* For sub-ioctls */
+                        /* Check for sub-ioctl handler */
+                        if (descr->name[0] == '\0')
+                                /* Reserve one int for sub-ioctl index */
+                                offset = sizeof(__u32);
+
+                        /* Size of set arguments */
+                        extra_size = get_priv_size(descr->set_args);
+
+                        /* Does it fits in iwr ? */
+                        if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
+                           ((extra_size + offset) <= IFNAMSIZ))
+                                extra_size = 0;
+                } else {
+                        /* Size of get arguments */
+                        extra_size = get_priv_size(descr->get_args);
+
+                        /* Does it fits in iwr ? */
+                        if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
+                           (extra_size <= IFNAMSIZ))
+                                extra_size = 0;
+                }
+        }
+        *descrp = descr;
+        return extra_size;
+}
+
+static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
+                                  const struct iw_priv_args *descr,
+                                  iw_handler handler, struct net_device *dev,
+                                  struct iw_request_info *info, int extra_size)
+{
+        char *extra;
+        int err;
+
+        /* Check what user space is giving us */
+        if (IW_IS_SET(cmd)) {
+                if (!iwp->pointer && iwp->length != 0)
+                        return -EFAULT;
+
+                if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
+                        return -E2BIG;
+        } else if (!iwp->pointer)
+                return -EFAULT;
+
+        extra = kmalloc(extra_size, GFP_KERNEL);
+        if (!extra)
+                return -ENOMEM;
+
+        /* If it is a SET, get all the extra data in here */
+        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
+                if (copy_from_user(extra, iwp->pointer, extra_size)) {
+                        err = -EFAULT;
+                        goto out;
+                }
+        }
+
+        /* Call the handler */
+        err = handler(dev, info, (union iwreq_data *) iwp, extra);
+
+        /* If we have something to return to the user */
+        if (!err && IW_IS_GET(cmd)) {
+                /* Adjust for the actual length if it's variable,
+                 * avoid leaking kernel bits outside.
+                 */
+                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
+                        extra_size = adjust_priv_size(descr->get_args, iwp);
+
+                if (copy_to_user(iwp->pointer, extra, extra_size))
+                        err =  -EFAULT;
+        }
+
+out:
+        kfree(extra);
+        return err;
+}
+
+int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
+                       unsigned int cmd, struct iw_request_info *info,
+                       iw_handler handler)
+{
+        int extra_size = 0, ret = -EINVAL;
+        const struct iw_priv_args *descr;
+
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
+                                             handler, dev, info, extra_size);
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        return ret;
+}
+
+#ifdef CONFIG_COMPAT
+int compat_private_call(struct net_device *dev, struct iwreq *iwr,
+                        unsigned int cmd, struct iw_request_info *info,
+                        iw_handler handler)
+{
+        const struct iw_priv_args *descr;
+        int ret, extra_size;
+
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                struct compat_iw_point *iwp_compat;
+                struct iw_point iwp;
+
+                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+                iwp.pointer = compat_ptr(iwp_compat->pointer);
+                iwp.length = iwp_compat->length;
+                iwp.flags = iwp_compat->flags;
+
+                ret = ioctl_private_iw_point(&iwp, cmd, descr,
+                                             handler, dev, info, extra_size);
+
+                iwp_compat->pointer = ptr_to_compat(iwp.pointer);
+                iwp_compat->length = iwp.length;
+                iwp_compat->flags = iwp.flags;
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        return ret;
+}
+#endif
diff --git a/net/wireless/wext-proc.c b/net/wireless/wext-proc.c
new file mode 100644
index 000000000000..8bafa31fa9f8
--- /dev/null
+++ b/net/wireless/wext-proc.c
@@ -0,0 +1,155 @@
+/*
+ * This file implement the Wireless Extensions proc API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+
+/*
+ * The /proc/net/wireless file is a human readable user-space interface
+ * exporting various wireless specific statistics from the wireless devices.
+ * This is the most popular part of the Wireless Extensions ;-)
+ *
+ * This interface is a pure clone of /proc/net/dev (in net/core/dev.c).
+ * The content of the file is basically the content of "struct iw_statistics".
+ */
+
+#include <linux/module.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <net/iw_handler.h>
+#include <net/wext.h>
+
+
+static void wireless_seq_printf_stats(struct seq_file *seq,
+                                      struct net_device *dev)
+{
+        /* Get stats from the driver */
+        struct iw_statistics *stats = get_wireless_stats(dev);
+        static struct iw_statistics nullstats = {};
+
+        /* show device if it's wireless regardless of current stats */
+        if (!stats) {
+#ifdef CONFIG_WIRELESS_EXT
+                if (dev->wireless_handlers)
+                        stats = &nullstats;
+#endif
+#ifdef CONFIG_CFG80211
+                if (dev->ieee80211_ptr)
+                        stats = &nullstats;
+#endif
+        }
+
+        if (stats) {
+                seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
+                                "%6d %6d   %6d\n",
+                           dev->name, stats->status, stats->qual.qual,
+                           stats->qual.updated & IW_QUAL_QUAL_UPDATED
+                           ? '.' : ' ',
+                           ((__s32) stats->qual.level) -
+                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
+                           stats->qual.updated & IW_QUAL_LEVEL_UPDATED
+                           ? '.' : ' ',
+                           ((__s32) stats->qual.noise) -
+                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
+                           stats->qual.updated & IW_QUAL_NOISE_UPDATED
+                           ? '.' : ' ',
+                           stats->discard.nwid, stats->discard.code,
+                           stats->discard.fragment, stats->discard.retries,
+                           stats->discard.misc, stats->miss.beacon);
+
+                if (stats != &nullstats)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+        }
+}
+
+/* ---------------------------------------------------------------- */
+/*
+ * Print info for /proc/net/wireless (print all entries)
+ */
+static int wireless_dev_seq_show(struct seq_file *seq, void *v)
+{
+        might_sleep();
+
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "Inter-| sta-|   Quality        |   Discarded "
+                                "packets               | Missed | WE\n"
+                                " face | tus | link level noise |  nwid  "
+                                "crypt   frag  retry   misc | beacon | %d\n",
+                           WIRELESS_EXT);
+        else
+                wireless_seq_printf_stats(seq, v);
+        return 0;
+}
+
+static void *wireless_dev_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+        loff_t off;
+        struct net_device *dev;
+
+        rtnl_lock();
+        if (!*pos)
+                return SEQ_START_TOKEN;
+
+        off = 1;
+        for_each_netdev(net, dev)
+                if (off++ == *pos)
+                        return dev;
+        return NULL;
+}
+
+static void *wireless_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+
+        ++*pos;
+
+        return v == SEQ_START_TOKEN ?
+                first_net_device(net) : next_net_device(v);
+}
+
+static void wireless_dev_seq_stop(struct seq_file *seq, void *v)
+{
+        rtnl_unlock();
+}
+
+static const struct seq_operations wireless_seq_ops = {
+        .start = wireless_dev_seq_start,
+        .next  = wireless_dev_seq_next,
+        .stop  = wireless_dev_seq_stop,
+        .show  = wireless_dev_seq_show,
+};
+
+static int seq_open_wireless(struct inode *inode, struct file *file)
+{
+        return seq_open_net(inode, file, &wireless_seq_ops,
+                            sizeof(struct seq_net_private));
+}
+
+static const struct file_operations wireless_seq_fops = {
+        .owner   = THIS_MODULE,
+        .open    = seq_open_wireless,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release_net,
+};
+
+int __net_init wext_proc_init(struct net *net)
+{
+        /* Create /proc/net/wireless entry */
+        if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
+                return -ENOMEM;
+
+        return 0;
+}
+
+void __net_exit wext_proc_exit(struct net *net)
+{
+        proc_net_remove(net, "wireless");
+}
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 5615a8802536..d5c6140f4cb8 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -7,6 +7,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <net/cfg80211.h>
 #include "wext-compat.h"
 #include "nl80211.h"
diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
new file mode 100644
index 000000000000..6dcfe65a2d1a
--- /dev/null
+++ b/net/wireless/wext-spy.c
@@ -0,0 +1,231 @@
+/*
+ * This file implement the Wireless Extensions spy API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/iw_handler.h>
+#include <net/arp.h>
+#include <net/wext.h>
+
+static inline struct iw_spy_data *get_spydata(struct net_device *dev)
+{
+        /* This is the new way */
+        if (dev->wireless_data)
+                return dev->wireless_data->spy_data;
+        return NULL;
+}
+
+int iw_handler_set_spy(struct net_device *      dev,
+                       struct iw_request_info * info,
+                       union iwreq_data *       wrqu,
+                       char *                   extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct sockaddr *       address = (struct sockaddr *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Disable spy collection while we copy the addresses.
+         * While we copy addresses, any call to wireless_spy_update()
+         * will NOP. This is OK, as anyway the addresses are changing. */
+        spydata->spy_number = 0;
+
+        /* We want to operate without locking, because wireless_spy_update()
+         * most likely will happen in the interrupt handler, and therefore
+         * have its own locking constraints and needs performance.
+         * The rtnl_lock() make sure we don't race with the other iw_handlers.
+         * This make sure wireless_spy_update() "see" that the spy list
+         * is temporarily disabled. */
+        smp_wmb();
+
+        /* Are there are addresses to copy? */
+        if (wrqu->data.length > 0) {
+                int i;
+
+                /* Copy addresses */
+                for (i = 0; i < wrqu->data.length; i++)
+                        memcpy(spydata->spy_address[i], address[i].sa_data,
+                               ETH_ALEN);
+                /* Reset stats */
+                memset(spydata->spy_stat, 0,
+                       sizeof(struct iw_quality) * IW_MAX_SPY);
+        }
+
+        /* Make sure above is updated before re-enabling */
+        smp_wmb();
+
+        /* Enable addresses */
+        spydata->spy_number = wrqu->data.length;
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_set_spy);
+
+int iw_handler_get_spy(struct net_device *      dev,
+                       struct iw_request_info * info,
+                       union iwreq_data *       wrqu,
+                       char *                   extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct sockaddr *       address = (struct sockaddr *) extra;
+        int                     i;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        wrqu->data.length = spydata->spy_number;
+
+        /* Copy addresses. */
+        for (i = 0; i < spydata->spy_number; i++)       {
+                memcpy(address[i].sa_data, spydata->spy_address[i], ETH_ALEN);
+                address[i].sa_family = AF_UNIX;
+        }
+        /* Copy stats to the user buffer (just after). */
+        if (spydata->spy_number > 0)
+                memcpy(extra  + (sizeof(struct sockaddr) *spydata->spy_number),
+                       spydata->spy_stat,
+                       sizeof(struct iw_quality) * spydata->spy_number);
+        /* Reset updated flags. */
+        for (i = 0; i < spydata->spy_number; i++)
+                spydata->spy_stat[i].updated &= ~IW_QUAL_ALL_UPDATED;
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_get_spy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Standard Wireless Handler : set spy threshold
+ */
+int iw_handler_set_thrspy(struct net_device *   dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *    wrqu,
+                          char *                extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Just do it */
+        memcpy(&(spydata->spy_thr_low), &(threshold->low),
+               2 * sizeof(struct iw_quality));
+
+        /* Clear flag */
+        memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_set_thrspy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Standard Wireless Handler : get spy threshold
+ */
+int iw_handler_get_thrspy(struct net_device *   dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *    wrqu,
+                          char *                extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Just do it */
+        memcpy(&(threshold->low), &(spydata->spy_thr_low),
+               2 * sizeof(struct iw_quality));
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_get_thrspy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Prepare and send a Spy Threshold event
+ */
+static void iw_send_thrspy_event(struct net_device *    dev,
+                                 struct iw_spy_data *   spydata,
+                                 unsigned char *        address,
+                                 struct iw_quality *    wstats)
+{
+        union iwreq_data        wrqu;
+        struct iw_thrspy        threshold;
+
+        /* Init */
+        wrqu.data.length = 1;
+        wrqu.data.flags = 0;
+        /* Copy address */
+        memcpy(threshold.addr.sa_data, address, ETH_ALEN);
+        threshold.addr.sa_family = ARPHRD_ETHER;
+        /* Copy stats */
+        memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
+        /* Copy also thresholds */
+        memcpy(&(threshold.low), &(spydata->spy_thr_low),
+               2 * sizeof(struct iw_quality));
+
+        /* Send event to user space */
+        wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
+}
+
+/* ---------------------------------------------------------------- */
+/*
+ * Call for the driver to update the spy data.
+ * For now, the spy data is a simple array. As the size of the array is
+ * small, this is good enough. If we wanted to support larger number of
+ * spy addresses, we should use something more efficient...
+ */
+void wireless_spy_update(struct net_device *    dev,
+                         unsigned char *        address,
+                         struct iw_quality *    wstats)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        int                     i;
+        int                     match = -1;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return;
+
+        /* Update all records that match */
+        for (i = 0; i < spydata->spy_number; i++)
+                if (!compare_ether_addr(address, spydata->spy_address[i])) {
+                        memcpy(&(spydata->spy_stat[i]), wstats,
+                               sizeof(struct iw_quality));
+                        match = i;
+                }
+
+        /* Generate an event if we cross the spy threshold.
+         * To avoid event storms, we have a simple hysteresis : we generate
+         * event only when we go under the low threshold or above the
+         * high threshold. */
+        if (match >= 0) {
+                if (spydata->spy_thr_under[match]) {
+                        if (wstats->level > spydata->spy_thr_high.level) {
+                                spydata->spy_thr_under[match] = 0;
+                                iw_send_thrspy_event(dev, spydata,
+                                                     address, wstats);
+                        }
+                } else {
+                        if (wstats->level < spydata->spy_thr_low.level) {
+                                spydata->spy_thr_under[match] = 1;
+                                iw_send_thrspy_event(dev, spydata,
+                                                     address, wstats);
+                        }
+                }
+        }
+}
+EXPORT_SYMBOL(wireless_spy_update);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 7fa9c7ad3d3b..36e84e13c6aa 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -47,6 +47,7 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
@@ -55,6 +56,7 @@
 #include <linux/notifier.h>
 #include <linux/init.h>
 #include <linux/compat.h>
+#include <linux/ctype.h>
 
 #include <net/x25.h>
 #include <net/compat.h>
@@ -81,6 +83,41 @@ struct compat_x25_subscrip_struct {
 };
 #endif
 
+
+int x25_parse_address_block(struct sk_buff *skb,
+                struct x25_address *called_addr,
+                struct x25_address *calling_addr)
+{
+        unsigned char len;
+        int needed;
+        int rc;
+
+        if (skb->len < 1) {
+                /* packet has no address block */
+                rc = 0;
+                goto empty;
+        }
+
+        len = *skb->data;
+        needed = 1 + (len >> 4) + (len & 0x0f);
+
+        if (skb->len < needed) {
+                /* packet is too short to hold the addresses it claims
+                   to hold */
+                rc = -1;
+                goto empty;
+        }
+
+        return x25_addr_ntoa(skb->data, called_addr, calling_addr);
+
+empty:
+        *called_addr->x25_addr = 0;
+        *calling_addr->x25_addr = 0;
+
+        return rc;
+}
+
+
 int x25_addr_ntoa(unsigned char *p, struct x25_address *called_addr,
                   struct x25_address *calling_addr)
 {
@@ -365,6 +402,7 @@ static void __x25_destroy_socket(struct sock *sk)
                         /*
                          * Queue the unaccepted socket for death
                          */
+                        skb->sk->sk_state = TCP_LISTEN;
                         sock_set_flag(skb->sk, SOCK_DEAD);
                         x25_start_heartbeat(skb->sk);
                         x25_sk(skb->sk)->state = X25_STATE_0;
@@ -415,6 +453,7 @@ static int x25_setsockopt(struct socket *sock, int level, int optname,
         struct sock *sk = sock->sk;
         int rc = -ENOPROTOOPT;
 
+        lock_kernel();
         if (level != SOL_X25 || optname != X25_QBITINCL)
                 goto out;
 
@@ -429,6 +468,7 @@ static int x25_setsockopt(struct socket *sock, int level, int optname,
         x25_sk(sk)->qbitincl = !!opt;
         rc = 0;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -438,6 +478,7 @@ static int x25_getsockopt(struct socket *sock, int level, int optname,
         struct sock *sk = sock->sk;
         int val, len, rc = -ENOPROTOOPT;
 
+        lock_kernel();
         if (level != SOL_X25 || optname != X25_QBITINCL)
                 goto out;
 
@@ -458,6 +499,7 @@ static int x25_getsockopt(struct socket *sock, int level, int optname,
         val = x25_sk(sk)->qbitincl;
         rc = copy_to_user(optval, &val, len) ? -EFAULT : 0;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -466,12 +508,14 @@ static int x25_listen(struct socket *sock, int backlog)
         struct sock *sk = sock->sk;
         int rc = -EOPNOTSUPP;
 
+        lock_kernel();
         if (sk->sk_state != TCP_LISTEN) {
                 memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
                 sk->sk_max_ack_backlog = backlog;
                 sk->sk_state           = TCP_LISTEN;
                 rc = 0;
         }
+        unlock_kernel();
 
         return rc;
 }
@@ -501,19 +545,25 @@ out:
         return sk;
 }
 
-static int x25_create(struct net *net, struct socket *sock, int protocol)
+static int x25_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
         struct sock *sk;
         struct x25_sock *x25;
-        int rc = -ESOCKTNOSUPPORT;
+        int rc = -EAFNOSUPPORT;
 
-        if (net != &init_net)
-                return -EAFNOSUPPORT;
+        if (!net_eq(net, &init_net))
+                goto out;
 
-        if (sock->type != SOCK_SEQPACKET || protocol)
+        rc = -ESOCKTNOSUPPORT;
+        if (sock->type != SOCK_SEQPACKET)
                 goto out;
 
-        rc = -ENOMEM;
+        rc = -EINVAL;
+        if (protocol)
+                goto out;
+
+        rc = -ENOBUFS;
         if ((sk = x25_alloc_socket(net)) == NULL)
                 goto out;
 
@@ -540,7 +590,8 @@ static int x25_create(struct net *net, struct socket *sock, int protocol)
         x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
         x25->facilities.pacsize_in  = X25_DEFAULT_PACKET_SIZE;
         x25->facilities.pacsize_out = X25_DEFAULT_PACKET_SIZE;
-        x25->facilities.throughput  = X25_DEFAULT_THROUGHPUT;
+        x25->facilities.throughput  = 0;        /* by default don't negotiate
+                                                   throughput */
         x25->facilities.reverse     = X25_DEFAULT_REVERSE;
         x25->dte_facilities.calling_len = 0;
         x25->dte_facilities.called_len = 0;
@@ -597,6 +648,7 @@ static int x25_release(struct socket *sock)
         struct sock *sk = sock->sk;
         struct x25_sock *x25;
 
+        lock_kernel();
         if (!sk)
                 goto out;
 
@@ -627,6 +679,7 @@ static int x25_release(struct socket *sock)
 
         sock_orphan(sk);
 out:
+        unlock_kernel();
         return 0;
 }
 
@@ -634,18 +687,31 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
+        int len, i, rc = 0;
 
+        lock_kernel();
         if (!sock_flag(sk, SOCK_ZAPPED) ||
             addr_len != sizeof(struct sockaddr_x25) ||
-            addr->sx25_family != AF_X25)
-                return -EINVAL;
+            addr->sx25_family != AF_X25) {
+                rc = -EINVAL;
+                goto out;
+        }
+
+        len = strlen(addr->sx25_addr.x25_addr);
+        for (i = 0; i < len; i++) {
+                if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
 
         x25_sk(sk)->source_addr = addr->sx25_addr;
         x25_insert_socket(sk);
         sock_reset_flag(sk, SOCK_ZAPPED);
         SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
-
-        return 0;
+out:
+        unlock_kernel();
+        return rc;
 }
 
 static int x25_wait_for_connection_establishment(struct sock *sk)
@@ -686,6 +752,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
         struct x25_route *rt;
         int rc = 0;
 
+        lock_kernel();
         lock_sock(sk);
         if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
                 sock->state = SS_CONNECTED;
@@ -763,6 +830,7 @@ out_put_route:
         x25_route_put(rt);
 out:
         release_sock(sk);
+        unlock_kernel();
         return rc;
 }
 
@@ -802,6 +870,7 @@ static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
         struct sk_buff *skb;
         int rc = -EINVAL;
 
+        lock_kernel();
         if (!sk || sk->sk_state != TCP_LISTEN)
                 goto out;
 
@@ -829,6 +898,7 @@ static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
 out2:
         release_sock(sk);
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -838,10 +908,14 @@ static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)uaddr;
         struct sock *sk = sock->sk;
         struct x25_sock *x25 = x25_sk(sk);
+        int rc = 0;
 
+        lock_kernel();
         if (peer) {
-                if (sk->sk_state != TCP_ESTABLISHED)
-                        return -ENOTCONN;
+                if (sk->sk_state != TCP_ESTABLISHED) {
+                        rc = -ENOTCONN;
+                        goto out;
+                }
                 sx25->sx25_addr = x25->dest_addr;
         } else
                 sx25->sx25_addr = x25->source_addr;
@@ -849,7 +923,21 @@ static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
         sx25->sx25_family = AF_X25;
         *uaddr_len = sizeof(*sx25);
 
-        return 0;
+out:
+        unlock_kernel();
+        return rc;
+}
+
+static unsigned int x25_datagram_poll(struct file *file, struct socket *sock,
+                           poll_table *wait)
+{
+        int rc;
+
+        lock_kernel();
+        rc = datagram_poll(file, sock, wait);
+        unlock_kernel();
+
+        return rc;
 }
 
 int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
@@ -871,16 +959,26 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         /*
          *      Extract the X.25 addresses and convert them to ASCII strings,
          *      and remove them.
+         *
+         *      Address block is mandatory in call request packets
          */
-        addr_len = x25_addr_ntoa(skb->data, &source_addr, &dest_addr);
+        addr_len = x25_parse_address_block(skb, &source_addr, &dest_addr);
+        if (addr_len <= 0)
+                goto out_clear_request;
         skb_pull(skb, addr_len);
 
         /*
          *      Get the length of the facilities, skip past them for the moment
          *      get the call user data because this is needed to determine
          *      the correct listener
+         *
+         *      Facilities length is mandatory in call request packets
          */
+        if (skb->len < 1)
+                goto out_clear_request;
         len = skb->data[0] + 1;
+        if (skb->len < len)
+                goto out_clear_request;
         skb_pull(skb,len);
 
         /*
@@ -1002,6 +1100,7 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
         size_t size;
         int qbit = 0, rc = -EINVAL;
 
+        lock_kernel();
         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_OOB|MSG_EOR|MSG_CMSG_COMPAT))
                 goto out;
 
@@ -1166,6 +1265,7 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
         release_sock(sk);
         rc = len;
 out:
+        unlock_kernel();
         return rc;
 out_kfree_skb:
         kfree_skb(skb);
@@ -1186,6 +1286,7 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
         unsigned char *asmptr;
         int rc = -ENOTCONN;
 
+        lock_kernel();
         /*
          * This works for seqpacket too. The receiver has ordered the queue for
          * us! We do one quick check first though
@@ -1259,6 +1360,7 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
 out_free_dgram:
         skb_free_datagram(sk, skb);
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -1270,6 +1372,7 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         void __user *argp = (void __user *)arg;
         int rc;
 
+        lock_kernel();
         switch (cmd) {
                 case TIOCOUTQ: {
                         int amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
@@ -1359,11 +1462,22 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (facilities.winsize_in < 1 ||
                             facilities.winsize_in > 127)
                                 break;
-                        if (facilities.throughput < 0x03 ||
-                            facilities.throughput > 0xDD)
-                                break;
+                        if (facilities.throughput) {
+                                int out = facilities.throughput & 0xf0;
+                                int in  = facilities.throughput & 0x0f;
+                                if (!out)
+                                        facilities.throughput |=
+                                                X25_DEFAULT_THROUGHPUT << 4;
+                                else if (out < 0x30 || out > 0xD0)
+                                        break;
+                                if (!in)
+                                        facilities.throughput |=
+                                                X25_DEFAULT_THROUGHPUT;
+                                else if (in < 0x03 || in > 0x0D)
+                                        break;
+                        }
                         if (facilities.reverse &&
-                                (facilities.reverse | 0x81)!= 0x81)
+                                (facilities.reverse & 0x81) != 0x81)
                                 break;
                         x25->facilities = facilities;
                         rc = 0;
@@ -1430,6 +1544,17 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         break;
                 }
 
+                case SIOCX25SCAUSEDIAG: {
+                        struct x25_causediag causediag;
+                        rc = -EFAULT;
+                        if (copy_from_user(&causediag, argp, sizeof(causediag)))
+                                break;
+                        x25->causediag = causediag;
+                        rc = 0;
+                        break;
+
+                }
+
                 case SIOCX25SCUDMATCHLEN: {
                         struct x25_subaddr sub_addr;
                         rc = -EINVAL;
@@ -1472,11 +1597,12 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         rc = -ENOIOCTLCMD;
                         break;
         }
+        unlock_kernel();
 
         return rc;
 }
 
-static struct net_proto_family x25_family_ops = {
+static const struct net_proto_family x25_family_ops = {
         .family =       AF_X25,
         .create =       x25_create,
         .owner  =       THIS_MODULE,
@@ -1542,15 +1668,19 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
                 break;
         case SIOCGSTAMP:
                 rc = -EINVAL;
+                lock_kernel();
                 if (sk)
                         rc = compat_sock_get_timestamp(sk,
                                         (struct timeval __user*)argp);
+                unlock_kernel();
                 break;
         case SIOCGSTAMPNS:
                 rc = -EINVAL;
+                lock_kernel();
                 if (sk)
                         rc = compat_sock_get_timestampns(sk,
                                         (struct timespec __user*)argp);
+                unlock_kernel();
                 break;
         case SIOCGIFADDR:
         case SIOCSIFADDR:
@@ -1569,16 +1699,22 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
                 rc = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
+                lock_kernel();
                 rc = x25_route_ioctl(cmd, argp);
+                unlock_kernel();
                 break;
         case SIOCX25GSUBSCRIP:
+                lock_kernel();
                 rc = compat_x25_subscr_ioctl(cmd, argp);
+                unlock_kernel();
                 break;
         case SIOCX25SSUBSCRIP:
                 rc = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
+                lock_kernel();
                 rc = compat_x25_subscr_ioctl(cmd, argp);
+                unlock_kernel();
                 break;
         case SIOCX25GFACILITIES:
         case SIOCX25SFACILITIES:
@@ -1587,6 +1723,7 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
         case SIOCX25GCALLUSERDATA:
         case SIOCX25SCALLUSERDATA:
         case SIOCX25GCAUSEDIAG:
+        case SIOCX25SCAUSEDIAG:
         case SIOCX25SCUDMATCHLEN:
         case SIOCX25CALLACCPTAPPRV:
         case SIOCX25SENDCALLACCPT:
@@ -1600,7 +1737,7 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
 }
 #endif
 
-static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
+static const struct proto_ops x25_proto_ops = {
         .family =       AF_X25,
         .owner =        THIS_MODULE,
         .release =      x25_release,
@@ -1609,7 +1746,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
         .socketpair =   sock_no_socketpair,
         .accept =       x25_accept,
         .getname =      x25_getname,
-        .poll =         datagram_poll,
+        .poll =         x25_datagram_poll,
         .ioctl =        x25_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = compat_x25_ioctl,
@@ -1624,8 +1761,6 @@ static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
         .sendpage =     sock_no_sendpage,
 };
 
-SOCKOPS_WRAP(x25_proto, AF_X25);
-
 static struct packet_type x25_packet_type __read_mostly = {
         .type = cpu_to_be16(ETH_P_X25),
         .func = x25_lapb_receive_frame,
@@ -1659,20 +1794,31 @@ static int __init x25_init(void)
         if (rc != 0)
                 goto out;
 
-        sock_register(&x25_family_ops);
+        rc = sock_register(&x25_family_ops);
+        if (rc != 0)
+                goto out_proto;
 
         dev_add_pack(&x25_packet_type);
 
-        register_netdevice_notifier(&x25_dev_notifier);
+        rc = register_netdevice_notifier(&x25_dev_notifier);
+        if (rc != 0)
+                goto out_sock;
 
         printk(KERN_INFO "X.25 for Linux Version 0.2\n");
 
-#ifdef CONFIG_SYSCTL
         x25_register_sysctl();
-#endif
-        x25_proc_init();
+        rc = x25_proc_init();
+        if (rc != 0)
+                goto out_dev;
 out:
         return rc;
+out_dev:
+        unregister_netdevice_notifier(&x25_dev_notifier);
+out_sock:
+        sock_unregister(AF_X25);
+out_proto:
+        proto_unregister(&x25_proto);
+        goto out;
 }
 module_init(x25_init);
 
@@ -1682,9 +1828,7 @@ static void __exit x25_exit(void)
         x25_link_free();
         x25_route_free();
 
-#ifdef CONFIG_SYSCTL
         x25_unregister_sysctl();
-#endif
 
         unregister_netdevice_notifier(&x25_dev_notifier);
 
diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
index a5d3416522de..d2efd29f434e 100644
--- a/net/x25/sysctl_net_x25.c
+++ b/net/x25/sysctl_net_x25.c
@@ -19,62 +19,51 @@ static struct ctl_table_header *x25_table_header;
 
 static struct ctl_table x25_table[] = {
         {
-                .ctl_name =     NET_X25_RESTART_REQUEST_TIMEOUT,
                 .procname =     "restart_request_timeout",
                 .data =         &sysctl_x25_restart_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_CALL_REQUEST_TIMEOUT,
                 .procname =     "call_request_timeout",
                 .data =         &sysctl_x25_call_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_RESET_REQUEST_TIMEOUT,
                 .procname =     "reset_request_timeout",
                 .data =         &sysctl_x25_reset_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_CLEAR_REQUEST_TIMEOUT,
                 .procname =     "clear_request_timeout",
                 .data =         &sysctl_x25_clear_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_ACK_HOLD_BACK_TIMEOUT,
                 .procname =     "acknowledgement_hold_back_timeout",
                 .data =         &sysctl_x25_ack_holdback_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_FORWARD,
                 .procname =     "x25_forward",
                 .data =         &sysctl_x25_forward,
                 .maxlen =       sizeof(int),
@@ -85,8 +74,8 @@ static struct ctl_table x25_table[] = {
 };
 
 static struct ctl_path x25_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "x25", .ctl_name = NET_X25, },
+        { .procname = "net", },
+        { .procname = "x25", },
         { }
 };
 
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 3e1efe534645..b9ef682230a0 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -20,6 +20,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/if_arp.h>
 #include <net/x25.h>
@@ -53,7 +54,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
                 if (!sock_owned_by_user(sk)) {
                         queued = x25_process_rx_frame(sk, skb);
                 } else {
-                        sk_add_backlog(sk, skb);
+                        queued = !sk_add_backlog(sk, skb);
                 }
                 bh_unlock_sock(sk);
                 sock_put(sk);
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index a21f6646eb3a..771bab00754b 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -35,7 +35,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                 struct x25_dte_facilities *dte_facs, unsigned long *vc_fac_mask)
 {
         unsigned char *p = skb->data;
-        unsigned int len = *p++;
+        unsigned int len;
 
         *vc_fac_mask = 0;
 
@@ -50,6 +50,14 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
         memset(dte_facs->called_ae, '\0', sizeof(dte_facs->called_ae));
         memset(dte_facs->calling_ae, '\0', sizeof(dte_facs->calling_ae));
 
+        if (skb->len < 1)
+                return 0;
+
+        len = *p++;
+
+        if (len >= skb->len)
+                return -1;
+
         while (len > 0) {
                 switch (*p & X25_FAC_CLASS_MASK) {
                 case X25_FAC_CLASS_A:
@@ -247,6 +255,8 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
         memcpy(new, ours, sizeof(*new));
 
         len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
+        if (len < 0)
+                return len;
 
         /*
          *      They want reverse charging, we won't accept it.
@@ -259,9 +269,18 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
         new->reverse = theirs.reverse;
 
         if (theirs.throughput) {
-                if (theirs.throughput < ours->throughput) {
-                        SOCK_DEBUG(sk, "X.25: throughput negotiated down\n");
-                        new->throughput = theirs.throughput;
+                int theirs_in =  theirs.throughput & 0x0f;
+                int theirs_out = theirs.throughput & 0xf0;
+                int ours_in  = ours->throughput & 0x0f;
+                int ours_out = ours->throughput & 0xf0;
+                if (!ours_in || theirs_in < ours_in) {
+                        SOCK_DEBUG(sk, "X.25: inbound throughput negotiated\n");
+                        new->throughput = (new->throughput & 0xf0) | theirs_in;
+                }
+                if (!ours_out || theirs_out < ours_out) {
+                        SOCK_DEBUG(sk,
+                                "X.25: outbound throughput negotiated\n");
+                        new->throughput = (new->throughput & 0x0f) | theirs_out;
                 }
         }
 
diff --git a/net/x25/x25_forward.c b/net/x25/x25_forward.c
index 056a55f3a871..25a810793968 100644
--- a/net/x25/x25_forward.c
+++ b/net/x25/x25_forward.c
@@ -10,6 +10,7 @@
  */
 #include <linux/if_arp.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/x25.h>
 
 LIST_HEAD(x25_forward_list);
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 7d7c3abf38b5..372ac226e648 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -23,6 +23,7 @@
  *                                        i-frames.
  */
 
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -89,6 +90,7 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
 static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametype)
 {
         struct x25_address source_addr, dest_addr;
+        int len;
 
         switch (frametype) {
                 case X25_CALL_ACCEPTED: {
@@ -106,15 +108,21 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                          *      Parse the data in the frame.
                          */
                         skb_pull(skb, X25_STD_MIN_LEN);
-                        skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
-                        skb_pull(skb,
-                                 x25_parse_facilities(skb, &x25->facilities,
+
+                        len = x25_parse_address_block(skb, &source_addr,
+                                                &dest_addr);
+                        if (len > 0)
+                                skb_pull(skb, len);
+
+                        len = x25_parse_facilities(skb, &x25->facilities,
                                                 &x25->dte_facilities,
-                                                &x25->vc_facil_mask));
+                                                &x25->vc_facil_mask);
+                        if (len > 0)
+                                skb_pull(skb, len);
                         /*
                          *      Copy any Call User Data.
                          */
-                        if (skb->len >= 0) {
+                        if (skb->len > 0) {
                                 skb_copy_from_linear_data(skb,
                                               x25->calluserdata.cuddata,
                                               skb->len);
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index e4e1b6e49538..73e7b954ad28 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -24,6 +24,7 @@
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <asm/uaccess.h>
diff --git a/net/x25/x25_out.c b/net/x25/x25_out.c
index 2b96b52114d6..52351a26b6fc 100644
--- a/net/x25/x25_out.c
+++ b/net/x25/x25_out.c
@@ -22,6 +22,7 @@
  *                                      needed cleaned seq-number fields.
  */
 
+#include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/x25/x25_proc.c b/net/x25/x25_proc.c
index 0a04e62e0e18..7ff373792324 100644
--- a/net/x25/x25_proc.c
+++ b/net/x25/x25_proc.c
@@ -25,49 +25,17 @@
 #include <net/x25.h>
 
 #ifdef CONFIG_PROC_FS
-static __inline__ struct x25_route *x25_get_route_idx(loff_t pos)
-{
-        struct list_head *route_entry;
-        struct x25_route *rt = NULL;
-
-        list_for_each(route_entry, &x25_route_list) {
-                rt = list_entry(route_entry, struct x25_route, node);
-                if (!pos--)
-                        goto found;
-        }
-        rt = NULL;
-found:
-        return rt;
-}
 
 static void *x25_seq_route_start(struct seq_file *seq, loff_t *pos)
         __acquires(x25_route_list_lock)
 {
-        loff_t l = *pos;
-
         read_lock_bh(&x25_route_list_lock);
-        return l ? x25_get_route_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&x25_route_list, *pos);
 }
 
 static void *x25_seq_route_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct x25_route *rt;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                rt = NULL;
-                if (!list_empty(&x25_route_list))
-                        rt = list_entry(x25_route_list.next,
-                                        struct x25_route, node);
-                goto out;
-        }
-        rt = v;
-        if (rt->node.next != &x25_route_list)
-                rt = list_entry(rt->node.next, struct x25_route, node);
-        else
-                rt = NULL;
-out:
-        return rt;
+        return seq_list_next(v, &x25_route_list, pos);
 }
 
 static void x25_seq_route_stop(struct seq_file *seq, void *v)
@@ -78,9 +46,9 @@ static void x25_seq_route_stop(struct seq_file *seq, void *v)
 
 static int x25_seq_route_show(struct seq_file *seq, void *v)
 {
-        struct x25_route *rt;
+        struct x25_route *rt = list_entry(v, struct x25_route, node);
 
-        if (v == SEQ_START_TOKEN) {
+        if (v == &x25_route_list) {
                 seq_puts(seq, "Address          Digits  Device\n");
                 goto out;
         }
@@ -93,40 +61,16 @@ out:
         return 0;
 }
 
-static __inline__ struct sock *x25_get_socket_idx(loff_t pos)
-{
-        struct sock *s;
-        struct hlist_node *node;
-
-        sk_for_each(s, node, &x25_list)
-                if (!pos--)
-                        goto found;
-        s = NULL;
-found:
-        return s;
-}
-
 static void *x25_seq_socket_start(struct seq_file *seq, loff_t *pos)
         __acquires(x25_list_lock)
 {
-        loff_t l = *pos;
-
         read_lock_bh(&x25_list_lock);
-        return l ? x25_get_socket_idx(--l) : SEQ_START_TOKEN;
+        return seq_hlist_start_head(&x25_list, *pos);
 }
 
 static void *x25_seq_socket_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct sock *s;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                s = sk_head(&x25_list);
-                goto out;
-        }
-        s = sk_next(v);
-out:
-        return s;
+        return seq_hlist_next(v, &x25_list, pos);
 }
 
 static void x25_seq_socket_stop(struct seq_file *seq, void *v)
@@ -148,7 +92,7 @@ static int x25_seq_socket_show(struct seq_file *seq, void *v)
                 goto out;
         }
 
-        s = v;
+        s = sk_entry(v);
         x25 = x25_sk(s);
 
         if (!x25->neighbour || (dev = x25->neighbour->dev) == NULL)
@@ -170,51 +114,16 @@ out:
         return 0;
 }
 
-static __inline__ struct x25_forward *x25_get_forward_idx(loff_t pos)
-{
-        struct x25_forward *f;
-        struct list_head *entry;
-
-        list_for_each(entry, &x25_forward_list) {
-                f = list_entry(entry, struct x25_forward, node);
-                if (!pos--)
-                        goto found;
-        }
-
-        f = NULL;
-found:
-        return f;
-}
-
 static void *x25_seq_forward_start(struct seq_file *seq, loff_t *pos)
         __acquires(x25_forward_list_lock)
 {
-        loff_t l = *pos;
-
         read_lock_bh(&x25_forward_list_lock);
-        return l ? x25_get_forward_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&x25_forward_list, *pos);
 }
 
 static void *x25_seq_forward_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct x25_forward *f;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                f = NULL;
-                if (!list_empty(&x25_forward_list))
-                        f = list_entry(x25_forward_list.next,
-                                        struct x25_forward, node);
-                goto out;
-        }
-        f = v;
-        if (f->node.next != &x25_forward_list)
-                f = list_entry(f->node.next, struct x25_forward, node);
-        else
-                f = NULL;
-out:
-        return f;
-
+        return seq_list_next(v, &x25_forward_list, pos);
 }
 
 static void x25_seq_forward_stop(struct seq_file *seq, void *v)
@@ -225,9 +134,9 @@ static void x25_seq_forward_stop(struct seq_file *seq, void *v)
 
 static int x25_seq_forward_show(struct seq_file *seq, void *v)
 {
-        struct x25_forward *f;
+        struct x25_forward *f = list_entry(v, struct x25_forward, node);
 
-        if (v == SEQ_START_TOKEN) {
+        if (v == &x25_forward_list) {
                 seq_printf(seq, "lci dev1       dev2\n");
                 goto out;
         }
@@ -236,7 +145,6 @@ static int x25_seq_forward_show(struct seq_file *seq, void *v)
 
         seq_printf(seq, "%d %-10s %-10s\n",
                         f->lci, f->dev1->name, f->dev2->name);
-
 out:
         return 0;
 }
diff --git a/net/x25/x25_route.c b/net/x25/x25_route.c
index 2c999ccf504a..97d77c532d8c 100644
--- a/net/x25/x25_route.c
+++ b/net/x25/x25_route.c
@@ -19,6 +19,7 @@
 
 #include <linux/if_arp.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/x25.h>
 
 LIST_HEAD(x25_route_list);
@@ -136,8 +137,10 @@ struct net_device *x25_dev_get(char *devname)
 #if defined(CONFIG_LLC) || defined(CONFIG_LLC_MODULE)
                                         && dev->type != ARPHRD_ETHER
 #endif
-                                        )))
+                                        ))){
                 dev_put(dev);
+                dev = NULL;
+        }
 
         return dev;
 }
@@ -190,7 +193,7 @@ int x25_route_ioctl(unsigned int cmd, void __user *arg)
                 goto out;
 
         rc = -EINVAL;
-        if (rt.sigdigits < 0 || rt.sigdigits > 15)
+        if (rt.sigdigits > 15)
                 goto out;
 
         dev = x25_dev_get(rt.device);
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 511a5986af3e..dc20cf12f39b 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -23,6 +23,7 @@
  *                                              restriction on response.
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/skbuff.h>
@@ -225,6 +226,12 @@ void x25_write_internal(struct sock *sk, int frametype)
                         break;
 
                 case X25_CLEAR_REQUEST:
+                        dptr    = skb_put(skb, 3);
+                        *dptr++ = frametype;
+                        *dptr++ = x25->causediag.cause;
+                        *dptr++ = x25->causediag.diagnostic;
+                        break;
+
                 case X25_RESET_REQUEST:
                         dptr    = skb_put(skb, 3);
                         *dptr++ = frametype;
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index faf54c6bf96b..8b4d6e3246e5 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -125,6 +125,22 @@ static struct xfrm_algo_desc aead_list[] = {
                 .sadb_alg_maxbits = 256
         }
 },
+{
+        .name = "rfc4543(gcm(aes))",
+
+        .uinfo = {
+                .aead = {
+                        .icv_truncbits = 128,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_EALG_NULL_AES_GMAC,
+                .sadb_alg_ivlen = 8,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 256
+        }
+},
 };
 
 static struct xfrm_algo_desc aalg_list[] = {
@@ -200,6 +216,40 @@ static struct xfrm_algo_desc aalg_list[] = {
         }
 },
 {
+        .name = "hmac(sha384)",
+
+        .uinfo = {
+                .auth = {
+                        .icv_truncbits = 192,
+                        .icv_fullbits = 384,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_AALG_SHA2_384HMAC,
+                .sadb_alg_ivlen = 0,
+                .sadb_alg_minbits = 384,
+                .sadb_alg_maxbits = 384
+        }
+},
+{
+        .name = "hmac(sha512)",
+
+        .uinfo = {
+                .auth = {
+                        .icv_truncbits = 256,
+                        .icv_fullbits = 512,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_AALG_SHA2_512HMAC,
+                .sadb_alg_ivlen = 0,
+                .sadb_alg_minbits = 512,
+                .sadb_alg_maxbits = 512
+        }
+},
+{
         .name = "hmac(rmd160)",
         .compat = "rmd160",
 
@@ -365,6 +415,7 @@ static struct xfrm_algo_desc ealg_list[] = {
 },
 {
         .name = "cbc(camellia)",
+        .compat = "camellia",
 
         .uinfo = {
                 .encr = {
@@ -689,84 +740,6 @@ int xfrm_count_enc_supported(void)
 }
 EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
 
-/* Move to common area: it is shared with AH. */
-
-int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
-                 int offset, int len, icv_update_fn_t icv_update)
-{
-        int start = skb_headlen(skb);
-        int i, copy = start - offset;
-        struct sk_buff *frag_iter;
-        struct scatterlist sg;
-        int err;
-
-        /* Checksum header. */
-        if (copy > 0) {
-                if (copy > len)
-                        copy = len;
-
-                sg_init_one(&sg, skb->data + offset, copy);
-
-                err = icv_update(desc, &sg, copy);
-                if (unlikely(err))
-                        return err;
-
-                if ((len -= copy) == 0)
-                        return 0;
-                offset += copy;
-        }
-
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                int end;
-
-                WARN_ON(start > offset + len);
-
-                end = start + skb_shinfo(skb)->frags[i].size;
-                if ((copy = end - offset) > 0) {
-                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-
-                        if (copy > len)
-                                copy = len;
-
-                        sg_init_table(&sg, 1);
-                        sg_set_page(&sg, frag->page, copy,
-                                    frag->page_offset + offset-start);
-
-                        err = icv_update(desc, &sg, copy);
-                        if (unlikely(err))
-                                return err;
-
-                        if (!(len -= copy))
-                                return 0;
-                        offset += copy;
-                }
-                start = end;
-        }
-
-        skb_walk_frags(skb, frag_iter) {
-                int end;
-
-                WARN_ON(start > offset + len);
-
-                end = start + frag_iter->len;
-                if ((copy = end - offset) > 0) {
-                        if (copy > len)
-                                copy = len;
-                        err = skb_icv_walk(frag_iter, desc, offset-start,
-                                           copy, icv_update);
-                        if (unlikely(err))
-                                return err;
-                        if ((len -= copy) == 0)
-                                return 0;
-                        offset += copy;
-                }
-                start = end;
-        }
-        BUG_ON(len);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(skb_icv_walk);
-
 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 
 void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index e0009c17d809..45f1c98d4fce 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -152,7 +152,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                         goto drop;
                 }
 
-                x = xfrm_state_lookup(net, daddr, spi, nexthdr, family);
+                x = xfrm_state_lookup(net, skb->mark, daddr, spi, nexthdr, family);
                 if (x == NULL) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
                         xfrm_audit_state_notfound(skb, family, spi, seq);
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index 42cd18391f46..fc91ad7ee26e 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -17,11 +17,11 @@
 
 #include <linux/crypto.h>
 #include <linux/err.h>
-#include <linux/gfp.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/percpu.h>
+#include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/vmalloc.h>
 #include <net/ip.h>
@@ -30,12 +30,12 @@
 
 struct ipcomp_tfms {
         struct list_head list;
-        struct crypto_comp **tfms;
+        struct crypto_comp * __percpu *tfms;
         int users;
 };
 
 static DEFINE_MUTEX(ipcomp_resource_mutex);
-static void **ipcomp_scratches;
+static void * __percpu *ipcomp_scratches;
 static int ipcomp_scratch_users;
 static LIST_HEAD(ipcomp_tfms_list);
 
@@ -200,7 +200,7 @@ EXPORT_SYMBOL_GPL(ipcomp_output);
 static void ipcomp_free_scratches(void)
 {
         int i;
-        void **scratches;
+        void * __percpu *scratches;
 
         if (--ipcomp_scratch_users)
                 return;
@@ -215,10 +215,10 @@ static void ipcomp_free_scratches(void)
         free_percpu(scratches);
 }
 
-static void **ipcomp_alloc_scratches(void)
+static void * __percpu *ipcomp_alloc_scratches(void)
 {
         int i;
-        void **scratches;
+        void * __percpu *scratches;
 
         if (ipcomp_scratch_users++)
                 return ipcomp_scratches;
@@ -239,7 +239,7 @@ static void **ipcomp_alloc_scratches(void)
         return scratches;
 }
 
-static void ipcomp_free_tfms(struct crypto_comp **tfms)
+static void ipcomp_free_tfms(struct crypto_comp * __percpu *tfms)
 {
         struct ipcomp_tfms *pos;
         int cpu;
@@ -267,10 +267,10 @@ static void ipcomp_free_tfms(struct crypto_comp **tfms)
         free_percpu(tfms);
 }
 
-static struct crypto_comp **ipcomp_alloc_tfms(const char *alg_name)
+static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name)
 {
         struct ipcomp_tfms *pos;
-        struct crypto_comp **tfms;
+        struct crypto_comp * __percpu *tfms;
         int cpu;
 
         /* This can be any valid CPU ID so we don't need locking. */
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index b9fe13138c07..6a329158bdfa 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -14,6 +14,7 @@
 #include <linux/netdevice.h>
 #include <linux/netfilter.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cb81ca35b0d6..843e066649cb 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -469,16 +469,16 @@ static inline int xfrm_byidx_should_resize(struct net *net, int total)
         return 0;
 }
 
-void xfrm_spd_getinfo(struct xfrmk_spdinfo *si)
+void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si)
 {
         read_lock_bh(&xfrm_policy_lock);
-        si->incnt = init_net.xfrm.policy_count[XFRM_POLICY_IN];
-        si->outcnt = init_net.xfrm.policy_count[XFRM_POLICY_OUT];
-        si->fwdcnt = init_net.xfrm.policy_count[XFRM_POLICY_FWD];
-        si->inscnt = init_net.xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
-        si->outscnt = init_net.xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
-        si->fwdscnt = init_net.xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
-        si->spdhcnt = init_net.xfrm.policy_idx_hmask;
+        si->incnt = net->xfrm.policy_count[XFRM_POLICY_IN];
+        si->outcnt = net->xfrm.policy_count[XFRM_POLICY_OUT];
+        si->fwdcnt = net->xfrm.policy_count[XFRM_POLICY_FWD];
+        si->inscnt = net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
+        si->outscnt = net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
+        si->fwdscnt = net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
+        si->spdhcnt = net->xfrm.policy_idx_hmask;
         si->spdhmcnt = xfrm_policy_hashmax;
         read_unlock_bh(&xfrm_policy_lock);
 }
@@ -556,6 +556,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct hlist_head *chain;
         struct hlist_node *entry, *newpos;
         struct dst_entry *gc_list;
+        u32 mark = policy->mark.v & policy->mark.m;
 
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
@@ -564,6 +565,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         hlist_for_each_entry(pol, entry, chain, bydst) {
                 if (pol->type == policy->type &&
                     !selector_cmp(&pol->selector, &policy->selector) &&
+                    (mark & pol->mark.m) == pol->mark.v &&
                     xfrm_sec_ctx_match(pol->security, policy->security) &&
                     !WARN_ON(delpol)) {
                         if (excl) {
@@ -635,8 +637,8 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 }
 EXPORT_SYMBOL(xfrm_policy_insert);
 
-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
-                                          struct xfrm_selector *sel,
+struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
+                                          int dir, struct xfrm_selector *sel,
                                           struct xfrm_sec_ctx *ctx, int delete,
                                           int *err)
 {
@@ -650,6 +652,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
         ret = NULL;
         hlist_for_each_entry(pol, entry, chain, bydst) {
                 if (pol->type == type &&
+                    (mark & pol->mark.m) == pol->mark.v &&
                     !selector_cmp(sel, &pol->selector) &&
                     xfrm_sec_ctx_match(ctx, pol->security)) {
                         xfrm_pol_hold(pol);
@@ -676,8 +679,8 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
 }
 EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
 
-struct xfrm_policy *xfrm_policy_byid(struct net *net, u8 type, int dir, u32 id,
-                                     int delete, int *err)
+struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
+                                     int dir, u32 id, int delete, int *err)
 {
         struct xfrm_policy *pol, *ret;
         struct hlist_head *chain;
@@ -692,7 +695,8 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u8 type, int dir, u32 id,
         chain = net->xfrm.policy_byidx + idx_hash(net, id);
         ret = NULL;
         hlist_for_each_entry(pol, entry, chain, byidx) {
-                if (pol->type == type && pol->index == id) {
+                if (pol->type == type && pol->index == id &&
+                    (mark & pol->mark.m) == pol->mark.v) {
                         xfrm_pol_hold(pol);
                         if (delete) {
                                 *err = security_xfrm_policy_delete(
@@ -771,7 +775,8 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
 
 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
 {
-        int dir, err = 0;
+        int dir, err = 0, cnt = 0;
+        struct xfrm_policy *dp;
 
         write_lock_bh(&xfrm_policy_lock);
 
@@ -789,8 +794,10 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                                      &net->xfrm.policy_inexact[dir], bydst) {
                         if (pol->type != type)
                                 continue;
-                        __xfrm_policy_unlink(pol, dir);
+                        dp = __xfrm_policy_unlink(pol, dir);
                         write_unlock_bh(&xfrm_policy_lock);
+                        if (dp)
+                                cnt++;
 
                         xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,
                                                  audit_info->sessionid,
@@ -809,8 +816,10 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                                              bydst) {
                                 if (pol->type != type)
                                         continue;
-                                __xfrm_policy_unlink(pol, dir);
+                                dp = __xfrm_policy_unlink(pol, dir);
                                 write_unlock_bh(&xfrm_policy_lock);
+                                if (dp)
+                                        cnt++;
 
                                 xfrm_audit_policy_delete(pol, 1,
                                                          audit_info->loginuid,
@@ -824,6 +833,8 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                 }
 
         }
+        if (!cnt)
+                err = -ESRCH;
         atomic_inc(&flow_cache_genid);
 out:
         write_unlock_bh(&xfrm_policy_lock);
@@ -909,6 +920,7 @@ static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,
         int match, ret = -ESRCH;
 
         if (pol->family != family ||
+            (fl->mark & pol->mark.m) != pol->mark.v ||
             pol->type != type)
                 return ret;
 
@@ -1033,6 +1045,10 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
                 int err = 0;
 
                 if (match) {
+                        if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
+                                pol = NULL;
+                                goto out;
+                        }
                         err = security_xfrm_policy_lookup(pol->security,
                                                       fl->secid,
                                                       policy_to_flow_dir(dir));
@@ -1045,6 +1061,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
                 } else
                         pol = NULL;
         }
+out:
         read_unlock_bh(&xfrm_policy_lock);
         return pol;
 }
@@ -1137,6 +1154,7 @@ static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
                 }
                 newp->lft = old->lft;
                 newp->curlft = old->curlft;
+                newp->mark = old->mark;
                 newp->action = old->action;
                 newp->flags = old->flags;
                 newp->xfrm_nr = old->xfrm_nr;
@@ -1309,15 +1327,28 @@ static inline int xfrm_get_tos(struct flowi *fl, int family)
         return tos;
 }
 
-static inline struct xfrm_dst *xfrm_alloc_dst(int family)
+static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
 {
         struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family);
+        struct dst_ops *dst_ops;
         struct xfrm_dst *xdst;
 
         if (!afinfo)
                 return ERR_PTR(-EINVAL);
 
-        xdst = dst_alloc(afinfo->dst_ops) ?: ERR_PTR(-ENOBUFS);
+        switch (family) {
+        case AF_INET:
+                dst_ops = &net->xfrm.xfrm4_dst_ops;
+                break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case AF_INET6:
+                dst_ops = &net->xfrm.xfrm6_dst_ops;
+                break;
+#endif
+        default:
+                BUG();
+        }
+        xdst = dst_alloc(dst_ops) ?: ERR_PTR(-ENOBUFS);
 
         xfrm_policy_put_afinfo(afinfo);
 
@@ -1341,7 +1372,8 @@ static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst,
         return err;
 }
 
-static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+                                struct flowi *fl)
 {
         struct xfrm_policy_afinfo *afinfo =
                 xfrm_policy_get_afinfo(xdst->u.dst.ops->family);
@@ -1350,7 +1382,7 @@ static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
         if (!afinfo)
                 return -EINVAL;
 
-        err = afinfo->fill_dst(xdst, dev);
+        err = afinfo->fill_dst(xdst, dev, fl);
 
         xfrm_policy_put_afinfo(afinfo);
 
@@ -1366,6 +1398,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                                             struct flowi *fl,
                                             struct dst_entry *dst)
 {
+        struct net *net = xp_net(policy);
         unsigned long now = jiffies;
         struct net_device *dev;
         struct dst_entry *dst_prev = NULL;
@@ -1389,7 +1422,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
         dst_hold(dst);
 
         for (; i < nx; i++) {
-                struct xfrm_dst *xdst = xfrm_alloc_dst(family);
+                struct xfrm_dst *xdst = xfrm_alloc_dst(net, family);
                 struct dst_entry *dst1 = &xdst->u.dst;
 
                 err = PTR_ERR(xdst);
@@ -1445,7 +1478,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
         if (!dev)
                 goto free_dst;
 
-        /* Copy neighbout for reachability confirmation */
+        /* Copy neighbour for reachability confirmation */
         dst0->neighbour = neigh_clone(dst->neighbour);
 
         xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len);
@@ -1454,7 +1487,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
         for (dst_prev = dst0; dst_prev != dst; dst_prev = dst_prev->child) {
                 struct xfrm_dst *xdst = (struct xfrm_dst *)dst_prev;
 
-                err = xfrm_fill_dst(xdst, dev);
+                err = xfrm_fill_dst(xdst, dev, fl);
                 if (err)
                         goto free_dst;
 
@@ -2031,8 +2064,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
         int res;
 
         if (xfrm_decode_session(skb, &fl, family) < 0) {
-                /* XXX: we should have something like FWDHDRERROR here. */
-                XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
+                XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
                 return 0;
         }
 
@@ -2279,6 +2311,7 @@ EXPORT_SYMBOL(xfrm_bundle_ok);
 
 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
 {
+        struct net *net;
         int err = 0;
         if (unlikely(afinfo == NULL))
                 return -EINVAL;
@@ -2302,6 +2335,27 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                 xfrm_policy_afinfo[afinfo->family] = afinfo;
         }
         write_unlock_bh(&xfrm_policy_afinfo_lock);
+
+        rtnl_lock();
+        for_each_net(net) {
+                struct dst_ops *xfrm_dst_ops;
+
+                switch (afinfo->family) {
+                case AF_INET:
+                        xfrm_dst_ops = &net->xfrm.xfrm4_dst_ops;
+                        break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+                case AF_INET6:
+                        xfrm_dst_ops = &net->xfrm.xfrm6_dst_ops;
+                        break;
+#endif
+                default:
+                        BUG();
+                }
+                *xfrm_dst_ops = *afinfo->dst_ops;
+        }
+        rtnl_unlock();
+
         return err;
 }
 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
@@ -2332,6 +2386,22 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
 }
 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
 
+static void __net_init xfrm_dst_ops_init(struct net *net)
+{
+        struct xfrm_policy_afinfo *afinfo;
+
+        read_lock_bh(&xfrm_policy_afinfo_lock);
+        afinfo = xfrm_policy_afinfo[AF_INET];
+        if (afinfo)
+                net->xfrm.xfrm4_dst_ops = *afinfo->dst_ops;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        afinfo = xfrm_policy_afinfo[AF_INET6];
+        if (afinfo)
+                net->xfrm.xfrm6_dst_ops = *afinfo->dst_ops;
+#endif
+        read_unlock_bh(&xfrm_policy_afinfo_lock);
+}
+
 static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
 {
         struct xfrm_policy_afinfo *afinfo;
@@ -2369,19 +2439,19 @@ static int __net_init xfrm_statistics_init(struct net *net)
 {
         int rv;
 
-        if (snmp_mib_init((void **)net->mib.xfrm_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.xfrm_statistics,
                           sizeof(struct linux_xfrm_mib)) < 0)
                 return -ENOMEM;
         rv = xfrm_proc_init(net);
         if (rv < 0)
-                snmp_mib_free((void **)net->mib.xfrm_statistics);
+                snmp_mib_free((void __percpu **)net->mib.xfrm_statistics);
         return rv;
 }
 
 static void xfrm_statistics_fini(struct net *net)
 {
         xfrm_proc_fini(net);
-        snmp_mib_free((void **)net->mib.xfrm_statistics);
+        snmp_mib_free((void __percpu **)net->mib.xfrm_statistics);
 }
 #else
 static int __net_init xfrm_statistics_init(struct net *net)
@@ -2494,6 +2564,7 @@ static int __net_init xfrm_net_init(struct net *net)
         rv = xfrm_policy_init(net);
         if (rv < 0)
                 goto out_policy;
+        xfrm_dst_ops_init(net);
         rv = xfrm_sysctl_init(net);
         if (rv < 0)
                 goto out_sysctl;
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index fef8db553e8d..58d9ae005597 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -15,7 +15,7 @@
 #include <net/snmp.h>
 #include <net/xfrm.h>
 
-static struct snmp_mib xfrm_mib_list[] = {
+static const struct snmp_mib xfrm_mib_list[] = {
         SNMP_MIB_ITEM("XfrmInError", LINUX_MIB_XFRMINERROR),
         SNMP_MIB_ITEM("XfrmInBufferError", LINUX_MIB_XFRMINBUFFERERROR),
         SNMP_MIB_ITEM("XfrmInHdrError", LINUX_MIB_XFRMINHDRERROR),
@@ -41,6 +41,7 @@ static struct snmp_mib xfrm_mib_list[] = {
         SNMP_MIB_ITEM("XfrmOutPolBlock", LINUX_MIB_XFRMOUTPOLBLOCK),
         SNMP_MIB_ITEM("XfrmOutPolDead", LINUX_MIB_XFRMOUTPOLDEAD),
         SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR),
+        SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR),
         SNMP_MIB_SENTINEL
 };
 
@@ -50,7 +51,8 @@ static int xfrm_statistics_seq_show(struct seq_file *seq, void *v)
         int i;
         for (i=0; xfrm_mib_list[i].name; i++)
                 seq_printf(seq, "%-24s\t%lu\n", xfrm_mib_list[i].name,
-                           snmp_fold_field((void **)net->mib.xfrm_statistics,
+                           snmp_fold_field((void __percpu **)
+                                           net->mib.xfrm_statistics,
                                            xfrm_mib_list[i].entry));
         return 0;
 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f2f7c638083e..add77ecb8ac4 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -21,6 +21,10 @@
 #include <linux/cache.h>
 #include <linux/audit.h>
 #include <asm/uaccess.h>
+#include <linux/ktime.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
 
 #include "xfrm_hash.h"
 
@@ -352,7 +356,7 @@ static void xfrm_put_mode(struct xfrm_mode *mode)
 
 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 {
-        del_timer_sync(&x->timer);
+        tasklet_hrtimer_cancel(&x->mtimer);
         del_timer_sync(&x->rtimer);
         kfree(x->aalg);
         kfree(x->ealg);
@@ -398,9 +402,10 @@ static inline unsigned long make_jiffies(long secs)
                 return secs*HZ;
 }
 
-static void xfrm_timer_handler(unsigned long data)
+static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
 {
-        struct xfrm_state *x = (struct xfrm_state*)data;
+        struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer);
+        struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer);
         struct net *net = xs_net(x);
         unsigned long now = get_seconds();
         long next = LONG_MAX;
@@ -451,8 +456,9 @@ static void xfrm_timer_handler(unsigned long data)
         if (warn)
                 km_state_expired(x, 0, 0);
 resched:
-        if (next != LONG_MAX)
-                mod_timer(&x->timer, jiffies + make_jiffies(next));
+        if (next != LONG_MAX){
+                tasklet_hrtimer_start(&x->mtimer, ktime_set(next, 0), HRTIMER_MODE_REL);
+        }
 
         goto out;
 
@@ -474,6 +480,7 @@ expired:
 
 out:
         spin_unlock(&x->lock);
+        return HRTIMER_NORESTART;
 }
 
 static void xfrm_replay_timer_handler(unsigned long data);
@@ -492,7 +499,7 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
                 INIT_HLIST_NODE(&x->bydst);
                 INIT_HLIST_NODE(&x->bysrc);
                 INIT_HLIST_NODE(&x->byspi);
-                setup_timer(&x->timer, xfrm_timer_handler, (unsigned long)x);
+                tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler, CLOCK_REALTIME, HRTIMER_MODE_ABS);
                 setup_timer(&x->rtimer, xfrm_replay_timer_handler,
                                 (unsigned long)x);
                 x->curlft.add_time = get_seconds();
@@ -597,13 +604,14 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audi
 
 int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 {
-        int i, err = 0;
+        int i, err = 0, cnt = 0;
 
         spin_lock_bh(&xfrm_state_lock);
         err = xfrm_state_flush_secctx_check(net, proto, audit_info);
         if (err)
                 goto out;
 
+        err = -ESRCH;
         for (i = 0; i <= net->xfrm.state_hmask; i++) {
                 struct hlist_node *entry;
                 struct xfrm_state *x;
@@ -620,13 +628,16 @@ restart:
                                                         audit_info->sessionid,
                                                         audit_info->secid);
                                 xfrm_state_put(x);
+                                if (!err)
+                                        cnt++;
 
                                 spin_lock_bh(&xfrm_state_lock);
                                 goto restart;
                         }
                 }
         }
-        err = 0;
+        if (cnt)
+                err = 0;
 
 out:
         spin_unlock_bh(&xfrm_state_lock);
@@ -635,11 +646,11 @@ out:
 }
 EXPORT_SYMBOL(xfrm_state_flush);
 
-void xfrm_sad_getinfo(struct xfrmk_sadinfo *si)
+void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
 {
         spin_lock_bh(&xfrm_state_lock);
-        si->sadcnt = init_net.xfrm.state_num;
-        si->sadhcnt = init_net.xfrm.state_hmask;
+        si->sadcnt = net->xfrm.state_num;
+        si->sadhcnt = net->xfrm.state_hmask;
         si->sadhmcnt = xfrm_state_hashmax;
         spin_unlock_bh(&xfrm_state_lock);
 }
@@ -659,7 +670,7 @@ xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
         return 0;
 }
 
-static struct xfrm_state *__xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
+static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 {
         unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
         struct xfrm_state *x;
@@ -672,6 +683,8 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, xfrm_address_t *d
                     xfrm_addr_cmp(&x->id.daddr, daddr, family))
                         continue;
 
+                if ((mark & x->mark.m) != x->mark.v)
+                        continue;
                 xfrm_state_hold(x);
                 return x;
         }
@@ -679,7 +692,7 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, xfrm_address_t *d
         return NULL;
 }
 
-static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
+static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 {
         unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
         struct xfrm_state *x;
@@ -692,6 +705,8 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, xfrm_addre
                     xfrm_addr_cmp(&x->props.saddr, saddr, family))
                         continue;
 
+                if ((mark & x->mark.m) != x->mark.v)
+                        continue;
                 xfrm_state_hold(x);
                 return x;
         }
@@ -703,12 +718,14 @@ static inline struct xfrm_state *
 __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
 {
         struct net *net = xs_net(x);
+        u32 mark = x->mark.v & x->mark.m;
 
         if (use_spi)
-                return __xfrm_state_lookup(net, &x->id.daddr, x->id.spi,
-                                           x->id.proto, family);
+                return __xfrm_state_lookup(net, mark, &x->id.daddr,
+                                           x->id.spi, x->id.proto, family);
         else
-                return __xfrm_state_lookup_byaddr(net, &x->id.daddr,
+                return __xfrm_state_lookup_byaddr(net, mark,
+                                                  &x->id.daddr,
                                                   &x->props.saddr,
                                                   x->id.proto, family);
 }
@@ -773,6 +790,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
         int acquire_in_progress = 0;
         int error = 0;
         struct xfrm_state *best = NULL;
+        u32 mark = pol->mark.v & pol->mark.m;
 
         to_put = NULL;
 
@@ -781,6 +799,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family == family &&
                     x->props.reqid == tmpl->reqid &&
+                    (mark & x->mark.m) == x->mark.v &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
                     xfrm_state_addr_check(x, daddr, saddr, family) &&
                     tmpl->mode == x->props.mode &&
@@ -796,6 +815,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
                 if (x->props.family == family &&
                     x->props.reqid == tmpl->reqid &&
+                    (mark & x->mark.m) == x->mark.v &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
                     xfrm_state_addr_check(x, daddr, saddr, family) &&
                     tmpl->mode == x->props.mode &&
@@ -809,7 +829,7 @@ found:
         x = best;
         if (!x && !error && !acquire_in_progress) {
                 if (tmpl->id.spi &&
-                    (x0 = __xfrm_state_lookup(net, daddr, tmpl->id.spi,
+                    (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
                                               tmpl->id.proto, family)) != NULL) {
                         to_put = x0;
                         error = -EEXIST;
@@ -823,6 +843,7 @@ found:
                 /* Initialize temporary selector matching only
                  * to current session. */
                 xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
+                memcpy(&x->mark, &pol->mark, sizeof(x->mark));
 
                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
                 if (error) {
@@ -843,8 +864,7 @@ found:
                                 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
                         }
                         x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
-                        x->timer.expires = jiffies + net->xfrm.sysctl_acq_expires*HZ;
-                        add_timer(&x->timer);
+                        tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
                         net->xfrm.state_num++;
                         xfrm_hash_grow_check(net, x->bydst.next != NULL);
                 } else {
@@ -866,7 +886,7 @@ out:
 }
 
 struct xfrm_state *
-xfrm_stateonly_find(struct net *net,
+xfrm_stateonly_find(struct net *net, u32 mark,
                     xfrm_address_t *daddr, xfrm_address_t *saddr,
                     unsigned short family, u8 mode, u8 proto, u32 reqid)
 {
@@ -879,6 +899,7 @@ xfrm_stateonly_find(struct net *net,
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family == family &&
                     x->props.reqid == reqid &&
+                    (mark & x->mark.m) == x->mark.v &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
                     xfrm_state_addr_check(x, daddr, saddr, family) &&
                     mode == x->props.mode &&
@@ -921,7 +942,7 @@ static void __xfrm_state_insert(struct xfrm_state *x)
                 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
         }
 
-        mod_timer(&x->timer, jiffies + HZ);
+        tasklet_hrtimer_start(&x->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
         if (x->replay_maxage)
                 mod_timer(&x->rtimer, jiffies + x->replay_maxage);
 
@@ -941,11 +962,13 @@ static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
         struct xfrm_state *x;
         struct hlist_node *entry;
         unsigned int h;
+        u32 mark = xnew->mark.v & xnew->mark.m;
 
         h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family     == family &&
                     x->props.reqid      == reqid &&
+                    (mark & x->mark.m) == x->mark.v &&
                     !xfrm_addr_cmp(&x->id.daddr, &xnew->id.daddr, family) &&
                     !xfrm_addr_cmp(&x->props.saddr, &xnew->props.saddr, family))
                         x->genid = xfrm_state_genid;
@@ -962,11 +985,12 @@ void xfrm_state_insert(struct xfrm_state *x)
 EXPORT_SYMBOL(xfrm_state_insert);
 
 /* xfrm_state_lock is held */
-static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
+static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m, unsigned short family, u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr, int create)
 {
         unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
         struct hlist_node *entry;
         struct xfrm_state *x;
+        u32 mark = m->v & m->m;
 
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.reqid  != reqid ||
@@ -975,6 +999,7 @@ static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family
                     x->km.state     != XFRM_STATE_ACQ ||
                     x->id.spi       != 0 ||
                     x->id.proto     != proto ||
+                    (mark & x->mark.m) != x->mark.v ||
                     xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
                     xfrm_addr_cmp(&x->props.saddr, saddr, family))
                         continue;
@@ -1017,10 +1042,11 @@ static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family
                 x->props.family = family;
                 x->props.mode = mode;
                 x->props.reqid = reqid;
+                x->mark.v = m->v;
+                x->mark.m = m->m;
                 x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
                 xfrm_state_hold(x);
-                x->timer.expires = jiffies + net->xfrm.sysctl_acq_expires*HZ;
-                add_timer(&x->timer);
+                tasklet_hrtimer_start(&x->mtimer, ktime_set(net->xfrm.sysctl_acq_expires, 0), HRTIMER_MODE_REL);
                 list_add(&x->km.all, &net->xfrm.state_all);
                 hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
                 h = xfrm_src_hash(net, daddr, saddr, family);
@@ -1034,7 +1060,7 @@ static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family
         return x;
 }
 
-static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq);
+static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
 
 int xfrm_state_add(struct xfrm_state *x)
 {
@@ -1042,6 +1068,7 @@ int xfrm_state_add(struct xfrm_state *x)
         struct xfrm_state *x1, *to_put;
         int family;
         int err;
+        u32 mark = x->mark.v & x->mark.m;
         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
 
         family = x->props.family;
@@ -1059,7 +1086,7 @@ int xfrm_state_add(struct xfrm_state *x)
         }
 
         if (use_spi && x->km.seq) {
-                x1 = __xfrm_find_acq_byseq(net, x->km.seq);
+                x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq);
                 if (x1 && ((x1->id.proto != x->id.proto) ||
                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
                         to_put = x1;
@@ -1068,8 +1095,8 @@ int xfrm_state_add(struct xfrm_state *x)
         }
 
         if (use_spi && !x1)
-                x1 = __find_acq_core(net, family, x->props.mode, x->props.reqid,
-                                     x->id.proto,
+                x1 = __find_acq_core(net, &x->mark, family, x->props.mode,
+                                     x->props.reqid, x->id.proto,
                                      &x->id.daddr, &x->props.saddr, 0);
 
         __xfrm_state_bump_genids(x);
@@ -1098,7 +1125,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         int err = -ENOMEM;
         struct xfrm_state *x = xfrm_state_alloc(net);
         if (!x)
-                goto error;
+                goto out;
 
         memcpy(&x->id, &orig->id, sizeof(x->id));
         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
@@ -1110,7 +1137,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         x->props.saddr = orig->props.saddr;
 
         if (orig->aalg) {
-                x->aalg = xfrm_algo_clone(orig->aalg);
+                x->aalg = xfrm_algo_auth_clone(orig->aalg);
                 if (!x->aalg)
                         goto error;
         }
@@ -1143,6 +1170,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
                         goto error;
         }
 
+        memcpy(&x->mark, &orig->mark, sizeof(x->mark));
+
         err = xfrm_init_state(x);
         if (err)
                 goto error;
@@ -1156,16 +1185,10 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         return x;
 
  error:
+        xfrm_state_put(x);
+out:
         if (errp)
                 *errp = err;
-        if (x) {
-                kfree(x->aalg);
-                kfree(x->ealg);
-                kfree(x->calg);
-                kfree(x->encap);
-                kfree(x->coaddr);
-        }
-        kfree(x);
         return NULL;
 }
 
@@ -1300,7 +1323,7 @@ out:
                 memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
                 x1->km.dying = 0;
 
-                mod_timer(&x1->timer, jiffies + HZ);
+                tasklet_hrtimer_start(&x1->mtimer, ktime_set(1, 0), HRTIMER_MODE_REL);
                 if (x1->curlft.use_time)
                         xfrm_state_check_expire(x1);
 
@@ -1325,7 +1348,7 @@ int xfrm_state_check_expire(struct xfrm_state *x)
         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
             x->curlft.packets >= x->lft.hard_packet_limit) {
                 x->km.state = XFRM_STATE_EXPIRED;
-                mod_timer(&x->timer, jiffies);
+                tasklet_hrtimer_start(&x->mtimer, ktime_set(0,0), HRTIMER_MODE_REL);
                 return -EINVAL;
         }
 
@@ -1340,41 +1363,41 @@ int xfrm_state_check_expire(struct xfrm_state *x)
 EXPORT_SYMBOL(xfrm_state_check_expire);
 
 struct xfrm_state *
-xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto,
-                  unsigned short family)
+xfrm_state_lookup(struct net *net, u32 mark, xfrm_address_t *daddr, __be32 spi,
+                  u8 proto, unsigned short family)
 {
         struct xfrm_state *x;
 
         spin_lock_bh(&xfrm_state_lock);
-        x = __xfrm_state_lookup(net, daddr, spi, proto, family);
+        x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
         spin_unlock_bh(&xfrm_state_lock);
         return x;
 }
 EXPORT_SYMBOL(xfrm_state_lookup);
 
 struct xfrm_state *
-xfrm_state_lookup_byaddr(struct net *net,
+xfrm_state_lookup_byaddr(struct net *net, u32 mark,
                          xfrm_address_t *daddr, xfrm_address_t *saddr,
                          u8 proto, unsigned short family)
 {
         struct xfrm_state *x;
 
         spin_lock_bh(&xfrm_state_lock);
-        x = __xfrm_state_lookup_byaddr(net, daddr, saddr, proto, family);
+        x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
         spin_unlock_bh(&xfrm_state_lock);
         return x;
 }
 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
 
 struct xfrm_state *
-xfrm_find_acq(struct net *net, u8 mode, u32 reqid, u8 proto,
+xfrm_find_acq(struct net *net, struct xfrm_mark *mark, u8 mode, u32 reqid, u8 proto,
               xfrm_address_t *daddr, xfrm_address_t *saddr,
               int create, unsigned short family)
 {
         struct xfrm_state *x;
 
         spin_lock_bh(&xfrm_state_lock);
-        x = __find_acq_core(net, family, mode, reqid, proto, daddr, saddr, create);
+        x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create);
         spin_unlock_bh(&xfrm_state_lock);
 
         return x;
@@ -1421,7 +1444,7 @@ EXPORT_SYMBOL(xfrm_state_sort);
 
 /* Silly enough, but I'm lazy to build resolution list */
 
-static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq)
+static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
 {
         int i;
 
@@ -1431,6 +1454,7 @@ static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq)
 
                 hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
                         if (x->km.seq == seq &&
+                            (mark & x->mark.m) == x->mark.v &&
                             x->km.state == XFRM_STATE_ACQ) {
                                 xfrm_state_hold(x);
                                 return x;
@@ -1440,12 +1464,12 @@ static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 seq)
         return NULL;
 }
 
-struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 seq)
+struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
 {
         struct xfrm_state *x;
 
         spin_lock_bh(&xfrm_state_lock);
-        x = __xfrm_find_acq_byseq(net, seq);
+        x = __xfrm_find_acq_byseq(net, mark, seq);
         spin_unlock_bh(&xfrm_state_lock);
         return x;
 }
@@ -1454,12 +1478,12 @@ EXPORT_SYMBOL(xfrm_find_acq_byseq);
 u32 xfrm_get_acqseq(void)
 {
         u32 res;
-        static u32 acqseq;
-        static DEFINE_SPINLOCK(acqseq_lock);
+        static atomic_t acqseq;
+
+        do {
+                res = atomic_inc_return(&acqseq);
+        } while (!res);
 
-        spin_lock_bh(&acqseq_lock);
-        res = (++acqseq ? : ++acqseq);
-        spin_unlock_bh(&acqseq_lock);
         return res;
 }
 EXPORT_SYMBOL(xfrm_get_acqseq);
@@ -1472,6 +1496,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
         int err = -ENOENT;
         __be32 minspi = htonl(low);
         __be32 maxspi = htonl(high);
+        u32 mark = x->mark.v & x->mark.m;
 
         spin_lock_bh(&x->lock);
         if (x->km.state == XFRM_STATE_DEAD)
@@ -1484,7 +1509,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
         err = -ENOENT;
 
         if (minspi == maxspi) {
-                x0 = xfrm_state_lookup(net, &x->id.daddr, minspi, x->id.proto, x->props.family);
+                x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
                 if (x0) {
                         xfrm_state_put(x0);
                         goto unlock;
@@ -1494,7 +1519,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
                 u32 spi = 0;
                 for (h=0; h<high-low+1; h++) {
                         spi = low + net_random()%(high-low+1);
-                        x0 = xfrm_state_lookup(net, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
+                        x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
                         if (x0 == NULL) {
                                 x->id.spi = htonl(spi);
                                 break;
diff --git a/net/xfrm/xfrm_sysctl.c b/net/xfrm/xfrm_sysctl.c
index 2e6ffb66f06f..05640bc9594b 100644
--- a/net/xfrm/xfrm_sysctl.c
+++ b/net/xfrm/xfrm_sysctl.c
@@ -1,8 +1,9 @@
 #include <linux/sysctl.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/xfrm.h>
 
-static void __xfrm_sysctl_init(struct net *net)
+static void __net_init __xfrm_sysctl_init(struct net *net)
 {
         net->xfrm.sysctl_aevent_etime = XFRM_AE_ETIME;
         net->xfrm.sysctl_aevent_rseqth = XFRM_AE_SEQT_SIZE;
@@ -13,28 +14,24 @@ static void __xfrm_sysctl_init(struct net *net)
 #ifdef CONFIG_SYSCTL
 static struct ctl_table xfrm_table[] = {
         {
-                .ctl_name       = NET_CORE_AEVENT_ETIME,
                 .procname       = "xfrm_aevent_etime",
                 .maxlen         = sizeof(u32),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_AEVENT_RSEQTH,
                 .procname       = "xfrm_aevent_rseqth",
                 .maxlen         = sizeof(u32),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "xfrm_larval_drop",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "xfrm_acq_expires",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
@@ -68,7 +65,7 @@ out_kmemdup:
         return -ENOMEM;
 }
 
-void xfrm_sysctl_fini(struct net *net)
+void __net_exit xfrm_sysctl_fini(struct net *net)
 {
         struct ctl_table *table;
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b95a2d64eb59..6106b72826d3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -62,6 +62,22 @@ static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
         return 0;
 }
 
+static int verify_auth_trunc(struct nlattr **attrs)
+{
+        struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
+        struct xfrm_algo_auth *algp;
+
+        if (!rt)
+                return 0;
+
+        algp = nla_data(rt);
+        if (nla_len(rt) < xfrm_alg_auth_len(algp))
+                return -EINVAL;
+
+        algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
+        return 0;
+}
+
 static int verify_aead(struct nlattr **attrs)
 {
         struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
@@ -128,7 +144,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         err = -EINVAL;
         switch (p->id.proto) {
         case IPPROTO_AH:
-                if (!attrs[XFRMA_ALG_AUTH]      ||
+                if ((!attrs[XFRMA_ALG_AUTH]     &&
+                     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
                     attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_CRYPT]      ||
                     attrs[XFRMA_ALG_COMP])
@@ -139,10 +156,12 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                 if (attrs[XFRMA_ALG_COMP])
                         goto out;
                 if (!attrs[XFRMA_ALG_AUTH] &&
+                    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
                     !attrs[XFRMA_ALG_CRYPT] &&
                     !attrs[XFRMA_ALG_AEAD])
                         goto out;
                 if ((attrs[XFRMA_ALG_AUTH] ||
+                     attrs[XFRMA_ALG_AUTH_TRUNC] ||
                      attrs[XFRMA_ALG_CRYPT]) &&
                     attrs[XFRMA_ALG_AEAD])
                         goto out;
@@ -152,6 +171,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                 if (!attrs[XFRMA_ALG_COMP]      ||
                     attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_AUTH]       ||
+                    attrs[XFRMA_ALG_AUTH_TRUNC] ||
                     attrs[XFRMA_ALG_CRYPT])
                         goto out;
                 break;
@@ -161,6 +181,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         case IPPROTO_ROUTING:
                 if (attrs[XFRMA_ALG_COMP]       ||
                     attrs[XFRMA_ALG_AUTH]       ||
+                    attrs[XFRMA_ALG_AUTH_TRUNC] ||
                     attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_CRYPT]      ||
                     attrs[XFRMA_ENCAP]          ||
@@ -176,6 +197,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 
         if ((err = verify_aead(attrs)))
                 goto out;
+        if ((err = verify_auth_trunc(attrs)))
+                goto out;
         if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
                 goto out;
         if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
@@ -229,6 +252,66 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
         return 0;
 }
 
+static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
+                       struct nlattr *rta)
+{
+        struct xfrm_algo *ualg;
+        struct xfrm_algo_auth *p;
+        struct xfrm_algo_desc *algo;
+
+        if (!rta)
+                return 0;
+
+        ualg = nla_data(rta);
+
+        algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
+        if (!algo)
+                return -ENOSYS;
+        *props = algo->desc.sadb_alg_id;
+
+        p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+
+        strcpy(p->alg_name, algo->name);
+        p->alg_key_len = ualg->alg_key_len;
+        p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
+        memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
+
+        *algpp = p;
+        return 0;
+}
+
+static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
+                             struct nlattr *rta)
+{
+        struct xfrm_algo_auth *p, *ualg;
+        struct xfrm_algo_desc *algo;
+
+        if (!rta)
+                return 0;
+
+        ualg = nla_data(rta);
+
+        algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
+        if (!algo)
+                return -ENOSYS;
+        if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
+                return -EINVAL;
+        *props = algo->desc.sadb_alg_id;
+
+        p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+
+        strcpy(p->alg_name, algo->name);
+        if (!p->alg_trunc_len)
+                p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
+
+        *algpp = p;
+        return 0;
+}
+
 static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
                        struct nlattr *rta)
 {
@@ -332,10 +415,14 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
         if ((err = attach_aead(&x->aead, &x->props.ealgo,
                                attrs[XFRMA_ALG_AEAD])))
                 goto error;
-        if ((err = attach_one_algo(&x->aalg, &x->props.aalgo,
-                                   xfrm_aalg_get_byname,
-                                   attrs[XFRMA_ALG_AUTH])))
+        if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
+                                     attrs[XFRMA_ALG_AUTH_TRUNC])))
                 goto error;
+        if (!x->props.aalgo) {
+                if ((err = attach_auth(&x->aalg, &x->props.aalgo,
+                                       attrs[XFRMA_ALG_AUTH])))
+                        goto error;
+        }
         if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
                                    xfrm_ealg_get_byname,
                                    attrs[XFRMA_ALG_CRYPT])))
@@ -359,6 +446,8 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
                         goto error;
         }
 
+        xfrm_mark_get(attrs, &x->mark);
+
         err = xfrm_init_state(x);
         if (err)
                 goto error;
@@ -439,11 +528,13 @@ static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
                                                  int *errp)
 {
         struct xfrm_state *x = NULL;
+        struct xfrm_mark m;
         int err;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
                 err = -ESRCH;
-                x = xfrm_state_lookup(net, &p->daddr, p->spi, p->proto, p->family);
+                x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
         } else {
                 xfrm_address_t *saddr = NULL;
 
@@ -454,7 +545,8 @@ static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
                 }
 
                 err = -ESRCH;
-                x = xfrm_state_lookup_byaddr(net, &p->daddr, saddr,
+                x = xfrm_state_lookup_byaddr(net, mark,
+                                             &p->daddr, saddr,
                                              p->proto, p->family);
         }
 
@@ -548,6 +640,24 @@ static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
         return 0;
 }
 
+static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
+{
+        struct xfrm_algo *algo;
+        struct nlattr *nla;
+
+        nla = nla_reserve(skb, XFRMA_ALG_AUTH,
+                          sizeof(*algo) + (auth->alg_key_len + 7) / 8);
+        if (!nla)
+                return -EMSGSIZE;
+
+        algo = nla_data(nla);
+        strcpy(algo->alg_name, auth->alg_name);
+        memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
+        algo->alg_key_len = auth->alg_key_len;
+
+        return 0;
+}
+
 /* Don't change this without updating xfrm_sa_len! */
 static int copy_to_user_state_extra(struct xfrm_state *x,
                                     struct xfrm_usersa_info *p,
@@ -563,8 +673,13 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
 
         if (x->aead)
                 NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
-        if (x->aalg)
-                NLA_PUT(skb, XFRMA_ALG_AUTH, xfrm_alg_len(x->aalg), x->aalg);
+        if (x->aalg) {
+                if (copy_to_user_auth(x->aalg, skb))
+                        goto nla_put_failure;
+
+                NLA_PUT(skb, XFRMA_ALG_AUTH_TRUNC,
+                        xfrm_alg_auth_len(x->aalg), x->aalg);
+        }
         if (x->ealg)
                 NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
         if (x->calg)
@@ -573,6 +688,9 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
         if (x->encap)
                 NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
 
+        if (xfrm_mark_put(skb, &x->mark))
+                goto nla_put_failure;
+
         if (x->security && copy_sec_ctx(x->security, skb) < 0)
                 goto nla_put_failure;
 
@@ -671,7 +789,8 @@ static inline size_t xfrm_spdinfo_msgsize(void)
                + nla_total_size(sizeof(struct xfrmu_spdhinfo));
 }
 
-static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
+static int build_spdinfo(struct sk_buff *skb, struct net *net,
+                         u32 pid, u32 seq, u32 flags)
 {
         struct xfrmk_spdinfo si;
         struct xfrmu_spdinfo spc;
@@ -685,7 +804,7 @@ static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
 
         f = nlmsg_data(nlh);
         *f = flags;
-        xfrm_spd_getinfo(&si);
+        xfrm_spd_getinfo(net, &si);
         spc.incnt = si.incnt;
         spc.outcnt = si.outcnt;
         spc.fwdcnt = si.fwdcnt;
@@ -718,7 +837,7 @@ static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        if (build_spdinfo(r_skb, spid, seq, *flags) < 0)
+        if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
                 BUG();
 
         return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
@@ -731,7 +850,8 @@ static inline size_t xfrm_sadinfo_msgsize(void)
                + nla_total_size(4); /* XFRMA_SAD_CNT */
 }
 
-static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
+static int build_sadinfo(struct sk_buff *skb, struct net *net,
+                         u32 pid, u32 seq, u32 flags)
 {
         struct xfrmk_sadinfo si;
         struct xfrmu_sadhinfo sh;
@@ -744,7 +864,7 @@ static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
 
         f = nlmsg_data(nlh);
         *f = flags;
-        xfrm_sad_getinfo(&si);
+        xfrm_sad_getinfo(net, &si);
 
         sh.sadhmcnt = si.sadhmcnt;
         sh.sadhcnt = si.sadhcnt;
@@ -772,7 +892,7 @@ static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        if (build_sadinfo(r_skb, spid, seq, *flags) < 0)
+        if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
                 BUG();
 
         return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
@@ -835,6 +955,8 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
         xfrm_address_t *daddr;
         int family;
         int err;
+        u32 mark;
+        struct xfrm_mark m;
 
         p = nlmsg_data(nlh);
         err = verify_userspi_info(p);
@@ -845,8 +967,10 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
         daddr = &p->info.id.daddr;
 
         x = NULL;
+
+        mark = xfrm_mark_get(attrs, &m);
         if (p->info.seq) {
-                x = xfrm_find_acq_byseq(net, p->info.seq);
+                x = xfrm_find_acq_byseq(net, mark, p->info.seq);
                 if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
                         xfrm_state_put(x);
                         x = NULL;
@@ -854,7 +978,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
         }
 
         if (!x)
-                x = xfrm_find_acq(net, p->info.mode, p->info.reqid,
+                x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
                                   p->info.id.proto, daddr,
                                   &p->info.saddr, 1,
                                   family);
@@ -1108,6 +1232,8 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us
         if (err)
                 goto error;
 
+        xfrm_mark_get(attrs, &xp->mark);
+
         return xp;
  error:
         *errp = err;
@@ -1254,10 +1380,13 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
                 goto nlmsg_failure;
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
 
         nlmsg_end(skb, nlh);
         return 0;
 
+nla_put_failure:
 nlmsg_failure:
         nlmsg_cancel(skb, nlh);
         return -EMSGSIZE;
@@ -1329,6 +1458,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
         int err;
         struct km_event c;
         int delete;
+        struct xfrm_mark m;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         p = nlmsg_data(nlh);
         delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
@@ -1342,7 +1473,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                 return err;
 
         if (p->index)
-                xp = xfrm_policy_byid(net, type, p->dir, p->index, delete, &err);
+                xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
         else {
                 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
                 struct xfrm_sec_ctx *ctx;
@@ -1359,8 +1490,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                         if (err)
                                 return err;
                 }
-                xp = xfrm_policy_bysel_ctx(net, type, p->dir, &p->sel, ctx,
-                                           delete, &err);
+                xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
+                                           ctx, delete, &err);
                 security_xfrm_policy_free(ctx);
         }
         if (xp == NULL)
@@ -1412,8 +1543,11 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
         audit_info.sessionid = NETLINK_CB(skb).sessionid;
         audit_info.secid = NETLINK_CB(skb).sid;
         err = xfrm_state_flush(net, p->proto, &audit_info);
-        if (err)
+        if (err) {
+                if (err == -ESRCH) /* empty table */
+                        return 0;
                 return err;
+        }
         c.data.proto = p->proto;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1429,6 +1563,7 @@ static inline size_t xfrm_aevent_msgsize(void)
         return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
                + nla_total_size(sizeof(struct xfrm_replay_state))
                + nla_total_size(sizeof(struct xfrm_lifetime_cur))
+               + nla_total_size(sizeof(struct xfrm_mark))
                + nla_total_size(4) /* XFRM_AE_RTHR */
                + nla_total_size(4); /* XFRM_AE_ETHR */
 }
@@ -1461,6 +1596,9 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
                 NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
                             x->replay_maxage * 10 / HZ);
 
+        if (xfrm_mark_put(skb, &x->mark))
+                goto nla_put_failure;
+
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -1476,6 +1614,8 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct sk_buff *r_skb;
         int err;
         struct km_event c;
+        u32 mark;
+        struct xfrm_mark m;
         struct xfrm_aevent_id *p = nlmsg_data(nlh);
         struct xfrm_usersa_id *id = &p->sa_id;
 
@@ -1483,7 +1623,9 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        x = xfrm_state_lookup(net, &id->daddr, id->spi, id->proto, id->family);
+        mark = xfrm_mark_get(attrs, &m);
+
+        x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
         if (x == NULL) {
                 kfree_skb(r_skb);
                 return -ESRCH;
@@ -1514,6 +1656,8 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_state *x;
         struct km_event c;
         int err = - EINVAL;
+        u32 mark = 0;
+        struct xfrm_mark m;
         struct xfrm_aevent_id *p = nlmsg_data(nlh);
         struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
         struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
@@ -1525,7 +1669,9 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
                 return err;
 
-        x = xfrm_state_lookup(net, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
+        mark = xfrm_mark_get(attrs, &m);
+
+        x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
         if (x == NULL)
                 return -ESRCH;
 
@@ -1564,8 +1710,12 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
         audit_info.sessionid = NETLINK_CB(skb).sessionid;
         audit_info.secid = NETLINK_CB(skb).sid;
         err = xfrm_policy_flush(net, type, &audit_info);
-        if (err)
+        if (err) {
+                if (err == -ESRCH) /* empty table */
+                        return 0;
                 return err;
+        }
+
         c.data.type = type;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1584,13 +1734,15 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_userpolicy_info *p = &up->pol;
         u8 type = XFRM_POLICY_TYPE_MAIN;
         int err = -ENOENT;
+        struct xfrm_mark m;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         err = copy_from_user_policy_type(&type, attrs);
         if (err)
                 return err;
 
         if (p->index)
-                xp = xfrm_policy_byid(net, type, p->dir, p->index, 0, &err);
+                xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
         else {
                 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
                 struct xfrm_sec_ctx *ctx;
@@ -1607,7 +1759,8 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                         if (err)
                                 return err;
                 }
-                xp = xfrm_policy_bysel_ctx(net, type, p->dir, &p->sel, ctx, 0, &err);
+                xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
+                                           &p->sel, ctx, 0, &err);
                 security_xfrm_policy_free(ctx);
         }
         if (xp == NULL)
@@ -1647,8 +1800,10 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         int err;
         struct xfrm_user_expire *ue = nlmsg_data(nlh);
         struct xfrm_usersa_info *p = &ue->state;
+        struct xfrm_mark m;
+        u32 mark = xfrm_mark_get(attrs, &m);;
 
-        x = xfrm_state_lookup(net, &p->id.daddr, p->id.spi, p->id.proto, p->family);
+        x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
 
         err = -ENOENT;
         if (x == NULL)
@@ -1682,6 +1837,7 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_user_tmpl *ut;
         int i;
         struct nlattr *rt = attrs[XFRMA_TMPL];
+        struct xfrm_mark mark;
 
         struct xfrm_user_acquire *ua = nlmsg_data(nlh);
         struct xfrm_state *x = xfrm_state_alloc(net);
@@ -1690,6 +1846,8 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (!x)
                 goto nomem;
 
+        xfrm_mark_get(attrs, &mark);
+
         err = verify_newpolicy_info(&ua->policy);
         if (err)
                 goto bad_policy;
@@ -1702,7 +1860,8 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
         memcpy(&x->id, &ua->id, sizeof(ua->id));
         memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
         memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
-
+        xp->mark.m = x->mark.m = mark.m;
+        xp->mark.v = x->mark.v = mark.v;
         ut = nla_data(rt);
         /* extract the templates and for each call km_key */
         for (i = 0; i < xp->xfrm_nr; i++, ut++) {
@@ -1942,6 +2101,10 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
 #undef XMSGSIZE
 
 static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
+        [XFRMA_SA]              = { .len = sizeof(struct xfrm_usersa_info)},
+        [XFRMA_POLICY]          = { .len = sizeof(struct xfrm_userpolicy_info)},
+        [XFRMA_LASTUSED]        = { .type = NLA_U64},
+        [XFRMA_ALG_AUTH_TRUNC]  = { .len = sizeof(struct xfrm_algo_auth)},
         [XFRMA_ALG_AEAD]        = { .len = sizeof(struct xfrm_algo_aead) },
         [XFRMA_ALG_AUTH]        = { .len = sizeof(struct xfrm_algo) },
         [XFRMA_ALG_CRYPT]       = { .len = sizeof(struct xfrm_algo) },
@@ -1958,6 +2121,7 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
         [XFRMA_POLICY_TYPE]     = { .len = sizeof(struct xfrm_userpolicy_type)},
         [XFRMA_MIGRATE]         = { .len = sizeof(struct xfrm_user_migrate) },
         [XFRMA_KMADDRESS]       = { .len = sizeof(struct xfrm_user_kmaddress) },
+        [XFRMA_MARK]            = { .len = sizeof(struct xfrm_mark) },
 };
 
 static struct xfrm_link {
@@ -2037,7 +2201,8 @@ static void xfrm_netlink_rcv(struct sk_buff *skb)
 
 static inline size_t xfrm_expire_msgsize(void)
 {
-        return NLMSG_ALIGN(sizeof(struct xfrm_user_expire));
+        return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
+               + nla_total_size(sizeof(struct xfrm_mark));
 }
 
 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
@@ -2053,7 +2218,13 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
         copy_to_user_state(x, &ue->state);
         ue->hard = (c->data.hard != 0) ? 1 : 0;
 
+        if (xfrm_mark_put(skb, &x->mark))
+                goto nla_put_failure;
+
         return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        return -EMSGSIZE;
 }
 
 static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
@@ -2065,8 +2236,10 @@ static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_expire(skb, x, c) < 0)
-                BUG();
+        if (build_expire(skb, x, c) < 0) {
+                kfree_skb(skb);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
 }
@@ -2117,8 +2290,11 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
         size_t l = 0;
         if (x->aead)
                 l += nla_total_size(aead_len(x->aead));
-        if (x->aalg)
-                l += nla_total_size(xfrm_alg_len(x->aalg));
+        if (x->aalg) {
+                l += nla_total_size(sizeof(struct xfrm_algo) +
+                                    (x->aalg->alg_key_len + 7) / 8);
+                l += nla_total_size(xfrm_alg_auth_len(x->aalg));
+        }
         if (x->ealg)
                 l += nla_total_size(xfrm_alg_len(x->ealg));
         if (x->calg)
@@ -2151,6 +2327,7 @@ static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
         if (c->event == XFRM_MSG_DELSA) {
                 len += nla_total_size(headlen);
                 headlen = sizeof(*id);
+                len += nla_total_size(sizeof(struct xfrm_mark));
         }
         len += NLMSG_ALIGN(headlen);
 
@@ -2221,6 +2398,7 @@ static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
                + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
+               + nla_total_size(sizeof(struct xfrm_mark))
                + nla_total_size(xfrm_user_sec_ctx_size(x->security))
                + userpolicy_type_attrsize();
 }
@@ -2253,9 +2431,12 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
                 goto nlmsg_failure;
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
+nla_put_failure:
 nlmsg_failure:
         nlmsg_cancel(skb, nlh);
         return -EMSGSIZE;
@@ -2342,6 +2523,7 @@ static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
         return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
                + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
                + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
+               + nla_total_size(sizeof(struct xfrm_mark))
                + userpolicy_type_attrsize();
 }
 
@@ -2364,10 +2546,13 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
                 goto nlmsg_failure;
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
         upe->hard = !!hard;
 
         return nlmsg_end(skb, nlh);
 
+nla_put_failure:
 nlmsg_failure:
         nlmsg_cancel(skb, nlh);
         return -EMSGSIZE;
@@ -2404,6 +2589,7 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
                 headlen = sizeof(*id);
         }
         len += userpolicy_type_attrsize();
+        len += nla_total_size(sizeof(struct xfrm_mark));
         len += NLMSG_ALIGN(headlen);
 
         skb = nlmsg_new(len, GFP_ATOMIC);
@@ -2439,10 +2625,14 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
 
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
+
         nlmsg_end(skb, nlh);
 
         return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
 
+nla_put_failure:
 nlmsg_failure:
         kfree_skb(skb);
         return -1;
@@ -2608,22 +2798,24 @@ static int __net_init xfrm_user_net_init(struct net *net)
                                      xfrm_netlink_rcv, NULL, THIS_MODULE);
         if (nlsk == NULL)
                 return -ENOMEM;
+        net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
         rcu_assign_pointer(net->xfrm.nlsk, nlsk);
         return 0;
 }
 
-static void __net_exit xfrm_user_net_exit(struct net *net)
+static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
 {
-        struct sock *nlsk = net->xfrm.nlsk;
-
-        rcu_assign_pointer(net->xfrm.nlsk, NULL);
-        synchronize_rcu();
-        netlink_kernel_release(nlsk);
+        struct net *net;
+        list_for_each_entry(net, net_exit_list, exit_list)
+                rcu_assign_pointer(net->xfrm.nlsk, NULL);
+        synchronize_net();
+        list_for_each_entry(net, net_exit_list, exit_list)
+                netlink_kernel_release(net->xfrm.nlsk_stash);
 }
 
 static struct pernet_operations xfrm_user_net_ops = {
-        .init = xfrm_user_net_init,
-        .exit = xfrm_user_net_exit,
+        .init       = xfrm_user_net_init,
+        .exit_batch = xfrm_user_net_exit,
 };
 
 static int __init xfrm_user_init(void)