110 files changed, 6315 insertions, 4242 deletions

diff --git a/net/Kconfig b/net/Kconfig
index 6627c6ae5db6..acbf7c60e89b 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -45,7 +45,7 @@ config INET
         ---help---
           These are the protocols used on the Internet and on most local
           Ethernets. It is highly recommended to say Y here (this will enlarge
-          your kernel by about 144 KB), since some programs (e.g. the X window
+          your kernel by about 400 KB), since some programs (e.g. the X window
           system) use TCP/IP even if your machine is not connected to any
           other computer. You will get the so-called loopback device which
           allows you to ping yourself (great fun, that!).
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index 18058bbc7962..61166f66479f 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -1033,25 +1033,8 @@ static const struct seq_operations aarp_seq_ops = {
 
 static int aarp_seq_open(struct inode *inode, struct file *file)
 {
-        struct seq_file *seq;
-        int rc = -ENOMEM;
-        struct aarp_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
-
-        if (!s)
-                goto out;
-
-        rc = seq_open(file, &aarp_seq_ops);
-        if (rc)
-                goto out_kfree;
-
-        seq          = file->private_data;
-        seq->private = s;
-        memset(s, 0, sizeof(*s));
-out:
-        return rc;
-out_kfree:
-        kfree(s);
-        goto out;
+        return seq_open_private(file, &aarp_seq_ops,
+                        sizeof(struct aarp_iter_state));
 }
 
 const struct file_operations atalk_seq_arp_fops = {
diff --git a/net/atm/clip.c b/net/atm/clip.c
index d30167c0b48e..d45971bd286c 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -648,10 +648,6 @@ static int clip_inet_event(struct notifier_block *this, unsigned long event,
         struct in_device *in_dev;
 
         in_dev = ((struct in_ifaddr *)ifa)->ifa_dev;
-        if (!in_dev || !in_dev->dev) {
-                printk(KERN_WARNING "clip_inet_event: no device\n");
-                return NOTIFY_DONE;
-        }
         /*
          * Transitions are of the down-change-up type, so it's sufficient to
          * handle the change on up.
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 0e450d12f035..e2d800d818e3 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1169,32 +1169,7 @@ static const struct seq_operations lec_seq_ops = {
 
 static int lec_seq_open(struct inode *inode, struct file *file)
 {
-        struct lec_state *state;
-        struct seq_file *seq;
-        int rc = -EAGAIN;
-
-        state = kmalloc(sizeof(*state), GFP_KERNEL);
-        if (!state) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        rc = seq_open(file, &lec_seq_ops);
-        if (rc)
-                goto out_kfree;
-        seq = file->private_data;
-        seq->private = state;
-out:
-        return rc;
-
-out_kfree:
-        kfree(state);
-        goto out;
-}
-
-static int lec_seq_release(struct inode *inode, struct file *file)
-{
-        return seq_release_private(inode, file);
+        return seq_open_private(file, &lec_seq_ops, sizeof(struct lec_state));
 }
 
 static const struct file_operations lec_seq_fops = {
@@ -1202,7 +1177,7 @@ static const struct file_operations lec_seq_fops = {
         .open = lec_seq_open,
         .read = seq_read,
         .llseek = seq_lseek,
-        .release = lec_seq_release,
+        .release = seq_release_private,
 };
 #endif
 
diff --git a/net/atm/proc.c b/net/atm/proc.c
index e9693aed7ef8..b995b66b5585 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -114,31 +114,13 @@ static int __vcc_seq_open(struct inode *inode, struct file *file,
         int family, const struct seq_operations *ops)
 {
         struct vcc_state *state;
-        struct seq_file *seq;
-        int rc = -ENOMEM;
 
-        state = kmalloc(sizeof(*state), GFP_KERNEL);
-        if (!state)
-                goto out;
-
-        rc = seq_open(file, ops);
-        if (rc)
-                goto out_kfree;
+        state = __seq_open_private(file, ops, sizeof(*state));
+        if (state == NULL)
+                return -ENOMEM;
 
         state->family = family;
-
-        seq = file->private_data;
-        seq->private = state;
-out:
-        return rc;
-out_kfree:
-        kfree(state);
-        goto out;
-}
-
-static int vcc_seq_release(struct inode *inode, struct file *file)
-{
-        return seq_release_private(inode, file);
+        return 0;
 }
 
 static void *vcc_seq_start(struct seq_file *seq, loff_t *pos)
@@ -314,7 +296,7 @@ static const struct file_operations pvc_seq_fops = {
         .open           = pvc_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = vcc_seq_release,
+        .release        = seq_release_private,
 };
 
 static int vcc_seq_show(struct seq_file *seq, void *v)
@@ -348,7 +330,7 @@ static const struct file_operations vcc_seq_fops = {
         .open           = vcc_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = vcc_seq_release,
+        .release        = seq_release_private,
 };
 
 static int svc_seq_show(struct seq_file *seq, void *v)
@@ -383,7 +365,7 @@ static const struct file_operations svc_seq_fops = {
         .open           = svc_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = vcc_seq_release,
+        .release        = seq_release_private,
 };
 
 static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index cec582563e0d..f8a3455f4493 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -156,39 +156,14 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
 EXPORT_SYMBOL(dev_mc_unsync);
 
 #ifdef CONFIG_PROC_FS
-static void *dev_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
-{
-        struct net *net = seq_file_net(seq);
-        struct net_device *dev;
-        loff_t off = 0;
-
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
-                if (off++ == *pos)
-                        return dev;
-        }
-        return NULL;
-}
-
-static void *dev_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
-{
-        ++*pos;
-        return next_net_device((struct net_device *)v);
-}
-
-static void dev_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
-{
-        read_unlock(&dev_base_lock);
-}
-
-
 static int dev_mc_seq_show(struct seq_file *seq, void *v)
 {
         struct dev_addr_list *m;
         struct net_device *dev = v;
 
+        if (v == SEQ_START_TOKEN)
+                return 0;
+
         netif_tx_lock_bh(dev);
         for (m = dev->mc_list; m; m = m->next) {
                 int i;
@@ -206,9 +181,9 @@ static int dev_mc_seq_show(struct seq_file *seq, void *v)
 }
 
 static const struct seq_operations dev_mc_seq_ops = {
-        .start = dev_mc_seq_start,
-        .next  = dev_mc_seq_next,
-        .stop  = dev_mc_seq_stop,
+        .start = dev_seq_start,
+        .next  = dev_seq_next,
+        .stop  = dev_seq_stop,
         .show  = dev_mc_seq_show,
 };
 
diff --git a/net/core/dst.c b/net/core/dst.c
index 7deef483c79f..3a01a819ba47 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -295,9 +295,6 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event, void
         struct net_device *dev = ptr;
         struct dst_entry *dst, *last = NULL;
 
-        if (dev->nd_net != &init_net)
-                return NOTIFY_DONE;
-
         switch (event) {
         case NETDEV_UNREGISTER:
         case NETDEV_DOWN:
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index d9a02b2cc289..23c0a10c0c37 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1284,9 +1284,7 @@ static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
         struct neigh_parms *p;
 
         for (p = &tbl->parms; p; p = p->next) {
-                if (p->net != net)
-                        continue;
-                if ((p->dev && p->dev->ifindex == ifindex) ||
+                if ((p->dev && p->dev->ifindex == ifindex && p->net == net) ||
                     (!p->dev && !ifindex))
                         return p;
         }
@@ -2741,7 +2739,8 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
         neigh_path[NEIGH_CTL_PATH_PROTO].procname = p_name;
         neigh_path[NEIGH_CTL_PATH_PROTO].ctl_name = p_id;
 
-        t->sysctl_header = register_sysctl_paths(neigh_path, t->neigh_vars);
+        t->sysctl_header =
+                register_net_sysctl_table(p->net, neigh_path, t->neigh_vars);
         if (!t->sysctl_header)
                 goto free_procname;
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 4b7e756181c9..d0c8bf585f06 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -388,9 +388,7 @@ static void arp_reply(struct sk_buff *skb)
         if (skb->dev->flags & IFF_NOARP)
                 return;
 
-        if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
-                                 (2 * skb->dev->addr_len) +
-                                 (2 * sizeof(u32)))))
+        if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
                 return;
 
         skb_reset_network_header(skb);
@@ -418,7 +416,7 @@ static void arp_reply(struct sk_buff *skb)
             ipv4_is_loopback(tip) || ipv4_is_multicast(tip))
                 return;
 
-        size = sizeof(struct arphdr) + 2 * (skb->dev->addr_len + 4);
+        size = arp_hdr_len(skb->dev);
         send_skb = find_skb(np, size + LL_RESERVED_SPACE(np->dev),
                             LL_RESERVED_SPACE(np->dev));
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 09cb3a74de7f..0ca069738021 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -987,6 +987,25 @@ void sk_free(struct sock *sk)
         sk_prot_free(sk->sk_prot_creator, sk);
 }
 
+/*
+ * Last sock_put should drop referrence to sk->sk_net. It has already
+ * been dropped in sk_change_net. Taking referrence to stopping namespace
+ * is not an option.
+ * Take referrence to a socket to remove it from hash _alive_ and after that
+ * destroy it in the context of init_net.
+ */
+void sk_release_kernel(struct sock *sk)
+{
+        if (sk == NULL || sk->sk_socket == NULL)
+                return;
+
+        sock_hold(sk);
+        sock_release(sk->sk_socket);
+        sk->sk_net = get_net(&init_net);
+        sock_put(sk);
+}
+EXPORT_SYMBOL(sk_release_kernel);
+
 struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
 {
         struct sock *newsk;
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 474075adbde4..514a40b7fc7f 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -471,15 +471,14 @@ static struct dst_entry* dccp_v4_route_skb(struct sock *sk,
         return &rt->u.dst;
 }
 
-static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
-                                 struct dst_entry *dst)
+static int dccp_v4_send_response(struct sock *sk, struct request_sock *req)
 {
         int err = -1;
         struct sk_buff *skb;
+        struct dst_entry *dst;
 
-        /* First, grab a route. */
-
-        if (dst == NULL && (dst = inet_csk_route_req(sk, req)) == NULL)
+        dst = inet_csk_route_req(sk, req);
+        if (dst == NULL)
                 goto out;
 
         skb = dccp_make_response(sk, dst, req);
@@ -620,7 +619,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         dreq->dreq_iss     = dccp_v4_init_sequence(skb);
         dreq->dreq_service = service;
 
-        if (dccp_v4_send_response(sk, req, NULL))
+        if (dccp_v4_send_response(sk, req))
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 490333d47c7b..1a5e50b90677 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -224,8 +224,7 @@ out:
 }
 
 
-static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
-                                 struct dst_entry *dst)
+static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
 {
         struct inet6_request_sock *ireq6 = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -234,6 +233,7 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
         struct in6_addr *final_p = NULL, final;
         struct flowi fl;
         int err = -1;
+        struct dst_entry *dst;
 
         memset(&fl, 0, sizeof(fl));
         fl.proto = IPPROTO_DCCP;
@@ -245,28 +245,26 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
         fl.fl_ip_sport = inet_sk(sk)->sport;
         security_req_classify_flow(req, &fl);
 
-        if (dst == NULL) {
-                opt = np->opt;
+        opt = np->opt;
 
-                if (opt != NULL && opt->srcrt != NULL) {
-                        const struct rt0_hdr *rt0 = (struct rt0_hdr *)opt->srcrt;
+        if (opt != NULL && opt->srcrt != NULL) {
+                const struct rt0_hdr *rt0 = (struct rt0_hdr *)opt->srcrt;
 
-                        ipv6_addr_copy(&final, &fl.fl6_dst);
-                        ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
-                        final_p = &final;
-                }
+                ipv6_addr_copy(&final, &fl.fl6_dst);
+                ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
+                final_p = &final;
+        }
 
-                err = ip6_dst_lookup(sk, &dst, &fl);
-                if (err)
-                        goto done;
+        err = ip6_dst_lookup(sk, &dst, &fl);
+        if (err)
+                goto done;
 
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
+        if (final_p)
+                ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-                err = xfrm_lookup(&dst, &fl, sk, 0);
-                if (err < 0)
-                        goto done;
-        }
+        err = xfrm_lookup(&dst, &fl, sk, 0);
+        if (err < 0)
+                goto done;
 
         skb = dccp_make_response(sk, dst, req);
         if (skb != NULL) {
@@ -448,7 +446,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         dreq->dreq_iss     = dccp_v6_init_sequence(skb);
         dreq->dreq_service = service;
 
-        if (dccp_v6_send_response(sk, req, NULL))
+        if (dccp_v6_send_response(sk, req))
                 goto drop_and_free;
 
         inet6_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 027d1814e1ab..33ad48321b08 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -216,7 +216,7 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
                          * counter (backoff, monitored by dccp_response_timer).
                          */
                         req->retrans++;
-                        req->rsk_ops->rtx_syn_ack(sk, req, NULL);
+                        req->rsk_ops->rtx_syn_ack(sk, req);
                 }
                 /* Network Duplicate, discard packet */
                 return NULL;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index acd48ee522d6..23fd95a7ad15 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -2320,25 +2320,8 @@ static const struct seq_operations dn_socket_seq_ops = {
 
 static int dn_socket_seq_open(struct inode *inode, struct file *file)
 {
-        struct seq_file *seq;
-        int rc = -ENOMEM;
-        struct dn_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
-
-        if (!s)
-                goto out;
-
-        rc = seq_open(file, &dn_socket_seq_ops);
-        if (rc)
-                goto out_kfree;
-
-        seq             = file->private_data;
-        seq->private    = s;
-        memset(s, 0, sizeof(*s));
-out:
-        return rc;
-out_kfree:
-        kfree(s);
-        goto out;
+        return seq_open_private(file, &dn_socket_seq_ops,
+                        sizeof(struct dn_iter_state));
 }
 
 static const struct file_operations dn_socket_seq_fops = {
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 9c7e5ffb223d..5098fd2ff4d0 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -632,5 +632,15 @@ config TCP_MD5SIG
 
           If unsure, say N.
 
+config IP_UDPLITE
+        bool "IP: UDP-Lite Protocol (RFC 3828)"
+        default n
+        ---help---
+          UDP-Lite (RFC 3828) is a UDP-like protocol with variable-length
+          checksum.  Read <file:Documentation/networking/udplite.txt> for
+          details.
+
+          If unsure, say N.
+
 source "net/ipv4/ipvs/Kconfig"
 
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index ad40ef3f9ebc..d5226241d5ed 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -8,7 +8,7 @@ obj-y     := route.o inetpeer.o protocol.o \
              inet_timewait_sock.o inet_connection_sock.o \
              tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
              tcp_minisocks.o tcp_cong.o \
-             datagram.o raw.o udp.o udplite.o \
+             datagram.o raw.o udp.o udp_ipv4.o \
              arp.o icmp.o devinet.o af_inet.o  igmp.o \
              fib_frontend.o fib_semantics.o \
              inet_fragment.o
@@ -49,6 +49,7 @@ obj-$(CONFIG_TCP_CONG_SCALABLE) += tcp_scalable.o
 obj-$(CONFIG_TCP_CONG_LP) += tcp_lp.o
 obj-$(CONFIG_TCP_CONG_YEAH) += tcp_yeah.o
 obj-$(CONFIG_TCP_CONG_ILLINOIS) += tcp_illinois.o
+obj-$(CONFIG_IP_UDPLITE) += udplite_ipv4.o
 obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
 
 obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 09ca5293d08f..67260c0eaaa8 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -784,6 +784,7 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
         int err = 0;
+        struct net *net = sk->sk_net;
 
         switch (cmd) {
                 case SIOCGSTAMP:
@@ -795,12 +796,12 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 case SIOCADDRT:
                 case SIOCDELRT:
                 case SIOCRTMSG:
-                        err = ip_rt_ioctl(sk->sk_net, cmd, (void __user *)arg);
+                        err = ip_rt_ioctl(net, cmd, (void __user *)arg);
                         break;
                 case SIOCDARP:
                 case SIOCGARP:
                 case SIOCSARP:
-                        err = arp_ioctl(sk->sk_net, cmd, (void __user *)arg);
+                        err = arp_ioctl(net, cmd, (void __user *)arg);
                         break;
                 case SIOCGIFADDR:
                 case SIOCSIFADDR:
@@ -813,7 +814,7 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 case SIOCSIFPFLAGS:
                 case SIOCGIFPFLAGS:
                 case SIOCSIFFLAGS:
-                        err = devinet_ioctl(cmd, (void __user *)arg);
+                        err = devinet_ioctl(net, cmd, (void __user *)arg);
                         break;
                 default:
                         if (sk->sk_prot->ioctl)
@@ -1316,15 +1317,18 @@ static int __init init_ipv4_mibs(void)
         if (snmp_mib_init((void **)udp_statistics,
                           sizeof(struct udp_mib)) < 0)
                 goto err_udp_mib;
+#ifdef CONFIG_IP_UDPLITE
         if (snmp_mib_init((void **)udplite_statistics,
                           sizeof(struct udp_mib)) < 0)
                 goto err_udplite_mib;
-
+#endif
         tcp_mib_init();
 
         return 0;
 
+#ifdef CONFIG_IP_UDPLITE
 err_udplite_mib:
+#endif
         snmp_mib_free((void **)udp_statistics);
 err_udp_mib:
         snmp_mib_free((void **)tcp_statistics);
@@ -1414,7 +1418,7 @@ static int __init inet_init(void)
 
         ip_init();
 
-        tcp_v4_init(&inet_family_ops);
+        tcp_v4_init();
 
         /* Setup TCP slab cache for open requests. */
         tcp_init();
@@ -1422,14 +1426,17 @@ static int __init inet_init(void)
         /* Setup UDP memory threshold */
         udp_init();
 
+#ifdef CONFIG_IP_UDPLITE
         /* Add UDP-Lite (RFC 3828) */
         udplite4_register();
+#endif
 
         /*
          *      Set the ICMP layer up
          */
 
-        icmp_init(&inet_family_ops);
+        if (icmp_init() < 0)
+                panic("Failed to create the ICMP control socket.\n");
 
         /*
          *      Initialise the multicast router
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 8e17f65f4002..69e80bd9774a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -570,14 +570,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
          *      Allocate a buffer
          */
 
-        skb = alloc_skb(sizeof(struct arphdr)+ 2*(dev->addr_len+4)
-                                + LL_RESERVED_SPACE(dev), GFP_ATOMIC);
+        skb = alloc_skb(arp_hdr_len(dev) + LL_RESERVED_SPACE(dev), GFP_ATOMIC);
         if (skb == NULL)
                 return NULL;
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         skb_reset_network_header(skb);
-        arp = (struct arphdr *) skb_put(skb,sizeof(struct arphdr) + 2*(dev->addr_len+4));
+        arp = (struct arphdr *) skb_put(skb, arp_hdr_len(dev));
         skb->dev = dev;
         skb->protocol = htons(ETH_P_ARP);
         if (src_hw == NULL)
@@ -916,9 +915,7 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
                 goto freeskb;
 
         /* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
-        if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
-                                 (2 * dev->addr_len) +
-                                 (2 * sizeof(u32)))))
+        if (!pskb_may_pull(skb, arp_hdr_len(dev)))
                 goto freeskb;
 
         arp = arp_hdr(skb);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 87490f7bb0f7..4a10dbbbe0a1 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -446,9 +446,6 @@ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
 
         ASSERT_RTNL();
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv4_policy);
         if (err < 0)
                 goto errout;
@@ -560,9 +557,6 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
 
         ASSERT_RTNL();
 
-        if (net != &init_net)
-                return -EINVAL;
-
         ifa = rtm_to_ifaddr(net, nlh);
         if (IS_ERR(ifa))
                 return PTR_ERR(ifa);
@@ -595,7 +589,7 @@ static __inline__ int inet_abc_len(__be32 addr)
 }
 
 
-int devinet_ioctl(unsigned int cmd, void __user *arg)
+int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 {
         struct ifreq ifr;
         struct sockaddr_in sin_orig;
@@ -624,7 +618,7 @@ int devinet_ioctl(unsigned int cmd, void __user *arg)
                 *colon = 0;
 
 #ifdef CONFIG_KMOD
-        dev_load(&init_net, ifr.ifr_name);
+        dev_load(net, ifr.ifr_name);
 #endif
 
         switch (cmd) {
@@ -665,7 +659,7 @@ int devinet_ioctl(unsigned int cmd, void __user *arg)
         rtnl_lock();
 
         ret = -ENODEV;
-        if ((dev = __dev_get_by_name(&init_net, ifr.ifr_name)) == NULL)
+        if ((dev = __dev_get_by_name(net, ifr.ifr_name)) == NULL)
                 goto done;
 
         if (colon)
@@ -878,6 +872,7 @@ __be32 inet_select_addr(const struct net_device *dev, __be32 dst, int scope)
 {
         __be32 addr = 0;
         struct in_device *in_dev;
+        struct net *net = dev->nd_net;
 
         rcu_read_lock();
         in_dev = __in_dev_get_rcu(dev);
@@ -906,7 +901,7 @@ no_in_dev:
          */
         read_lock(&dev_base_lock);
         rcu_read_lock();
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
                         continue;
 
@@ -1045,9 +1040,6 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
         struct net_device *dev = ptr;
         struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
-        if (dev->nd_net != &init_net)
-                return NOTIFY_DONE;
-
         ASSERT_RTNL();
 
         if (!in_dev) {
@@ -1173,9 +1165,6 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
         struct in_ifaddr *ifa;
         int s_ip_idx, s_idx = cb->args[0];
 
-        if (net != &init_net)
-                return 0;
-
         s_ip_idx = ip_idx = cb->args[1];
         idx = 0;
         for_each_netdev(net, dev) {
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a13c074dac09..cee77d606fbe 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -229,14 +229,16 @@ static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
  *
  *      On SMP we have one ICMP socket per-cpu.
  */
-static DEFINE_PER_CPU(struct socket *, __icmp_socket) = NULL;
-#define icmp_socket     __get_cpu_var(__icmp_socket)
+static struct sock *icmp_sk(struct net *net)
+{
+        return net->ipv4.icmp_sk[smp_processor_id()];
+}
 
-static inline int icmp_xmit_lock(void)
+static inline int icmp_xmit_lock(struct sock *sk)
 {
         local_bh_disable();
 
-        if (unlikely(!spin_trylock(&icmp_socket->sk->sk_lock.slock))) {
+        if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
                 /* This can happen if the output path signals a
                  * dst_link_failure() for an outgoing ICMP packet.
                  */
@@ -246,9 +248,9 @@ static inline int icmp_xmit_lock(void)
         return 0;
 }
 
-static inline void icmp_xmit_unlock(void)
+static inline void icmp_xmit_unlock(struct sock *sk)
 {
-        spin_unlock_bh(&icmp_socket->sk->sk_lock.slock);
+        spin_unlock_bh(&sk->sk_lock.slock);
 }
 
 /*
@@ -346,19 +348,21 @@ static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
 static void icmp_push_reply(struct icmp_bxm *icmp_param,
                             struct ipcm_cookie *ipc, struct rtable *rt)
 {
+        struct sock *sk;
         struct sk_buff *skb;
 
-        if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
+        sk = icmp_sk(rt->u.dst.dev->nd_net);
+        if (ip_append_data(sk, icmp_glue_bits, icmp_param,
                            icmp_param->data_len+icmp_param->head_len,
                            icmp_param->head_len,
                            ipc, rt, MSG_DONTWAIT) < 0)
-                ip_flush_pending_frames(icmp_socket->sk);
-        else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
+                ip_flush_pending_frames(sk);
+        else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
                 struct icmphdr *icmph = icmp_hdr(skb);
                 __wsum csum = 0;
                 struct sk_buff *skb1;
 
-                skb_queue_walk(&icmp_socket->sk->sk_write_queue, skb1) {
+                skb_queue_walk(&sk->sk_write_queue, skb1) {
                         csum = csum_add(csum, skb1->csum);
                 }
                 csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
@@ -366,7 +370,7 @@ static void icmp_push_reply(struct icmp_bxm *icmp_param,
                                                  icmp_param->head_len, csum);
                 icmph->checksum = csum_fold(csum);
                 skb->ip_summed = CHECKSUM_NONE;
-                ip_push_pending_frames(icmp_socket->sk);
+                ip_push_pending_frames(sk);
         }
 }
 
@@ -376,16 +380,17 @@ static void icmp_push_reply(struct icmp_bxm *icmp_param,
 
 static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
 {
-        struct sock *sk = icmp_socket->sk;
-        struct inet_sock *inet = inet_sk(sk);
         struct ipcm_cookie ipc;
         struct rtable *rt = (struct rtable *)skb->dst;
+        struct net *net = rt->u.dst.dev->nd_net;
+        struct sock *sk = icmp_sk(net);
+        struct inet_sock *inet = inet_sk(sk);
         __be32 daddr;
 
         if (ip_options_echo(&icmp_param->replyopts, skb))
                 return;
 
-        if (icmp_xmit_lock())
+        if (icmp_xmit_lock(sk))
                 return;
 
         icmp_param->data.icmph.checksum = 0;
@@ -405,7 +410,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
                                                 .tos = RT_TOS(ip_hdr(skb)->tos) } },
                                     .proto = IPPROTO_ICMP };
                 security_skb_classify_flow(skb, &fl);
-                if (ip_route_output_key(rt->u.dst.dev->nd_net, &rt, &fl))
+                if (ip_route_output_key(net, &rt, &fl))
                         goto out_unlock;
         }
         if (icmpv4_xrlim_allow(rt, icmp_param->data.icmph.type,
@@ -413,7 +418,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
                 icmp_push_reply(icmp_param, &ipc, rt);
         ip_rt_put(rt);
 out_unlock:
-        icmp_xmit_unlock();
+        icmp_xmit_unlock(sk);
 }
 
 
@@ -438,10 +443,12 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         __be32 saddr;
         u8  tos;
         struct net *net;
+        struct sock *sk;
 
         if (!rt)
                 goto out;
         net = rt->u.dst.dev->nd_net;
+        sk = icmp_sk(net);
 
         /*
          *      Find the original header. It is expected to be valid, of course.
@@ -505,7 +512,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                 }
         }
 
-        if (icmp_xmit_lock())
+        if (icmp_xmit_lock(sk))
                 return;
 
         /*
@@ -544,7 +551,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         icmp_param.data.icmph.checksum   = 0;
         icmp_param.skb    = skb_in;
         icmp_param.offset = skb_network_offset(skb_in);
-        inet_sk(icmp_socket->sk)->tos = tos;
+        inet_sk(sk)->tos = tos;
         ipc.addr = iph->saddr;
         ipc.opt = &icmp_param.replyopts;
 
@@ -652,7 +659,7 @@ route_done:
 ende:
         ip_rt_put(rt);
 out_unlock:
-        icmp_xmit_unlock();
+        icmp_xmit_unlock(sk);
 out:;
 }
 
@@ -1139,29 +1146,46 @@ static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
         },
 };
 
-void __init icmp_init(struct net_proto_family *ops)
+static void __net_exit icmp_sk_exit(struct net *net)
 {
-        struct inet_sock *inet;
         int i;
 
-        for_each_possible_cpu(i) {
-                int err;
+        for_each_possible_cpu(i)
+                sk_release_kernel(net->ipv4.icmp_sk[i]);
+        kfree(net->ipv4.icmp_sk);
+        net->ipv4.icmp_sk = NULL;
+}
 
-                err = sock_create_kern(PF_INET, SOCK_RAW, IPPROTO_ICMP,
-                                       &per_cpu(__icmp_socket, i));
+int __net_init icmp_sk_init(struct net *net)
+{
+        int i, err;
 
+        net->ipv4.icmp_sk =
+                kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
+        if (net->ipv4.icmp_sk == NULL)
+                return -ENOMEM;
+
+        for_each_possible_cpu(i) {
+                struct sock *sk;
+                struct socket *sock;
+                struct inet_sock *inet;
+
+                err = sock_create_kern(PF_INET, SOCK_RAW, IPPROTO_ICMP, &sock);
                 if (err < 0)
-                        panic("Failed to create the ICMP control socket.\n");
+                        goto fail;
+
+                net->ipv4.icmp_sk[i] = sk = sock->sk;
+                sk_change_net(sk, net);
 
-                per_cpu(__icmp_socket, i)->sk->sk_allocation = GFP_ATOMIC;
+                sk->sk_allocation = GFP_ATOMIC;
 
                 /* Enough space for 2 64K ICMP packets, including
                  * sk_buff struct overhead.
                  */
-                per_cpu(__icmp_socket, i)->sk->sk_sndbuf =
+                sk->sk_sndbuf =
                         (2 * ((64 * 1024) + sizeof(struct sk_buff)));
 
-                inet = inet_sk(per_cpu(__icmp_socket, i)->sk);
+                inet = inet_sk(sk);
                 inet->uc_ttl = -1;
                 inet->pmtudisc = IP_PMTUDISC_DONT;
 
@@ -1169,8 +1193,25 @@ void __init icmp_init(struct net_proto_family *ops)
                  * see it, we do not wish this socket to see incoming
                  * packets.
                  */
-                per_cpu(__icmp_socket, i)->sk->sk_prot->unhash(per_cpu(__icmp_socket, i)->sk);
+                sk->sk_prot->unhash(sk);
         }
+        return 0;
+
+fail:
+        for_each_possible_cpu(i)
+                sk_release_kernel(net->ipv4.icmp_sk[i]);
+        kfree(net->ipv4.icmp_sk);
+        return err;
+}
+
+static struct pernet_operations __net_initdata icmp_sk_ops = {
+       .init = icmp_sk_init,
+       .exit = icmp_sk_exit,
+};
+
+int __init icmp_init(void)
+{
+        return register_pernet_device(&icmp_sk_ops);
 }
 
 EXPORT_SYMBOL(icmp_err_convert);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 732cd07e6071..d3f34a772f3b 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1198,6 +1198,9 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 
         ASSERT_RTNL();
 
+        if (in_dev->dev->nd_net != &init_net)
+                return;
+
         for (im=in_dev->mc_list; im; im=im->next) {
                 if (im->multiaddr == addr) {
                         im->users++;
@@ -1277,6 +1280,9 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
 
         ASSERT_RTNL();
 
+        if (in_dev->dev->nd_net != &init_net)
+                return;
+
         for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
                 if (i->multiaddr==addr) {
                         if (--i->users == 0) {
@@ -1304,6 +1310,9 @@ void ip_mc_down(struct in_device *in_dev)
 
         ASSERT_RTNL();
 
+        if (in_dev->dev->nd_net != &init_net)
+                return;
+
         for (i=in_dev->mc_list; i; i=i->next)
                 igmp_group_dropped(i);
 
@@ -1324,6 +1333,9 @@ void ip_mc_init_dev(struct in_device *in_dev)
 {
         ASSERT_RTNL();
 
+        if (in_dev->dev->nd_net != &init_net)
+                return;
+
         in_dev->mc_tomb = NULL;
 #ifdef CONFIG_IP_MULTICAST
         in_dev->mr_gq_running = 0;
@@ -1347,6 +1359,9 @@ void ip_mc_up(struct in_device *in_dev)
 
         ASSERT_RTNL();
 
+        if (in_dev->dev->nd_net != &init_net)
+                return;
+
         ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
 
         for (i=in_dev->mc_list; i; i=i->next)
@@ -1363,6 +1378,9 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
 
         ASSERT_RTNL();
 
+        if (in_dev->dev->nd_net != &init_net)
+                return;
+
         /* Deactivate timers */
         ip_mc_down(in_dev);
 
@@ -1744,6 +1762,9 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
+        if (sk->sk_net != &init_net)
+                return -EPROTONOSUPPORT;
+
         rtnl_lock();
 
         in_dev = ip_mc_find_dev(imr);
@@ -1812,6 +1833,9 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
         u32 ifindex;
         int ret = -EADDRNOTAVAIL;
 
+        if (sk->sk_net != &init_net)
+                return -EPROTONOSUPPORT;
+
         rtnl_lock();
         in_dev = ip_mc_find_dev(imr);
         ifindex = imr->imr_ifindex;
@@ -1857,6 +1881,9 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
+        if (sk->sk_net != &init_net)
+                return -EPROTONOSUPPORT;
+
         rtnl_lock();
 
         imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
@@ -1990,6 +2017,9 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
             msf->imsf_fmode != MCAST_EXCLUDE)
                 return -EINVAL;
 
+        if (sk->sk_net != &init_net)
+                return -EPROTONOSUPPORT;
+
         rtnl_lock();
 
         imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
@@ -2070,6 +2100,9 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
+        if (sk->sk_net != &init_net)
+                return -EPROTONOSUPPORT;
+
         rtnl_lock();
 
         imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
@@ -2132,6 +2165,9 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
+        if (sk->sk_net != &init_net)
+                return -EPROTONOSUPPORT;
+
         rtnl_lock();
 
         err = -EADDRNOTAVAIL;
@@ -2216,6 +2252,9 @@ void ip_mc_drop_socket(struct sock *sk)
         if (inet->mc_list == NULL)
                 return;
 
+        if (sk->sk_net != &init_net)
+                return;
+
         rtnl_lock();
         while ((iml = inet->mc_list) != NULL) {
                 struct in_device *in_dev;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index b189278c7bc1..c0e0fa03fce1 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -463,7 +463,7 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                         if (time_after_eq(now, req->expires)) {
                                 if ((req->retrans < thresh ||
                                      (inet_rsk(req)->acked && req->retrans < max_retries))
-                                    && !req->rsk_ops->rtx_syn_ack(parent, req, NULL)) {
+                                    && !req->rsk_ops->rtx_syn_ack(parent, req)) {
                                         unsigned long timeo;
 
                                         if (req->retrans++ == 0)
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 4d315158fd3c..baaedd9689a0 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -107,10 +107,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
         sptr = skb_network_header(skb);
         dptr = dopt->__data;
 
-        if (skb->dst)
-                daddr = ((struct rtable*)skb->dst)->rt_spec_dst;
-        else
-                daddr = ip_hdr(skb)->daddr;
+        daddr = ((struct rtable*)skb->dst)->rt_spec_dst;
 
         if (sopt->rr) {
                 optlen  = sptr[sopt->rr+1];
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 5dd938579eeb..4afce0572806 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -291,7 +291,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
 
         mm_segment_t oldfs = get_fs();
         set_fs(get_ds());
-        res = devinet_ioctl(cmd, (struct ifreq __user *) arg);
+        res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
         set_fs(oldfs);
         return res;
 }
@@ -459,10 +459,7 @@ ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         if (rarp->ar_pro != htons(ETH_P_IP))
                 goto drop;
 
-        if (!pskb_may_pull(skb,
-                           sizeof(struct arphdr) +
-                           (2 * dev->addr_len) +
-                           (2 * 4)))
+        if (!pskb_may_pull(skb, arp_hdr_len(dev)))
                 goto drop;
 
         /* OK, it is all there and looks valid, process... */
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index a7591ce344d2..9b5904486184 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -233,10 +233,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         void *table_base;
         struct xt_table_info *private;
 
-        /* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
-        if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
-                                 (2 * skb->dev->addr_len) +
-                                 (2 * sizeof(u32)))))
+        if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
                 return NF_DROP;
 
         indev = in ? in->name : nulldevname;
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index d80fee8327e4..313b3fcf387e 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -139,18 +139,8 @@ static int masq_inet_event(struct notifier_block *this,
                            unsigned long event,
                            void *ptr)
 {
-        const struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
-
-        if (event == NETDEV_DOWN) {
-                /* IP address was deleted.  Search entire table for
-                   conntracks which were associated with that device,
-                   and forget them. */
-                NF_CT_ASSERT(dev->ifindex != 0);
-
-                nf_ct_iterate_cleanup(device_cmp, (void *)(long)dev->ifindex);
-        }
-
-        return NOTIFY_DONE;
+        struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
+        return masq_device_event(this, event, dev);
 }
 
 static struct notifier_block masq_dev_notifier = {
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 089252e82c01..9668c3a23efe 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -379,7 +379,7 @@ static const struct file_operations ct_cpu_seq_fops = {
         .open    = ct_cpu_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release,
 };
 
 int __init nf_conntrack_ipv4_compat_init(void)
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index d63474c6b400..d75ddb7fa4b8 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -59,7 +59,9 @@ static int sockstat_seq_show(struct seq_file *seq, void *v)
                    atomic_read(&tcp_memory_allocated));
         seq_printf(seq, "UDP: inuse %d mem %d\n", sock_prot_inuse_get(&udp_prot),
                    atomic_read(&udp_memory_allocated));
+#ifdef CONFIG_IP_UDPLITE
         seq_printf(seq, "UDPLITE: inuse %d\n", sock_prot_inuse_get(&udplite_prot));
+#endif
         seq_printf(seq, "RAW: inuse %d\n", sock_prot_inuse_get(&raw_prot));
         seq_printf(seq,  "FRAG: inuse %d memory %d\n",
                         ip_frag_nqueues(&init_net), ip_frag_mem(&init_net));
@@ -349,6 +351,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
                            snmp_fold_field((void **)udp_statistics,
                                            snmp4_udp_list[i].entry));
 
+#ifdef CONFIG_IP_UDPLITE
         /* the UDP and UDP-Lite MIBs are the same */
         seq_puts(seq, "\nUdpLite:");
         for (i = 0; snmp4_udp_list[i].name != NULL; i++)
@@ -359,7 +362,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
                 seq_printf(seq, " %lu",
                            snmp_fold_field((void **)udplite_statistics,
                                            snmp4_udp_list[i].entry));
-
+#endif
         seq_putc(seq, '\n');
         return 0;
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 7b5e8e1d94be..8c3e165f0034 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -273,6 +273,7 @@ static unsigned int rt_hash_code(u32 daddr, u32 saddr)
 
 #ifdef CONFIG_PROC_FS
 struct rt_cache_iter_state {
+        struct seq_net_private p;
         int bucket;
         int genid;
 };
@@ -285,7 +286,8 @@ static struct rtable *rt_cache_get_first(struct rt_cache_iter_state *st)
                 rcu_read_lock_bh();
                 r = rcu_dereference(rt_hash_table[st->bucket].chain);
                 while (r) {
-                        if (r->rt_genid == st->genid)
+                        if (r->u.dst.dev->nd_net == st->p.net &&
+                            r->rt_genid == st->genid)
                                 return r;
                         r = rcu_dereference(r->u.dst.rt_next);
                 }
@@ -294,7 +296,8 @@ static struct rtable *rt_cache_get_first(struct rt_cache_iter_state *st)
         return r;
 }
 
-static struct rtable *rt_cache_get_next(struct rt_cache_iter_state *st, struct rtable *r)
+static struct rtable *__rt_cache_get_next(struct rt_cache_iter_state *st,
+                                          struct rtable *r)
 {
         r = r->u.dst.rt_next;
         while (!r) {
@@ -307,16 +310,25 @@ static struct rtable *rt_cache_get_next(struct rt_cache_iter_state *st, struct r
         return rcu_dereference(r);
 }
 
+static struct rtable *rt_cache_get_next(struct rt_cache_iter_state *st,
+                                        struct rtable *r)
+{
+        while ((r = __rt_cache_get_next(st, r)) != NULL) {
+                if (r->u.dst.dev->nd_net != st->p.net)
+                        continue;
+                if (r->rt_genid == st->genid)
+                        break;
+        }
+        return r;
+}
+
 static struct rtable *rt_cache_get_idx(struct rt_cache_iter_state *st, loff_t pos)
 {
         struct rtable *r = rt_cache_get_first(st);
 
         if (r)
-                while (pos && (r = rt_cache_get_next(st, r))) {
-                        if (r->rt_genid != st->genid)
-                                continue;
+                while (pos && (r = rt_cache_get_next(st, r)))
                         --pos;
-                }
         return pos ? NULL : r;
 }
 
@@ -390,7 +402,7 @@ static const struct seq_operations rt_cache_seq_ops = {
 
 static int rt_cache_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open_private(file, &rt_cache_seq_ops,
+        return seq_open_net(inode, file, &rt_cache_seq_ops,
                         sizeof(struct rt_cache_iter_state));
 }
 
@@ -399,7 +411,7 @@ static const struct file_operations rt_cache_seq_fops = {
         .open    = rt_cache_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 
 
@@ -533,7 +545,7 @@ static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
 }
 #endif
 
-static __init int ip_rt_proc_init(struct net *net)
+static int __net_init ip_rt_do_proc_init(struct net *net)
 {
         struct proc_dir_entry *pde;
 
@@ -564,8 +576,26 @@ err2:
 err1:
         return -ENOMEM;
 }
+
+static void __net_exit ip_rt_do_proc_exit(struct net *net)
+{
+        remove_proc_entry("rt_cache", net->proc_net_stat);
+        remove_proc_entry("rt_cache", net->proc_net);
+        remove_proc_entry("rt_acct", net->proc_net);
+}
+
+static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
+        .init = ip_rt_do_proc_init,
+        .exit = ip_rt_do_proc_exit,
+};
+
+static int __init ip_rt_proc_init(void)
+{
+        return register_pernet_subsys(&ip_rt_proc_ops);
+}
+
 #else
-static inline int ip_rt_proc_init(struct net *net)
+static inline int ip_rt_proc_init(void)
 {
         return 0;
 }
@@ -1131,10 +1161,12 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
         __be32  skeys[2] = { saddr, 0 };
         int  ikeys[2] = { dev->ifindex, 0 };
         struct netevent_redirect netevent;
+        struct net *net;
 
         if (!in_dev)
                 return;
 
+        net = dev->nd_net;
         if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev)
             || ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw)
             || ipv4_is_zeronet(new_gw))
@@ -1146,7 +1178,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                 if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
                         goto reject_redirect;
         } else {
-                if (inet_addr_type(&init_net, new_gw) != RTN_UNICAST)
+                if (inet_addr_type(net, new_gw) != RTN_UNICAST)
                         goto reject_redirect;
         }
 
@@ -1164,7 +1196,8 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                     rth->fl.fl4_src != skeys[i] ||
                                     rth->fl.oif != ikeys[k] ||
                                     rth->fl.iif != 0 ||
-                                    rth->rt_genid != atomic_read(&rt_genid)) {
+                                    rth->rt_genid != atomic_read(&rt_genid) ||
+                                    rth->u.dst.dev->nd_net != net) {
                                         rthp = &rth->u.dst.rt_next;
                                         continue;
                                 }
@@ -2668,9 +2701,6 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         int err;
         struct sk_buff *skb;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
         if (err < 0)
                 goto errout;
@@ -2700,7 +2730,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         if (iif) {
                 struct net_device *dev;
 
-                dev = __dev_get_by_index(&init_net, iif);
+                dev = __dev_get_by_index(net, iif);
                 if (dev == NULL) {
                         err = -ENODEV;
                         goto errout_free;
@@ -2726,7 +2756,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                         },
                         .oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0,
                 };
-                err = ip_route_output_key(&init_net, &rt, &fl);
+                err = ip_route_output_key(net, &rt, &fl);
         }
 
         if (err)
@@ -2737,11 +2767,11 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                 rt->rt_flags |= RTCF_NOTIFY;
 
         err = rt_fill_info(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
-                                RTM_NEWROUTE, 0, 0);
+                           RTM_NEWROUTE, 0, 0);
         if (err <= 0)
                 goto errout_free;
 
-        err = rtnl_unicast(skb, &init_net, NETLINK_CB(in_skb).pid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
 errout:
         return err;
 
@@ -2755,6 +2785,9 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
         struct rtable *rt;
         int h, s_h;
         int idx, s_idx;
+        struct net *net;
+
+        net = skb->sk->sk_net;
 
         s_h = cb->args[0];
         if (s_h < 0)
@@ -2764,7 +2797,7 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                 rcu_read_lock_bh();
                 for (rt = rcu_dereference(rt_hash_table[h].chain), idx = 0; rt;
                      rt = rcu_dereference(rt->u.dst.rt_next), idx++) {
-                        if (idx < s_idx)
+                        if (rt->u.dst.dev->nd_net != net || idx < s_idx)
                                 continue;
                         if (rt->rt_genid != atomic_read(&rt_genid))
                                 continue;
@@ -3040,7 +3073,7 @@ int __init ip_rt_init(void)
                 ip_rt_secret_interval;
         add_timer(&rt_secret_timer);
 
-        if (ip_rt_proc_init(&init_net))
+        if (ip_rt_proc_init())
                 printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
         xfrm_init();
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index f470fe4511db..4704f27f6c0b 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -10,8 +10,6 @@
  *      2 of the License, or (at your option) any later version.
  *
  *  $Id: syncookies.c,v 1.18 2002/02/01 22:01:04 davem Exp $
- *
- *  Missing: IPv6 support.
  */
 
 #include <linux/tcp.h>
@@ -23,22 +21,25 @@
 
 extern int sysctl_tcp_syncookies;
 
-static __u32 syncookie_secret[2][16-3+SHA_DIGEST_WORDS];
+__u32 syncookie_secret[2][16-3+SHA_DIGEST_WORDS];
+EXPORT_SYMBOL(syncookie_secret);
 
 static __init int init_syncookies(void)
 {
         get_random_bytes(syncookie_secret, sizeof(syncookie_secret));
         return 0;
 }
-module_init(init_syncookies);
+__initcall(init_syncookies);
 
 #define COOKIEBITS 24   /* Upper bits store count */
 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
 
+static DEFINE_PER_CPU(__u32, cookie_scratch)[16 + 5 + SHA_WORKSPACE_WORDS];
+
 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
                        u32 count, int c)
 {
-        __u32 tmp[16 + 5 + SHA_WORKSPACE_WORDS];
+        __u32 *tmp = __get_cpu_var(cookie_scratch);
 
         memcpy(tmp + 3, syncookie_secret[c], sizeof(syncookie_secret[c]));
         tmp[0] = (__force u32)saddr;
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 3aa0b23c1ea0..eb5b9854c8c7 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -1,12 +1,13 @@
 /*
- * TCP CUBIC: Binary Increase Congestion control for TCP v2.1
- *
+ * TCP CUBIC: Binary Increase Congestion control for TCP v2.2
+ * Home page:
+ *      http://netsrv.csc.ncsu.edu/twiki/bin/view/Main/BIC
  * This is from the implementation of CUBIC TCP in
  * Injong Rhee, Lisong Xu.
  *  "CUBIC: A New TCP-Friendly High-Speed TCP Variant
  *  in PFLDnet 2005
  * Available from:
- *  http://www.csc.ncsu.edu/faculty/rhee/export/bitcp/cubic-paper.pdf
+ *  http://netsrv.csc.ncsu.edu/export/cubic-paper.pdf
  *
  * Unless CUBIC is enabled and congestion window is large
  * this behaves the same as the original Reno.
@@ -20,15 +21,10 @@
 #define BICTCP_BETA_SCALE    1024       /* Scale factor beta calculation
                                          * max_cwnd = snd_cwnd * beta
                                          */
-#define BICTCP_B                4        /*
-                                          * In binary search,
-                                          * go to point (max+min)/N
-                                          */
 #define BICTCP_HZ               10      /* BIC HZ 2^10 = 1024 */
 
 static int fast_convergence __read_mostly = 1;
-static int max_increment __read_mostly = 16;
-static int beta __read_mostly = 819;    /* = 819/1024 (BICTCP_BETA_SCALE) */
+static int beta __read_mostly = 717;    /* = 717/1024 (BICTCP_BETA_SCALE) */
 static int initial_ssthresh __read_mostly;
 static int bic_scale __read_mostly = 41;
 static int tcp_friendliness __read_mostly = 1;
@@ -40,9 +36,7 @@ static u64 cube_factor __read_mostly;
 /* Note parameters that are used for precomputing scale factors are read-only */
 module_param(fast_convergence, int, 0644);
 MODULE_PARM_DESC(fast_convergence, "turn on/off fast convergence");
-module_param(max_increment, int, 0644);
-MODULE_PARM_DESC(max_increment, "Limit on increment allowed during binary search");
-module_param(beta, int, 0444);
+module_param(beta, int, 0644);
 MODULE_PARM_DESC(beta, "beta for multiplicative increase");
 module_param(initial_ssthresh, int, 0644);
 MODULE_PARM_DESC(initial_ssthresh, "initial value of slow start threshold");
@@ -145,7 +139,7 @@ static u32 cubic_root(u64 a)
 static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
 {
         u64 offs;
-        u32 delta, t, bic_target, min_cnt, max_cnt;
+        u32 delta, t, bic_target, max_cnt;
 
         ca->ack_cnt++;  /* count the number of ACKs */
 
@@ -211,19 +205,6 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
                 ca->cnt = 100 * cwnd;              /* very small increment*/
         }
 
-        if (ca->delay_min > 0) {
-                /* max increment = Smax * rtt / 0.1  */
-                min_cnt = (cwnd * HZ * 8)/(10 * max_increment * ca->delay_min);
-
-                /* use concave growth when the target is above the origin */
-                if (ca->cnt < min_cnt && t >= ca->bic_K)
-                        ca->cnt = min_cnt;
-        }
-
-        /* slow start and low utilization  */
-        if (ca->loss_cwnd == 0)         /* could be aggressive in slow start */
-                ca->cnt = 50;
-
         /* TCP Friendly */
         if (tcp_friendliness) {
                 u32 scale = beta_scale;
@@ -391,4 +372,4 @@ module_exit(cubictcp_unregister);
 MODULE_AUTHOR("Sangtae Ha, Stephen Hemminger");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("CUBIC TCP");
-MODULE_VERSION("2.1");
+MODULE_VERSION("2.2");
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7facdb0f6960..c4679f343675 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5330,6 +5330,7 @@ discard:
 
 EXPORT_SYMBOL(sysctl_tcp_ecn);
 EXPORT_SYMBOL(sysctl_tcp_reordering);
+EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 EXPORT_SYMBOL(tcp_parse_options);
 EXPORT_SYMBOL(tcp_rcv_established);
 EXPORT_SYMBOL(tcp_rcv_state_process);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 00156bf421ca..3873c4dbeaeb 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -723,8 +723,8 @@ static void tcp_v4_reqsk_send_ack(struct sk_buff *skb,
  *      This still operates on a request_sock only, not on a big
  *      socket.
  */
-static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
-                              struct dst_entry *dst)
+static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
+                                struct dst_entry *dst)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         int err = -1;
@@ -732,7 +732,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
 
         /* First, grab a route. */
         if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
-                goto out;
+                return -1;
 
         skb = tcp_make_synack(sk, dst, req);
 
@@ -751,11 +751,15 @@ static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
                 err = net_xmit_eval(err);
         }
 
-out:
         dst_release(dst);
         return err;
 }
 
+static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req)
+{
+        return __tcp_v4_send_synack(sk, req, NULL);
+}
+
 /*
  *      IPv4 request_sock destructor.
  */
@@ -1351,8 +1355,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                             (s32)(peer->tcp_ts - req->ts_recent) >
                                                         TCP_PAWS_WINDOW) {
                                 NET_INC_STATS_BH(LINUX_MIB_PAWSPASSIVEREJECTED);
-                                dst_release(dst);
-                                goto drop_and_free;
+                                goto drop_and_release;
                         }
                 }
                 /* Kill the following clause, if you dislike this way. */
@@ -1372,24 +1375,21 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                                        "request from %u.%u.%u.%u/%u\n",
                                        NIPQUAD(saddr),
                                        ntohs(tcp_hdr(skb)->source));
-                        dst_release(dst);
-                        goto drop_and_free;
+                        goto drop_and_release;
                 }
 
                 isn = tcp_v4_init_sequence(skb);
         }
         tcp_rsk(req)->snt_isn = isn;
 
-        if (tcp_v4_send_synack(sk, req, dst))
+        if (__tcp_v4_send_synack(sk, req, dst) || want_cookie)
                 goto drop_and_free;
 
-        if (want_cookie) {
-                reqsk_free(req);
-        } else {
-                inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
-        }
+        inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
         return 0;
 
+drop_and_release:
+        dst_release(dst);
 drop_and_free:
         reqsk_free(req);
 drop:
@@ -2443,7 +2443,7 @@ struct proto tcp_prot = {
         REF_PROTO_INUSE(tcp)
 };
 
-void __init tcp_v4_init(struct net_proto_family *ops)
+void __init tcp_v4_init(void)
 {
         if (inet_csk_ctl_sock_create(&tcp_socket, PF_INET, SOCK_RAW,
                                      IPPROTO_TCP) < 0)
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index b61b76847ad9..8245247a6ceb 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -35,6 +35,8 @@
 #endif
 
 int sysctl_tcp_syncookies __read_mostly = SYNC_INIT;
+EXPORT_SYMBOL(sysctl_tcp_syncookies);
+
 int sysctl_tcp_abort_on_overflow __read_mostly;
 
 struct inet_timewait_death_row tcp_death_row = {
@@ -536,7 +538,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                  * Enforce "SYN-ACK" according to figure 8, figure 6
                  * of RFC793, fixed by RFC1122.
                  */
-                req->rsk_ops->rtx_syn_ack(sk, req, NULL);
+                req->rsk_ops->rtx_syn_ack(sk, req);
                 return NULL;
         }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ed750f9ceb07..cbfef8b1f5e8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2560,6 +2560,7 @@ void tcp_send_probe0(struct sock *sk)
         }
 }
 
+EXPORT_SYMBOL(tcp_select_initial_window);
 EXPORT_SYMBOL(tcp_connect);
 EXPORT_SYMBOL(tcp_make_synack);
 EXPORT_SYMBOL(tcp_simple_retransmit);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 7ea1b67b6de1..c53d7673b57d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -246,553 +246,6 @@ int udp_get_port(struct sock *sk, unsigned short snum,
         return  __udp_lib_get_port(sk, snum, udp_hash, scmp);
 }
 
-int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
-{
-        struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
-
-        return  ( !ipv6_only_sock(sk2)  &&
-                  (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr      ));
-}
-
-static inline int udp_v4_get_port(struct sock *sk, unsigned short snum)
-{
-        return udp_get_port(sk, snum, ipv4_rcv_saddr_equal);
-}
-
-/* UDP is nearly always wildcards out the wazoo, it makes no sense to try
- * harder than this. -DaveM
- */
-static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
-                __be16 sport, __be32 daddr, __be16 dport,
-                int dif, struct hlist_head udptable[])
-{
-        struct sock *sk, *result = NULL;
-        struct hlist_node *node;
-        unsigned short hnum = ntohs(dport);
-        int badness = -1;
-
-        read_lock(&udp_hash_lock);
-        sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
-                struct inet_sock *inet = inet_sk(sk);
-
-                if (sk->sk_net == net && sk->sk_hash == hnum &&
-                                !ipv6_only_sock(sk)) {
-                        int score = (sk->sk_family == PF_INET ? 1 : 0);
-                        if (inet->rcv_saddr) {
-                                if (inet->rcv_saddr != daddr)
-                                        continue;
-                                score+=2;
-                        }
-                        if (inet->daddr) {
-                                if (inet->daddr != saddr)
-                                        continue;
-                                score+=2;
-                        }
-                        if (inet->dport) {
-                                if (inet->dport != sport)
-                                        continue;
-                                score+=2;
-                        }
-                        if (sk->sk_bound_dev_if) {
-                                if (sk->sk_bound_dev_if != dif)
-                                        continue;
-                                score+=2;
-                        }
-                        if (score == 9) {
-                                result = sk;
-                                break;
-                        } else if (score > badness) {
-                                result = sk;
-                                badness = score;
-                        }
-                }
-        }
-        if (result)
-                sock_hold(result);
-        read_unlock(&udp_hash_lock);
-        return result;
-}
-
-static inline struct sock *udp_v4_mcast_next(struct sock *sk,
-                                             __be16 loc_port, __be32 loc_addr,
-                                             __be16 rmt_port, __be32 rmt_addr,
-                                             int dif)
-{
-        struct hlist_node *node;
-        struct sock *s = sk;
-        unsigned short hnum = ntohs(loc_port);
-
-        sk_for_each_from(s, node) {
-                struct inet_sock *inet = inet_sk(s);
-
-                if (s->sk_hash != hnum                                  ||
-                    (inet->daddr && inet->daddr != rmt_addr)            ||
-                    (inet->dport != rmt_port && inet->dport)            ||
-                    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
-                    ipv6_only_sock(s)                                   ||
-                    (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
-                        continue;
-                if (!ip_mc_sf_allow(s, loc_addr, rmt_addr, dif))
-                        continue;
-                goto found;
-        }
-        s = NULL;
-found:
-        return s;
-}
-
-/*
- * This routine is called by the ICMP module when it gets some
- * sort of error condition.  If err < 0 then the socket should
- * be closed and the error returned to the user.  If err > 0
- * it's just the icmp type << 8 | icmp code.
- * Header points to the ip header of the error packet. We move
- * on past this. Then (as it used to claim before adjustment)
- * header points to the first 8 bytes of the udp header.  We need
- * to find the appropriate port.
- */
-
-void __udp4_lib_err(struct sk_buff *skb, u32 info, struct hlist_head udptable[])
-{
-        struct inet_sock *inet;
-        struct iphdr *iph = (struct iphdr*)skb->data;
-        struct udphdr *uh = (struct udphdr*)(skb->data+(iph->ihl<<2));
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
-        struct sock *sk;
-        int harderr;
-        int err;
-
-        sk = __udp4_lib_lookup(skb->dev->nd_net, iph->daddr, uh->dest,
-                        iph->saddr, uh->source, skb->dev->ifindex, udptable);
-        if (sk == NULL) {
-                ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
-                return; /* No socket for error */
-        }
-
-        err = 0;
-        harderr = 0;
-        inet = inet_sk(sk);
-
-        switch (type) {
-        default:
-        case ICMP_TIME_EXCEEDED:
-                err = EHOSTUNREACH;
-                break;
-        case ICMP_SOURCE_QUENCH:
-                goto out;
-        case ICMP_PARAMETERPROB:
-                err = EPROTO;
-                harderr = 1;
-                break;
-        case ICMP_DEST_UNREACH:
-                if (code == ICMP_FRAG_NEEDED) { /* Path MTU discovery */
-                        if (inet->pmtudisc != IP_PMTUDISC_DONT) {
-                                err = EMSGSIZE;
-                                harderr = 1;
-                                break;
-                        }
-                        goto out;
-                }
-                err = EHOSTUNREACH;
-                if (code <= NR_ICMP_UNREACH) {
-                        harderr = icmp_err_convert[code].fatal;
-                        err = icmp_err_convert[code].errno;
-                }
-                break;
-        }
-
-        /*
-         *      RFC1122: OK.  Passes ICMP errors back to application, as per
-         *      4.1.3.3.
-         */
-        if (!inet->recverr) {
-                if (!harderr || sk->sk_state != TCP_ESTABLISHED)
-                        goto out;
-        } else {
-                ip_icmp_error(sk, skb, err, uh->dest, info, (u8*)(uh+1));
-        }
-        sk->sk_err = err;
-        sk->sk_error_report(sk);
-out:
-        sock_put(sk);
-}
-
-void udp_err(struct sk_buff *skb, u32 info)
-{
-        __udp4_lib_err(skb, info, udp_hash);
-}
-
-/*
- * Throw away all pending data and cancel the corking. Socket is locked.
- */
-static void udp_flush_pending_frames(struct sock *sk)
-{
-        struct udp_sock *up = udp_sk(sk);
-
-        if (up->pending) {
-                up->len = 0;
-                up->pending = 0;
-                ip_flush_pending_frames(sk);
-        }
-}
-
-/**
- *      udp4_hwcsum_outgoing  -  handle outgoing HW checksumming
- *      @sk:    socket we are sending on
- *      @skb:   sk_buff containing the filled-in UDP header
- *              (checksum field must be zeroed out)
- */
-static void udp4_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
-                                 __be32 src, __be32 dst, int len      )
-{
-        unsigned int offset;
-        struct udphdr *uh = udp_hdr(skb);
-        __wsum csum = 0;
-
-        if (skb_queue_len(&sk->sk_write_queue) == 1) {
-                /*
-                 * Only one fragment on the socket.
-                 */
-                skb->csum_start = skb_transport_header(skb) - skb->head;
-                skb->csum_offset = offsetof(struct udphdr, check);
-                uh->check = ~csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, 0);
-        } else {
-                /*
-                 * HW-checksum won't work as there are two or more
-                 * fragments on the socket so that all csums of sk_buffs
-                 * should be together
-                 */
-                offset = skb_transport_offset(skb);
-                skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
-
-                skb->ip_summed = CHECKSUM_NONE;
-
-                skb_queue_walk(&sk->sk_write_queue, skb) {
-                        csum = csum_add(csum, skb->csum);
-                }
-
-                uh->check = csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, csum);
-                if (uh->check == 0)
-                        uh->check = CSUM_MANGLED_0;
-        }
-}
-
-/*
- * Push out all pending data as one UDP datagram. Socket is locked.
- */
-static int udp_push_pending_frames(struct sock *sk)
-{
-        struct udp_sock  *up = udp_sk(sk);
-        struct inet_sock *inet = inet_sk(sk);
-        struct flowi *fl = &inet->cork.fl;
-        struct sk_buff *skb;
-        struct udphdr *uh;
-        int err = 0;
-        int is_udplite = IS_UDPLITE(sk);
-        __wsum csum = 0;
-
-        /* Grab the skbuff where UDP header space exists. */
-        if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
-                goto out;
-
-        /*
-         * Create a UDP header
-         */
-        uh = udp_hdr(skb);
-        uh->source = fl->fl_ip_sport;
-        uh->dest = fl->fl_ip_dport;
-        uh->len = htons(up->len);
-        uh->check = 0;
-
-        if (is_udplite)                                  /*     UDP-Lite      */
-                csum  = udplite_csum_outgoing(sk, skb);
-
-        else if (sk->sk_no_check == UDP_CSUM_NOXMIT) {   /* UDP csum disabled */
-
-                skb->ip_summed = CHECKSUM_NONE;
-                goto send;
-
-        } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
-
-                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src,fl->fl4_dst, up->len);
-                goto send;
-
-        } else                                           /*   `normal' UDP    */
-                csum = udp_csum_outgoing(sk, skb);
-
-        /* add protocol-dependent pseudo-header */
-        uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst, up->len,
-                                      sk->sk_protocol, csum             );
-        if (uh->check == 0)
-                uh->check = CSUM_MANGLED_0;
-
-send:
-        err = ip_push_pending_frames(sk);
-out:
-        up->len = 0;
-        up->pending = 0;
-        if (!err)
-                UDP_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS, is_udplite);
-        return err;
-}
-
-int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                size_t len)
-{
-        struct inet_sock *inet = inet_sk(sk);
-        struct udp_sock *up = udp_sk(sk);
-        int ulen = len;
-        struct ipcm_cookie ipc;
-        struct rtable *rt = NULL;
-        int free = 0;
-        int connected = 0;
-        __be32 daddr, faddr, saddr;
-        __be16 dport;
-        u8  tos;
-        int err, is_udplite = IS_UDPLITE(sk);
-        int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
-        int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
-
-        if (len > 0xFFFF)
-                return -EMSGSIZE;
-
-        /*
-         *      Check the flags.
-         */
-
-        if (msg->msg_flags&MSG_OOB)     /* Mirror BSD error message compatibility */
-                return -EOPNOTSUPP;
-
-        ipc.opt = NULL;
-
-        if (up->pending) {
-                /*
-                 * There are pending frames.
-                 * The socket lock must be held while it's corked.
-                 */
-                lock_sock(sk);
-                if (likely(up->pending)) {
-                        if (unlikely(up->pending != AF_INET)) {
-                                release_sock(sk);
-                                return -EINVAL;
-                        }
-                        goto do_append_data;
-                }
-                release_sock(sk);
-        }
-        ulen += sizeof(struct udphdr);
-
-        /*
-         *      Get and verify the address.
-         */
-        if (msg->msg_name) {
-                struct sockaddr_in * usin = (struct sockaddr_in*)msg->msg_name;
-                if (msg->msg_namelen < sizeof(*usin))
-                        return -EINVAL;
-                if (usin->sin_family != AF_INET) {
-                        if (usin->sin_family != AF_UNSPEC)
-                                return -EAFNOSUPPORT;
-                }
-
-                daddr = usin->sin_addr.s_addr;
-                dport = usin->sin_port;
-                if (dport == 0)
-                        return -EINVAL;
-        } else {
-                if (sk->sk_state != TCP_ESTABLISHED)
-                        return -EDESTADDRREQ;
-                daddr = inet->daddr;
-                dport = inet->dport;
-                /* Open fast path for connected socket.
-                   Route will not be used, if at least one option is set.
-                 */
-                connected = 1;
-        }
-        ipc.addr = inet->saddr;
-
-        ipc.oif = sk->sk_bound_dev_if;
-        if (msg->msg_controllen) {
-                err = ip_cmsg_send(msg, &ipc);
-                if (err)
-                        return err;
-                if (ipc.opt)
-                        free = 1;
-                connected = 0;
-        }
-        if (!ipc.opt)
-                ipc.opt = inet->opt;
-
-        saddr = ipc.addr;
-        ipc.addr = faddr = daddr;
-
-        if (ipc.opt && ipc.opt->srr) {
-                if (!daddr)
-                        return -EINVAL;
-                faddr = ipc.opt->faddr;
-                connected = 0;
-        }
-        tos = RT_TOS(inet->tos);
-        if (sock_flag(sk, SOCK_LOCALROUTE) ||
-            (msg->msg_flags & MSG_DONTROUTE) ||
-            (ipc.opt && ipc.opt->is_strictroute)) {
-                tos |= RTO_ONLINK;
-                connected = 0;
-        }
-
-        if (ipv4_is_multicast(daddr)) {
-                if (!ipc.oif)
-                        ipc.oif = inet->mc_index;
-                if (!saddr)
-                        saddr = inet->mc_addr;
-                connected = 0;
-        }
-
-        if (connected)
-                rt = (struct rtable*)sk_dst_check(sk, 0);
-
-        if (rt == NULL) {
-                struct flowi fl = { .oif = ipc.oif,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = faddr,
-                                                .saddr = saddr,
-                                                .tos = tos } },
-                                    .proto = sk->sk_protocol,
-                                    .uli_u = { .ports =
-                                               { .sport = inet->sport,
-                                                 .dport = dport } } };
-                security_sk_classify_flow(sk, &fl);
-                err = ip_route_output_flow(&init_net, &rt, &fl, sk, 1);
-                if (err) {
-                        if (err == -ENETUNREACH)
-                                IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
-                        goto out;
-                }
-
-                err = -EACCES;
-                if ((rt->rt_flags & RTCF_BROADCAST) &&
-                    !sock_flag(sk, SOCK_BROADCAST))
-                        goto out;
-                if (connected)
-                        sk_dst_set(sk, dst_clone(&rt->u.dst));
-        }
-
-        if (msg->msg_flags&MSG_CONFIRM)
-                goto do_confirm;
-back_from_confirm:
-
-        saddr = rt->rt_src;
-        if (!ipc.addr)
-                daddr = ipc.addr = rt->rt_dst;
-
-        lock_sock(sk);
-        if (unlikely(up->pending)) {
-                /* The socket is already corked while preparing it. */
-                /* ... which is an evident application bug. --ANK */
-                release_sock(sk);
-
-                LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
-                err = -EINVAL;
-                goto out;
-        }
-        /*
-         *      Now cork the socket to pend data.
-         */
-        inet->cork.fl.fl4_dst = daddr;
-        inet->cork.fl.fl_ip_dport = dport;
-        inet->cork.fl.fl4_src = saddr;
-        inet->cork.fl.fl_ip_sport = inet->sport;
-        up->pending = AF_INET;
-
-do_append_data:
-        up->len += ulen;
-        getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
-        err = ip_append_data(sk, getfrag, msg->msg_iov, ulen,
-                        sizeof(struct udphdr), &ipc, rt,
-                        corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
-        if (err)
-                udp_flush_pending_frames(sk);
-        else if (!corkreq)
-                err = udp_push_pending_frames(sk);
-        else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
-                up->pending = 0;
-        release_sock(sk);
-
-out:
-        ip_rt_put(rt);
-        if (free)
-                kfree(ipc.opt);
-        if (!err)
-                return len;
-        /*
-         * ENOBUFS = no kernel mem, SOCK_NOSPACE = no sndbuf space.  Reporting
-         * ENOBUFS might not be good (it's not tunable per se), but otherwise
-         * we don't have a good statistic (IpOutDiscards but it can be too many
-         * things).  We could add another new stat but at least for now that
-         * seems like overkill.
-         */
-        if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
-                UDP_INC_STATS_USER(UDP_MIB_SNDBUFERRORS, is_udplite);
-        }
-        return err;
-
-do_confirm:
-        dst_confirm(&rt->u.dst);
-        if (!(msg->msg_flags&MSG_PROBE) || len)
-                goto back_from_confirm;
-        err = 0;
-        goto out;
-}
-
-int udp_sendpage(struct sock *sk, struct page *page, int offset,
-                 size_t size, int flags)
-{
-        struct udp_sock *up = udp_sk(sk);
-        int ret;
-
-        if (!up->pending) {
-                struct msghdr msg = {   .msg_flags = flags|MSG_MORE };
-
-                /* Call udp_sendmsg to specify destination address which
-                 * sendpage interface can't pass.
-                 * This will succeed only when the socket is connected.
-                 */
-                ret = udp_sendmsg(NULL, sk, &msg, 0);
-                if (ret < 0)
-                        return ret;
-        }
-
-        lock_sock(sk);
-
-        if (unlikely(!up->pending)) {
-                release_sock(sk);
-
-                LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 3\n");
-                return -EINVAL;
-        }
-
-        ret = ip_append_page(sk, page, offset, size, flags);
-        if (ret == -EOPNOTSUPP) {
-                release_sock(sk);
-                return sock_no_sendpage(sk->sk_socket, page, offset,
-                                        size, flags);
-        }
-        if (ret < 0) {
-                udp_flush_pending_frames(sk);
-                goto out;
-        }
-
-        up->len += size;
-        if (!(up->corkflag || (flags&MSG_MORE)))
-                ret = udp_push_pending_frames(sk);
-        if (!ret)
-                ret = size;
-out:
-        release_sock(sk);
-        return ret;
-}
-
 /*
  *      IOCTL requests applicable to the UDP protocol
  */
@@ -833,107 +286,6 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
         return 0;
 }
 
-/*
- *      This should be easy, if there is something there we
- *      return it, otherwise we block.
- */
-
-int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                size_t len, int noblock, int flags, int *addr_len)
-{
-        struct inet_sock *inet = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
-        struct sk_buff *skb;
-        unsigned int ulen, copied;
-        int peeked;
-        int err;
-        int is_udplite = IS_UDPLITE(sk);
-
-        /*
-         *      Check any passed addresses
-         */
-        if (addr_len)
-                *addr_len=sizeof(*sin);
-
-        if (flags & MSG_ERRQUEUE)
-                return ip_recv_error(sk, msg, len);
-
-try_again:
-        skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
-                                  &peeked, &err);
-        if (!skb)
-                goto out;
-
-        ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
-        if (copied > ulen)
-                copied = ulen;
-        else if (copied < ulen)
-                msg->msg_flags |= MSG_TRUNC;
-
-        /*
-         * If checksum is needed at all, try to do it while copying the
-         * data.  If the data is truncated, or if we only want a partial
-         * coverage checksum (UDP-Lite), do it before the copy.
-         */
-
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
-                if (udp_lib_checksum_complete(skb))
-                        goto csum_copy_err;
-        }
-
-        if (skb_csum_unnecessary(skb))
-                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied       );
-        else {
-                err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
-
-                if (err == -EINVAL)
-                        goto csum_copy_err;
-        }
-
-        if (err)
-                goto out_free;
-
-        if (!peeked)
-                UDP_INC_STATS_USER(UDP_MIB_INDATAGRAMS, is_udplite);
-
-        sock_recv_timestamp(msg, sk, skb);
-
-        /* Copy the address. */
-        if (sin)
-        {
-                sin->sin_family = AF_INET;
-                sin->sin_port = udp_hdr(skb)->source;
-                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
-                memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
-        }
-        if (inet->cmsg_flags)
-                ip_cmsg_recv(msg, skb);
-
-        err = copied;
-        if (flags & MSG_TRUNC)
-                err = ulen;
-
-out_free:
-        lock_sock(sk);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
-out:
-        return err;
-
-csum_copy_err:
-        lock_sock(sk);
-        if (!skb_kill_datagram(sk, skb, flags))
-                UDP_INC_STATS_USER(UDP_MIB_INERRORS, is_udplite);
-        release_sock(sk);
-
-        if (noblock)
-                return -EAGAIN;
-        goto try_again;
-}
-
-
 int udp_disconnect(struct sock *sk, int flags)
 {
         struct inet_sock *inet = inet_sk(sk);
@@ -956,319 +308,6 @@ int udp_disconnect(struct sock *sk, int flags)
         return 0;
 }
 
-/* returns:
- *  -1: error
- *   0: success
- *  >0: "udp encap" protocol resubmission
- *
- * Note that in the success and error cases, the skb is assumed to
- * have either been requeued or freed.
- */
-int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
-{
-        struct udp_sock *up = udp_sk(sk);
-        int rc;
-        int is_udplite = IS_UDPLITE(sk);
-
-        /*
-         *      Charge it to the socket, dropping if the queue is full.
-         */
-        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
-                goto drop;
-        nf_reset(skb);
-
-        if (up->encap_type) {
-                /*
-                 * This is an encapsulation socket so pass the skb to
-                 * the socket's udp_encap_rcv() hook. Otherwise, just
-                 * fall through and pass this up the UDP socket.
-                 * up->encap_rcv() returns the following value:
-                 * =0 if skb was successfully passed to the encap
-                 *    handler or was discarded by it.
-                 * >0 if skb should be passed on to UDP.
-                 * <0 if skb should be resubmitted as proto -N
-                 */
-
-                /* if we're overly short, let UDP handle it */
-                if (skb->len > sizeof(struct udphdr) &&
-                    up->encap_rcv != NULL) {
-                        int ret;
-
-                        ret = (*up->encap_rcv)(sk, skb);
-                        if (ret <= 0) {
-                                UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS,
-                                                 is_udplite);
-                                return -ret;
-                        }
-                }
-
-                /* FALLTHROUGH -- it's a UDP Packet */
-        }
-
-        /*
-         *      UDP-Lite specific tests, ignored on UDP sockets
-         */
-        if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
-
-                /*
-                 * MIB statistics other than incrementing the error count are
-                 * disabled for the following two types of errors: these depend
-                 * on the application settings, not on the functioning of the
-                 * protocol stack as such.
-                 *
-                 * RFC 3828 here recommends (sec 3.3): "There should also be a
-                 * way ... to ... at least let the receiving application block
-                 * delivery of packets with coverage values less than a value
-                 * provided by the application."
-                 */
-                if (up->pcrlen == 0) {          /* full coverage was set  */
-                        LIMIT_NETDEBUG(KERN_WARNING "UDPLITE: partial coverage "
-                                "%d while full coverage %d requested\n",
-                                UDP_SKB_CB(skb)->cscov, skb->len);
-                        goto drop;
-                }
-                /* The next case involves violating the min. coverage requested
-                 * by the receiver. This is subtle: if receiver wants x and x is
-                 * greater than the buffersize/MTU then receiver will complain
-                 * that it wants x while sender emits packets of smaller size y.
-                 * Therefore the above ...()->partial_cov statement is essential.
-                 */
-                if (UDP_SKB_CB(skb)->cscov  <  up->pcrlen) {
-                        LIMIT_NETDEBUG(KERN_WARNING
-                                "UDPLITE: coverage %d too small, need min %d\n",
-                                UDP_SKB_CB(skb)->cscov, up->pcrlen);
-                        goto drop;
-                }
-        }
-
-        if (sk->sk_filter) {
-                if (udp_lib_checksum_complete(skb))
-                        goto drop;
-        }
-
-        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
-                /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM)
-                        UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, is_udplite);
-                goto drop;
-        }
-
-        return 0;
-
-drop:
-        UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
-        kfree_skb(skb);
-        return -1;
-}
-
-/*
- *      Multicasts and broadcasts go to each listener.
- *
- *      Note: called only from the BH handler context,
- *      so we don't need to lock the hashes.
- */
-static int __udp4_lib_mcast_deliver(struct sk_buff *skb,
-                                    struct udphdr  *uh,
-                                    __be32 saddr, __be32 daddr,
-                                    struct hlist_head udptable[])
-{
-        struct sock *sk;
-        int dif;
-
-        read_lock(&udp_hash_lock);
-        sk = sk_head(&udptable[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
-        dif = skb->dev->ifindex;
-        sk = udp_v4_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (sk) {
-                struct sock *sknext = NULL;
-
-                do {
-                        struct sk_buff *skb1 = skb;
-
-                        sknext = udp_v4_mcast_next(sk_next(sk), uh->dest, daddr,
-                                                   uh->source, saddr, dif);
-                        if (sknext)
-                                skb1 = skb_clone(skb, GFP_ATOMIC);
-
-                        if (skb1) {
-                                int ret = 0;
-
-                                bh_lock_sock_nested(sk);
-                                if (!sock_owned_by_user(sk))
-                                        ret = udp_queue_rcv_skb(sk, skb1);
-                                else
-                                        sk_add_backlog(sk, skb1);
-                                bh_unlock_sock(sk);
-
-                                if (ret > 0)
-                                        /* we should probably re-process instead
-                                         * of dropping packets here. */
-                                        kfree_skb(skb1);
-                        }
-                        sk = sknext;
-                } while (sknext);
-        } else
-                kfree_skb(skb);
-        read_unlock(&udp_hash_lock);
-        return 0;
-}
-
-/* Initialize UDP checksum. If exited with zero value (success),
- * CHECKSUM_UNNECESSARY means, that no more checks are required.
- * Otherwise, csum completion requires chacksumming packet body,
- * including udp header and folding it to skb->csum.
- */
-static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
-                                 int proto)
-{
-        const struct iphdr *iph;
-        int err;
-
-        UDP_SKB_CB(skb)->partial_cov = 0;
-        UDP_SKB_CB(skb)->cscov = skb->len;
-
-        if (proto == IPPROTO_UDPLITE) {
-                err = udplite_checksum_init(skb, uh);
-                if (err)
-                        return err;
-        }
-
-        iph = ip_hdr(skb);
-        if (uh->check == 0) {
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-        } else if (skb->ip_summed == CHECKSUM_COMPLETE) {
-               if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
-                                      proto, skb->csum))
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        }
-        if (!skb_csum_unnecessary(skb))
-                skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                               skb->len, proto, 0);
-        /* Probably, we should checksum udp header (it should be in cache
-         * in any case) and data in tiny packets (< rx copybreak).
-         */
-
-        return 0;
-}
-
-/*
- *      All we need to do is get the socket, and then do a checksum.
- */
-
-int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
-                   int proto)
-{
-        struct sock *sk;
-        struct udphdr *uh = udp_hdr(skb);
-        unsigned short ulen;
-        struct rtable *rt = (struct rtable*)skb->dst;
-        __be32 saddr = ip_hdr(skb)->saddr;
-        __be32 daddr = ip_hdr(skb)->daddr;
-
-        /*
-         *  Validate the packet.
-         */
-        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
-                goto drop;              /* No space for header. */
-
-        ulen = ntohs(uh->len);
-        if (ulen > skb->len)
-                goto short_packet;
-
-        if (proto == IPPROTO_UDP) {
-                /* UDP validates ulen. */
-                if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
-                        goto short_packet;
-                uh = udp_hdr(skb);
-        }
-
-        if (udp4_csum_init(skb, uh, proto))
-                goto csum_error;
-
-        if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
-                return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);
-
-        sk = __udp4_lib_lookup(skb->dev->nd_net, saddr, uh->source, daddr,
-                        uh->dest, inet_iif(skb), udptable);
-
-        if (sk != NULL) {
-                int ret = 0;
-                bh_lock_sock_nested(sk);
-                if (!sock_owned_by_user(sk))
-                        ret = udp_queue_rcv_skb(sk, skb);
-                else
-                        sk_add_backlog(sk, skb);
-                bh_unlock_sock(sk);
-                sock_put(sk);
-
-                /* a return value > 0 means to resubmit the input, but
-                 * it wants the return to be -protocol, or 0
-                 */
-                if (ret > 0)
-                        return -ret;
-                return 0;
-        }
-
-        if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
-                goto drop;
-        nf_reset(skb);
-
-        /* No socket. Drop packet silently, if checksum is wrong */
-        if (udp_lib_checksum_complete(skb))
-                goto csum_error;
-
-        UDP_INC_STATS_BH(UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-
-        /*
-         * Hmm.  We got an UDP packet to a port to which we
-         * don't wanna listen.  Ignore it.
-         */
-        kfree_skb(skb);
-        return 0;
-
-short_packet:
-        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
-                       proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       NIPQUAD(saddr),
-                       ntohs(uh->source),
-                       ulen,
-                       skb->len,
-                       NIPQUAD(daddr),
-                       ntohs(uh->dest));
-        goto drop;
-
-csum_error:
-        /*
-         * RFC1122: OK.  Discards the bad packet silently (as far as
-         * the network is concerned, anyway) as per 4.1.3.4 (MUST).
-         */
-        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
-                       proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       NIPQUAD(saddr),
-                       ntohs(uh->source),
-                       NIPQUAD(daddr),
-                       ntohs(uh->dest),
-                       ulen);
-drop:
-        UDP_INC_STATS_BH(UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
-        kfree_skb(skb);
-        return 0;
-}
-
-int udp_rcv(struct sk_buff *skb)
-{
-        return __udp4_lib_rcv(skb, udp_hash, IPPROTO_UDP);
-}
-
-int udp_destroy_sock(struct sock *sk)
-{
-        lock_sock(sk);
-        udp_flush_pending_frames(sk);
-        release_sock(sk);
-        return 0;
-}
-
 /*
  *      Socket option code for UDP
  */
@@ -1279,7 +318,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
         struct udp_sock *up = udp_sk(sk);
         int val;
         int err = 0;
+#ifdef CONFIG_IP_UDPLITE
         int is_udplite = IS_UDPLITE(sk);
+#endif
 
         if (optlen<sizeof(int))
                 return -EINVAL;
@@ -1315,6 +356,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                 }
                 break;
 
+#ifdef CONFIG_IP_UDPLITE
         /*
          *      UDP-Lite's partial checksum coverage (RFC 3828).
          */
@@ -1340,6 +382,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                 up->pcrlen = val;
                 up->pcflag |= UDPLITE_RECV_CC;
                 break;
+#endif
 
         default:
                 err = -ENOPROTOOPT;
@@ -1349,26 +392,6 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
         return err;
 }
 
-int udp_setsockopt(struct sock *sk, int level, int optname,
-                   char __user *optval, int optlen)
-{
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
-                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
-                                          udp_push_pending_frames);
-        return ip_setsockopt(sk, level, optname, optval, optlen);
-}
-
-#ifdef CONFIG_COMPAT
-int compat_udp_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
-{
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
-                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
-                                          udp_push_pending_frames);
-        return compat_ip_setsockopt(sk, level, optname, optval, optlen);
-}
-#endif
-
 int udp_lib_getsockopt(struct sock *sk, int level, int optname,
                        char __user *optval, int __user *optlen)
 {
@@ -1413,23 +436,6 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
         return 0;
 }
 
-int udp_getsockopt(struct sock *sk, int level, int optname,
-                   char __user *optval, int __user *optlen)
-{
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
-                return udp_lib_getsockopt(sk, level, optname, optval, optlen);
-        return ip_getsockopt(sk, level, optname, optval, optlen);
-}
-
-#ifdef CONFIG_COMPAT
-int compat_udp_getsockopt(struct sock *sk, int level, int optname,
-                                 char __user *optval, int __user *optlen)
-{
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
-                return udp_lib_getsockopt(sk, level, optname, optval, optlen);
-        return compat_ip_getsockopt(sk, level, optname, optval, optlen);
-}
-#endif
 /**
  *      udp_poll - wait for a UDP event.
  *      @file - file struct
@@ -1474,36 +480,6 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 
 }
 
-DEFINE_PROTO_INUSE(udp)
-
-struct proto udp_prot = {
-        .name              = "UDP",
-        .owner             = THIS_MODULE,
-        .close             = udp_lib_close,
-        .connect           = ip4_datagram_connect,
-        .disconnect        = udp_disconnect,
-        .ioctl             = udp_ioctl,
-        .destroy           = udp_destroy_sock,
-        .setsockopt        = udp_setsockopt,
-        .getsockopt        = udp_getsockopt,
-        .sendmsg           = udp_sendmsg,
-        .recvmsg           = udp_recvmsg,
-        .sendpage          = udp_sendpage,
-        .backlog_rcv       = udp_queue_rcv_skb,
-        .hash              = udp_lib_hash,
-        .unhash            = udp_lib_unhash,
-        .get_port          = udp_v4_get_port,
-        .memory_allocated  = &udp_memory_allocated,
-        .sysctl_mem        = sysctl_udp_mem,
-        .sysctl_wmem       = &sysctl_udp_wmem_min,
-        .sysctl_rmem       = &sysctl_udp_rmem_min,
-        .obj_size          = sizeof(struct udp_sock),
-#ifdef CONFIG_COMPAT
-        .compat_setsockopt = compat_udp_setsockopt,
-        .compat_getsockopt = compat_udp_getsockopt,
-#endif
-        REF_PROTO_INUSE(udp)
-};
 
 /* ------------------------------------------------------------------------ */
 #ifdef CONFIG_PROC_FS
@@ -1636,62 +612,6 @@ void udp_proc_unregister(struct udp_seq_afinfo *afinfo)
         proc_net_remove(&init_net, afinfo->name);
         memset(afinfo->seq_fops, 0, sizeof(*afinfo->seq_fops));
 }
-
-/* ------------------------------------------------------------------------ */
-static void udp4_format_sock(struct sock *sp, char *tmpbuf, int bucket)
-{
-        struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr;
-        __be32 src  = inet->rcv_saddr;
-        __u16 destp       = ntohs(inet->dport);
-        __u16 srcp        = ntohs(inet->sport);
-
-        sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p",
-                bucket, src, srcp, dest, destp, sp->sk_state,
-                atomic_read(&sp->sk_wmem_alloc),
-                atomic_read(&sp->sk_rmem_alloc),
-                0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-                atomic_read(&sp->sk_refcnt), sp);
-}
-
-int udp4_seq_show(struct seq_file *seq, void *v)
-{
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "%-127s\n",
-                           "  sl  local_address rem_address   st tx_queue "
-                           "rx_queue tr tm->when retrnsmt   uid  timeout "
-                           "inode");
-        else {
-                char tmpbuf[129];
-                struct udp_iter_state *state = seq->private;
-
-                udp4_format_sock(v, tmpbuf, state->bucket);
-                seq_printf(seq, "%-127s\n", tmpbuf);
-        }
-        return 0;
-}
-
-/* ------------------------------------------------------------------------ */
-static struct file_operations udp4_seq_fops;
-static struct udp_seq_afinfo udp4_seq_afinfo = {
-        .owner          = THIS_MODULE,
-        .name           = "udp",
-        .family         = AF_INET,
-        .hashtable      = udp_hash,
-        .seq_show       = udp4_seq_show,
-        .seq_fops       = &udp4_seq_fops,
-};
-
-int __init udp4_proc_init(void)
-{
-        return udp_proc_register(&udp4_seq_afinfo);
-}
-
-void udp4_proc_exit(void)
-{
-        udp_proc_unregister(&udp4_seq_afinfo);
-}
 #endif /* CONFIG_PROC_FS */
 
 void __init udp_init(void)
@@ -1718,8 +638,6 @@ EXPORT_SYMBOL(udp_hash);
 EXPORT_SYMBOL(udp_hash_lock);
 EXPORT_SYMBOL(udp_ioctl);
 EXPORT_SYMBOL(udp_get_port);
-EXPORT_SYMBOL(udp_prot);
-EXPORT_SYMBOL(udp_sendmsg);
 EXPORT_SYMBOL(udp_lib_getsockopt);
 EXPORT_SYMBOL(udp_lib_setsockopt);
 EXPORT_SYMBOL(udp_poll);
diff --git a/net/ipv4/udp_ipv4.c b/net/ipv4/udp_ipv4.c
new file mode 100644
index 000000000000..40978de7fb51
--- /dev/null
+++ b/net/ipv4/udp_ipv4.c
@@ -0,0 +1,1134 @@
+/*
+ * INET         An implementation of the TCP/IP protocol suite for the LINUX
+ *              operating system.  INET is implemented using the  BSD Socket
+ *              interface as the means of communication with the user level.
+ *
+ *              UDP for IPv4.
+ *
+ *              For full credits, see net/ipv4/udp.c.
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ */
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+#include <asm/ioctls.h>
+#include <linux/bootmem.h>
+#include <linux/types.h>
+#include <linux/fcntl.h>
+#include <linux/module.h>
+#include <linux/socket.h>
+#include <linux/sockios.h>
+#include <linux/igmp.h>
+#include <linux/in.h>
+#include <linux/errno.h>
+#include <linux/timer.h>
+#include <linux/mm.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <net/tcp_states.h>
+#include <linux/skbuff.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <net/net_namespace.h>
+#include <net/icmp.h>
+#include <net/route.h>
+#include <net/checksum.h>
+#include <net/xfrm.h>
+#include "udp_impl.h"
+
+int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
+{
+        struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
+
+        return  ( !ipv6_only_sock(sk2)  &&
+                  (!inet1->rcv_saddr || !inet2->rcv_saddr ||
+                   inet1->rcv_saddr == inet2->rcv_saddr      ));
+}
+
+static inline int udp_v4_get_port(struct sock *sk, unsigned short snum)
+{
+        return udp_get_port(sk, snum, ipv4_rcv_saddr_equal);
+}
+
+/* UDP is nearly always wildcards out the wazoo, it makes no sense to try
+ * harder than this. -DaveM
+ */
+static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
+                __be16 sport, __be32 daddr, __be16 dport,
+                int dif, struct hlist_head udptable[])
+{
+        struct sock *sk, *result = NULL;
+        struct hlist_node *node;
+        unsigned short hnum = ntohs(dport);
+        int badness = -1;
+
+        read_lock(&udp_hash_lock);
+        sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
+                struct inet_sock *inet = inet_sk(sk);
+
+                if (sk->sk_net == net && sk->sk_hash == hnum &&
+                                !ipv6_only_sock(sk)) {
+                        int score = (sk->sk_family == PF_INET ? 1 : 0);
+                        if (inet->rcv_saddr) {
+                                if (inet->rcv_saddr != daddr)
+                                        continue;
+                                score+=2;
+                        }
+                        if (inet->daddr) {
+                                if (inet->daddr != saddr)
+                                        continue;
+                                score+=2;
+                        }
+                        if (inet->dport) {
+                                if (inet->dport != sport)
+                                        continue;
+                                score+=2;
+                        }
+                        if (sk->sk_bound_dev_if) {
+                                if (sk->sk_bound_dev_if != dif)
+                                        continue;
+                                score+=2;
+                        }
+                        if (score == 9) {
+                                result = sk;
+                                break;
+                        } else if (score > badness) {
+                                result = sk;
+                                badness = score;
+                        }
+                }
+        }
+        if (result)
+                sock_hold(result);
+        read_unlock(&udp_hash_lock);
+        return result;
+}
+
+static inline struct sock *udp_v4_mcast_next(struct sock *sk,
+                                             __be16 loc_port, __be32 loc_addr,
+                                             __be16 rmt_port, __be32 rmt_addr,
+                                             int dif)
+{
+        struct hlist_node *node;
+        struct sock *s = sk;
+        unsigned short hnum = ntohs(loc_port);
+
+        sk_for_each_from(s, node) {
+                struct inet_sock *inet = inet_sk(s);
+
+                if (s->sk_hash != hnum                                  ||
+                    (inet->daddr && inet->daddr != rmt_addr)            ||
+                    (inet->dport != rmt_port && inet->dport)            ||
+                    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
+                    ipv6_only_sock(s)                                   ||
+                    (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
+                        continue;
+                if (!ip_mc_sf_allow(s, loc_addr, rmt_addr, dif))
+                        continue;
+                goto found;
+        }
+        s = NULL;
+found:
+        return s;
+}
+
+/*
+ * This routine is called by the ICMP module when it gets some
+ * sort of error condition.  If err < 0 then the socket should
+ * be closed and the error returned to the user.  If err > 0
+ * it's just the icmp type << 8 | icmp code.
+ * Header points to the ip header of the error packet. We move
+ * on past this. Then (as it used to claim before adjustment)
+ * header points to the first 8 bytes of the udp header.  We need
+ * to find the appropriate port.
+ */
+
+void __udp4_lib_err(struct sk_buff *skb, u32 info, struct hlist_head udptable[])
+{
+        struct inet_sock *inet;
+        struct iphdr *iph = (struct iphdr*)skb->data;
+        struct udphdr *uh = (struct udphdr*)(skb->data+(iph->ihl<<2));
+        const int type = icmp_hdr(skb)->type;
+        const int code = icmp_hdr(skb)->code;
+        struct sock *sk;
+        int harderr;
+        int err;
+
+        sk = __udp4_lib_lookup(skb->dev->nd_net, iph->daddr, uh->dest,
+                        iph->saddr, uh->source, skb->dev->ifindex, udptable);
+        if (sk == NULL) {
+                ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
+                return; /* No socket for error */
+        }
+
+        err = 0;
+        harderr = 0;
+        inet = inet_sk(sk);
+
+        switch (type) {
+        default:
+        case ICMP_TIME_EXCEEDED:
+                err = EHOSTUNREACH;
+                break;
+        case ICMP_SOURCE_QUENCH:
+                goto out;
+        case ICMP_PARAMETERPROB:
+                err = EPROTO;
+                harderr = 1;
+                break;
+        case ICMP_DEST_UNREACH:
+                if (code == ICMP_FRAG_NEEDED) { /* Path MTU discovery */
+                        if (inet->pmtudisc != IP_PMTUDISC_DONT) {
+                                err = EMSGSIZE;
+                                harderr = 1;
+                                break;
+                        }
+                        goto out;
+                }
+                err = EHOSTUNREACH;
+                if (code <= NR_ICMP_UNREACH) {
+                        harderr = icmp_err_convert[code].fatal;
+                        err = icmp_err_convert[code].errno;
+                }
+                break;
+        }
+
+        /*
+         *      RFC1122: OK.  Passes ICMP errors back to application, as per
+         *      4.1.3.3.
+         */
+        if (!inet->recverr) {
+                if (!harderr || sk->sk_state != TCP_ESTABLISHED)
+                        goto out;
+        } else {
+                ip_icmp_error(sk, skb, err, uh->dest, info, (u8*)(uh+1));
+        }
+        sk->sk_err = err;
+        sk->sk_error_report(sk);
+out:
+        sock_put(sk);
+}
+
+void udp_err(struct sk_buff *skb, u32 info)
+{
+        __udp4_lib_err(skb, info, udp_hash);
+}
+
+/*
+ * Throw away all pending data and cancel the corking. Socket is locked.
+ */
+static void udp_flush_pending_frames(struct sock *sk)
+{
+        struct udp_sock *up = udp_sk(sk);
+
+        if (up->pending) {
+                up->len = 0;
+                up->pending = 0;
+                ip_flush_pending_frames(sk);
+        }
+}
+
+/**
+ *      udp4_hwcsum_outgoing  -  handle outgoing HW checksumming
+ *      @sk:    socket we are sending on
+ *      @skb:   sk_buff containing the filled-in UDP header
+ *              (checksum field must be zeroed out)
+ */
+static void udp4_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
+                                 __be32 src, __be32 dst, int len      )
+{
+        unsigned int offset;
+        struct udphdr *uh = udp_hdr(skb);
+        __wsum csum = 0;
+
+        if (skb_queue_len(&sk->sk_write_queue) == 1) {
+                /*
+                 * Only one fragment on the socket.
+                 */
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                uh->check = ~csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, 0);
+        } else {
+                /*
+                 * HW-checksum won't work as there are two or more
+                 * fragments on the socket so that all csums of sk_buffs
+                 * should be together
+                 */
+                offset = skb_transport_offset(skb);
+                skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
+
+                skb->ip_summed = CHECKSUM_NONE;
+
+                skb_queue_walk(&sk->sk_write_queue, skb) {
+                        csum = csum_add(csum, skb->csum);
+                }
+
+                uh->check = csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, csum);
+                if (uh->check == 0)
+                        uh->check = CSUM_MANGLED_0;
+        }
+}
+
+/*
+ * Push out all pending data as one UDP datagram. Socket is locked.
+ */
+static int udp_push_pending_frames(struct sock *sk)
+{
+        struct udp_sock  *up = udp_sk(sk);
+        struct inet_sock *inet = inet_sk(sk);
+        struct flowi *fl = &inet->cork.fl;
+        struct sk_buff *skb;
+        struct udphdr *uh;
+        int err = 0;
+        int is_udplite = IS_UDPLITE(sk);
+        __wsum csum = 0;
+
+        /* Grab the skbuff where UDP header space exists. */
+        if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
+                goto out;
+
+        /*
+         * Create a UDP header
+         */
+        uh = udp_hdr(skb);
+        uh->source = fl->fl_ip_sport;
+        uh->dest = fl->fl_ip_dport;
+        uh->len = htons(up->len);
+        uh->check = 0;
+
+        if (is_udplite)                                  /*     UDP-Lite      */
+                csum  = udplite_csum_outgoing(sk, skb);
+
+        else if (sk->sk_no_check == UDP_CSUM_NOXMIT) {   /* UDP csum disabled */
+
+                skb->ip_summed = CHECKSUM_NONE;
+                goto send;
+
+        } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
+
+                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src,fl->fl4_dst, up->len);
+                goto send;
+
+        } else                                           /*   `normal' UDP    */
+                csum = udp_csum_outgoing(sk, skb);
+
+        /* add protocol-dependent pseudo-header */
+        uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst, up->len,
+                                      sk->sk_protocol, csum             );
+        if (uh->check == 0)
+                uh->check = CSUM_MANGLED_0;
+
+send:
+        err = ip_push_pending_frames(sk);
+out:
+        up->len = 0;
+        up->pending = 0;
+        if (!err)
+                UDP_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS, is_udplite);
+        return err;
+}
+
+int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                size_t len)
+{
+        struct inet_sock *inet = inet_sk(sk);
+        struct udp_sock *up = udp_sk(sk);
+        int ulen = len;
+        struct ipcm_cookie ipc;
+        struct rtable *rt = NULL;
+        int free = 0;
+        int connected = 0;
+        __be32 daddr, faddr, saddr;
+        __be16 dport;
+        u8  tos;
+        int err, is_udplite = IS_UDPLITE(sk);
+        int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
+        int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
+
+        if (len > 0xFFFF)
+                return -EMSGSIZE;
+
+        /*
+         *      Check the flags.
+         */
+
+        if (msg->msg_flags&MSG_OOB)     /* Mirror BSD error message compatibility */
+                return -EOPNOTSUPP;
+
+        ipc.opt = NULL;
+
+        if (up->pending) {
+                /*
+                 * There are pending frames.
+                 * The socket lock must be held while it's corked.
+                 */
+                lock_sock(sk);
+                if (likely(up->pending)) {
+                        if (unlikely(up->pending != AF_INET)) {
+                                release_sock(sk);
+                                return -EINVAL;
+                        }
+                        goto do_append_data;
+                }
+                release_sock(sk);
+        }
+        ulen += sizeof(struct udphdr);
+
+        /*
+         *      Get and verify the address.
+         */
+        if (msg->msg_name) {
+                struct sockaddr_in * usin = (struct sockaddr_in*)msg->msg_name;
+                if (msg->msg_namelen < sizeof(*usin))
+                        return -EINVAL;
+                if (usin->sin_family != AF_INET) {
+                        if (usin->sin_family != AF_UNSPEC)
+                                return -EAFNOSUPPORT;
+                }
+
+                daddr = usin->sin_addr.s_addr;
+                dport = usin->sin_port;
+                if (dport == 0)
+                        return -EINVAL;
+        } else {
+                if (sk->sk_state != TCP_ESTABLISHED)
+                        return -EDESTADDRREQ;
+                daddr = inet->daddr;
+                dport = inet->dport;
+                /* Open fast path for connected socket.
+                   Route will not be used, if at least one option is set.
+                 */
+                connected = 1;
+        }
+        ipc.addr = inet->saddr;
+
+        ipc.oif = sk->sk_bound_dev_if;
+        if (msg->msg_controllen) {
+                err = ip_cmsg_send(msg, &ipc);
+                if (err)
+                        return err;
+                if (ipc.opt)
+                        free = 1;
+                connected = 0;
+        }
+        if (!ipc.opt)
+                ipc.opt = inet->opt;
+
+        saddr = ipc.addr;
+        ipc.addr = faddr = daddr;
+
+        if (ipc.opt && ipc.opt->srr) {
+                if (!daddr)
+                        return -EINVAL;
+                faddr = ipc.opt->faddr;
+                connected = 0;
+        }
+        tos = RT_TOS(inet->tos);
+        if (sock_flag(sk, SOCK_LOCALROUTE) ||
+            (msg->msg_flags & MSG_DONTROUTE) ||
+            (ipc.opt && ipc.opt->is_strictroute)) {
+                tos |= RTO_ONLINK;
+                connected = 0;
+        }
+
+        if (ipv4_is_multicast(daddr)) {
+                if (!ipc.oif)
+                        ipc.oif = inet->mc_index;
+                if (!saddr)
+                        saddr = inet->mc_addr;
+                connected = 0;
+        }
+
+        if (connected)
+                rt = (struct rtable*)sk_dst_check(sk, 0);
+
+        if (rt == NULL) {
+                struct flowi fl = { .oif = ipc.oif,
+                                    .nl_u = { .ip4_u =
+                                              { .daddr = faddr,
+                                                .saddr = saddr,
+                                                .tos = tos } },
+                                    .proto = sk->sk_protocol,
+                                    .uli_u = { .ports =
+                                               { .sport = inet->sport,
+                                                 .dport = dport } } };
+                security_sk_classify_flow(sk, &fl);
+                err = ip_route_output_flow(&init_net, &rt, &fl, sk, 1);
+                if (err) {
+                        if (err == -ENETUNREACH)
+                                IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
+                        goto out;
+                }
+
+                err = -EACCES;
+                if ((rt->rt_flags & RTCF_BROADCAST) &&
+                    !sock_flag(sk, SOCK_BROADCAST))
+                        goto out;
+                if (connected)
+                        sk_dst_set(sk, dst_clone(&rt->u.dst));
+        }
+
+        if (msg->msg_flags&MSG_CONFIRM)
+                goto do_confirm;
+back_from_confirm:
+
+        saddr = rt->rt_src;
+        if (!ipc.addr)
+                daddr = ipc.addr = rt->rt_dst;
+
+        lock_sock(sk);
+        if (unlikely(up->pending)) {
+                /* The socket is already corked while preparing it. */
+                /* ... which is an evident application bug. --ANK */
+                release_sock(sk);
+
+                LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
+                err = -EINVAL;
+                goto out;
+        }
+        /*
+         *      Now cork the socket to pend data.
+         */
+        inet->cork.fl.fl4_dst = daddr;
+        inet->cork.fl.fl_ip_dport = dport;
+        inet->cork.fl.fl4_src = saddr;
+        inet->cork.fl.fl_ip_sport = inet->sport;
+        up->pending = AF_INET;
+
+do_append_data:
+        up->len += ulen;
+        getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
+        err = ip_append_data(sk, getfrag, msg->msg_iov, ulen,
+                        sizeof(struct udphdr), &ipc, rt,
+                        corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
+        if (err)
+                udp_flush_pending_frames(sk);
+        else if (!corkreq)
+                err = udp_push_pending_frames(sk);
+        else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
+                up->pending = 0;
+        release_sock(sk);
+
+out:
+        ip_rt_put(rt);
+        if (free)
+                kfree(ipc.opt);
+        if (!err)
+                return len;
+        /*
+         * ENOBUFS = no kernel mem, SOCK_NOSPACE = no sndbuf space.  Reporting
+         * ENOBUFS might not be good (it's not tunable per se), but otherwise
+         * we don't have a good statistic (IpOutDiscards but it can be too many
+         * things).  We could add another new stat but at least for now that
+         * seems like overkill.
+         */
+        if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
+                UDP_INC_STATS_USER(UDP_MIB_SNDBUFERRORS, is_udplite);
+        }
+        return err;
+
+do_confirm:
+        dst_confirm(&rt->u.dst);
+        if (!(msg->msg_flags&MSG_PROBE) || len)
+                goto back_from_confirm;
+        err = 0;
+        goto out;
+}
+
+int udp_sendpage(struct sock *sk, struct page *page, int offset,
+                 size_t size, int flags)
+{
+        struct udp_sock *up = udp_sk(sk);
+        int ret;
+
+        if (!up->pending) {
+                struct msghdr msg = {   .msg_flags = flags|MSG_MORE };
+
+                /* Call udp_sendmsg to specify destination address which
+                 * sendpage interface can't pass.
+                 * This will succeed only when the socket is connected.
+                 */
+                ret = udp_sendmsg(NULL, sk, &msg, 0);
+                if (ret < 0)
+                        return ret;
+        }
+
+        lock_sock(sk);
+
+        if (unlikely(!up->pending)) {
+                release_sock(sk);
+
+                LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 3\n");
+                return -EINVAL;
+        }
+
+        ret = ip_append_page(sk, page, offset, size, flags);
+        if (ret == -EOPNOTSUPP) {
+                release_sock(sk);
+                return sock_no_sendpage(sk->sk_socket, page, offset,
+                                        size, flags);
+        }
+        if (ret < 0) {
+                udp_flush_pending_frames(sk);
+                goto out;
+        }
+
+        up->len += size;
+        if (!(up->corkflag || (flags&MSG_MORE)))
+                ret = udp_push_pending_frames(sk);
+        if (!ret)
+                ret = size;
+out:
+        release_sock(sk);
+        return ret;
+}
+
+/*
+ *      This should be easy, if there is something there we
+ *      return it, otherwise we block.
+ */
+
+int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                size_t len, int noblock, int flags, int *addr_len)
+{
+        struct inet_sock *inet = inet_sk(sk);
+        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+        struct sk_buff *skb;
+        unsigned int ulen, copied;
+        int peeked;
+        int err;
+        int is_udplite = IS_UDPLITE(sk);
+
+        /*
+         *      Check any passed addresses
+         */
+        if (addr_len)
+                *addr_len=sizeof(*sin);
+
+        if (flags & MSG_ERRQUEUE)
+                return ip_recv_error(sk, msg, len);
+
+try_again:
+        skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
+                                  &peeked, &err);
+        if (!skb)
+                goto out;
+
+        ulen = skb->len - sizeof(struct udphdr);
+        copied = len;
+        if (copied > ulen)
+                copied = ulen;
+        else if (copied < ulen)
+                msg->msg_flags |= MSG_TRUNC;
+
+        /*
+         * If checksum is needed at all, try to do it while copying the
+         * data.  If the data is truncated, or if we only want a partial
+         * coverage checksum (UDP-Lite), do it before the copy.
+         */
+
+        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+                if (udp_lib_checksum_complete(skb))
+                        goto csum_copy_err;
+        }
+
+        if (skb_csum_unnecessary(skb))
+                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+                                              msg->msg_iov, copied       );
+        else {
+                err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
+
+                if (err == -EINVAL)
+                        goto csum_copy_err;
+        }
+
+        if (err)
+                goto out_free;
+
+        if (!peeked)
+                UDP_INC_STATS_USER(UDP_MIB_INDATAGRAMS, is_udplite);
+
+        sock_recv_timestamp(msg, sk, skb);
+
+        /* Copy the address. */
+        if (sin)
+        {
+                sin->sin_family = AF_INET;
+                sin->sin_port = udp_hdr(skb)->source;
+                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+                memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+        }
+        if (inet->cmsg_flags)
+                ip_cmsg_recv(msg, skb);
+
+        err = copied;
+        if (flags & MSG_TRUNC)
+                err = ulen;
+
+out_free:
+        lock_sock(sk);
+        skb_free_datagram(sk, skb);
+        release_sock(sk);
+out:
+        return err;
+
+csum_copy_err:
+        lock_sock(sk);
+        if (!skb_kill_datagram(sk, skb, flags))
+                UDP_INC_STATS_USER(UDP_MIB_INERRORS, is_udplite);
+        release_sock(sk);
+
+        if (noblock)
+                return -EAGAIN;
+        goto try_again;
+}
+
+
+/* returns:
+ *  -1: error
+ *   0: success
+ *  >0: "udp encap" protocol resubmission
+ *
+ * Note that in the success and error cases, the skb is assumed to
+ * have either been requeued or freed.
+ */
+int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+{
+        struct udp_sock *up = udp_sk(sk);
+        int rc;
+        int is_udplite = IS_UDPLITE(sk);
+
+        /*
+         *      Charge it to the socket, dropping if the queue is full.
+         */
+        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+                goto drop;
+        nf_reset(skb);
+
+        if (up->encap_type) {
+                /*
+                 * This is an encapsulation socket so pass the skb to
+                 * the socket's udp_encap_rcv() hook. Otherwise, just
+                 * fall through and pass this up the UDP socket.
+                 * up->encap_rcv() returns the following value:
+                 * =0 if skb was successfully passed to the encap
+                 *    handler or was discarded by it.
+                 * >0 if skb should be passed on to UDP.
+                 * <0 if skb should be resubmitted as proto -N
+                 */
+
+                /* if we're overly short, let UDP handle it */
+                if (skb->len > sizeof(struct udphdr) &&
+                    up->encap_rcv != NULL) {
+                        int ret;
+
+                        ret = (*up->encap_rcv)(sk, skb);
+                        if (ret <= 0) {
+                                UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS,
+                                                 is_udplite);
+                                return -ret;
+                        }
+                }
+
+                /* FALLTHROUGH -- it's a UDP Packet */
+        }
+
+        /*
+         *      UDP-Lite specific tests, ignored on UDP sockets
+         */
+        if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
+
+                /*
+                 * MIB statistics other than incrementing the error count are
+                 * disabled for the following two types of errors: these depend
+                 * on the application settings, not on the functioning of the
+                 * protocol stack as such.
+                 *
+                 * RFC 3828 here recommends (sec 3.3): "There should also be a
+                 * way ... to ... at least let the receiving application block
+                 * delivery of packets with coverage values less than a value
+                 * provided by the application."
+                 */
+                if (up->pcrlen == 0) {          /* full coverage was set  */
+                        LIMIT_NETDEBUG(KERN_WARNING "UDPLITE: partial coverage "
+                                "%d while full coverage %d requested\n",
+                                UDP_SKB_CB(skb)->cscov, skb->len);
+                        goto drop;
+                }
+                /* The next case involves violating the min. coverage requested
+                 * by the receiver. This is subtle: if receiver wants x and x is
+                 * greater than the buffersize/MTU then receiver will complain
+                 * that it wants x while sender emits packets of smaller size y.
+                 * Therefore the above ...()->partial_cov statement is essential.
+                 */
+                if (UDP_SKB_CB(skb)->cscov  <  up->pcrlen) {
+                        LIMIT_NETDEBUG(KERN_WARNING
+                                "UDPLITE: coverage %d too small, need min %d\n",
+                                UDP_SKB_CB(skb)->cscov, up->pcrlen);
+                        goto drop;
+                }
+        }
+
+        if (sk->sk_filter) {
+                if (udp_lib_checksum_complete(skb))
+                        goto drop;
+        }
+
+        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+                /* Note that an ENOMEM error is charged twice */
+                if (rc == -ENOMEM)
+                        UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, is_udplite);
+                goto drop;
+        }
+
+        return 0;
+
+drop:
+        UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
+        kfree_skb(skb);
+        return -1;
+}
+
+/*
+ *      Multicasts and broadcasts go to each listener.
+ *
+ *      Note: called only from the BH handler context,
+ *      so we don't need to lock the hashes.
+ */
+static int __udp4_lib_mcast_deliver(struct sk_buff *skb,
+                                    struct udphdr  *uh,
+                                    __be32 saddr, __be32 daddr,
+                                    struct hlist_head udptable[])
+{
+        struct sock *sk;
+        int dif;
+
+        read_lock(&udp_hash_lock);
+        sk = sk_head(&udptable[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
+        dif = skb->dev->ifindex;
+        sk = udp_v4_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
+        if (sk) {
+                struct sock *sknext = NULL;
+
+                do {
+                        struct sk_buff *skb1 = skb;
+
+                        sknext = udp_v4_mcast_next(sk_next(sk), uh->dest, daddr,
+                                                   uh->source, saddr, dif);
+                        if (sknext)
+                                skb1 = skb_clone(skb, GFP_ATOMIC);
+
+                        if (skb1) {
+                                int ret = 0;
+
+                                bh_lock_sock_nested(sk);
+                                if (!sock_owned_by_user(sk))
+                                        ret = udp_queue_rcv_skb(sk, skb1);
+                                else
+                                        sk_add_backlog(sk, skb1);
+                                bh_unlock_sock(sk);
+
+                                if (ret > 0)
+                                        /* we should probably re-process instead
+                                         * of dropping packets here. */
+                                        kfree_skb(skb1);
+                        }
+                        sk = sknext;
+                } while (sknext);
+        } else
+                kfree_skb(skb);
+        read_unlock(&udp_hash_lock);
+        return 0;
+}
+
+/* Initialize UDP checksum. If exited with zero value (success),
+ * CHECKSUM_UNNECESSARY means, that no more checks are required.
+ * Otherwise, csum completion requires chacksumming packet body,
+ * including udp header and folding it to skb->csum.
+ */
+static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
+                                 int proto)
+{
+        const struct iphdr *iph;
+        int err;
+
+        UDP_SKB_CB(skb)->partial_cov = 0;
+        UDP_SKB_CB(skb)->cscov = skb->len;
+
+        if (IS_PROTO_UDPLITE(proto)) {
+                err = udplite_checksum_init(skb, uh);
+                if (err)
+                        return err;
+        }
+
+        iph = ip_hdr(skb);
+        if (uh->check == 0) {
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+        } else if (skb->ip_summed == CHECKSUM_COMPLETE) {
+               if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                                      proto, skb->csum))
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        }
+        if (!skb_csum_unnecessary(skb))
+                skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
+                                               skb->len, proto, 0);
+        /* Probably, we should checksum udp header (it should be in cache
+         * in any case) and data in tiny packets (< rx copybreak).
+         */
+
+        return 0;
+}
+
+/*
+ *      All we need to do is get the socket, and then do a checksum.
+ */
+
+int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
+                   int proto)
+{
+        struct sock *sk;
+        struct udphdr *uh = udp_hdr(skb);
+        unsigned short ulen;
+        struct rtable *rt = (struct rtable*)skb->dst;
+        __be32 saddr = ip_hdr(skb)->saddr;
+        __be32 daddr = ip_hdr(skb)->daddr;
+
+        /*
+         *  Validate the packet.
+         */
+        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
+                goto drop;              /* No space for header. */
+
+        ulen = ntohs(uh->len);
+        if (ulen > skb->len)
+                goto short_packet;
+
+        if (IS_PROTO_UDPLITE(proto)) {
+                /* UDP validates ulen. */
+                if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
+                        goto short_packet;
+                uh = udp_hdr(skb);
+        }
+
+        if (udp4_csum_init(skb, uh, proto))
+                goto csum_error;
+
+        if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
+                return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);
+
+        sk = __udp4_lib_lookup(skb->dev->nd_net, saddr, uh->source, daddr,
+                        uh->dest, inet_iif(skb), udptable);
+
+        if (sk != NULL) {
+                int ret = 0;
+                bh_lock_sock_nested(sk);
+                if (!sock_owned_by_user(sk))
+                        ret = udp_queue_rcv_skb(sk, skb);
+                else
+                        sk_add_backlog(sk, skb);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+
+                /* a return value > 0 means to resubmit the input, but
+                 * it wants the return to be -protocol, or 0
+                 */
+                if (ret > 0)
+                        return -ret;
+                return 0;
+        }
+
+        if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                goto drop;
+        nf_reset(skb);
+
+        /* No socket. Drop packet silently, if checksum is wrong */
+        if (udp_lib_checksum_complete(skb))
+                goto csum_error;
+
+        UDP_INC_STATS_BH(UDP_MIB_NOPORTS, IS_PROTO_UDPLITE(proto));
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+        /*
+         * Hmm.  We got an UDP packet to a port to which we
+         * don't wanna listen.  Ignore it.
+         */
+        kfree_skb(skb);
+        return 0;
+
+short_packet:
+        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
+                       IS_PROTO_UDPLITE(proto) ? "-Lite" : "",
+                       NIPQUAD(saddr),
+                       ntohs(uh->source),
+                       ulen,
+                       skb->len,
+                       NIPQUAD(daddr),
+                       ntohs(uh->dest));
+        goto drop;
+
+csum_error:
+        /*
+         * RFC1122: OK.  Discards the bad packet silently (as far as
+         * the network is concerned, anyway) as per 4.1.3.4 (MUST).
+         */
+        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
+                       IS_PROTO_UDPLITE(proto) ? "-Lite" : "",
+                       NIPQUAD(saddr),
+                       ntohs(uh->source),
+                       NIPQUAD(daddr),
+                       ntohs(uh->dest),
+                       ulen);
+drop:
+        UDP_INC_STATS_BH(UDP_MIB_INERRORS, IS_PROTO_UDPLITE(proto));
+        kfree_skb(skb);
+        return 0;
+}
+
+int udp_rcv(struct sk_buff *skb)
+{
+        return __udp4_lib_rcv(skb, udp_hash, IPPROTO_UDP);
+}
+
+int udp_destroy_sock(struct sock *sk)
+{
+        lock_sock(sk);
+        udp_flush_pending_frames(sk);
+        release_sock(sk);
+        return 0;
+}
+
+int udp_setsockopt(struct sock *sk, int level, int optname,
+                   char __user *optval, int optlen)
+{
+        if (IS_SOL_UDPFAMILY(level))
+                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
+                                          udp_push_pending_frames);
+        return ip_setsockopt(sk, level, optname, optval, optlen);
+}
+
+#ifdef CONFIG_COMPAT
+int compat_udp_setsockopt(struct sock *sk, int level, int optname,
+                          char __user *optval, int optlen)
+{
+        if (IS_SOL_UDPFAMILY(level))
+                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
+                                          udp_push_pending_frames);
+        return compat_ip_setsockopt(sk, level, optname, optval, optlen);
+}
+#endif
+
+int udp_getsockopt(struct sock *sk, int level, int optname,
+                   char __user *optval, int __user *optlen)
+{
+        if (IS_SOL_UDPFAMILY(level))
+                return udp_lib_getsockopt(sk, level, optname, optval, optlen);
+        return ip_getsockopt(sk, level, optname, optval, optlen);
+}
+
+#ifdef CONFIG_COMPAT
+int compat_udp_getsockopt(struct sock *sk, int level, int optname,
+                          char __user *optval, int __user *optlen)
+{
+        if (IS_SOL_UDPFAMILY(level))
+                return udp_lib_getsockopt(sk, level, optname, optval, optlen);
+        return compat_ip_getsockopt(sk, level, optname, optval, optlen);
+}
+#endif
+
+/* ------------------------------------------------------------------------ */
+DEFINE_PROTO_INUSE(udp)
+
+struct proto udp_prot = {
+        .name              = "UDP",
+        .owner             = THIS_MODULE,
+        .close             = udp_lib_close,
+        .connect           = ip4_datagram_connect,
+        .disconnect        = udp_disconnect,
+        .ioctl             = udp_ioctl,
+        .destroy           = udp_destroy_sock,
+        .setsockopt        = udp_setsockopt,
+        .getsockopt        = udp_getsockopt,
+        .sendmsg           = udp_sendmsg,
+        .recvmsg           = udp_recvmsg,
+        .sendpage          = udp_sendpage,
+        .backlog_rcv       = udp_queue_rcv_skb,
+        .hash              = udp_lib_hash,
+        .unhash            = udp_lib_unhash,
+        .get_port          = udp_v4_get_port,
+        .memory_allocated  = &udp_memory_allocated,
+        .sysctl_mem        = sysctl_udp_mem,
+        .sysctl_wmem       = &sysctl_udp_wmem_min,
+        .sysctl_rmem       = &sysctl_udp_rmem_min,
+        .obj_size          = sizeof(struct udp_sock),
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = compat_udp_setsockopt,
+        .compat_getsockopt = compat_udp_getsockopt,
+#endif
+        REF_PROTO_INUSE(udp)
+};
+
+/* ------------------------------------------------------------------------ */
+static void udp4_format_sock(struct sock *sp, char *tmpbuf, int bucket)
+{
+        struct inet_sock *inet = inet_sk(sp);
+        __be32 dest = inet->daddr;
+        __be32 src  = inet->rcv_saddr;
+        __u16 destp       = ntohs(inet->dport);
+        __u16 srcp        = ntohs(inet->sport);
+
+        sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p",
+                bucket, src, srcp, dest, destp, sp->sk_state,
+                atomic_read(&sp->sk_wmem_alloc),
+                atomic_read(&sp->sk_rmem_alloc),
+                0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
+                atomic_read(&sp->sk_refcnt), sp);
+}
+
+int udp4_seq_show(struct seq_file *seq, void *v)
+{
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "%-127s\n",
+                           "  sl  local_address rem_address   st tx_queue "
+                           "rx_queue tr tm->when retrnsmt   uid  timeout "
+                           "inode");
+        else {
+                char tmpbuf[129];
+                struct udp_iter_state *state = seq->private;
+
+                udp4_format_sock(v, tmpbuf, state->bucket);
+                seq_printf(seq, "%-127s\n", tmpbuf);
+        }
+        return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+#ifdef CONFIG_PROC_FS
+static struct file_operations udp4_seq_fops;
+static struct udp_seq_afinfo udp4_seq_afinfo = {
+        .owner          = THIS_MODULE,
+        .name           = "udp",
+        .family         = AF_INET,
+        .hashtable      = udp_hash,
+        .seq_show       = udp4_seq_show,
+        .seq_fops       = &udp4_seq_fops,
+};
+
+int __init udp4_proc_init(void)
+{
+        return udp_proc_register(&udp4_seq_afinfo);
+}
+
+void udp4_proc_exit(void)
+{
+        udp_proc_unregister(&udp4_seq_afinfo);
+}
+#endif /* CONFIG_PROC_FS */
+
+EXPORT_SYMBOL(udp_prot);
+EXPORT_SYMBOL(udp_sendmsg);
+
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite_ipv4.c
index 001b881ca36f..001b881ca36f 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite_ipv4.c
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 24f3aa0f2a35..107051f7c227 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -6,7 +6,7 @@ obj-$(CONFIG_IPV6) += ipv6.o
 
 ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
                 addrlabel.o \
-                route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o udplite.o \
+                route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp_ipv6.o \
                 raw.o protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
                 exthdrs.o datagram.o ip6_flowlabel.o inet6_connection_sock.o
 
@@ -16,6 +16,8 @@ ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \
 ipv6-$(CONFIG_NETFILTER) += netfilter.o
 ipv6-$(CONFIG_IPV6_MULTIPLE_TABLES) += fib6_rules.o
 ipv6-$(CONFIG_PROC_FS) += proc.o
+ipv6-$(CONFIG_SYN_COOKIES) += syncookies.o
+ipv6-$(CONFIG_IP_UDPLITE) += udplite_ipv6.o
 
 ipv6-objs += $(ipv6-y)
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 101e0e70ba27..c878fb681efb 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -493,7 +493,7 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
                 dev_forward_change((struct inet6_dev *)table->extra1);
 
         if (*p)
-                rt6_purge_dflt_routers();
+                rt6_purge_dflt_routers(net);
 }
 #endif
 
@@ -561,7 +561,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         write_lock(&addrconf_hash_lock);
 
         /* Ignore adding duplicate addresses on an interface */
-        if (ipv6_chk_same_addr(&init_net, addr, idev->dev)) {
+        if (ipv6_chk_same_addr(idev->dev->nd_net, addr, idev->dev)) {
                 ADBG(("ipv6_add_addr: already assigned\n"));
                 err = -EEXIST;
                 goto out;
@@ -751,9 +751,9 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
                 struct in6_addr prefix;
                 struct rt6_info *rt;
-
+                struct net *net = ifp->idev->dev->nd_net;
                 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
-                rt = rt6_lookup(&prefix, NULL, ifp->idev->dev->ifindex, 1);
+                rt = rt6_lookup(net, &prefix, NULL, ifp->idev->dev->ifindex, 1);
 
                 if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
                         if (onlink == 0) {
@@ -905,6 +905,7 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
 {
         struct ipv6_saddr_score hiscore;
         struct inet6_ifaddr *ifa_result = NULL;
+        struct net *net = daddr_dev->nd_net;
         int daddr_type = __ipv6_addr_type(daddr);
         int daddr_scope = __ipv6_addr_src_scope(daddr_type);
         int daddr_ifindex = daddr_dev ? daddr_dev->ifindex : 0;
@@ -916,7 +917,7 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
         read_lock(&dev_base_lock);
         rcu_read_lock();
 
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 struct inet6_dev *idev;
                 struct inet6_ifaddr *ifa;
 
@@ -1125,6 +1126,11 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                         if (hiscore.rule < 7)
                                 hiscore.rule++;
 #endif
+
+                        /* Skip rule 8 for orchid -> non-orchid address pairs. */
+                        if (ipv6_addr_orchid(&ifa->addr) && !ipv6_addr_orchid(daddr))
+                                continue;
+
                         /* Rule 8: Use longest matching prefix */
                         if (hiscore.rule < 8) {
                                 hiscore.matchlen = ipv6_addr_diff(&ifa_result->addr, daddr);
@@ -1162,14 +1168,7 @@ record_it:
         return 0;
 }
 
-
-int ipv6_get_saddr(struct dst_entry *dst,
-                   struct in6_addr *daddr, struct in6_addr *saddr)
-{
-        return ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL, daddr, saddr);
-}
-
-EXPORT_SYMBOL(ipv6_get_saddr);
+EXPORT_SYMBOL(ipv6_dev_get_saddr);
 
 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
                     unsigned char banned_flags)
@@ -1557,7 +1556,7 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
                 .fc_expires = expires,
                 .fc_dst_len = plen,
                 .fc_flags = RTF_UP | flags,
-                .fc_nlinfo.nl_net = &init_net,
+                .fc_nlinfo.nl_net = dev->nd_net,
         };
 
         ipv6_addr_copy(&cfg.fc_dst, pfx);
@@ -1584,7 +1583,7 @@ static void addrconf_add_mroute(struct net_device *dev)
                 .fc_ifindex = dev->ifindex,
                 .fc_dst_len = 8,
                 .fc_flags = RTF_UP,
-                .fc_nlinfo.nl_net = &init_net,
+                .fc_nlinfo.nl_net = dev->nd_net,
         };
 
         ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
@@ -1601,7 +1600,7 @@ static void sit_route_add(struct net_device *dev)
                 .fc_ifindex = dev->ifindex,
                 .fc_dst_len = 96,
                 .fc_flags = RTF_UP | RTF_NONEXTHOP,
-                .fc_nlinfo.nl_net = &init_net,
+                .fc_nlinfo.nl_net = dev->nd_net,
         };
 
         /* prefix length - 96 bits "::d.d.d.d" */
@@ -1702,7 +1701,8 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
 
         if (pinfo->onlink) {
                 struct rt6_info *rt;
-                rt = rt6_lookup(&pinfo->prefix, NULL, dev->ifindex, 1);
+                rt = rt6_lookup(dev->nd_net, &pinfo->prefix, NULL,
+                                dev->ifindex, 1);
 
                 if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
                         if (rt->rt6i_flags&RTF_EXPIRES) {
@@ -1745,7 +1745,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
 
 ok:
 
-                ifp = ipv6_get_ifaddr(&init_net, &addr, dev, 1);
+                ifp = ipv6_get_ifaddr(dev->nd_net, &addr, dev, 1);
 
                 if (ifp == NULL && valid_lft) {
                         int max_addresses = in6_dev->cnf.max_addresses;
@@ -1868,7 +1868,7 @@ ok:
  *      Special case for SIT interfaces where we create a new "virtual"
  *      device.
  */
-int addrconf_set_dstaddr(void __user *arg)
+int addrconf_set_dstaddr(struct net *net, void __user *arg)
 {
         struct in6_ifreq ireq;
         struct net_device *dev;
@@ -1880,7 +1880,7 @@ int addrconf_set_dstaddr(void __user *arg)
         if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
                 goto err_exit;
 
-        dev = __dev_get_by_index(&init_net, ireq.ifr6_ifindex);
+        dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
 
         err = -ENODEV;
         if (dev == NULL)
@@ -1911,7 +1911,8 @@ int addrconf_set_dstaddr(void __user *arg)
 
                 if (err == 0) {
                         err = -ENOBUFS;
-                        if ((dev = __dev_get_by_name(&init_net, p.name)) == NULL)
+                        dev = __dev_get_by_name(net, p.name);
+                        if (!dev)
                                 goto err_exit;
                         err = dev_open(dev);
                 }
@@ -1926,8 +1927,9 @@ err_exit:
 /*
  *      Manual configuration of address on an interface
  */
-static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen,
-                          __u8 ifa_flags, __u32 prefered_lft, __u32 valid_lft)
+static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
+                          int plen, __u8 ifa_flags, __u32 prefered_lft,
+                          __u32 valid_lft)
 {
         struct inet6_ifaddr *ifp;
         struct inet6_dev *idev;
@@ -1941,7 +1943,8 @@ static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen,
         if (!valid_lft || prefered_lft > valid_lft)
                 return -EINVAL;
 
-        if ((dev = __dev_get_by_index(&init_net, ifindex)) == NULL)
+        dev = __dev_get_by_index(net, ifindex);
+        if (!dev)
                 return -ENODEV;
 
         if ((idev = addrconf_add_dev(dev)) == NULL)
@@ -1986,13 +1989,15 @@ static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen,
         return PTR_ERR(ifp);
 }
 
-static int inet6_addr_del(int ifindex, struct in6_addr *pfx, int plen)
+static int inet6_addr_del(struct net *net, int ifindex, struct in6_addr *pfx,
+                          int plen)
 {
         struct inet6_ifaddr *ifp;
         struct inet6_dev *idev;
         struct net_device *dev;
 
-        if ((dev = __dev_get_by_index(&init_net, ifindex)) == NULL)
+        dev = __dev_get_by_index(net, ifindex);
+        if (!dev)
                 return -ENODEV;
 
         if ((idev = __in6_dev_get(dev)) == NULL)
@@ -2020,7 +2025,7 @@ static int inet6_addr_del(int ifindex, struct in6_addr *pfx, int plen)
 }
 
 
-int addrconf_add_ifaddr(void __user *arg)
+int addrconf_add_ifaddr(struct net *net, void __user *arg)
 {
         struct in6_ifreq ireq;
         int err;
@@ -2032,13 +2037,14 @@ int addrconf_add_ifaddr(void __user *arg)
                 return -EFAULT;
 
         rtnl_lock();
-        err = inet6_addr_add(ireq.ifr6_ifindex, &ireq.ifr6_addr, ireq.ifr6_prefixlen,
-                             IFA_F_PERMANENT, INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
+        err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr,
+                             ireq.ifr6_prefixlen, IFA_F_PERMANENT,
+                             INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
         rtnl_unlock();
         return err;
 }
 
-int addrconf_del_ifaddr(void __user *arg)
+int addrconf_del_ifaddr(struct net *net, void __user *arg)
 {
         struct in6_ifreq ireq;
         int err;
@@ -2050,7 +2056,8 @@ int addrconf_del_ifaddr(void __user *arg)
                 return -EFAULT;
 
         rtnl_lock();
-        err = inet6_addr_del(ireq.ifr6_ifindex, &ireq.ifr6_addr, ireq.ifr6_prefixlen);
+        err = inet6_addr_del(net, ireq.ifr6_ifindex, &ireq.ifr6_addr,
+                             ireq.ifr6_prefixlen);
         rtnl_unlock();
         return err;
 }
@@ -2061,6 +2068,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         struct inet6_ifaddr * ifp;
         struct in6_addr addr;
         struct net_device *dev;
+        struct net *net = idev->dev->nd_net;
         int scope;
 
         ASSERT_RTNL();
@@ -2087,7 +2095,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                 return;
         }
 
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 struct in_device * in_dev = __in_dev_get_rtnl(dev);
                 if (in_dev && (dev->flags & IFF_UP)) {
                         struct in_ifaddr * ifa;
@@ -2250,15 +2258,16 @@ ipv6_inherit_linklocal(struct inet6_dev *idev, struct net_device *link_dev)
 static void ip6_tnl_add_linklocal(struct inet6_dev *idev)
 {
         struct net_device *link_dev;
+        struct net *net = idev->dev->nd_net;
 
         /* first try to inherit the link-local address from the link device */
         if (idev->dev->iflink &&
-            (link_dev = __dev_get_by_index(&init_net, idev->dev->iflink))) {
+            (link_dev = __dev_get_by_index(net, idev->dev->iflink))) {
                 if (!ipv6_inherit_linklocal(idev, link_dev))
                         return;
         }
         /* then try to inherit it from any device */
-        for_each_netdev(&init_net, link_dev) {
+        for_each_netdev(net, link_dev) {
                 if (!ipv6_inherit_linklocal(idev, link_dev))
                         return;
         }
@@ -2291,9 +2300,6 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
         int run_pending = 0;
         int err;
 
-        if (dev->nd_net != &init_net)
-                return NOTIFY_DONE;
-
         switch(event) {
         case NETDEV_REGISTER:
                 if (!idev && dev->mtu >= IPV6_MIN_MTU) {
@@ -2433,6 +2439,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 {
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa, **bifa;
+        struct net *net = dev->nd_net;
         int i;
 
         ASSERT_RTNL();
@@ -2440,7 +2447,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         if (dev == init_net.loopback_dev && how == 1)
                 how = 0;
 
-        rt6_ifdown(dev);
+        rt6_ifdown(net, dev);
         neigh_ifdown(&nd_tbl, dev);
 
         idev = __in6_dev_get(dev);
@@ -3050,9 +3057,6 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         struct in6_addr *pfx;
         int err;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
         if (err < 0)
                 return err;
@@ -3062,7 +3066,7 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         if (pfx == NULL)
                 return -EINVAL;
 
-        return inet6_addr_del(ifm->ifa_index, pfx, ifm->ifa_prefixlen);
+        return inet6_addr_del(net, ifm->ifa_index, pfx, ifm->ifa_prefixlen);
 }
 
 static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
@@ -3115,9 +3119,6 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         u8 ifa_flags;
         int err;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
         if (err < 0)
                 return err;
@@ -3138,7 +3139,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 valid_lft = INFINITY_LIFE_TIME;
         }
 
-        dev =  __dev_get_by_index(&init_net, ifm->ifa_index);
+        dev =  __dev_get_by_index(net, ifm->ifa_index);
         if (dev == NULL)
                 return -ENODEV;
 
@@ -3151,8 +3152,9 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                  * It would be best to check for !NLM_F_CREATE here but
                  * userspace alreay relies on not having to provide this.
                  */
-                return inet6_addr_add(ifm->ifa_index, pfx, ifm->ifa_prefixlen,
-                                      ifa_flags, preferred_lft, valid_lft);
+                return inet6_addr_add(net, ifm->ifa_index, pfx,
+                                      ifm->ifa_prefixlen, ifa_flags,
+                                      preferred_lft, valid_lft);
         }
 
         if (nlh->nlmsg_flags & NLM_F_EXCL ||
@@ -3317,12 +3319,13 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
         struct inet6_ifaddr *ifa;
         struct ifmcaddr6 *ifmca;
         struct ifacaddr6 *ifaca;
+        struct net *net = skb->sk->sk_net;
 
         s_idx = cb->args[0];
         s_ip_idx = ip_idx = cb->args[1];
 
         idx = 0;
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 if (idx < s_idx)
                         goto cont;
                 if (idx > s_idx)
@@ -3389,35 +3392,23 @@ cont:
 
 static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net *net = skb->sk->sk_net;
         enum addr_type_t type = UNICAST_ADDR;
 
-        if (net != &init_net)
-                return 0;
-
         return inet6_dump_addr(skb, cb, type);
 }
 
 static int inet6_dump_ifmcaddr(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net *net = skb->sk->sk_net;
         enum addr_type_t type = MULTICAST_ADDR;
 
-        if (net != &init_net)
-                return 0;
-
         return inet6_dump_addr(skb, cb, type);
 }
 
 
 static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net *net = skb->sk->sk_net;
         enum addr_type_t type = ANYCAST_ADDR;
 
-        if (net != &init_net)
-                return 0;
-
         return inet6_dump_addr(skb, cb, type);
 }
 
@@ -3433,9 +3424,6 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
         struct sk_buff *skb;
         int err;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
         if (err < 0)
                 goto errout;
@@ -3448,7 +3436,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
 
         ifm = nlmsg_data(nlh);
         if (ifm->ifa_index)
-                dev = __dev_get_by_index(&init_net, ifm->ifa_index);
+                dev = __dev_get_by_index(net, ifm->ifa_index);
 
         if ((ifa = ipv6_get_ifaddr(net, addr, dev, 1)) == NULL) {
                 err = -EADDRNOTAVAIL;
@@ -3468,7 +3456,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
                 kfree_skb(skb);
                 goto errout_ifa;
         }
-        err = rtnl_unicast(skb, &init_net, NETLINK_CB(in_skb).pid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
 errout_ifa:
         in6_ifa_put(ifa);
 errout:
@@ -3478,6 +3466,7 @@ errout:
 static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
 {
         struct sk_buff *skb;
+        struct net *net = ifa->idev->dev->nd_net;
         int err = -ENOBUFS;
 
         skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
@@ -3491,10 +3480,10 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
                 kfree_skb(skb);
                 goto errout;
         }
-        err = rtnl_notify(skb, &init_net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
+        err = rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
-                rtnl_set_sk_err(&init_net, RTNLGRP_IPV6_IFADDR, err);
+                rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
 }
 
 static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
@@ -3659,12 +3648,9 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         struct inet6_dev *idev;
 
-        if (net != &init_net)
-                return 0;
-
         read_lock(&dev_base_lock);
         idx = 0;
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 if (idx < s_idx)
                         goto cont;
                 if ((idev = in6_dev_get(dev)) == NULL)
@@ -3686,6 +3672,7 @@ cont:
 void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
 {
         struct sk_buff *skb;
+        struct net *net = idev->dev->nd_net;
         int err = -ENOBUFS;
 
         skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
@@ -3699,10 +3686,10 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
                 kfree_skb(skb);
                 goto errout;
         }
-        err = rtnl_notify(skb, &init_net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
+        err = rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
-                rtnl_set_sk_err(&init_net, RTNLGRP_IPV6_IFADDR, err);
+                rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
 }
 
 static inline size_t inet6_prefix_nlmsg_size(void)
@@ -3755,6 +3742,7 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                          struct prefix_info *pinfo)
 {
         struct sk_buff *skb;
+        struct net *net = idev->dev->nd_net;
         int err = -ENOBUFS;
 
         skb = nlmsg_new(inet6_prefix_nlmsg_size(), GFP_ATOMIC);
@@ -3768,10 +3756,10 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                 kfree_skb(skb);
                 goto errout;
         }
-        err = rtnl_notify(skb, &init_net, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
+        err = rtnl_notify(skb, net, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
-                rtnl_set_sk_err(&init_net, RTNLGRP_IPV6_PREFIX, err);
+                rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
 }
 
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
@@ -4261,6 +4249,41 @@ int unregister_inet6addr_notifier(struct notifier_block *nb)
 
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
 
+
+static int addrconf_net_init(struct net *net)
+{
+        return 0;
+}
+
+static void addrconf_net_exit(struct net *net)
+{
+        struct net_device *dev;
+
+        /*
+         * Remove loopback references from default routing entries
+         */
+/*      in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev); */
+/* #ifdef CONFIG_IPV6_MULTIPLE_TABLES */
+/*      in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev); */
+/*      in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev); */
+/* #endif */
+
+        rtnl_lock();
+        /* clean dev list */
+        for_each_netdev(net, dev) {
+                if (__in6_dev_get(dev) == NULL)
+                        continue;
+                addrconf_ifdown(dev, 1);
+        }
+        addrconf_ifdown(net->loopback_dev, 2);
+        rtnl_unlock();
+}
+
+static struct pernet_operations addrconf_net_ops = {
+        .init = addrconf_net_init,
+        .exit = addrconf_net_exit,
+};
+
 /*
  *      Init / cleanup code
  */
@@ -4302,14 +4325,9 @@ int __init addrconf_init(void)
         if (err)
                 goto errlo;
 
-        ip6_null_entry.u.dst.dev = init_net.loopback_dev;
-        ip6_null_entry.rt6i_idev = in6_dev_get(init_net.loopback_dev);
-#ifdef CONFIG_IPV6_MULTIPLE_TABLES
-        ip6_prohibit_entry.u.dst.dev = init_net.loopback_dev;
-        ip6_prohibit_entry.rt6i_idev = in6_dev_get(init_net.loopback_dev);
-        ip6_blk_hole_entry.u.dst.dev = init_net.loopback_dev;
-        ip6_blk_hole_entry.rt6i_idev = in6_dev_get(init_net.loopback_dev);
-#endif
+        err = register_pernet_device(&addrconf_net_ops);
+        if (err)
+                return err;
 
         register_netdevice_notifier(&ipv6_dev_notf);
 
@@ -4339,31 +4357,19 @@ errlo:
 
 void addrconf_cleanup(void)
 {
-        struct net_device *dev;
         struct inet6_ifaddr *ifa;
         int i;
 
         unregister_netdevice_notifier(&ipv6_dev_notf);
+        unregister_pernet_device(&addrconf_net_ops);
 
         unregister_pernet_subsys(&addrconf_ops);
 
         rtnl_lock();
 
         /*
-         *      clean dev list.
-         */
-
-        for_each_netdev(&init_net, dev) {
-                if (__in6_dev_get(dev) == NULL)
-                        continue;
-                addrconf_ifdown(dev, 1);
-        }
-        addrconf_ifdown(init_net.loopback_dev, 2);
-
-        /*
          *      Check hash table.
          */
-
         write_lock_bh(&addrconf_hash_lock);
         for (i=0; i < IN6_ADDR_HSIZE; i++) {
                 for (ifa=inet6_addr_lst[i]; ifa; ) {
@@ -4380,6 +4386,7 @@ void addrconf_cleanup(void)
         write_unlock_bh(&addrconf_hash_lock);
 
         del_timer(&addr_chk_timer);
-
         rtnl_unlock();
+
+        unregister_pernet_subsys(&addrconf_net_ops);
 }
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index a3c5a72218fd..3a8b3f52da35 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -58,6 +58,7 @@ static struct ip6addrlbl_table
  * ::ffff:0:0/96        V4MAPPED        4
  * fc00::/7             N/A             5               ULA (RFC 4193)
  * 2001::/32            N/A             6               Teredo (RFC 4380)
+ * 2001:10::/28         N/A             7               ORCHID (RFC 4843)
  *
  * Note: 0xffffffff is used if we do not have any policies.
  */
@@ -85,6 +86,10 @@ static const __initdata struct ip6addrlbl_init_table
                 .prefix = &(struct in6_addr){{{ 0x20, 0x01 }}},
                 .prefixlen = 32,
                 .label = 6,
+        },{     /* 2001:10::/28 */
+                .prefix = &(struct in6_addr){{{ 0x20, 0x01, 0x00, 0x10 }}},
+                .prefixlen = 28,
+                .label = 7,
         },{     /* ::ffff:0:0 */
                 .prefix = &(struct in6_addr){{{ [10] = 0xff, [11] = 0xff }}},
                 .prefixlen = 96,
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index f0aa97738746..afe9276d0420 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -92,9 +92,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol)
         int try_loading_module = 0;
         int err;
 
-        if (net != &init_net)
-                return -EAFNOSUPPORT;
-
         if (sock->type != SOCK_RAW &&
             sock->type != SOCK_DGRAM &&
             !inet_ehash_secret)
@@ -248,6 +245,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sock *sk = sock->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
+        struct net *net = sk->sk_net;
         __be32 v4addr = 0;
         unsigned short snum;
         int addr_type = 0;
@@ -278,7 +276,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         /* Check if the address belongs to the host. */
         if (addr_type == IPV6_ADDR_MAPPED) {
                 v4addr = addr->sin6_addr.s6_addr32[3];
-                if (inet_addr_type(&init_net, v4addr) != RTN_LOCAL) {
+                if (inet_addr_type(net, v4addr) != RTN_LOCAL) {
                         err = -EADDRNOTAVAIL;
                         goto out;
                 }
@@ -300,7 +298,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                         err = -EINVAL;
                                         goto out;
                                 }
-                                dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
                                 if (!dev) {
                                         err = -ENODEV;
                                         goto out;
@@ -312,7 +310,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                          */
                         v4addr = LOOPBACK4_IPV6;
                         if (!(addr_type & IPV6_ADDR_MULTICAST)) {
-                                if (!ipv6_chk_addr(&init_net, &addr->sin6_addr,
+                                if (!ipv6_chk_addr(net, &addr->sin6_addr,
                                                    dev, 0)) {
                                         if (dev)
                                                 dev_put(dev);
@@ -440,6 +438,7 @@ EXPORT_SYMBOL(inet6_getname);
 int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
+        struct net *net = sk->sk_net;
 
         switch(cmd)
         {
@@ -452,14 +451,14 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         case SIOCADDRT:
         case SIOCDELRT:
 
-                return(ipv6_route_ioctl(cmd,(void __user *)arg));
+                return(ipv6_route_ioctl(net, cmd, (void __user *)arg));
 
         case SIOCSIFADDR:
-                return addrconf_add_ifaddr((void __user *) arg);
+                return addrconf_add_ifaddr(net, (void __user *) arg);
         case SIOCDIFADDR:
-                return addrconf_del_ifaddr((void __user *) arg);
+                return addrconf_del_ifaddr(net, (void __user *) arg);
         case SIOCSIFDSTADDR:
-                return addrconf_set_dstaddr((void __user *) arg);
+                return addrconf_set_dstaddr(net, (void __user *) arg);
         default:
                 if (!sk->sk_prot->ioctl)
                         return -ENOIOCTLCMD;
@@ -678,6 +677,129 @@ int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
 
 EXPORT_SYMBOL_GPL(ipv6_opt_accepted);
 
+static struct inet6_protocol *ipv6_gso_pull_exthdrs(struct sk_buff *skb,
+                                                    int proto)
+{
+        struct inet6_protocol *ops = NULL;
+
+        for (;;) {
+                struct ipv6_opt_hdr *opth;
+                int len;
+
+                if (proto != NEXTHDR_HOP) {
+                        ops = rcu_dereference(inet6_protos[proto]);
+
+                        if (unlikely(!ops))
+                                break;
+
+                        if (!(ops->flags & INET6_PROTO_GSO_EXTHDR))
+                                break;
+                }
+
+                if (unlikely(!pskb_may_pull(skb, 8)))
+                        break;
+
+                opth = (void *)skb->data;
+                len = ipv6_optlen(opth);
+
+                if (unlikely(!pskb_may_pull(skb, len)))
+                        break;
+
+                proto = opth->nexthdr;
+                __skb_pull(skb, len);
+        }
+
+        return ops;
+}
+
+static int ipv6_gso_send_check(struct sk_buff *skb)
+{
+        struct ipv6hdr *ipv6h;
+        struct inet6_protocol *ops;
+        int err = -EINVAL;
+
+        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+                goto out;
+
+        ipv6h = ipv6_hdr(skb);
+        __skb_pull(skb, sizeof(*ipv6h));
+        err = -EPROTONOSUPPORT;
+
+        rcu_read_lock();
+        ops = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
+        if (likely(ops && ops->gso_send_check)) {
+                skb_reset_transport_header(skb);
+                err = ops->gso_send_check(skb);
+        }
+        rcu_read_unlock();
+
+out:
+        return err;
+}
+
+static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        struct ipv6hdr *ipv6h;
+        struct inet6_protocol *ops;
+
+        if (!(features & NETIF_F_V6_CSUM))
+                features &= ~NETIF_F_SG;
+
+        if (unlikely(skb_shinfo(skb)->gso_type &
+                     ~(SKB_GSO_UDP |
+                       SKB_GSO_DODGY |
+                       SKB_GSO_TCP_ECN |
+                       SKB_GSO_TCPV6 |
+                       0)))
+                goto out;
+
+        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+                goto out;
+
+        ipv6h = ipv6_hdr(skb);
+        __skb_pull(skb, sizeof(*ipv6h));
+        segs = ERR_PTR(-EPROTONOSUPPORT);
+
+        rcu_read_lock();
+        ops = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
+        if (likely(ops && ops->gso_segment)) {
+                skb_reset_transport_header(skb);
+                segs = ops->gso_segment(skb, features);
+        }
+        rcu_read_unlock();
+
+        if (unlikely(IS_ERR(segs)))
+                goto out;
+
+        for (skb = segs; skb; skb = skb->next) {
+                ipv6h = ipv6_hdr(skb);
+                ipv6h->payload_len = htons(skb->len - skb->mac_len -
+                                           sizeof(*ipv6h));
+        }
+
+out:
+        return segs;
+}
+
+static struct packet_type ipv6_packet_type = {
+        .type = __constant_htons(ETH_P_IPV6),
+        .func = ipv6_rcv,
+        .gso_send_check = ipv6_gso_send_check,
+        .gso_segment = ipv6_gso_segment,
+};
+
+static int __init ipv6_packet_init(void)
+{
+        dev_add_pack(&ipv6_packet_type);
+        return 0;
+}
+
+static void ipv6_packet_cleanup(void)
+{
+        dev_remove_pack(&ipv6_packet_type);
+}
+
 static int __init init_ipv6_mibs(void)
 {
         if (snmp_mib_init((void **)ipv6_statistics,
@@ -691,12 +813,16 @@ static int __init init_ipv6_mibs(void)
                 goto err_icmpmsg_mib;
         if (snmp_mib_init((void **)udp_stats_in6, sizeof (struct udp_mib)) < 0)
                 goto err_udp_mib;
+#ifdef CONFIG_IP_UDPLITE
         if (snmp_mib_init((void **)udplite_stats_in6,
                           sizeof (struct udp_mib)) < 0)
                 goto err_udplite_mib;
+#endif
         return 0;
 
+#ifdef CONFIG_IP_UDPLITE
 err_udplite_mib:
+#endif
         snmp_mib_free((void **)udp_stats_in6);
 err_udp_mib:
         snmp_mib_free((void **)icmpv6msg_statistics);
@@ -715,7 +841,9 @@ static void cleanup_ipv6_mibs(void)
         snmp_mib_free((void **)icmpv6_statistics);
         snmp_mib_free((void **)icmpv6msg_statistics);
         snmp_mib_free((void **)udp_stats_in6);
+#ifdef CONFIG_IP_UDPLITE
         snmp_mib_free((void **)udplite_stats_in6);
+#endif
 }
 
 static int inet6_net_init(struct net *net)
@@ -760,9 +888,11 @@ static int __init inet6_init(void)
         if (err)
                 goto out_unregister_tcp_proto;
 
+#ifdef CONFIG_IP_UDPLITE
         err = proto_register(&udplitev6_prot, 1);
         if (err)
                 goto out_unregister_udp_proto;
+#endif
 
         err = proto_register(&rawv6_prot, 1);
         if (err)
@@ -802,19 +932,13 @@ static int __init inet6_init(void)
         err = register_pernet_subsys(&inet6_net_ops);
         if (err)
                 goto register_pernet_fail;
-
-#ifdef CONFIG_SYSCTL
-        err = ipv6_sysctl_register();
-        if (err)
-                goto sysctl_fail;
-#endif
-        err = icmpv6_init(&inet6_family_ops);
+        err = icmpv6_init();
         if (err)
                 goto icmp_fail;
-        err = ndisc_init(&inet6_family_ops);
+        err = ndisc_init();
         if (err)
                 goto ndisc_fail;
-        err = igmp6_init(&inet6_family_ops);
+        err = igmp6_init();
         if (err)
                 goto igmp_fail;
         err = ipv6_netfilter_init();
@@ -874,9 +998,19 @@ static int __init inet6_init(void)
         err = ipv6_packet_init();
         if (err)
                 goto ipv6_packet_fail;
+
+#ifdef CONFIG_SYSCTL
+        err = ipv6_sysctl_register();
+        if (err)
+                goto sysctl_fail;
+#endif
 out:
         return err;
 
+#ifdef CONFIG_SYSCTL
+sysctl_fail:
+        ipv6_packet_cleanup();
+#endif
 ipv6_packet_fail:
         tcpv6_exit();
 tcpv6_fail:
@@ -918,10 +1052,6 @@ igmp_fail:
 ndisc_fail:
         icmpv6_cleanup();
 icmp_fail:
-#ifdef CONFIG_SYSCTL
-        ipv6_sysctl_unregister();
-sysctl_fail:
-#endif
         unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
         cleanup_ipv6_mibs();
@@ -933,8 +1063,10 @@ out_sock_register_fail:
 out_unregister_raw_proto:
         proto_unregister(&rawv6_prot);
 out_unregister_udplite_proto:
+#ifdef CONFIG_IP_UDPLITE
         proto_unregister(&udplitev6_prot);
 out_unregister_udp_proto:
+#endif
         proto_unregister(&udpv6_prot);
 out_unregister_tcp_proto:
         proto_unregister(&tcpv6_prot);
@@ -949,8 +1081,13 @@ static void __exit inet6_exit(void)
         /* Disallow any further netlink messages */
         rtnl_unregister_all(PF_INET6);
 
+#ifdef CONFIG_SYSCTL
+        ipv6_sysctl_unregister();
+#endif
         udpv6_exit();
+#ifdef CONFIG_IP_UDPLITE
         udplitev6_exit();
+#endif
         tcpv6_exit();
 
         /* Cleanup code parts. */
@@ -976,13 +1113,13 @@ static void __exit inet6_exit(void)
         ndisc_cleanup();
         icmpv6_cleanup();
         rawv6_exit();
-#ifdef CONFIG_SYSCTL
-        ipv6_sysctl_unregister();
-#endif
+
         unregister_pernet_subsys(&inet6_net_ops);
         cleanup_ipv6_mibs();
         proto_unregister(&rawv6_prot);
+#ifdef CONFIG_IP_UDPLITE
         proto_unregister(&udplitev6_prot);
+#endif
         proto_unregister(&udpv6_prot);
         proto_unregister(&tcpv6_prot);
 }
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 9c7f83fbc3a1..96868b994b37 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -101,7 +101,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, struct in6_addr *addr)
         if (ifindex == 0) {
                 struct rt6_info *rt;
 
-                rt = rt6_lookup(addr, NULL, 0, 0);
+                rt = rt6_lookup(&init_net, addr, NULL, 0, 0);
                 if (rt) {
                         dev = rt->rt6i_dev;
                         dev_hold(dev);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 695c0ca8a417..55137408f054 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -29,24 +29,22 @@ struct fib6_rule
         u8                      tclass;
 };
 
-static struct fib_rules_ops fib6_rules_ops;
-
-struct dst_entry *fib6_rule_lookup(struct flowi *fl, int flags,
-                                   pol_lookup_t lookup)
+struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
+                                   int flags, pol_lookup_t lookup)
 {
         struct fib_lookup_arg arg = {
                 .lookup_ptr = lookup,
         };
 
-        fib_rules_lookup(&fib6_rules_ops, fl, flags, &arg);
+        fib_rules_lookup(net->ipv6.fib6_rules_ops, fl, flags, &arg);
         if (arg.rule)
                 fib_rule_put(arg.rule);
 
         if (arg.result)
                 return arg.result;
 
-        dst_hold(&ip6_null_entry.u.dst);
-        return &ip6_null_entry.u.dst;
+        dst_hold(&net->ipv6.ip6_null_entry->u.dst);
+        return &net->ipv6.ip6_null_entry->u.dst;
 }
 
 static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
@@ -54,28 +52,29 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
 {
         struct rt6_info *rt = NULL;
         struct fib6_table *table;
+        struct net *net = rule->fr_net;
         pol_lookup_t lookup = arg->lookup_ptr;
 
         switch (rule->action) {
         case FR_ACT_TO_TBL:
                 break;
         case FR_ACT_UNREACHABLE:
-                rt = &ip6_null_entry;
+                rt = net->ipv6.ip6_null_entry;
                 goto discard_pkt;
         default:
         case FR_ACT_BLACKHOLE:
-                rt = &ip6_blk_hole_entry;
+                rt = net->ipv6.ip6_blk_hole_entry;
                 goto discard_pkt;
         case FR_ACT_PROHIBIT:
-                rt = &ip6_prohibit_entry;
+                rt = net->ipv6.ip6_prohibit_entry;
                 goto discard_pkt;
         }
 
-        table = fib6_get_table(rule->table);
+        table = fib6_get_table(net, rule->table);
         if (table)
-                rt = lookup(table, flp, flags);
+                rt = lookup(net, table, flp, flags);
 
-        if (rt != &ip6_null_entry) {
+        if (rt != net->ipv6.ip6_null_entry) {
                 struct fib6_rule *r = (struct fib6_rule *)rule;
 
                 /*
@@ -85,8 +84,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                 if ((rule->flags & FIB_RULE_FIND_SADDR) &&
                     r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
                         struct in6_addr saddr;
-                        if (ipv6_get_saddr(&rt->u.dst, &flp->fl6_dst,
-                                           &saddr))
+                        if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                                               &flp->fl6_dst, &saddr))
                                 goto again;
                         if (!ipv6_prefix_equal(&saddr, &r->src.addr,
                                                r->src.plen))
@@ -145,13 +144,14 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                                struct nlattr **tb)
 {
         int err = -EINVAL;
+        struct net *net = skb->sk->sk_net;
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
         if (rule->action == FR_ACT_TO_TBL) {
                 if (rule->table == RT6_TABLE_UNSPEC)
                         goto errout;
 
-                if (fib6_new_table(rule->table) == NULL) {
+                if (fib6_new_table(net, rule->table) == NULL) {
                         err = -ENOBUFS;
                         goto errout;
                 }
@@ -234,7 +234,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
                + nla_total_size(16); /* src */
 }
 
-static struct fib_rules_ops fib6_rules_ops = {
+static struct fib_rules_ops fib6_rules_ops_template = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
         .addr_size              = sizeof(struct in6_addr),
@@ -247,45 +247,64 @@ static struct fib_rules_ops fib6_rules_ops = {
         .nlmsg_payload          = fib6_rule_nlmsg_payload,
         .nlgroup                = RTNLGRP_IPV6_RULE,
         .policy                 = fib6_rule_policy,
-        .rules_list             = LIST_HEAD_INIT(fib6_rules_ops.rules_list),
         .owner                  = THIS_MODULE,
         .fro_net                = &init_net,
 };
 
-static int __init fib6_default_rules_init(void)
+static int fib6_rules_net_init(struct net *net)
 {
-        int err;
+        int err = -ENOMEM;
 
-        err = fib_default_rule_add(&fib6_rules_ops, 0,
-                                   RT6_TABLE_LOCAL, FIB_RULE_PERMANENT);
-        if (err < 0)
-                return err;
-        err = fib_default_rule_add(&fib6_rules_ops, 0x7FFE, RT6_TABLE_MAIN, 0);
-        if (err < 0)
-                return err;
-        return 0;
-}
+        net->ipv6.fib6_rules_ops = kmemdup(&fib6_rules_ops_template,
+                                           sizeof(*net->ipv6.fib6_rules_ops),
+                                           GFP_KERNEL);
+        if (!net->ipv6.fib6_rules_ops)
+                goto out;
 
-int __init fib6_rules_init(void)
-{
-        int ret;
+        net->ipv6.fib6_rules_ops->fro_net = net;
+        INIT_LIST_HEAD(&net->ipv6.fib6_rules_ops->rules_list);
 
-        ret = fib6_default_rules_init();
-        if (ret)
-                goto out;
+        err = fib_default_rule_add(net->ipv6.fib6_rules_ops, 0,
+                                   RT6_TABLE_LOCAL, FIB_RULE_PERMANENT);
+        if (err)
+                goto out_fib6_rules_ops;
 
-        ret = fib_rules_register(&fib6_rules_ops);
-        if (ret)
-                goto out_default_rules_init;
+        err = fib_default_rule_add(net->ipv6.fib6_rules_ops,
+                                   0x7FFE, RT6_TABLE_MAIN, 0);
+        if (err)
+                goto out_fib6_default_rule_add;
+
+        err = fib_rules_register(net->ipv6.fib6_rules_ops);
+        if (err)
+                goto out_fib6_default_rule_add;
 out:
-        return ret;
+        return err;
 
-out_default_rules_init:
-        fib_rules_cleanup_ops(&fib6_rules_ops);
+out_fib6_default_rule_add:
+        fib_rules_cleanup_ops(net->ipv6.fib6_rules_ops);
+out_fib6_rules_ops:
+        kfree(net->ipv6.fib6_rules_ops);
         goto out;
 }
 
+static void fib6_rules_net_exit(struct net *net)
+{
+        fib_rules_unregister(net->ipv6.fib6_rules_ops);
+        kfree(net->ipv6.fib6_rules_ops);
+}
+
+static struct pernet_operations fib6_rules_net_ops = {
+        .init = fib6_rules_net_init,
+        .exit = fib6_rules_net_exit,
+};
+
+int __init fib6_rules_init(void)
+{
+        return register_pernet_subsys(&fib6_rules_net_ops);
+}
+
+
 void fib6_rules_cleanup(void)
 {
-        fib_rules_unregister(&fib6_rules_ops);
+        return unregister_pernet_subsys(&fib6_rules_net_ops);
 }
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 121d517bf91c..6b5391ab8346 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -80,8 +80,10 @@ EXPORT_SYMBOL(icmpv6msg_statistics);
  *
  *      On SMP we have one ICMP socket per-cpu.
  */
-static DEFINE_PER_CPU(struct socket *, __icmpv6_socket) = NULL;
-#define icmpv6_socket   __get_cpu_var(__icmpv6_socket)
+static inline struct sock *icmpv6_sk(struct net *net)
+{
+        return net->ipv6.icmp_sk[smp_processor_id()];
+}
 
 static int icmpv6_rcv(struct sk_buff *skb);
 
@@ -90,11 +92,11 @@ static struct inet6_protocol icmpv6_protocol = {
         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
-static __inline__ int icmpv6_xmit_lock(void)
+static __inline__ int icmpv6_xmit_lock(struct sock *sk)
 {
         local_bh_disable();
 
-        if (unlikely(!spin_trylock(&icmpv6_socket->sk->sk_lock.slock))) {
+        if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
                 /* This can happen if the output path (f.e. SIT or
                  * ip6ip6 tunnel) signals dst_link_failure() for an
                  * outgoing ICMP6 packet.
@@ -105,9 +107,9 @@ static __inline__ int icmpv6_xmit_lock(void)
         return 0;
 }
 
-static __inline__ void icmpv6_xmit_unlock(void)
+static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 {
-        spin_unlock_bh(&icmpv6_socket->sk->sk_lock.slock);
+        spin_unlock_bh(&sk->sk_lock.slock);
 }
 
 /*
@@ -161,6 +163,7 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
                                      struct flowi *fl)
 {
         struct dst_entry *dst;
+        struct net *net = sk->sk_net;
         int res = 0;
 
         /* Informational messages are not limited. */
@@ -176,7 +179,7 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
          * XXX: perhaps the expire for routing entries cloned by
          * this lookup should be more aggressive (not longer than timeout).
          */
-        dst = ip6_route_output(sk, fl);
+        dst = ip6_route_output(net, sk, fl);
         if (dst->error) {
                 IP6_INC_STATS(ip6_dst_idev(dst),
                               IPSTATS_MIB_OUTNOROUTES);
@@ -184,7 +187,7 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
                 res = 1;
         } else {
                 struct rt6_info *rt = (struct rt6_info *)dst;
-                int tmo = init_net.ipv6.sysctl.icmpv6_time;
+                int tmo = net->ipv6.sysctl.icmpv6_time;
 
                 /* Give more bandwidth to wider prefixes. */
                 if (rt->rt6i_dst.plen < 128)
@@ -303,6 +306,7 @@ static inline void mip6_addr_swap(struct sk_buff *skb) {}
 void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
                  struct net_device *dev)
 {
+        struct net *net = skb->dev->nd_net;
         struct inet6_dev *idev = NULL;
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct sock *sk;
@@ -332,7 +336,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
          */
         addr_type = ipv6_addr_type(&hdr->daddr);
 
-        if (ipv6_chk_addr(&init_net, &hdr->daddr, skb->dev, 0))
+        if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0))
                 saddr = &hdr->daddr;
 
         /*
@@ -389,12 +393,12 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         fl.fl_icmp_code = code;
         security_skb_classify_flow(skb, &fl);
 
-        if (icmpv6_xmit_lock())
-                return;
-
-        sk = icmpv6_socket->sk;
+        sk = icmpv6_sk(net);
         np = inet6_sk(sk);
 
+        if (icmpv6_xmit_lock(sk))
+                return;
+
         if (!icmpv6_xrlim_allow(sk, type, &fl))
                 goto out;
 
@@ -498,13 +502,14 @@ out_put:
 out_dst_release:
         dst_release(dst);
 out:
-        icmpv6_xmit_unlock();
+        icmpv6_xmit_unlock(sk);
 }
 
 EXPORT_SYMBOL(icmpv6_send);
 
 static void icmpv6_echo_reply(struct sk_buff *skb)
 {
+        struct net *net = skb->dev->nd_net;
         struct sock *sk;
         struct inet6_dev *idev;
         struct ipv6_pinfo *np;
@@ -535,12 +540,12 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         fl.fl_icmp_type = ICMPV6_ECHO_REPLY;
         security_skb_classify_flow(skb, &fl);
 
-        if (icmpv6_xmit_lock())
-                return;
-
-        sk = icmpv6_socket->sk;
+        sk = icmpv6_sk(net);
         np = inet6_sk(sk);
 
+        if (icmpv6_xmit_lock(sk))
+                return;
+
         if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
                 fl.oif = np->mcast_oif;
 
@@ -584,7 +589,7 @@ out_put:
                 in6_dev_put(idev);
         dst_release(dst);
 out:
-        icmpv6_xmit_unlock();
+        icmpv6_xmit_unlock(sk);
 }
 
 static void icmpv6_notify(struct sk_buff *skb, int type, int code, __be32 info)
@@ -775,19 +780,41 @@ drop_no_count:
         return 0;
 }
 
+void icmpv6_flow_init(struct sock *sk, struct flowi *fl,
+                      u8 type,
+                      const struct in6_addr *saddr,
+                      const struct in6_addr *daddr,
+                      int oif)
+{
+        memset(fl, 0, sizeof(*fl));
+        ipv6_addr_copy(&fl->fl6_src, saddr);
+        ipv6_addr_copy(&fl->fl6_dst, daddr);
+        fl->proto               = IPPROTO_ICMPV6;
+        fl->fl_icmp_type        = type;
+        fl->fl_icmp_code        = 0;
+        fl->oif                 = oif;
+        security_sk_classify_flow(sk, fl);
+}
+
 /*
- * Special lock-class for __icmpv6_socket:
+ * Special lock-class for __icmpv6_sk:
  */
 static struct lock_class_key icmpv6_socket_sk_dst_lock_key;
 
-int __init icmpv6_init(struct net_proto_family *ops)
+static int __net_init icmpv6_sk_init(struct net *net)
 {
         struct sock *sk;
         int err, i, j;
 
+        net->ipv6.icmp_sk =
+                kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
+        if (net->ipv6.icmp_sk == NULL)
+                return -ENOMEM;
+
         for_each_possible_cpu(i) {
+                struct socket *sock;
                 err = sock_create_kern(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6,
-                                       &per_cpu(__icmpv6_socket, i));
+                                       &sock);
                 if (err < 0) {
                         printk(KERN_ERR
                                "Failed to initialize the ICMP6 control socket "
@@ -796,12 +823,14 @@ int __init icmpv6_init(struct net_proto_family *ops)
                         goto fail;
                 }
 
-                sk = per_cpu(__icmpv6_socket, i)->sk;
+                net->ipv6.icmp_sk[i] = sk = sock->sk;
+                sk_change_net(sk, net);
+
                 sk->sk_allocation = GFP_ATOMIC;
                 /*
                  * Split off their lock-class, because sk->sk_dst_lock
                  * gets used from softirqs, which is safe for
-                 * __icmpv6_socket (because those never get directly used
+                 * __icmpv6_sk (because those never get directly used
                  * via userspace syscalls), but unsafe for normal sockets.
                  */
                 lockdep_set_class(&sk->sk_dst_lock,
@@ -815,36 +844,56 @@ int __init icmpv6_init(struct net_proto_family *ops)
 
                 sk->sk_prot->unhash(sk);
         }
-
-
-        if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0) {
-                printk(KERN_ERR "Failed to register ICMP6 protocol\n");
-                err = -EAGAIN;
-                goto fail;
-        }
-
         return 0;
 
  fail:
-        for (j = 0; j < i; j++) {
-                if (!cpu_possible(j))
-                        continue;
-                sock_release(per_cpu(__icmpv6_socket, j));
-        }
-
+        for (j = 0; j < i; j++)
+                sk_release_kernel(net->ipv6.icmp_sk[j]);
+        kfree(net->ipv6.icmp_sk);
         return err;
 }
 
-void icmpv6_cleanup(void)
+static void __net_exit icmpv6_sk_exit(struct net *net)
 {
         int i;
 
         for_each_possible_cpu(i) {
-                sock_release(per_cpu(__icmpv6_socket, i));
+                sk_release_kernel(net->ipv6.icmp_sk[i]);
         }
+        kfree(net->ipv6.icmp_sk);
+}
+
+static struct pernet_operations icmpv6_sk_ops = {
+       .init = icmpv6_sk_init,
+       .exit = icmpv6_sk_exit,
+};
+
+int __init icmpv6_init(void)
+{
+        int err;
+
+        err = register_pernet_subsys(&icmpv6_sk_ops);
+        if (err < 0)
+                return err;
+
+        err = -EAGAIN;
+        if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
+                goto fail;
+        return 0;
+
+fail:
+        printk(KERN_ERR "Failed to register ICMP6 protocol\n");
+        unregister_pernet_subsys(&icmpv6_sk_ops);
+        return err;
+}
+
+void icmpv6_cleanup(void)
+{
+        unregister_pernet_subsys(&icmpv6_sk_ops);
         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 }
 
+
 static const struct icmp6_err {
         int err;
         int fatal;
@@ -925,6 +974,10 @@ struct ctl_table *ipv6_icmp_sysctl_init(struct net *net)
         table = kmemdup(ipv6_icmp_table_template,
                         sizeof(ipv6_icmp_table_template),
                         GFP_KERNEL);
+
+        if (table)
+                table[0].data = &net->ipv6.sysctl.icmpv6_time;
+
         return table;
 }
 #endif
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index bab72b6f1444..b0814b0082e7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -48,8 +48,6 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
 
-struct rt6_statistics   rt6_stats;
-
 static struct kmem_cache * fib6_node_kmem __read_mostly;
 
 enum fib_walk_state_t
@@ -66,6 +64,7 @@ enum fib_walk_state_t
 struct fib6_cleaner_t
 {
         struct fib6_walker_t w;
+        struct net *net;
         int (*func)(struct rt6_info *, void *arg);
         void *arg;
 };
@@ -78,9 +77,10 @@ static DEFINE_RWLOCK(fib6_walker_lock);
 #define FWS_INIT FWS_L
 #endif
 
-static void fib6_prune_clones(struct fib6_node *fn, struct rt6_info *rt);
-static struct rt6_info * fib6_find_prefix(struct fib6_node *fn);
-static struct fib6_node * fib6_repair_tree(struct fib6_node *fn);
+static void fib6_prune_clones(struct net *net, struct fib6_node *fn,
+                              struct rt6_info *rt);
+static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn);
+static struct fib6_node *fib6_repair_tree(struct net *net, struct fib6_node *fn);
 static int fib6_walk(struct fib6_walker_t *w);
 static int fib6_walk_continue(struct fib6_walker_t *w);
 
@@ -93,7 +93,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w);
 
 static __u32 rt_sernum;
 
-static DEFINE_TIMER(ip6_fib_timer, fib6_run_gc, 0, 0);
+static void fib6_gc_timer_cb(unsigned long arg);
 
 static struct fib6_walker_t fib6_walker_list = {
         .prev   = &fib6_walker_list,
@@ -166,22 +166,13 @@ static __inline__ void rt6_release(struct rt6_info *rt)
                 dst_free(&rt->u.dst);
 }
 
-static struct fib6_table fib6_main_tbl = {
-        .tb6_id         = RT6_TABLE_MAIN,
-        .tb6_root       = {
-                .leaf           = &ip6_null_entry,
-                .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
-        },
-};
-
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 #define FIB_TABLE_HASHSZ 256
 #else
 #define FIB_TABLE_HASHSZ 1
 #endif
-static struct hlist_head fib_table_hash[FIB_TABLE_HASHSZ];
 
-static void fib6_link_table(struct fib6_table *tb)
+static void fib6_link_table(struct net *net, struct fib6_table *tb)
 {
         unsigned int h;
 
@@ -197,52 +188,46 @@ static void fib6_link_table(struct fib6_table *tb)
          * No protection necessary, this is the only list mutatation
          * operation, tables never disappear once they exist.
          */
-        hlist_add_head_rcu(&tb->tb6_hlist, &fib_table_hash[h]);
+        hlist_add_head_rcu(&tb->tb6_hlist, &net->ipv6.fib_table_hash[h]);
 }
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-static struct fib6_table fib6_local_tbl = {
-        .tb6_id         = RT6_TABLE_LOCAL,
-        .tb6_root       = {
-                .leaf           = &ip6_null_entry,
-                .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
-        },
-};
 
-static struct fib6_table *fib6_alloc_table(u32 id)
+static struct fib6_table *fib6_alloc_table(struct net *net, u32 id)
 {
         struct fib6_table *table;
 
         table = kzalloc(sizeof(*table), GFP_ATOMIC);
         if (table != NULL) {
                 table->tb6_id = id;
-                table->tb6_root.leaf = &ip6_null_entry;
+                table->tb6_root.leaf = net->ipv6.ip6_null_entry;
                 table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
         }
 
         return table;
 }
 
-struct fib6_table *fib6_new_table(u32 id)
+struct fib6_table *fib6_new_table(struct net *net, u32 id)
 {
         struct fib6_table *tb;
 
         if (id == 0)
                 id = RT6_TABLE_MAIN;
-        tb = fib6_get_table(id);
+        tb = fib6_get_table(net, id);
         if (tb)
                 return tb;
 
-        tb = fib6_alloc_table(id);
+        tb = fib6_alloc_table(net, id);
         if (tb != NULL)
-                fib6_link_table(tb);
+                fib6_link_table(net, tb);
 
         return tb;
 }
 
-struct fib6_table *fib6_get_table(u32 id)
+struct fib6_table *fib6_get_table(struct net *net, u32 id)
 {
         struct fib6_table *tb;
+        struct hlist_head *head;
         struct hlist_node *node;
         unsigned int h;
 
@@ -250,7 +235,8 @@ struct fib6_table *fib6_get_table(u32 id)
                 id = RT6_TABLE_MAIN;
         h = id & (FIB_TABLE_HASHSZ - 1);
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tb, node, &fib_table_hash[h], tb6_hlist) {
+        head = &net->ipv6.fib_table_hash[h];
+        hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
                 if (tb->tb6_id == id) {
                         rcu_read_unlock();
                         return tb;
@@ -261,33 +247,32 @@ struct fib6_table *fib6_get_table(u32 id)
         return NULL;
 }
 
-static void __init fib6_tables_init(void)
+static void fib6_tables_init(struct net *net)
 {
-        fib6_link_table(&fib6_main_tbl);
-        fib6_link_table(&fib6_local_tbl);
+        fib6_link_table(net, net->ipv6.fib6_main_tbl);
+        fib6_link_table(net, net->ipv6.fib6_local_tbl);
 }
-
 #else
 
-struct fib6_table *fib6_new_table(u32 id)
+struct fib6_table *fib6_new_table(struct net *net, u32 id)
 {
-        return fib6_get_table(id);
+        return fib6_get_table(net, id);
 }
 
-struct fib6_table *fib6_get_table(u32 id)
+struct fib6_table *fib6_get_table(struct net *net, u32 id)
 {
-        return &fib6_main_tbl;
+          return net->ipv6.fib6_main_tbl;
 }
 
-struct dst_entry *fib6_rule_lookup(struct flowi *fl, int flags,
-                                   pol_lookup_t lookup)
+struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
+                                   int flags, pol_lookup_t lookup)
 {
-        return (struct dst_entry *) lookup(&fib6_main_tbl, fl, flags);
+        return (struct dst_entry *) lookup(net, net->ipv6.fib6_main_tbl, fl, flags);
 }
 
-static void __init fib6_tables_init(void)
+static void fib6_tables_init(struct net *net)
 {
-        fib6_link_table(&fib6_main_tbl);
+        fib6_link_table(net, net->ipv6.fib6_main_tbl);
 }
 
 #endif
@@ -368,11 +353,9 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         struct fib6_walker_t *w;
         struct fib6_table *tb;
         struct hlist_node *node;
+        struct hlist_head *head;
         int res = 0;
 
-        if (net != &init_net)
-                return 0;
-
         s_h = cb->args[0];
         s_e = cb->args[1];
 
@@ -401,7 +384,8 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
 
         for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
-                hlist_for_each_entry(tb, node, &fib_table_hash[h], tb6_hlist) {
+                head = &net->ipv6.fib_table_hash[h];
+                hlist_for_each_entry(tb, node, head, tb6_hlist) {
                         if (e < s_e)
                                 goto next;
                         res = fib6_dump_table(tb, skb, cb);
@@ -667,29 +651,29 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
         rt->rt6i_node = fn;
         atomic_inc(&rt->rt6i_ref);
         inet6_rt_notify(RTM_NEWROUTE, rt, info);
-        rt6_stats.fib_rt_entries++;
+        info->nl_net->ipv6.rt6_stats->fib_rt_entries++;
 
         if ((fn->fn_flags & RTN_RTINFO) == 0) {
-                rt6_stats.fib_route_nodes++;
+                info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
                 fn->fn_flags |= RTN_RTINFO;
         }
 
         return 0;
 }
 
-static __inline__ void fib6_start_gc(struct rt6_info *rt)
+static __inline__ void fib6_start_gc(struct net *net, struct rt6_info *rt)
 {
-        if (ip6_fib_timer.expires == 0 &&
+        if (net->ipv6.ip6_fib_timer->expires == 0 &&
             (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE)))
-                mod_timer(&ip6_fib_timer, jiffies +
-                          init_net.ipv6.sysctl.ip6_rt_gc_interval);
+                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
+                          net->ipv6.sysctl.ip6_rt_gc_interval);
 }
 
-void fib6_force_start_gc(void)
+void fib6_force_start_gc(struct net *net)
 {
-        if (ip6_fib_timer.expires == 0)
-                mod_timer(&ip6_fib_timer, jiffies +
-                          init_net.ipv6.sysctl.ip6_rt_gc_interval);
+        if (net->ipv6.ip6_fib_timer->expires == 0)
+                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
+                          net->ipv6.sysctl.ip6_rt_gc_interval);
 }
 
 /*
@@ -733,8 +717,8 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
                         if (sfn == NULL)
                                 goto st_failure;
 
-                        sfn->leaf = &ip6_null_entry;
-                        atomic_inc(&ip6_null_entry.rt6i_ref);
+                        sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
+                        atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
                         sfn->fn_flags = RTN_ROOT;
                         sfn->fn_sernum = fib6_new_sernum();
 
@@ -776,9 +760,9 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
         err = fib6_add_rt2node(fn, rt, info);
 
         if (err == 0) {
-                fib6_start_gc(rt);
+                fib6_start_gc(info->nl_net, rt);
                 if (!(rt->rt6i_flags&RTF_CACHE))
-                        fib6_prune_clones(pn, rt);
+                        fib6_prune_clones(info->nl_net, pn, rt);
         }
 
 out:
@@ -789,11 +773,11 @@ out:
                  * super-tree leaf node we have to find a new one for it.
                  */
                 if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) {
-                        pn->leaf = fib6_find_prefix(pn);
+                        pn->leaf = fib6_find_prefix(info->nl_net, pn);
 #if RT6_DEBUG >= 2
                         if (!pn->leaf) {
                                 BUG_TRAP(pn->leaf != NULL);
-                                pn->leaf = &ip6_null_entry;
+                                pn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         }
 #endif
                         atomic_inc(&pn->leaf->rt6i_ref);
@@ -809,7 +793,7 @@ out:
          */
 st_failure:
         if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
-                fib6_repair_tree(fn);
+                fib6_repair_tree(info->nl_net, fn);
         dst_free(&rt->u.dst);
         return err;
 #endif
@@ -975,10 +959,10 @@ struct fib6_node * fib6_locate(struct fib6_node *root,
  *
  */
 
-static struct rt6_info * fib6_find_prefix(struct fib6_node *fn)
+static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn)
 {
         if (fn->fn_flags&RTN_ROOT)
-                return &ip6_null_entry;
+                return net->ipv6.ip6_null_entry;
 
         while(fn) {
                 if(fn->left)
@@ -997,7 +981,8 @@ static struct rt6_info * fib6_find_prefix(struct fib6_node *fn)
  *      is the node we want to try and remove.
  */
 
-static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
+static struct fib6_node *fib6_repair_tree(struct net *net,
+                                           struct fib6_node *fn)
 {
         int children;
         int nstate;
@@ -1024,11 +1009,11 @@ static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
                     || (children && fn->fn_flags&RTN_ROOT)
 #endif
                     ) {
-                        fn->leaf = fib6_find_prefix(fn);
+                        fn->leaf = fib6_find_prefix(net, fn);
 #if RT6_DEBUG >= 2
                         if (fn->leaf==NULL) {
                                 BUG_TRAP(fn->leaf);
-                                fn->leaf = &ip6_null_entry;
+                                fn->leaf = net->ipv6.ip6_null_entry;
                         }
 #endif
                         atomic_inc(&fn->leaf->rt6i_ref);
@@ -1101,14 +1086,15 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
 {
         struct fib6_walker_t *w;
         struct rt6_info *rt = *rtp;
+        struct net *net = info->nl_net;
 
         RT6_TRACE("fib6_del_route\n");
 
         /* Unlink it */
         *rtp = rt->u.dst.rt6_next;
         rt->rt6i_node = NULL;
-        rt6_stats.fib_rt_entries--;
-        rt6_stats.fib_discarded_routes++;
+        net->ipv6.rt6_stats->fib_rt_entries--;
+        net->ipv6.rt6_stats->fib_discarded_routes++;
 
         /* Reset round-robin state, if necessary */
         if (fn->rr_ptr == rt)
@@ -1131,8 +1117,8 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         /* If it was last route, expunge its radix tree node */
         if (fn->leaf == NULL) {
                 fn->fn_flags &= ~RTN_RTINFO;
-                rt6_stats.fib_route_nodes--;
-                fn = fib6_repair_tree(fn);
+                net->ipv6.rt6_stats->fib_route_nodes--;
+                fn = fib6_repair_tree(net, fn);
         }
 
         if (atomic_read(&rt->rt6i_ref) != 1) {
@@ -1144,7 +1130,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
                  */
                 while (fn) {
                         if (!(fn->fn_flags&RTN_RTINFO) && fn->leaf == rt) {
-                                fn->leaf = fib6_find_prefix(fn);
+                                fn->leaf = fib6_find_prefix(net, fn);
                                 atomic_inc(&fn->leaf->rt6i_ref);
                                 rt6_release(rt);
                         }
@@ -1160,6 +1146,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
 
 int fib6_del(struct rt6_info *rt, struct nl_info *info)
 {
+        struct net *net = info->nl_net;
         struct fib6_node *fn = rt->rt6i_node;
         struct rt6_info **rtp;
 
@@ -1169,7 +1156,7 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
                 return -ENOENT;
         }
 #endif
-        if (fn == NULL || rt == &ip6_null_entry)
+        if (fn == NULL || rt == net->ipv6.ip6_null_entry)
                 return -ENOENT;
 
         BUG_TRAP(fn->fn_flags&RTN_RTINFO);
@@ -1184,7 +1171,7 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
                         pn = pn->parent;
                 }
 #endif
-                fib6_prune_clones(pn, rt);
+                fib6_prune_clones(info->nl_net, pn, rt);
         }
 
         /*
@@ -1314,12 +1301,12 @@ static int fib6_walk(struct fib6_walker_t *w)
 
 static int fib6_clean_node(struct fib6_walker_t *w)
 {
-        struct nl_info info = {
-                .nl_net = &init_net,
-        };
         int res;
         struct rt6_info *rt;
         struct fib6_cleaner_t *c = container_of(w, struct fib6_cleaner_t, w);
+        struct nl_info info = {
+                .nl_net = c->net,
+        };
 
         for (rt = w->leaf; rt; rt = rt->u.dst.rt6_next) {
                 res = c->func(rt, c->arg);
@@ -1351,7 +1338,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
  *      ignoring pure split nodes) will be scanned.
  */
 
-static void fib6_clean_tree(struct fib6_node *root,
+static void fib6_clean_tree(struct net *net, struct fib6_node *root,
                             int (*func)(struct rt6_info *, void *arg),
                             int prune, void *arg)
 {
@@ -1362,23 +1349,26 @@ static void fib6_clean_tree(struct fib6_node *root,
         c.w.prune = prune;
         c.func = func;
         c.arg = arg;
+        c.net = net;
 
         fib6_walk(&c.w);
 }
 
-void fib6_clean_all(int (*func)(struct rt6_info *, void *arg),
+void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     int prune, void *arg)
 {
         struct fib6_table *table;
         struct hlist_node *node;
+        struct hlist_head *head;
         unsigned int h;
 
         rcu_read_lock();
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
-                hlist_for_each_entry_rcu(table, node, &fib_table_hash[h],
-                                         tb6_hlist) {
+                head = &net->ipv6.fib_table_hash[h];
+                hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
                         write_lock_bh(&table->tb6_lock);
-                        fib6_clean_tree(&table->tb6_root, func, prune, arg);
+                        fib6_clean_tree(net, &table->tb6_root,
+                                        func, prune, arg);
                         write_unlock_bh(&table->tb6_lock);
                 }
         }
@@ -1395,9 +1385,10 @@ static int fib6_prune_clone(struct rt6_info *rt, void *arg)
         return 0;
 }
 
-static void fib6_prune_clones(struct fib6_node *fn, struct rt6_info *rt)
+static void fib6_prune_clones(struct net *net, struct fib6_node *fn,
+                              struct rt6_info *rt)
 {
-        fib6_clean_tree(fn, fib6_prune_clone, 1, rt);
+        fib6_clean_tree(net, fn, fib6_prune_clone, 1, rt);
 }
 
 /*
@@ -1447,54 +1438,145 @@ static int fib6_age(struct rt6_info *rt, void *arg)
 
 static DEFINE_SPINLOCK(fib6_gc_lock);
 
-void fib6_run_gc(unsigned long dummy)
+void fib6_run_gc(unsigned long expires, struct net *net)
 {
-        if (dummy != ~0UL) {
+        if (expires != ~0UL) {
                 spin_lock_bh(&fib6_gc_lock);
-                gc_args.timeout = dummy ? (int)dummy :
-                        init_net.ipv6.sysctl.ip6_rt_gc_interval;
+                gc_args.timeout = expires ? (int)expires :
+                        net->ipv6.sysctl.ip6_rt_gc_interval;
         } else {
                 local_bh_disable();
                 if (!spin_trylock(&fib6_gc_lock)) {
-                        mod_timer(&ip6_fib_timer, jiffies + HZ);
+                        mod_timer(net->ipv6.ip6_fib_timer, jiffies + HZ);
                         local_bh_enable();
                         return;
                 }
-                gc_args.timeout = init_net.ipv6.sysctl.ip6_rt_gc_interval;
+                gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
         }
         gc_args.more = 0;
 
-        ndisc_dst_gc(&gc_args.more);
-        fib6_clean_all(fib6_age, 0, NULL);
+        icmp6_dst_gc(&gc_args.more);
+
+        fib6_clean_all(net, fib6_age, 0, NULL);
 
         if (gc_args.more)
-                mod_timer(&ip6_fib_timer, jiffies +
-                          init_net.ipv6.sysctl.ip6_rt_gc_interval);
+                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
+                          net->ipv6.sysctl.ip6_rt_gc_interval);
         else {
-                del_timer(&ip6_fib_timer);
-                ip6_fib_timer.expires = 0;
+                del_timer(net->ipv6.ip6_fib_timer);
+                net->ipv6.ip6_fib_timer->expires = 0;
         }
         spin_unlock_bh(&fib6_gc_lock);
 }
 
-int __init fib6_init(void)
+static void fib6_gc_timer_cb(unsigned long arg)
+{
+        fib6_run_gc(0, (struct net *)arg);
+}
+
+static int fib6_net_init(struct net *net)
 {
         int ret;
+        struct timer_list *timer;
+
+        ret = -ENOMEM;
+        timer = kzalloc(sizeof(*timer), GFP_KERNEL);
+        if (!timer)
+                goto out;
+
+        setup_timer(timer, fib6_gc_timer_cb, (unsigned long)net);
+        net->ipv6.ip6_fib_timer = timer;
+
+        net->ipv6.rt6_stats = kzalloc(sizeof(*net->ipv6.rt6_stats), GFP_KERNEL);
+        if (!net->ipv6.rt6_stats)
+                goto out_timer;
+
+        net->ipv6.fib_table_hash =
+                kzalloc(sizeof(*net->ipv6.fib_table_hash)*FIB_TABLE_HASHSZ,
+                        GFP_KERNEL);
+        if (!net->ipv6.fib_table_hash)
+                goto out_rt6_stats;
+
+        net->ipv6.fib6_main_tbl = kzalloc(sizeof(*net->ipv6.fib6_main_tbl),
+                                          GFP_KERNEL);
+        if (!net->ipv6.fib6_main_tbl)
+                goto out_fib_table_hash;
+
+        net->ipv6.fib6_main_tbl->tb6_id = RT6_TABLE_MAIN;
+        net->ipv6.fib6_main_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
+        net->ipv6.fib6_main_tbl->tb6_root.fn_flags =
+                RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
+
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        net->ipv6.fib6_local_tbl = kzalloc(sizeof(*net->ipv6.fib6_local_tbl),
+                                           GFP_KERNEL);
+        if (!net->ipv6.fib6_local_tbl)
+                goto out_fib6_main_tbl;
+        net->ipv6.fib6_local_tbl->tb6_id = RT6_TABLE_LOCAL;
+        net->ipv6.fib6_local_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
+        net->ipv6.fib6_local_tbl->tb6_root.fn_flags =
+                RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
+#endif
+        fib6_tables_init(net);
+
+        ret = 0;
+out:
+        return ret;
+
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+out_fib6_main_tbl:
+        kfree(net->ipv6.fib6_main_tbl);
+#endif
+out_fib_table_hash:
+        kfree(net->ipv6.fib_table_hash);
+out_rt6_stats:
+        kfree(net->ipv6.rt6_stats);
+out_timer:
+        kfree(timer);
+        goto out;
+ }
+
+static void fib6_net_exit(struct net *net)
+{
+        rt6_ifdown(net, NULL);
+        del_timer(net->ipv6.ip6_fib_timer);
+        kfree(net->ipv6.ip6_fib_timer);
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        kfree(net->ipv6.fib6_local_tbl);
+#endif
+        kfree(net->ipv6.fib6_main_tbl);
+        kfree(net->ipv6.fib_table_hash);
+        kfree(net->ipv6.rt6_stats);
+}
+
+static struct pernet_operations fib6_net_ops = {
+        .init = fib6_net_init,
+        .exit = fib6_net_exit,
+};
+
+int __init fib6_init(void)
+{
+        int ret = -ENOMEM;
+
         fib6_node_kmem = kmem_cache_create("fib6_nodes",
                                            sizeof(struct fib6_node),
                                            0, SLAB_HWCACHE_ALIGN,
                                            NULL);
         if (!fib6_node_kmem)
-                return -ENOMEM;
+                goto out;
 
-        fib6_tables_init();
+        ret = register_pernet_subsys(&fib6_net_ops);
+        if (ret)
+                goto out_kmem_cache_create;
 
         ret = __rtnl_register(PF_INET6, RTM_GETROUTE, NULL, inet6_dump_fib);
         if (ret)
-                goto out_kmem_cache_create;
+                goto out_unregister_subsys;
 out:
         return ret;
 
+out_unregister_subsys:
+        unregister_pernet_subsys(&fib6_net_ops);
 out_kmem_cache_create:
         kmem_cache_destroy(fib6_node_kmem);
         goto out;
@@ -1502,6 +1584,6 @@ out_kmem_cache_create:
 
 void fib6_gc_cleanup(void)
 {
-        del_timer(&ip6_fib_timer);
+        unregister_pernet_subsys(&fib6_net_ops);
         kmem_cache_destroy(fib6_node_kmem);
 }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 178aebc0427a..7e36269826ba 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -61,11 +61,6 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         u32             pkt_len;
         struct inet6_dev *idev;
 
-        if (dev->nd_net != &init_net) {
-                kfree_skb(skb);
-                return 0;
-        }
-
         if (skb->pkt_type == PACKET_OTHERHOST) {
                 kfree_skb(skb);
                 return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 8b67ca07467d..937018529d18 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -596,7 +596,6 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
         return offset;
 }
-EXPORT_SYMBOL_GPL(ip6_find_1stfragopt);
 
 static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
@@ -914,13 +913,14 @@ static int ip6_dst_lookup_tail(struct sock *sk,
         int err;
 
         if (*dst == NULL)
-                *dst = ip6_route_output(sk, fl);
+                *dst = ip6_route_output(sk->sk_net, sk, fl);
 
         if ((err = (*dst)->error))
                 goto out_err_release;
 
         if (ipv6_addr_any(&fl->fl6_src)) {
-                err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
+                err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev,
+                                         &fl->fl6_dst, &fl->fl6_src);
                 if (err)
                         goto out_err_release;
         }
@@ -954,7 +954,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                                 dst_release(*dst);
                                 memcpy(&fl_gw, fl, sizeof(struct flowi));
                                 memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
-                                *dst = ip6_route_output(sk, &fl_gw);
+                                *dst = ip6_route_output(sk->sk_net, sk, &fl_gw);
                                 if ((err = (*dst)->error))
                                         goto out_err_release;
                         }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 78f438880923..1e1ad1ed87e6 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -602,7 +602,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 skb_reset_network_header(skb2);
 
                 /* Try to guess incoming interface */
-                rt = rt6_lookup(&ipv6_hdr(skb2)->saddr, NULL, 0, 0);
+                rt = rt6_lookup(&init_net, &ipv6_hdr(skb2)->saddr, NULL, 0, 0);
 
                 if (rt && rt->rt6i_dev)
                         skb2->dev = rt->rt6i_dev;
@@ -847,7 +847,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         if ((dst = ip6_tnl_dst_check(t)) != NULL)
                 dst_hold(dst);
         else {
-                dst = ip6_route_output(NULL, fl);
+                dst = ip6_route_output(&init_net, NULL, fl);
 
                 if (dst->error || xfrm_lookup(&dst, fl, NULL, 0) < 0)
                         goto tx_err_link_failure;
@@ -1112,7 +1112,7 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
                 int strict = (ipv6_addr_type(&p->raddr) &
                               (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
 
-                struct rt6_info *rt = rt6_lookup(&p->raddr, &p->laddr,
+                struct rt6_info *rt = rt6_lookup(&init_net, &p->raddr, &p->laddr,
                                                  p->link, strict);
 
                 if (rt == NULL)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index bf2a686aa13d..3bbfdff698d2 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -57,118 +57,6 @@
 
 DEFINE_SNMP_STAT(struct ipstats_mib, ipv6_statistics) __read_mostly;
 
-static struct inet6_protocol *ipv6_gso_pull_exthdrs(struct sk_buff *skb,
-                                                    int proto)
-{
-        struct inet6_protocol *ops = NULL;
-
-        for (;;) {
-                struct ipv6_opt_hdr *opth;
-                int len;
-
-                if (proto != NEXTHDR_HOP) {
-                        ops = rcu_dereference(inet6_protos[proto]);
-
-                        if (unlikely(!ops))
-                                break;
-
-                        if (!(ops->flags & INET6_PROTO_GSO_EXTHDR))
-                                break;
-                }
-
-                if (unlikely(!pskb_may_pull(skb, 8)))
-                        break;
-
-                opth = (void *)skb->data;
-                len = opth->hdrlen * 8 + 8;
-
-                if (unlikely(!pskb_may_pull(skb, len)))
-                        break;
-
-                proto = opth->nexthdr;
-                __skb_pull(skb, len);
-        }
-
-        return ops;
-}
-
-static int ipv6_gso_send_check(struct sk_buff *skb)
-{
-        struct ipv6hdr *ipv6h;
-        struct inet6_protocol *ops;
-        int err = -EINVAL;
-
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
-                goto out;
-
-        ipv6h = ipv6_hdr(skb);
-        __skb_pull(skb, sizeof(*ipv6h));
-        err = -EPROTONOSUPPORT;
-
-        rcu_read_lock();
-        ops = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
-        if (likely(ops && ops->gso_send_check)) {
-                skb_reset_transport_header(skb);
-                err = ops->gso_send_check(skb);
-        }
-        rcu_read_unlock();
-
-out:
-        return err;
-}
-
-static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
-{
-        struct sk_buff *segs = ERR_PTR(-EINVAL);
-        struct ipv6hdr *ipv6h;
-        struct inet6_protocol *ops;
-
-        if (!(features & NETIF_F_V6_CSUM))
-                features &= ~NETIF_F_SG;
-
-        if (unlikely(skb_shinfo(skb)->gso_type &
-                     ~(SKB_GSO_UDP |
-                       SKB_GSO_DODGY |
-                       SKB_GSO_TCP_ECN |
-                       SKB_GSO_TCPV6 |
-                       0)))
-                goto out;
-
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
-                goto out;
-
-        ipv6h = ipv6_hdr(skb);
-        __skb_pull(skb, sizeof(*ipv6h));
-        segs = ERR_PTR(-EPROTONOSUPPORT);
-
-        rcu_read_lock();
-        ops = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
-        if (likely(ops && ops->gso_segment)) {
-                skb_reset_transport_header(skb);
-                segs = ops->gso_segment(skb, features);
-        }
-        rcu_read_unlock();
-
-        if (unlikely(IS_ERR(segs)))
-                goto out;
-
-        for (skb = segs; skb; skb = skb->next) {
-                ipv6h = ipv6_hdr(skb);
-                ipv6h->payload_len = htons(skb->len - skb->mac_len -
-                                           sizeof(*ipv6h));
-        }
-
-out:
-        return segs;
-}
-
-static struct packet_type ipv6_packet_type = {
-        .type = __constant_htons(ETH_P_IPV6),
-        .func = ipv6_rcv,
-        .gso_send_check = ipv6_gso_send_check,
-        .gso_segment = ipv6_gso_segment,
-};
-
 struct ip6_ra_chain *ip6_ra_chain;
 DEFINE_RWLOCK(ip6_ra_lock);
 
@@ -239,7 +127,9 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                         struct sk_buff *pktopt;
 
                         if (sk->sk_protocol != IPPROTO_UDP &&
+#ifdef CONFIG_IP_UDPLITE
                             sk->sk_protocol != IPPROTO_UDPLITE &&
+#endif
                             sk->sk_protocol != IPPROTO_TCP)
                                 break;
 
@@ -279,7 +169,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                         } else {
                                 struct proto *prot = &udp_prot;
 
-                                if (sk->sk_protocol == IPPROTO_UDPLITE)
+                                if (IS_PROTO_UDPLITE(sk->sk_protocol))
                                         prot = &udplite_prot;
                                 local_bh_disable();
                                 sock_prot_inuse_add(sk->sk_prot, -1);
@@ -844,7 +734,9 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
         switch (optname) {
         case IPV6_ADDRFORM:
                 if (sk->sk_protocol != IPPROTO_UDP &&
+#ifdef CONFIG_IP_UDPLITE
                     sk->sk_protocol != IPPROTO_UDPLITE &&
+#endif
                     sk->sk_protocol != IPPROTO_TCP)
                         return -EINVAL;
                 if (sk->sk_state != TCP_ESTABLISHED)
@@ -1128,13 +1020,3 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_ipv6_getsockopt);
 #endif
 
-int __init ipv6_packet_init(void)
-{
-        dev_add_pack(&ipv6_packet_type);
-        return 0;
-}
-
-void ipv6_packet_cleanup(void)
-{
-        dev_remove_pack(&ipv6_packet_type);
-}
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index ab228d1ea114..197ca390a15d 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -208,7 +208,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, struct in6_addr *addr)
 
         if (ifindex == 0) {
                 struct rt6_info *rt;
-                rt = rt6_lookup(addr, NULL, 0, 0);
+                rt = rt6_lookup(&init_net, addr, NULL, 0, 0);
                 if (rt) {
                         dev = rt->rt6i_dev;
                         dev_hold(dev);
@@ -294,7 +294,7 @@ static struct inet6_dev *ip6_mc_find_dev(struct in6_addr *group, int ifindex)
         if (ifindex == 0) {
                 struct rt6_info *rt;
 
-                rt = rt6_lookup(group, NULL, 0, 0);
+                rt = rt6_lookup(&init_net, group, NULL, 0, 0);
                 if (rt) {
                         dev = rt->rt6i_dev;
                         dev_hold(dev);
@@ -1433,25 +1433,6 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
         return skb;
 }
 
-static inline int mld_dev_queue_xmit2(struct sk_buff *skb)
-{
-        struct net_device *dev = skb->dev;
-        unsigned char ha[MAX_ADDR_LEN];
-
-        ndisc_mc_map(&ipv6_hdr(skb)->daddr, ha, dev, 1);
-        if (dev_hard_header(skb, dev, ETH_P_IPV6, ha, NULL, skb->len) < 0) {
-                kfree_skb(skb);
-                return -EINVAL;
-        }
-        return dev_queue_xmit(skb);
-}
-
-static inline int mld_dev_queue_xmit(struct sk_buff *skb)
-{
-        return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
-                       mld_dev_queue_xmit2);
-}
-
 static void mld_sendpack(struct sk_buff *skb)
 {
         struct ipv6hdr *pip6 = ipv6_hdr(skb);
@@ -1460,6 +1441,7 @@ static void mld_sendpack(struct sk_buff *skb)
         int payload_len, mldlen;
         struct inet6_dev *idev = in6_dev_get(skb->dev);
         int err;
+        struct flowi fl;
 
         IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
         payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
@@ -1469,8 +1451,25 @@ static void mld_sendpack(struct sk_buff *skb)
         pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
                 IPPROTO_ICMPV6, csum_partial(skb_transport_header(skb),
                                              mldlen, 0));
+
+        skb->dst = icmp6_dst_alloc(skb->dev, NULL, &ipv6_hdr(skb)->daddr);
+
+        if (!skb->dst) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        icmpv6_flow_init(igmp6_socket->sk, &fl, ICMPV6_MLD2_REPORT,
+                         &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
+                         skb->dev->ifindex);
+
+        err = xfrm_lookup(&skb->dst, &fl, NULL, 0);
+        if (err)
+                goto err_out;
+
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
-                mld_dev_queue_xmit);
+                      dst_output);
+out:
         if (!err) {
                 ICMP6MSGOUT_INC_STATS_BH(idev, ICMPV6_MLD2_REPORT);
                 ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
@@ -1480,6 +1479,11 @@ static void mld_sendpack(struct sk_buff *skb)
 
         if (likely(idev != NULL))
                 in6_dev_put(idev);
+        return;
+
+err_out:
+        kfree_skb(skb);
+        goto out;
 }
 
 static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel)
@@ -1761,6 +1765,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         u8 ra[8] = { IPPROTO_ICMPV6, 0,
                      IPV6_TLV_ROUTERALERT, 2, 0, 0,
                      IPV6_TLV_PADN, 0 };
+        struct flowi fl;
 
         rcu_read_lock();
         IP6_INC_STATS(__in6_dev_get(dev),
@@ -1813,8 +1818,23 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 
         idev = in6_dev_get(skb->dev);
 
+        skb->dst = icmp6_dst_alloc(skb->dev, NULL, &ipv6_hdr(skb)->daddr);
+        if (!skb->dst) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        icmpv6_flow_init(igmp6_socket->sk, &fl, type,
+                         &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
+                         skb->dev->ifindex);
+
+        err = xfrm_lookup(&skb->dst, &fl, NULL, 0);
+        if (err)
+                goto err_out;
+
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
-                mld_dev_queue_xmit);
+                      dst_output);
+out:
         if (!err) {
                 ICMP6MSGOUT_INC_STATS(idev, type);
                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
@@ -1825,6 +1845,10 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         if (likely(idev != NULL))
                 in6_dev_put(idev);
         return;
+
+err_out:
+        kfree_skb(skb);
+        goto out;
 }
 
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
@@ -2597,7 +2621,7 @@ static const struct file_operations igmp6_mcf_seq_fops = {
 };
 #endif
 
-int __init igmp6_init(struct net_proto_family *ops)
+int __init igmp6_init(void)
 {
         struct ipv6_pinfo *np;
         struct sock *sk;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0d33a7d32125..b5b4fd173e98 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -441,21 +441,6 @@ static void pndisc_destructor(struct pneigh_entry *n)
 /*
  *      Send a Neighbour Advertisement
  */
-
-static inline void ndisc_flow_init(struct flowi *fl, u8 type,
-                            struct in6_addr *saddr, struct in6_addr *daddr,
-                            int oif)
-{
-        memset(fl, 0, sizeof(*fl));
-        ipv6_addr_copy(&fl->fl6_src, saddr);
-        ipv6_addr_copy(&fl->fl6_dst, daddr);
-        fl->proto               = IPPROTO_ICMPV6;
-        fl->fl_icmp_type        = type;
-        fl->fl_icmp_code        = 0;
-        fl->oif                 = oif;
-        security_sk_classify_flow(ndisc_socket->sk, fl);
-}
-
 static void __ndisc_send(struct net_device *dev,
                          struct neighbour *neigh,
                          struct in6_addr *daddr, struct in6_addr *saddr,
@@ -474,10 +459,10 @@ static void __ndisc_send(struct net_device *dev,
 
         type = icmp6h->icmp6_type;
 
-        ndisc_flow_init(&fl, type, saddr, daddr,
-                        dev->ifindex);
+        icmpv6_flow_init(ndisc_socket->sk, &fl, type,
+                         saddr, daddr, dev->ifindex);
 
-        dst = ndisc_dst_alloc(dev, neigh, daddr, ip6_output);
+        dst = icmp6_dst_alloc(dev, neigh, daddr);
         if (!dst)
                 return;
 
@@ -1439,10 +1424,10 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 return;
         }
 
-        ndisc_flow_init(&fl, NDISC_REDIRECT, &saddr_buf, &ipv6_hdr(skb)->saddr,
-                        dev->ifindex);
+        icmpv6_flow_init(ndisc_socket->sk, &fl, NDISC_REDIRECT,
+                         &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
 
-        dst = ip6_route_output(NULL, &fl);
+        dst = ip6_route_output(&init_net, NULL, &fl);
         if (dst == NULL)
                 return;
 
@@ -1613,6 +1598,7 @@ int ndisc_rcv(struct sk_buff *skb)
 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = ptr;
+        struct net *net = dev->nd_net;
 
         if (dev->nd_net != &init_net)
                 return NOTIFY_DONE;
@@ -1620,11 +1606,11 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
         switch (event) {
         case NETDEV_CHANGEADDR:
                 neigh_changeaddr(&nd_tbl, dev);
-                fib6_run_gc(~0UL);
+                fib6_run_gc(~0UL, net);
                 break;
         case NETDEV_DOWN:
                 neigh_ifdown(&nd_tbl, dev);
-                fib6_run_gc(~0UL);
+                fib6_run_gc(~0UL, net);
                 break;
         default:
                 break;
@@ -1733,7 +1719,7 @@ static int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl, int __user *name,
 
 #endif
 
-int __init ndisc_init(struct net_proto_family *ops)
+int __init ndisc_init(void)
 {
         struct ipv6_pinfo *np;
         struct sock *sk;
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 2e06724dc348..aed51bcc66b4 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -23,7 +23,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
                     .saddr = iph->saddr, } },
         };
 
-        dst = ip6_route_output(skb->sk, &fl);
+        dst = ip6_route_output(&init_net, skb->sk, &fl);
 
 #ifdef CONFIG_XFRM
         if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
@@ -86,7 +86,7 @@ static int nf_ip6_reroute(struct sk_buff *skb,
 
 static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
 {
-        *dst = ip6_route_output(NULL, fl);
+        *dst = ip6_route_output(&init_net, NULL, fl);
         return (*dst)->error;
 }
 
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index b23baa635fe0..831708aeab37 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -93,7 +93,7 @@ static void send_reset(struct sk_buff *oldskb)
         fl.fl_ip_sport = otcph.dest;
         fl.fl_ip_dport = otcph.source;
         security_skb_classify_flow(oldskb, &fl);
-        dst = ip6_route_output(NULL, &fl);
+        dst = ip6_route_output(&init_net, NULL, &fl);
         if (dst == NULL)
                 return;
         if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 199ef379e501..2453f2229ef7 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -39,8 +39,10 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v)
                        sock_prot_inuse_get(&tcpv6_prot));
         seq_printf(seq, "UDP6: inuse %d\n",
                        sock_prot_inuse_get(&udpv6_prot));
+#ifdef CONFIG_IP_UDPLITE
         seq_printf(seq, "UDPLITE6: inuse %d\n",
                         sock_prot_inuse_get(&udplitev6_prot));
+#endif
         seq_printf(seq, "RAW6: inuse %d\n",
                        sock_prot_inuse_get(&rawv6_prot));
         seq_printf(seq, "FRAG6: inuse %d memory %d\n",
@@ -111,6 +113,7 @@ static struct snmp_mib snmp6_udp6_list[] = {
         SNMP_MIB_SENTINEL
 };
 
+#ifdef CONFIG_IP_UDPLITE
 static struct snmp_mib snmp6_udplite6_list[] = {
         SNMP_MIB_ITEM("UdpLite6InDatagrams", UDP_MIB_INDATAGRAMS),
         SNMP_MIB_ITEM("UdpLite6NoPorts", UDP_MIB_NOPORTS),
@@ -118,6 +121,7 @@ static struct snmp_mib snmp6_udplite6_list[] = {
         SNMP_MIB_ITEM("UdpLite6OutDatagrams", UDP_MIB_OUTDATAGRAMS),
         SNMP_MIB_SENTINEL
 };
+#endif
 
 static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
 {
@@ -176,7 +180,9 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
                 snmp6_seq_show_item(seq, (void **)icmpv6_statistics, snmp6_icmp6_list);
                 snmp6_seq_show_icmpv6msg(seq, (void **)icmpv6msg_statistics);
                 snmp6_seq_show_item(seq, (void **)udp_stats_in6, snmp6_udp6_list);
+#ifdef CONFIG_IP_UDPLITE
                 snmp6_seq_show_item(seq, (void **)udplite_stats_in6, snmp6_udplite6_list);
+#endif
         }
         return 0;
 }
@@ -214,6 +220,9 @@ int snmp6_register_dev(struct inet6_dev *idev)
         if (!idev || !idev->dev)
                 return -EINVAL;
 
+        if (idev->dev->nd_net != &init_net)
+                return 0;
+
         if (!proc_net_devsnmp6)
                 return -ENOENT;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e8b241cb60bc..f31d7dc11e72 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -40,6 +40,7 @@
 #include <linux/if_arp.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/nsproxy.h>
 #include <net/net_namespace.h>
 #include <net/snmp.h>
 #include <net/ipv6.h>
@@ -87,14 +88,16 @@ static void		ip6_link_failure(struct sk_buff *skb);
 static void             ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
-static struct rt6_info *rt6_add_route_info(struct in6_addr *prefix, int prefixlen,
+static struct rt6_info *rt6_add_route_info(struct net *net,
+                                           struct in6_addr *prefix, int prefixlen,
                                            struct in6_addr *gwaddr, int ifindex,
                                            unsigned pref);
-static struct rt6_info *rt6_get_route_info(struct in6_addr *prefix, int prefixlen,
+static struct rt6_info *rt6_get_route_info(struct net *net,
+                                           struct in6_addr *prefix, int prefixlen,
                                            struct in6_addr *gwaddr, int ifindex);
 #endif
 
-static struct dst_ops ip6_dst_ops = {
+static struct dst_ops ip6_dst_ops_template = {
         .family                 =       AF_INET6,
         .protocol               =       __constant_htons(ETH_P_IPV6),
         .gc                     =       ip6_dst_gc,
@@ -124,7 +127,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .entries                =       ATOMIC_INIT(0),
 };
 
-struct rt6_info ip6_null_entry = {
+static struct rt6_info ip6_null_entry_template = {
         .u = {
                 .dst = {
                         .__refcnt       = ATOMIC_INIT(1),
@@ -134,8 +137,6 @@ struct rt6_info ip6_null_entry = {
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                         .input          = ip6_pkt_discard,
                         .output         = ip6_pkt_discard_out,
-                        .ops            = &ip6_dst_ops,
-                        .path           = (struct dst_entry*)&ip6_null_entry,
                 }
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
@@ -148,7 +149,7 @@ struct rt6_info ip6_null_entry = {
 static int ip6_pkt_prohibit(struct sk_buff *skb);
 static int ip6_pkt_prohibit_out(struct sk_buff *skb);
 
-struct rt6_info ip6_prohibit_entry = {
+struct rt6_info ip6_prohibit_entry_template = {
         .u = {
                 .dst = {
                         .__refcnt       = ATOMIC_INIT(1),
@@ -158,8 +159,6 @@ struct rt6_info ip6_prohibit_entry = {
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                         .input          = ip6_pkt_prohibit,
                         .output         = ip6_pkt_prohibit_out,
-                        .ops            = &ip6_dst_ops,
-                        .path           = (struct dst_entry*)&ip6_prohibit_entry,
                 }
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
@@ -167,7 +166,7 @@ struct rt6_info ip6_prohibit_entry = {
         .rt6i_ref       = ATOMIC_INIT(1),
 };
 
-struct rt6_info ip6_blk_hole_entry = {
+static struct rt6_info ip6_blk_hole_entry_template = {
         .u = {
                 .dst = {
                         .__refcnt       = ATOMIC_INIT(1),
@@ -177,8 +176,6 @@ struct rt6_info ip6_blk_hole_entry = {
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                         .input          = dst_discard,
                         .output         = dst_discard,
-                        .ops            = &ip6_dst_ops,
-                        .path           = (struct dst_entry*)&ip6_blk_hole_entry,
                 }
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
@@ -189,9 +186,9 @@ struct rt6_info ip6_blk_hole_entry = {
 #endif
 
 /* allocate dst with ip6_dst_ops */
-static __inline__ struct rt6_info *ip6_dst_alloc(void)
+static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops)
 {
-        return (struct rt6_info *)dst_alloc(&ip6_dst_ops);
+        return (struct rt6_info *)dst_alloc(ops);
 }
 
 static void ip6_dst_destroy(struct dst_entry *dst)
@@ -239,7 +236,8 @@ static inline int rt6_need_strict(struct in6_addr *daddr)
  *      Route lookup. Any table->tb6_lock is implied.
  */
 
-static __inline__ struct rt6_info *rt6_device_match(struct rt6_info *rt,
+static inline struct rt6_info *rt6_device_match(struct net *net,
+                                                    struct rt6_info *rt,
                                                     int oif,
                                                     int strict)
 {
@@ -268,7 +266,7 @@ static __inline__ struct rt6_info *rt6_device_match(struct rt6_info *rt,
                         return local;
 
                 if (strict)
-                        return &ip6_null_entry;
+                        return net->ipv6.ip6_null_entry;
         }
         return rt;
 }
@@ -409,6 +407,7 @@ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
 static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
 {
         struct rt6_info *match, *rt0;
+        struct net *net;
 
         RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
                   __FUNCTION__, fn->leaf, oif);
@@ -434,13 +433,15 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
         RT6_TRACE("%s() => %p\n",
                   __FUNCTION__, match);
 
-        return (match ? match : &ip6_null_entry);
+        net = rt0->rt6i_dev->nd_net;
+        return (match ? match : net->ipv6.ip6_null_entry);
 }
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
 int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                   struct in6_addr *gwaddr)
 {
+        struct net *net = dev->nd_net;
         struct route_info *rinfo = (struct route_info *) opt;
         struct in6_addr prefix_buf, *prefix;
         unsigned int pref;
@@ -488,7 +489,8 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                 prefix = &prefix_buf;
         }
 
-        rt = rt6_get_route_info(prefix, rinfo->prefix_len, gwaddr, dev->ifindex);
+        rt = rt6_get_route_info(net, prefix, rinfo->prefix_len, gwaddr,
+                                dev->ifindex);
 
         if (rt && !lifetime) {
                 ip6_del_rt(rt);
@@ -496,7 +498,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
         }
 
         if (!rt && lifetime)
-                rt = rt6_add_route_info(prefix, rinfo->prefix_len, gwaddr, dev->ifindex,
+                rt = rt6_add_route_info(net, prefix, rinfo->prefix_len, gwaddr, dev->ifindex,
                                         pref);
         else if (rt)
                 rt->rt6i_flags = RTF_ROUTEINFO |
@@ -515,9 +517,9 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
 }
 #endif
 
-#define BACKTRACK(saddr) \
+#define BACKTRACK(__net, saddr)                 \
 do { \
-        if (rt == &ip6_null_entry) { \
+        if (rt == __net->ipv6.ip6_null_entry) { \
                 struct fib6_node *pn; \
                 while (1) { \
                         if (fn->fn_flags & RTN_TL_ROOT) \
@@ -533,7 +535,8 @@ do { \
         } \
 } while(0)
 
-static struct rt6_info *ip6_pol_route_lookup(struct fib6_table *table,
+static struct rt6_info *ip6_pol_route_lookup(struct net *net,
+                                             struct fib6_table *table,
                                              struct flowi *fl, int flags)
 {
         struct fib6_node *fn;
@@ -543,8 +546,8 @@ static struct rt6_info *ip6_pol_route_lookup(struct fib6_table *table,
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
         rt = fn->leaf;
-        rt = rt6_device_match(rt, fl->oif, flags);
-        BACKTRACK(&fl->fl6_src);
+        rt = rt6_device_match(net, rt, fl->oif, flags);
+        BACKTRACK(net, &fl->fl6_src);
 out:
         dst_use(&rt->u.dst, jiffies);
         read_unlock_bh(&table->tb6_lock);
@@ -552,8 +555,8 @@ out:
 
 }
 
-struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
-                            int oif, int strict)
+struct rt6_info *rt6_lookup(struct net *net, struct in6_addr *daddr,
+                            struct in6_addr *saddr, int oif, int strict)
 {
         struct flowi fl = {
                 .oif = oif,
@@ -571,7 +574,7 @@ struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
                 flags |= RT6_LOOKUP_F_HAS_SADDR;
         }
 
-        dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_lookup);
+        dst = fib6_rule_lookup(net, &fl, flags, ip6_pol_route_lookup);
         if (dst->error == 0)
                 return (struct rt6_info *) dst;
 
@@ -604,7 +607,7 @@ static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info)
 int ip6_ins_rt(struct rt6_info *rt)
 {
         struct nl_info info = {
-                .nl_net = &init_net,
+                .nl_net = rt->rt6i_dev->nd_net,
         };
         return __ip6_ins_rt(rt, &info);
 }
@@ -660,8 +663,8 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *d
         return rt;
 }
 
-static struct rt6_info *ip6_pol_route(struct fib6_table *table, int oif,
-                                            struct flowi *fl, int flags)
+static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, int oif,
+                                      struct flowi *fl, int flags)
 {
         struct fib6_node *fn;
         struct rt6_info *rt, *nrt;
@@ -680,8 +683,9 @@ restart_2:
 
 restart:
         rt = rt6_select(fn, oif, strict | reachable);
-        BACKTRACK(&fl->fl6_src);
-        if (rt == &ip6_null_entry ||
+
+        BACKTRACK(net, &fl->fl6_src);
+        if (rt == net->ipv6.ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
                 goto out;
 
@@ -699,7 +703,7 @@ restart:
         }
 
         dst_release(&rt->u.dst);
-        rt = nrt ? : &ip6_null_entry;
+        rt = nrt ? : net->ipv6.ip6_null_entry;
 
         dst_hold(&rt->u.dst);
         if (nrt) {
@@ -732,15 +736,16 @@ out2:
         return rt;
 }
 
-static struct rt6_info *ip6_pol_route_input(struct fib6_table *table,
+static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
                                             struct flowi *fl, int flags)
 {
-        return ip6_pol_route(table, fl->iif, fl, flags);
+        return ip6_pol_route(net, table, fl->iif, fl, flags);
 }
 
 void ip6_route_input(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct net *net = skb->dev->nd_net;
         int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct flowi fl = {
                 .iif = skb->dev->ifindex,
@@ -758,16 +763,17 @@ void ip6_route_input(struct sk_buff *skb)
         if (rt6_need_strict(&iph->daddr))
                 flags |= RT6_LOOKUP_F_IFACE;
 
-        skb->dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_input);
+        skb->dst = fib6_rule_lookup(net, &fl, flags, ip6_pol_route_input);
 }
 
-static struct rt6_info *ip6_pol_route_output(struct fib6_table *table,
+static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
                                              struct flowi *fl, int flags)
 {
-        return ip6_pol_route(table, fl->oif, fl, flags);
+        return ip6_pol_route(net, table, fl->oif, fl, flags);
 }
 
-struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
+struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
+                                    struct flowi *fl)
 {
         int flags = 0;
 
@@ -777,7 +783,7 @@ struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
         if (!ipv6_addr_any(&fl->fl6_src))
                 flags |= RT6_LOOKUP_F_HAS_SADDR;
 
-        return fib6_rule_lookup(fl, flags, ip6_pol_route_output);
+        return fib6_rule_lookup(net, fl, flags, ip6_pol_route_output);
 }
 
 EXPORT_SYMBOL(ip6_route_output);
@@ -886,12 +892,12 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static int ipv6_get_mtu(struct net_device *dev);
 
-static inline unsigned int ipv6_advmss(unsigned int mtu)
+static inline unsigned int ipv6_advmss(struct net *net, unsigned int mtu)
 {
         mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
 
-        if (mtu < init_net.ipv6.sysctl.ip6_rt_min_advmss)
-                mtu = init_net.ipv6.sysctl.ip6_rt_min_advmss;
+        if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
+                mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
 
         /*
          * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
@@ -904,21 +910,21 @@ static inline unsigned int ipv6_advmss(unsigned int mtu)
         return mtu;
 }
 
-static struct dst_entry *ndisc_dst_gc_list;
-static DEFINE_SPINLOCK(ndisc_lock);
+static struct dst_entry *icmp6_dst_gc_list;
+static DEFINE_SPINLOCK(icmp6_dst_lock);
 
-struct dst_entry *ndisc_dst_alloc(struct net_device *dev,
+struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
                                   struct neighbour *neigh,
-                                  struct in6_addr *addr,
-                                  int (*output)(struct sk_buff *))
+                                  struct in6_addr *addr)
 {
         struct rt6_info *rt;
         struct inet6_dev *idev = in6_dev_get(dev);
+        struct net *net = dev->nd_net;
 
         if (unlikely(idev == NULL))
                 return NULL;
 
-        rt = ip6_dst_alloc();
+        rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
         if (unlikely(rt == NULL)) {
                 in6_dev_put(idev);
                 goto out;
@@ -936,8 +942,8 @@ struct dst_entry *ndisc_dst_alloc(struct net_device *dev,
         atomic_set(&rt->u.dst.__refcnt, 1);
         rt->u.dst.metrics[RTAX_HOPLIMIT-1] = 255;
         rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(rt->rt6i_dev);
-        rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&rt->u.dst));
-        rt->u.dst.output  = output;
+        rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->u.dst));
+        rt->u.dst.output  = ip6_output;
 
 #if 0   /* there's no chance to use these for ndisc */
         rt->u.dst.flags   = ipv6_addr_type(addr) & IPV6_ADDR_UNICAST
@@ -947,18 +953,18 @@ struct dst_entry *ndisc_dst_alloc(struct net_device *dev,
         rt->rt6i_dst.plen = 128;
 #endif
 
-        spin_lock_bh(&ndisc_lock);
-        rt->u.dst.next = ndisc_dst_gc_list;
-        ndisc_dst_gc_list = &rt->u.dst;
-        spin_unlock_bh(&ndisc_lock);
+        spin_lock_bh(&icmp6_dst_lock);
+        rt->u.dst.next = icmp6_dst_gc_list;
+        icmp6_dst_gc_list = &rt->u.dst;
+        spin_unlock_bh(&icmp6_dst_lock);
 
-        fib6_force_start_gc();
+        fib6_force_start_gc(net);
 
 out:
         return &rt->u.dst;
 }
 
-int ndisc_dst_gc(int *more)
+int icmp6_dst_gc(int *more)
 {
         struct dst_entry *dst, *next, **pprev;
         int freed;
@@ -966,8 +972,8 @@ int ndisc_dst_gc(int *more)
         next = NULL;
         freed = 0;
 
-        spin_lock_bh(&ndisc_lock);
-        pprev = &ndisc_dst_gc_list;
+        spin_lock_bh(&icmp6_dst_lock);
+        pprev = &icmp6_dst_gc_list;
 
         while ((dst = *pprev) != NULL) {
                 if (!atomic_read(&dst->__refcnt)) {
@@ -980,30 +986,33 @@ int ndisc_dst_gc(int *more)
                 }
         }
 
-        spin_unlock_bh(&ndisc_lock);
+        spin_unlock_bh(&icmp6_dst_lock);
 
         return freed;
 }
 
 static int ip6_dst_gc(struct dst_ops *ops)
 {
-        static unsigned expire = 30*HZ;
-        static unsigned long last_gc;
         unsigned long now = jiffies;
-
-        if (time_after(last_gc + init_net.ipv6.sysctl.ip6_rt_gc_min_interval, now) &&
-            atomic_read(&ip6_dst_ops.entries) <= init_net.ipv6.sysctl.ip6_rt_max_size)
+        struct net *net = ops->dst_net;
+        int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
+        int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
+        int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
+        int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
+        unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
+
+        if (time_after(rt_last_gc + rt_min_interval, now) &&
+            atomic_read(&ops->entries) <= rt_max_size)
                 goto out;
 
-        expire++;
-        fib6_run_gc(expire);
-        last_gc = now;
-        if (atomic_read(&ip6_dst_ops.entries) < ip6_dst_ops.gc_thresh)
-                expire = init_net.ipv6.sysctl.ip6_rt_gc_timeout>>1;
-
+        net->ipv6.ip6_rt_gc_expire++;
+        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net);
+        net->ipv6.ip6_rt_last_gc = now;
+        if (atomic_read(&ops->entries) < ops->gc_thresh)
+                net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
 out:
-        expire -= expire>>init_net.ipv6.sysctl.ip6_rt_gc_elasticity;
-        return (atomic_read(&ip6_dst_ops.entries) > init_net.ipv6.sysctl.ip6_rt_max_size);
+        net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
+        return (atomic_read(&ops->entries) > rt_max_size);
 }
 
 /* Clean host part of a prefix. Not necessary in radix tree,
@@ -1045,6 +1054,7 @@ int ipv6_get_hoplimit(struct net_device *dev)
 int ip6_route_add(struct fib6_config *cfg)
 {
         int err;
+        struct net *net = cfg->fc_nlinfo.nl_net;
         struct rt6_info *rt = NULL;
         struct net_device *dev = NULL;
         struct inet6_dev *idev = NULL;
@@ -1059,7 +1069,7 @@ int ip6_route_add(struct fib6_config *cfg)
 #endif
         if (cfg->fc_ifindex) {
                 err = -ENODEV;
-                dev = dev_get_by_index(&init_net, cfg->fc_ifindex);
+                dev = dev_get_by_index(net, cfg->fc_ifindex);
                 if (!dev)
                         goto out;
                 idev = in6_dev_get(dev);
@@ -1070,13 +1080,13 @@ int ip6_route_add(struct fib6_config *cfg)
         if (cfg->fc_metric == 0)
                 cfg->fc_metric = IP6_RT_PRIO_USER;
 
-        table = fib6_new_table(cfg->fc_table);
+        table = fib6_new_table(net, cfg->fc_table);
         if (table == NULL) {
                 err = -ENOBUFS;
                 goto out;
         }
 
-        rt = ip6_dst_alloc();
+        rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
 
         if (rt == NULL) {
                 err = -ENOMEM;
@@ -1117,12 +1127,12 @@ int ip6_route_add(struct fib6_config *cfg)
         if ((cfg->fc_flags & RTF_REJECT) ||
             (dev && (dev->flags&IFF_LOOPBACK) && !(addr_type&IPV6_ADDR_LOOPBACK))) {
                 /* hold loopback dev/idev if we haven't done so. */
-                if (dev != init_net.loopback_dev) {
+                if (dev != net->loopback_dev) {
                         if (dev) {
                                 dev_put(dev);
                                 in6_dev_put(idev);
                         }
-                        dev = init_net.loopback_dev;
+                        dev = net->loopback_dev;
                         dev_hold(dev);
                         idev = in6_dev_get(dev);
                         if (!idev) {
@@ -1159,7 +1169,7 @@ int ip6_route_add(struct fib6_config *cfg)
                         if (!(gwa_type&IPV6_ADDR_UNICAST))
                                 goto out;
 
-                        grt = rt6_lookup(gw_addr, NULL, cfg->fc_ifindex, 1);
+                        grt = rt6_lookup(net, gw_addr, NULL, cfg->fc_ifindex, 1);
 
                         err = -EHOSTUNREACH;
                         if (grt == NULL)
@@ -1226,10 +1236,13 @@ install_route:
         if (!rt->u.dst.metrics[RTAX_MTU-1])
                 rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
         if (!rt->u.dst.metrics[RTAX_ADVMSS-1])
-                rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&rt->u.dst));
+                rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->u.dst));
         rt->u.dst.dev = dev;
         rt->rt6i_idev = idev;
         rt->rt6i_table = table;
+
+        cfg->fc_nlinfo.nl_net = dev->nd_net;
+
         return __ip6_ins_rt(rt, &cfg->fc_nlinfo);
 
 out:
@@ -1246,8 +1259,9 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
 {
         int err;
         struct fib6_table *table;
+        struct net *net = rt->rt6i_dev->nd_net;
 
-        if (rt == &ip6_null_entry)
+        if (rt == net->ipv6.ip6_null_entry)
                 return -ENOENT;
 
         table = rt->rt6i_table;
@@ -1264,7 +1278,7 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
 int ip6_del_rt(struct rt6_info *rt)
 {
         struct nl_info info = {
-                .nl_net = &init_net,
+                .nl_net = rt->rt6i_dev->nd_net,
         };
         return __ip6_del_rt(rt, &info);
 }
@@ -1276,7 +1290,7 @@ static int ip6_route_del(struct fib6_config *cfg)
         struct rt6_info *rt;
         int err = -ESRCH;
 
-        table = fib6_get_table(cfg->fc_table);
+        table = fib6_get_table(cfg->fc_nlinfo.nl_net, cfg->fc_table);
         if (table == NULL)
                 return err;
 
@@ -1316,7 +1330,8 @@ struct ip6rd_flowi {
         struct in6_addr gateway;
 };
 
-static struct rt6_info *__ip6_route_redirect(struct fib6_table *table,
+static struct rt6_info *__ip6_route_redirect(struct net *net,
+                                             struct fib6_table *table,
                                              struct flowi *fl,
                                              int flags)
 {
@@ -1359,8 +1374,8 @@ restart:
         }
 
         if (!rt)
-                rt = &ip6_null_entry;
-        BACKTRACK(&fl->fl6_src);
+                rt = net->ipv6.ip6_null_entry;
+        BACKTRACK(net, &fl->fl6_src);
 out:
         dst_hold(&rt->u.dst);
 
@@ -1375,6 +1390,7 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                            struct net_device *dev)
 {
         int flags = RT6_LOOKUP_F_HAS_SADDR;
+        struct net *net = dev->nd_net;
         struct ip6rd_flowi rdfl = {
                 .fl = {
                         .oif = dev->ifindex,
@@ -1391,7 +1407,8 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
         if (rt6_need_strict(dest))
                 flags |= RT6_LOOKUP_F_IFACE;
 
-        return (struct rt6_info *)fib6_rule_lookup((struct flowi *)&rdfl, flags, __ip6_route_redirect);
+        return (struct rt6_info *)fib6_rule_lookup(net, (struct flowi *)&rdfl,
+                                                   flags, __ip6_route_redirect);
 }
 
 void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
@@ -1400,10 +1417,11 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
 {
         struct rt6_info *rt, *nrt = NULL;
         struct netevent_redirect netevent;
+        struct net *net = neigh->dev->nd_net;
 
         rt = ip6_route_redirect(dest, src, saddr, neigh->dev);
 
-        if (rt == &ip6_null_entry) {
+        if (rt == net->ipv6.ip6_null_entry) {
                 if (net_ratelimit())
                         printk(KERN_DEBUG "rt6_redirect: source isn't a valid nexthop "
                                "for redirect target\n");
@@ -1448,7 +1466,8 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
         nrt->rt6i_nexthop = neigh_clone(neigh);
         /* Reset pmtu, it may be better */
         nrt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(neigh->dev);
-        nrt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&nrt->u.dst));
+        nrt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(neigh->dev->nd_net,
+                                                        dst_mtu(&nrt->u.dst));
 
         if (ip6_ins_rt(nrt))
                 goto out;
@@ -1476,9 +1495,10 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
                         struct net_device *dev, u32 pmtu)
 {
         struct rt6_info *rt, *nrt;
+        struct net *net = dev->nd_net;
         int allfrag = 0;
 
-        rt = rt6_lookup(daddr, saddr, dev->ifindex, 0);
+        rt = rt6_lookup(net, daddr, saddr, dev->ifindex, 0);
         if (rt == NULL)
                 return;
 
@@ -1511,7 +1531,7 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
                 rt->u.dst.metrics[RTAX_MTU-1] = pmtu;
                 if (allfrag)
                         rt->u.dst.metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
-                dst_set_expires(&rt->u.dst, init_net.ipv6.sysctl.ip6_rt_mtu_expires);
+                dst_set_expires(&rt->u.dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
                 rt->rt6i_flags |= RTF_MODIFIED|RTF_EXPIRES;
                 goto out;
         }
@@ -1537,7 +1557,7 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
                  * which is 10 mins. After 10 mins the decreased pmtu is expired
                  * and detecting PMTU increase will be automatically happened.
                  */
-                dst_set_expires(&nrt->u.dst, init_net.ipv6.sysctl.ip6_rt_mtu_expires);
+                dst_set_expires(&nrt->u.dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
                 nrt->rt6i_flags |= RTF_DYNAMIC|RTF_EXPIRES;
 
                 ip6_ins_rt(nrt);
@@ -1552,7 +1572,8 @@ out:
 
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 {
-        struct rt6_info *rt = ip6_dst_alloc();
+        struct net *net = ort->rt6i_dev->nd_net;
+        struct rt6_info *rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
 
         if (rt) {
                 rt->u.dst.input = ort->u.dst.input;
@@ -1583,14 +1604,15 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 }
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
-static struct rt6_info *rt6_get_route_info(struct in6_addr *prefix, int prefixlen,
+static struct rt6_info *rt6_get_route_info(struct net *net,
+                                           struct in6_addr *prefix, int prefixlen,
                                            struct in6_addr *gwaddr, int ifindex)
 {
         struct fib6_node *fn;
         struct rt6_info *rt = NULL;
         struct fib6_table *table;
 
-        table = fib6_get_table(RT6_TABLE_INFO);
+        table = fib6_get_table(net, RT6_TABLE_INFO);
         if (table == NULL)
                 return NULL;
 
@@ -1614,7 +1636,8 @@ out:
         return rt;
 }
 
-static struct rt6_info *rt6_add_route_info(struct in6_addr *prefix, int prefixlen,
+static struct rt6_info *rt6_add_route_info(struct net *net,
+                                           struct in6_addr *prefix, int prefixlen,
                                            struct in6_addr *gwaddr, int ifindex,
                                            unsigned pref)
 {
@@ -1625,6 +1648,9 @@ static struct rt6_info *rt6_add_route_info(struct in6_addr *prefix, int prefixle
                 .fc_dst_len     = prefixlen,
                 .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
                                   RTF_UP | RTF_PREF(pref),
+                .fc_nlinfo.pid = 0,
+                .fc_nlinfo.nlh = NULL,
+                .fc_nlinfo.nl_net = net,
         };
 
         ipv6_addr_copy(&cfg.fc_dst, prefix);
@@ -1636,7 +1662,7 @@ static struct rt6_info *rt6_add_route_info(struct in6_addr *prefix, int prefixle
 
         ip6_route_add(&cfg);
 
-        return rt6_get_route_info(prefix, prefixlen, gwaddr, ifindex);
+        return rt6_get_route_info(net, prefix, prefixlen, gwaddr, ifindex);
 }
 #endif
 
@@ -1645,7 +1671,7 @@ struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *d
         struct rt6_info *rt;
         struct fib6_table *table;
 
-        table = fib6_get_table(RT6_TABLE_DFLT);
+        table = fib6_get_table(dev->nd_net, RT6_TABLE_DFLT);
         if (table == NULL)
                 return NULL;
 
@@ -1674,6 +1700,9 @@ struct rt6_info *rt6_add_dflt_router(struct in6_addr *gwaddr,
                 .fc_ifindex     = dev->ifindex,
                 .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
                                   RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
+                .fc_nlinfo.pid = 0,
+                .fc_nlinfo.nlh = NULL,
+                .fc_nlinfo.nl_net = dev->nd_net,
         };
 
         ipv6_addr_copy(&cfg.fc_gateway, gwaddr);
@@ -1683,13 +1712,13 @@ struct rt6_info *rt6_add_dflt_router(struct in6_addr *gwaddr,
         return rt6_get_dflt_router(gwaddr, dev);
 }
 
-void rt6_purge_dflt_routers(void)
+void rt6_purge_dflt_routers(struct net *net)
 {
         struct rt6_info *rt;
         struct fib6_table *table;
 
         /* NOTE: Keep consistent with rt6_get_dflt_router */
-        table = fib6_get_table(RT6_TABLE_DFLT);
+        table = fib6_get_table(net, RT6_TABLE_DFLT);
         if (table == NULL)
                 return;
 
@@ -1706,7 +1735,8 @@ restart:
         read_unlock_bh(&table->tb6_lock);
 }
 
-static void rtmsg_to_fib6_config(struct in6_rtmsg *rtmsg,
+static void rtmsg_to_fib6_config(struct net *net,
+                                 struct in6_rtmsg *rtmsg,
                                  struct fib6_config *cfg)
 {
         memset(cfg, 0, sizeof(*cfg));
@@ -1719,14 +1749,14 @@ static void rtmsg_to_fib6_config(struct in6_rtmsg *rtmsg,
         cfg->fc_src_len = rtmsg->rtmsg_src_len;
         cfg->fc_flags = rtmsg->rtmsg_flags;
 
-        cfg->fc_nlinfo.nl_net = &init_net;
+        cfg->fc_nlinfo.nl_net = net;
 
         ipv6_addr_copy(&cfg->fc_dst, &rtmsg->rtmsg_dst);
         ipv6_addr_copy(&cfg->fc_src, &rtmsg->rtmsg_src);
         ipv6_addr_copy(&cfg->fc_gateway, &rtmsg->rtmsg_gateway);
 }
 
-int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
+int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 {
         struct fib6_config cfg;
         struct in6_rtmsg rtmsg;
@@ -1742,7 +1772,7 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
                 if (err)
                         return -EFAULT;
 
-                rtmsg_to_fib6_config(&rtmsg, &cfg);
+                rtmsg_to_fib6_config(net, &rtmsg, &cfg);
 
                 rtnl_lock();
                 switch (cmd) {
@@ -1821,21 +1851,22 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                     const struct in6_addr *addr,
                                     int anycast)
 {
-        struct rt6_info *rt = ip6_dst_alloc();
+        struct net *net = idev->dev->nd_net;
+        struct rt6_info *rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
 
         if (rt == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        dev_hold(init_net.loopback_dev);
+        dev_hold(net->loopback_dev);
         in6_dev_hold(idev);
 
         rt->u.dst.flags = DST_HOST;
         rt->u.dst.input = ip6_input;
         rt->u.dst.output = ip6_output;
-        rt->rt6i_dev = init_net.loopback_dev;
+        rt->rt6i_dev = net->loopback_dev;
         rt->rt6i_idev = idev;
         rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(rt->rt6i_dev);
-        rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&rt->u.dst));
+        rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->u.dst));
         rt->u.dst.metrics[RTAX_HOPLIMIT-1] = -1;
         rt->u.dst.obsolete = -1;
 
@@ -1852,26 +1883,39 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 
         ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
         rt->rt6i_dst.plen = 128;
-        rt->rt6i_table = fib6_get_table(RT6_TABLE_LOCAL);
+        rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);
 
         atomic_set(&rt->u.dst.__refcnt, 1);
 
         return rt;
 }
 
+struct arg_dev_net {
+        struct net_device *dev;
+        struct net *net;
+};
+
 static int fib6_ifdown(struct rt6_info *rt, void *arg)
 {
-        if (((void*)rt->rt6i_dev == arg || arg == NULL) &&
-            rt != &ip6_null_entry) {
+        struct net_device *dev = ((struct arg_dev_net *)arg)->dev;
+        struct net *net = ((struct arg_dev_net *)arg)->net;
+
+        if (((void *)rt->rt6i_dev == dev || dev == NULL) &&
+            rt != net->ipv6.ip6_null_entry) {
                 RT6_TRACE("deleted by ifdown %p\n", rt);
                 return -1;
         }
         return 0;
 }
 
-void rt6_ifdown(struct net_device *dev)
+void rt6_ifdown(struct net *net, struct net_device *dev)
 {
-        fib6_clean_all(fib6_ifdown, 0, dev);
+        struct arg_dev_net adn = {
+                .dev = dev,
+                .net = net,
+        };
+
+        fib6_clean_all(net, fib6_ifdown, 0, &adn);
 }
 
 struct rt6_mtu_change_arg
@@ -1884,6 +1928,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
 {
         struct rt6_mtu_change_arg *arg = (struct rt6_mtu_change_arg *) p_arg;
         struct inet6_dev *idev;
+        struct net *net = arg->dev->nd_net;
 
         /* In IPv6 pmtu discovery is not optional,
            so that RTAX_MTU lock cannot disable it.
@@ -1915,7 +1960,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
              (dst_mtu(&rt->u.dst) < arg->mtu &&
               dst_mtu(&rt->u.dst) == idev->cnf.mtu6))) {
                 rt->u.dst.metrics[RTAX_MTU-1] = arg->mtu;
-                rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(arg->mtu);
+                rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, arg->mtu);
         }
         return 0;
 }
@@ -1927,7 +1972,7 @@ void rt6_mtu_change(struct net_device *dev, unsigned mtu)
                 .mtu = mtu,
         };
 
-        fib6_clean_all(rt6_mtu_change_route, 0, &arg);
+        fib6_clean_all(dev->nd_net, rt6_mtu_change_route, 0, &arg);
 }
 
 static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
@@ -2010,13 +2055,9 @@ errout:
 
 static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
-        struct net *net = skb->sk->sk_net;
         struct fib6_config cfg;
         int err;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = rtm_to_fib6_config(skb, nlh, &cfg);
         if (err < 0)
                 return err;
@@ -2026,13 +2067,9 @@ static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *a
 
 static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
-        struct net *net = skb->sk->sk_net;
         struct fib6_config cfg;
         int err;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = rtm_to_fib6_config(skb, nlh, &cfg);
         if (err < 0)
                 return err;
@@ -2122,7 +2159,8 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                 NLA_PUT_U32(skb, RTA_IIF, iif);
         else if (dst) {
                 struct in6_addr saddr_buf;
-                if (ipv6_get_saddr(&rt->u.dst, dst, &saddr_buf) == 0)
+                if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                                       dst, &saddr_buf) == 0)
                         NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
 
@@ -2175,9 +2213,6 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         struct flowi fl;
         int err, iif = 0;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
         if (err < 0)
                 goto errout;
@@ -2207,7 +2242,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
 
         if (iif) {
                 struct net_device *dev;
-                dev = __dev_get_by_index(&init_net, iif);
+                dev = __dev_get_by_index(net, iif);
                 if (!dev) {
                         err = -ENODEV;
                         goto errout;
@@ -2226,7 +2261,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         skb_reset_mac_header(skb);
         skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
 
-        rt = (struct rt6_info*) ip6_route_output(NULL, &fl);
+        rt = (struct rt6_info*) ip6_route_output(&init_net, NULL, &fl);
         skb->dst = &rt->u.dst;
 
         err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
@@ -2237,7 +2272,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                 goto errout;
         }
 
-        err = rtnl_unicast(skb, &init_net, NETLINK_CB(in_skb).pid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
 errout:
         return err;
 }
@@ -2245,6 +2280,7 @@ errout:
 void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
 {
         struct sk_buff *skb;
+        struct net *net = info->nl_net;
         u32 seq;
         int err;
 
@@ -2263,11 +2299,31 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
                 kfree_skb(skb);
                 goto errout;
         }
-        err = rtnl_notify(skb, &init_net, info->pid,
-                                RTNLGRP_IPV6_ROUTE, info->nlh, gfp_any());
+        err = rtnl_notify(skb, net, info->pid, RTNLGRP_IPV6_ROUTE,
+                          info->nlh, gfp_any());
 errout:
         if (err < 0)
-                rtnl_set_sk_err(&init_net, RTNLGRP_IPV6_ROUTE, err);
+                rtnl_set_sk_err(net, RTNLGRP_IPV6_ROUTE, err);
+}
+
+static int ip6_route_dev_notify(struct notifier_block *this,
+                                unsigned long event, void *data)
+{
+        struct net_device *dev = (struct net_device *)data;
+        struct net *net = dev->nd_net;
+
+        if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
+                net->ipv6.ip6_null_entry->u.dst.dev = dev;
+                net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+                net->ipv6.ip6_prohibit_entry->u.dst.dev = dev;
+                net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
+                net->ipv6.ip6_blk_hole_entry->u.dst.dev = dev;
+                net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
+#endif
+        }
+
+        return NOTIFY_OK;
 }
 
 /*
@@ -2316,13 +2372,25 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 
 static int ipv6_route_show(struct seq_file *m, void *v)
 {
-        fib6_clean_all(rt6_info_route, 0, m);
+        struct net *net = (struct net *)m->private;
+        fib6_clean_all(net, rt6_info_route, 0, m);
         return 0;
 }
 
 static int ipv6_route_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, ipv6_route_show, NULL);
+        struct net *net = get_proc_net(inode);
+        if (!net)
+                return -ENXIO;
+        return single_open(file, ipv6_route_show, net);
+}
+
+static int ipv6_route_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+        struct net *net = seq->private;
+        put_net(net);
+        return single_release(inode, file);
 }
 
 static const struct file_operations ipv6_route_proc_fops = {
@@ -2330,24 +2398,36 @@ static const struct file_operations ipv6_route_proc_fops = {
         .open           = ipv6_route_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = single_release,
+        .release        = ipv6_route_release,
 };
 
 static int rt6_stats_seq_show(struct seq_file *seq, void *v)
 {
+        struct net *net = (struct net *)seq->private;
         seq_printf(seq, "%04x %04x %04x %04x %04x %04x %04x\n",
-                      rt6_stats.fib_nodes, rt6_stats.fib_route_nodes,
-                      rt6_stats.fib_rt_alloc, rt6_stats.fib_rt_entries,
-                      rt6_stats.fib_rt_cache,
-                      atomic_read(&ip6_dst_ops.entries),
-                      rt6_stats.fib_discarded_routes);
+                   net->ipv6.rt6_stats->fib_nodes,
+                   net->ipv6.rt6_stats->fib_route_nodes,
+                   net->ipv6.rt6_stats->fib_rt_alloc,
+                   net->ipv6.rt6_stats->fib_rt_entries,
+                   net->ipv6.rt6_stats->fib_rt_cache,
+                   atomic_read(&net->ipv6.ip6_dst_ops->entries),
+                   net->ipv6.rt6_stats->fib_discarded_routes);
 
         return 0;
 }
 
 static int rt6_stats_seq_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, rt6_stats_seq_show, NULL);
+        struct net *net = get_proc_net(inode);
+        return single_open(file, rt6_stats_seq_show, net);
+}
+
+static int rt6_stats_seq_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+        struct net *net = (struct net *)seq->private;
+        put_net(net);
+        return single_release(inode, file);
 }
 
 static const struct file_operations rt6_stats_seq_fops = {
@@ -2355,42 +2435,8 @@ static const struct file_operations rt6_stats_seq_fops = {
         .open    = rt6_stats_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = single_release,
+        .release = rt6_stats_seq_release,
 };
-
-static int ipv6_route_proc_init(struct net *net)
-{
-        int ret = -ENOMEM;
-        if (!proc_net_fops_create(net, "ipv6_route",
-                                  0, &ipv6_route_proc_fops))
-                goto out;
-
-        if (!proc_net_fops_create(net, "rt6_stats",
-                                  S_IRUGO, &rt6_stats_seq_fops))
-                goto out_ipv6_route;
-
-        ret = 0;
-out:
-        return ret;
-out_ipv6_route:
-        proc_net_remove(net, "ipv6_route");
-        goto out;
-}
-
-static void ipv6_route_proc_fini(struct net *net)
-{
-        proc_net_remove(net, "ipv6_route");
-        proc_net_remove(net, "rt6_stats");
-}
-#else
-static inline int ipv6_route_proc_init(struct net *net)
-{
-        return 0;
-}
-static inline void ipv6_route_proc_fini(struct net *net)
-{
-        return ;
-}
 #endif  /* CONFIG_PROC_FS */
 
 #ifdef CONFIG_SYSCTL
@@ -2399,10 +2445,11 @@ static
 int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write, struct file * filp,
                               void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        int delay = init_net.ipv6.sysctl.flush_delay;
+        struct net *net = current->nsproxy->net_ns;
+        int delay = net->ipv6.sysctl.flush_delay;
         if (write) {
                 proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
-                fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay);
+                fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
                 return 0;
         } else
                 return -EINVAL;
@@ -2419,7 +2466,7 @@ ctl_table ipv6_route_table_template[] = {
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_THRESH,
                 .procname       =       "gc_thresh",
-                .data           =       &ip6_dst_ops.gc_thresh,
+                .data           =       &ip6_dst_ops_template.gc_thresh,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
                 .proc_handler   =       &proc_dointvec,
@@ -2505,33 +2552,141 @@ struct ctl_table *ipv6_route_sysctl_init(struct net *net)
         table = kmemdup(ipv6_route_table_template,
                         sizeof(ipv6_route_table_template),
                         GFP_KERNEL);
+
+        if (table) {
+                table[0].data = &net->ipv6.sysctl.flush_delay;
+                table[1].data = &net->ipv6.ip6_dst_ops->gc_thresh;
+                table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
+                table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
+                table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;
+                table[5].data = &net->ipv6.sysctl.ip6_rt_gc_interval;
+                table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
+                table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
+                table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
+        }
+
         return table;
 }
 #endif
 
+static int ip6_route_net_init(struct net *net)
+{
+        int ret = 0;
+
+        ret = -ENOMEM;
+        net->ipv6.ip6_dst_ops = kmemdup(&ip6_dst_ops_template,
+                                        sizeof(*net->ipv6.ip6_dst_ops),
+                                        GFP_KERNEL);
+        if (!net->ipv6.ip6_dst_ops)
+                goto out;
+        net->ipv6.ip6_dst_ops->dst_net = net;
+
+        net->ipv6.ip6_null_entry = kmemdup(&ip6_null_entry_template,
+                                           sizeof(*net->ipv6.ip6_null_entry),
+                                           GFP_KERNEL);
+        if (!net->ipv6.ip6_null_entry)
+                goto out_ip6_dst_ops;
+        net->ipv6.ip6_null_entry->u.dst.path =
+                (struct dst_entry *)net->ipv6.ip6_null_entry;
+        net->ipv6.ip6_null_entry->u.dst.ops = net->ipv6.ip6_dst_ops;
+
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
+                                               sizeof(*net->ipv6.ip6_prohibit_entry),
+                                               GFP_KERNEL);
+        if (!net->ipv6.ip6_prohibit_entry) {
+                kfree(net->ipv6.ip6_null_entry);
+                goto out;
+        }
+        net->ipv6.ip6_prohibit_entry->u.dst.path =
+                (struct dst_entry *)net->ipv6.ip6_prohibit_entry;
+        net->ipv6.ip6_prohibit_entry->u.dst.ops = net->ipv6.ip6_dst_ops;
+
+        net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
+                                               sizeof(*net->ipv6.ip6_blk_hole_entry),
+                                               GFP_KERNEL);
+        if (!net->ipv6.ip6_blk_hole_entry) {
+                kfree(net->ipv6.ip6_null_entry);
+                kfree(net->ipv6.ip6_prohibit_entry);
+                goto out;
+        }
+        net->ipv6.ip6_blk_hole_entry->u.dst.path =
+                (struct dst_entry *)net->ipv6.ip6_blk_hole_entry;
+        net->ipv6.ip6_blk_hole_entry->u.dst.ops = net->ipv6.ip6_dst_ops;
+#endif
+
+#ifdef CONFIG_PROC_FS
+        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
+        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+#endif
+        net->ipv6.ip6_rt_gc_expire = 30*HZ;
+
+        ret = 0;
+out:
+        return ret;
+
+out_ip6_dst_ops:
+        kfree(net->ipv6.ip6_dst_ops);
+        goto out;
+}
+
+static void ip6_route_net_exit(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_remove(net, "ipv6_route");
+        proc_net_remove(net, "rt6_stats");
+#endif
+        kfree(net->ipv6.ip6_null_entry);
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        kfree(net->ipv6.ip6_prohibit_entry);
+        kfree(net->ipv6.ip6_blk_hole_entry);
+#endif
+        kfree(net->ipv6.ip6_dst_ops);
+}
+
+static struct pernet_operations ip6_route_net_ops = {
+        .init = ip6_route_net_init,
+        .exit = ip6_route_net_exit,
+};
+
+static struct notifier_block ip6_route_dev_notifier = {
+        .notifier_call = ip6_route_dev_notify,
+        .priority = 0,
+};
+
 int __init ip6_route_init(void)
 {
         int ret;
 
-        ip6_dst_ops.kmem_cachep =
+        ret = -ENOMEM;
+        ip6_dst_ops_template.kmem_cachep =
                 kmem_cache_create("ip6_dst_cache", sizeof(struct rt6_info), 0,
                                   SLAB_HWCACHE_ALIGN, NULL);
-        if (!ip6_dst_ops.kmem_cachep)
-                return -ENOMEM;
+        if (!ip6_dst_ops_template.kmem_cachep)
+                goto out;;
 
-        ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops.kmem_cachep;
-
-        ret = fib6_init();
+        ret = register_pernet_subsys(&ip6_route_net_ops);
         if (ret)
                 goto out_kmem_cache;
 
-        ret = ipv6_route_proc_init(&init_net);
+        /* Registering of the loopback is done before this portion of code,
+         * the loopback reference in rt6_info will not be taken, do it
+         * manually for init_net */
+        init_net.ipv6.ip6_null_entry->u.dst.dev = init_net.loopback_dev;
+        init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        init_net.ipv6.ip6_prohibit_entry->u.dst.dev = init_net.loopback_dev;
+        init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+        init_net.ipv6.ip6_blk_hole_entry->u.dst.dev = init_net.loopback_dev;
+        init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+  #endif
+        ret = fib6_init();
         if (ret)
-                goto out_fib6_init;
+                goto out_register_subsys;
 
         ret = xfrm6_init();
         if (ret)
-                goto out_proc_init;
+                goto out_fib6_init;
 
         ret = fib6_rules_init();
         if (ret)
@@ -2543,7 +2698,10 @@ int __init ip6_route_init(void)
             __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL))
                 goto fib6_rules_init;
 
-        ret = 0;
+        ret = register_netdevice_notifier(&ip6_route_dev_notifier);
+        if (ret)
+                goto fib6_rules_init;
+
 out:
         return ret;
 
@@ -2551,22 +2709,21 @@ fib6_rules_init:
         fib6_rules_cleanup();
 xfrm6_init:
         xfrm6_fini();
-out_proc_init:
-        ipv6_route_proc_fini(&init_net);
 out_fib6_init:
-        rt6_ifdown(NULL);
         fib6_gc_cleanup();
+out_register_subsys:
+        unregister_pernet_subsys(&ip6_route_net_ops);
 out_kmem_cache:
-        kmem_cache_destroy(ip6_dst_ops.kmem_cachep);
+        kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
         goto out;
 }
 
 void ip6_route_cleanup(void)
 {
+        unregister_netdevice_notifier(&ip6_route_dev_notifier);
         fib6_rules_cleanup();
-        ipv6_route_proc_fini(&init_net);
         xfrm6_fini();
-        rt6_ifdown(NULL);
         fib6_gc_cleanup();
-        kmem_cache_destroy(ip6_dst_ops.kmem_cachep);
+        unregister_pernet_subsys(&ip6_route_net_ops);
+        kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
 }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1656c003b989..1b8196c8d145 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -339,11 +339,11 @@ out:
         skb_reset_network_header(skb2);
 
         /* Try to guess incoming interface */
-        rt6i = rt6_lookup(&iph6->saddr, NULL, NULL, 0);
+        rt6i = rt6_lookup(&init_net, &iph6->saddr, NULL, NULL, 0);
         if (rt6i && rt6i->rt6i_dev) {
                 skb2->dev = rt6i->rt6i_dev;
 
-                rt6i = rt6_lookup(&iph6->daddr, &iph6->saddr, NULL, 0);
+                rt6i = rt6_lookup(&init_net, &iph6->daddr, &iph6->saddr, NULL, 0);
 
                 if (rt6i && rt6i->rt6i_dev && rt6i->rt6i_dev->type == ARPHRD_SIT) {
                         struct ip_tunnel *t = netdev_priv(rt6i->rt6i_dev);
@@ -393,7 +393,7 @@ isatap_srcok(struct sk_buff *skb, struct iphdr *iph, struct net_device *dev)
         fl.oif = dev->ifindex;
         security_skb_classify_flow(skb, &fl);
 
-        dst = ip6_route_output(NULL, &fl);
+        dst = ip6_route_output(&init_net, NULL, &fl);
         if (!dst->error && (dst->dev == dev) && (neigh = dst->neighbour)) {
 
                 addr6 = (struct in6_addr*)&neigh->primary_key;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
new file mode 100644
index 000000000000..827c5aa7524c
--- /dev/null
+++ b/net/ipv6/syncookies.c
@@ -0,0 +1,267 @@
+/*
+ *  IPv6 Syncookies implementation for the Linux kernel
+ *
+ *  Authors:
+ *  Glenn Griffin       <ggriffin.kernel@gmail.com>
+ *
+ *  Based on IPv4 implementation by Andi Kleen
+ *  linux/net/ipv4/syncookies.c
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ */
+
+#include <linux/tcp.h>
+#include <linux/random.h>
+#include <linux/cryptohash.h>
+#include <linux/kernel.h>
+#include <net/ipv6.h>
+#include <net/tcp.h>
+
+extern int sysctl_tcp_syncookies;
+extern __u32 syncookie_secret[2][16-3+SHA_DIGEST_WORDS];
+
+#define COOKIEBITS 24   /* Upper bits store count */
+#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
+
+/*
+ * This table has to be sorted and terminated with (__u16)-1.
+ * XXX generate a better table.
+ * Unresolved Issues: HIPPI with a 64k MSS is not well supported.
+ *
+ * Taken directly from ipv4 implementation.
+ * Should this list be modified for ipv6 use or is it close enough?
+ * rfc 2460 8.3 suggests mss values 20 bytes less than ipv4 counterpart
+ */
+static __u16 const msstab[] = {
+        64 - 1,
+        256 - 1,
+        512 - 1,
+        536 - 1,
+        1024 - 1,
+        1440 - 1,
+        1460 - 1,
+        4312 - 1,
+        (__u16)-1
+};
+/* The number doesn't include the -1 terminator */
+#define NUM_MSS (ARRAY_SIZE(msstab) - 1)
+
+/*
+ * This (misnamed) value is the age of syncookie which is permitted.
+ * Its ideal value should be dependent on TCP_TIMEOUT_INIT and
+ * sysctl_tcp_retries1. It's a rather complicated formula (exponential
+ * backoff) to compute at runtime so it's currently hardcoded here.
+ */
+#define COUNTER_TRIES 4
+
+static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
+                                           struct request_sock *req,
+                                           struct dst_entry *dst)
+{
+        struct inet_connection_sock *icsk = inet_csk(sk);
+        struct sock *child;
+
+        child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
+        if (child)
+                inet_csk_reqsk_queue_add(sk, req, child);
+        else
+                reqsk_free(req);
+
+        return child;
+}
+
+static DEFINE_PER_CPU(__u32, cookie_scratch)[16 + 5 + SHA_WORKSPACE_WORDS];
+
+static u32 cookie_hash(struct in6_addr *saddr, struct in6_addr *daddr,
+                       __be16 sport, __be16 dport, u32 count, int c)
+{
+        __u32 *tmp = __get_cpu_var(cookie_scratch);
+
+        /*
+         * we have 320 bits of information to hash, copy in the remaining
+         * 192 bits required for sha_transform, from the syncookie_secret
+         * and overwrite the digest with the secret
+         */
+        memcpy(tmp + 10, syncookie_secret[c], 44);
+        memcpy(tmp, saddr, 16);
+        memcpy(tmp + 4, daddr, 16);
+        tmp[8] = ((__force u32)sport << 16) + (__force u32)dport;
+        tmp[9] = count;
+        sha_transform(tmp + 16, (__u8 *)tmp, tmp + 16 + 5);
+
+        return tmp[17];
+}
+
+static __u32 secure_tcp_syn_cookie(struct in6_addr *saddr, struct in6_addr *daddr,
+                                   __be16 sport, __be16 dport, __u32 sseq,
+                                   __u32 count, __u32 data)
+{
+        return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
+                sseq + (count << COOKIEBITS) +
+                ((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
+                & COOKIEMASK));
+}
+
+static __u32 check_tcp_syn_cookie(__u32 cookie, struct in6_addr *saddr,
+                                  struct in6_addr *daddr, __be16 sport,
+                                  __be16 dport, __u32 sseq, __u32 count,
+                                  __u32 maxdiff)
+{
+        __u32 diff;
+
+        cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
+
+        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
+        if (diff >= maxdiff)
+                return (__u32)-1;
+
+        return (cookie -
+                cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
+                & COOKIEMASK;
+}
+
+__u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
+{
+        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
+        int mssind;
+        const __u16 mss = *mssp;
+
+        tcp_sk(sk)->last_synq_overflow = jiffies;
+
+        for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
+                ;
+        *mssp = msstab[mssind] + 1;
+
+        NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESSENT);
+
+        return secure_tcp_syn_cookie(&iph->saddr, &iph->daddr, th->source,
+                                     th->dest, ntohl(th->seq),
+                                     jiffies / (HZ * 60), mssind);
+}
+
+static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
+{
+        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
+        __u32 seq = ntohl(th->seq) - 1;
+        __u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
+                                            th->source, th->dest, seq,
+                                            jiffies / (HZ * 60), COUNTER_TRIES);
+
+        return mssind < NUM_MSS ? msstab[mssind] + 1 : 0;
+}
+
+struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+{
+        struct inet_request_sock *ireq;
+        struct inet6_request_sock *ireq6;
+        struct tcp_request_sock *treq;
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcphdr *th = tcp_hdr(skb);
+        __u32 cookie = ntohl(th->ack_seq) - 1;
+        struct sock *ret = sk;
+        struct request_sock *req;
+        int mss;
+        struct dst_entry *dst;
+        __u8 rcv_wscale;
+
+        if (!sysctl_tcp_syncookies || !th->ack)
+                goto out;
+
+        if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
+                (mss = cookie_check(skb, cookie)) == 0) {
+                NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED);
+                goto out;
+        }
+
+        NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV);
+
+        ret = NULL;
+        req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
+        if (!req)
+                goto out;
+
+        ireq = inet_rsk(req);
+        ireq6 = inet6_rsk(req);
+        treq = tcp_rsk(req);
+        ireq6->pktopts = NULL;
+
+        if (security_inet_conn_request(sk, skb, req)) {
+                reqsk_free(req);
+                goto out;
+        }
+
+        req->mss = mss;
+        ireq->rmt_port = th->source;
+        ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
+        ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
+        if (ipv6_opt_accepted(sk, skb) ||
+            np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
+            np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
+                atomic_inc(&skb->users);
+                ireq6->pktopts = skb;
+        }
+
+        ireq6->iif = sk->sk_bound_dev_if;
+        /* So that link locals have meaning */
+        if (!sk->sk_bound_dev_if &&
+            ipv6_addr_type(&ireq6->rmt_addr) & IPV6_ADDR_LINKLOCAL)
+                ireq6->iif = inet6_iif(skb);
+
+        req->expires = 0UL;
+        req->retrans = 0;
+        ireq->snd_wscale = ireq->rcv_wscale = ireq->tstamp_ok = 0;
+        ireq->wscale_ok = ireq->sack_ok = 0;
+        treq->rcv_isn = ntohl(th->seq) - 1;
+        treq->snt_isn = cookie;
+
+        /*
+         * We need to lookup the dst_entry to get the correct window size.
+         * This is taken from tcp_v6_syn_recv_sock.  Somebody please enlighten
+         * me if there is a preferred way.
+         */
+        {
+                struct in6_addr *final_p = NULL, final;
+                struct flowi fl;
+                memset(&fl, 0, sizeof(fl));
+                fl.proto = IPPROTO_TCP;
+                ipv6_addr_copy(&fl.fl6_dst, &ireq6->rmt_addr);
+                if (np->opt && np->opt->srcrt) {
+                        struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
+                        ipv6_addr_copy(&final, &fl.fl6_dst);
+                        ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
+                        final_p = &final;
+                }
+                ipv6_addr_copy(&fl.fl6_src, &ireq6->loc_addr);
+                fl.oif = sk->sk_bound_dev_if;
+                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
+                fl.fl_ip_sport = inet_sk(sk)->sport;
+                security_req_classify_flow(req, &fl);
+                if (ip6_dst_lookup(sk, &dst, &fl)) {
+                        reqsk_free(req);
+                        goto out;
+                }
+                if (final_p)
+                        ipv6_addr_copy(&fl.fl6_dst, final_p);
+                if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+                        goto out;
+        }
+
+        req->window_clamp = dst_metric(dst, RTAX_WINDOW);
+        tcp_select_initial_window(tcp_full_space(sk), req->mss,
+                                  &req->rcv_wnd, &req->window_clamp,
+                                  0, &rcv_wscale);
+
+        ireq->rcv_wscale = rcv_wscale;
+
+        ret = get_cookie_sock(sk, skb, req, dst);
+
+out:    return ret;
+}
+
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index d6d3e68086f8..3804dcbbfab0 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -71,24 +71,11 @@ static int ipv6_sysctl_net_init(struct net *net)
         ipv6_route_table = ipv6_route_sysctl_init(net);
         if (!ipv6_route_table)
                 goto out_ipv6_table;
+        ipv6_table[0].child = ipv6_route_table;
 
         ipv6_icmp_table = ipv6_icmp_sysctl_init(net);
         if (!ipv6_icmp_table)
                 goto out_ipv6_route_table;
-
-        ipv6_route_table[0].data = &net->ipv6.sysctl.flush_delay;
-        /* ipv6_route_table[1].data will be handled when we have
-           routes per namespace */
-        ipv6_route_table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
-        ipv6_route_table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
-        ipv6_route_table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;
-        ipv6_route_table[5].data = &net->ipv6.sysctl.ip6_rt_gc_interval;
-        ipv6_route_table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
-        ipv6_route_table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
-        ipv6_route_table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
-        ipv6_table[0].child = ipv6_route_table;
-
-        ipv6_icmp_table[0].data = &net->ipv6.sysctl.icmpv6_time;
         ipv6_table[1].child = ipv6_icmp_table;
 
         ipv6_table[2].data = &net->ipv6.sysctl.bindv6only;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 12750f2b05ab..aacbb7688bf9 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -455,8 +455,7 @@ out:
 }
 
 
-static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
-                              struct dst_entry *dst)
+static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -464,6 +463,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         struct ipv6_txoptions *opt = NULL;
         struct in6_addr * final_p = NULL, final;
         struct flowi fl;
+        struct dst_entry *dst;
         int err = -1;
 
         memset(&fl, 0, sizeof(fl));
@@ -476,24 +476,22 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         fl.fl_ip_sport = inet_sk(sk)->sport;
         security_req_classify_flow(req, &fl);
 
-        if (dst == NULL) {
-                opt = np->opt;
-                if (opt && opt->srcrt) {
-                        struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
-                        ipv6_addr_copy(&final, &fl.fl6_dst);
-                        ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
-                        final_p = &final;
-                }
-
-                err = ip6_dst_lookup(sk, &dst, &fl);
-                if (err)
-                        goto done;
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-                if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
-                        goto done;
+        opt = np->opt;
+        if (opt && opt->srcrt) {
+                struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
+                ipv6_addr_copy(&final, &fl.fl6_dst);
+                ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
+                final_p = &final;
         }
 
+        err = ip6_dst_lookup(sk, &dst, &fl);
+        if (err)
+                goto done;
+        if (final_p)
+                ipv6_addr_copy(&fl.fl6_dst, final_p);
+        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+                goto done;
+
         skb = tcp_make_synack(sk, dst, req);
         if (skb) {
                 struct tcphdr *th = tcp_hdr(skb);
@@ -514,6 +512,20 @@ done:
         return err;
 }
 
+static inline void syn_flood_warning(struct sk_buff *skb)
+{
+#ifdef CONFIG_SYN_COOKIES
+        if (sysctl_tcp_syncookies)
+                printk(KERN_INFO
+                       "TCPv6: Possible SYN flooding on port %d. "
+                       "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
+        else
+#endif
+                printk(KERN_INFO
+                       "TCPv6: Possible SYN flooding on port %d. "
+                       "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
+}
+
 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 {
         if (inet6_rsk(req)->pktopts)
@@ -917,7 +929,7 @@ done_opts:
 }
 #endif
 
-static struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
+struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
         .family         =       AF_INET6,
         .obj_size       =       sizeof(struct tcp6_request_sock),
         .rtx_syn_ack    =       tcp_v6_send_synack,
@@ -1059,8 +1071,11 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         fl.fl_ip_sport = t1->source;
         security_skb_classify_flow(skb, &fl);
 
-        /* sk = NULL, but it is safe for now. RST socket required. */
-        if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
+        /* Pass a socket to ip6_dst_lookup either it is for RST
+         * Underlying function will use this to retrieve the network
+         * namespace
+         */
+        if (!ip6_dst_lookup(tcp6_socket->sk, &buff->dst, &fl)) {
 
                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
@@ -1160,7 +1175,7 @@ static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
         fl.fl_ip_sport = t1->source;
         security_skb_classify_flow(skb, &fl);
 
-        if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
+        if (!ip6_dst_lookup(tcp6_socket->sk, &buff->dst, &fl)) {
                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
@@ -1215,9 +1230,9 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                 return NULL;
         }
 
-#if 0 /*def CONFIG_SYN_COOKIES*/
+#ifdef CONFIG_SYN_COOKIES
         if (!th->rst && !th->syn && th->ack)
-                sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
+                sk = cookie_v6_check(sk, skb);
 #endif
         return sk;
 }
@@ -1233,6 +1248,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         struct request_sock *req = NULL;
         __u32 isn = TCP_SKB_CB(skb)->when;
+#ifdef CONFIG_SYN_COOKIES
+        int want_cookie = 0;
+#else
+#define want_cookie 0
+#endif
 
         if (skb->protocol == htons(ETH_P_IP))
                 return tcp_v4_conn_request(sk, skb);
@@ -1240,12 +1260,14 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (!ipv6_unicast_destination(skb))
                 goto drop;
 
-        /*
-         *      There are no SYN attacks on IPv6, yet...
-         */
         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
                 if (net_ratelimit())
-                        printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
+                        syn_flood_warning(skb);
+#ifdef CONFIG_SYN_COOKIES
+                if (sysctl_tcp_syncookies)
+                        want_cookie = 1;
+                else
+#endif
                 goto drop;
         }
 
@@ -1266,39 +1288,51 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 
         tcp_parse_options(skb, &tmp_opt, 0);
 
+        if (want_cookie) {
+                tcp_clear_options(&tmp_opt);
+                tmp_opt.saw_tstamp = 0;
+        }
+
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
         tcp_openreq_init(req, &tmp_opt, skb);
 
         treq = inet6_rsk(req);
         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
-        TCP_ECN_create_request(req, tcp_hdr(skb));
         treq->pktopts = NULL;
-        if (ipv6_opt_accepted(sk, skb) ||
-            np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
-            np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
-                atomic_inc(&skb->users);
-                treq->pktopts = skb;
-        }
-        treq->iif = sk->sk_bound_dev_if;
+        if (!want_cookie)
+                TCP_ECN_create_request(req, tcp_hdr(skb));
+
+        if (want_cookie) {
+                isn = cookie_v6_init_sequence(sk, skb, &req->mss);
+        } else if (!isn) {
+                if (ipv6_opt_accepted(sk, skb) ||
+                    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
+                    np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
+                        atomic_inc(&skb->users);
+                        treq->pktopts = skb;
+                }
+                treq->iif = sk->sk_bound_dev_if;
 
-        /* So that link locals have meaning */
-        if (!sk->sk_bound_dev_if &&
-            ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
-                treq->iif = inet6_iif(skb);
+                /* So that link locals have meaning */
+                if (!sk->sk_bound_dev_if &&
+                    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
+                        treq->iif = inet6_iif(skb);
 
-        if (isn == 0)
                 isn = tcp_v6_init_sequence(skb);
+        }
 
         tcp_rsk(req)->snt_isn = isn;
 
         security_inet_conn_request(sk, skb, req);
 
-        if (tcp_v6_send_synack(sk, req, NULL))
+        if (tcp_v6_send_synack(sk, req))
                 goto drop;
 
-        inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
-        return 0;
+        if (!want_cookie) {
+                inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+                return 0;
+        }
 
 drop:
         if (req)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp_ipv6.c
index 53739de829db..55feac7ba717 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp_ipv6.c
@@ -400,7 +400,7 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh,
         UDP_SKB_CB(skb)->partial_cov = 0;
         UDP_SKB_CB(skb)->cscov = skb->len;
 
-        if (proto == IPPROTO_UDPLITE) {
+        if (IS_PROTO_UDPLITE(proto)) {
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
@@ -489,7 +489,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
 
                 if (udp_lib_checksum_complete(skb))
                         goto discard;
-                UDP6_INC_STATS_BH(UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
+                UDP6_INC_STATS_BH(UDP_MIB_NOPORTS, IS_PROTO_UDPLITE(proto));
 
                 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
 
@@ -510,11 +510,11 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
 
 short_packet:
         LIMIT_NETDEBUG(KERN_DEBUG "UDP%sv6: short packet: %d/%u\n",
-                       proto == IPPROTO_UDPLITE ? "-Lite" : "",
+                       IS_PROTO_UDPLITE(proto) ? "-Lite" : "",
                        ulen, skb->len);
 
 discard:
-        UDP6_INC_STATS_BH(UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
+        UDP6_INC_STATS_BH(UDP_MIB_INERRORS, IS_PROTO_UDPLITE(proto));
         kfree_skb(skb);
         return 0;
 }
@@ -890,7 +890,7 @@ int udpv6_destroy_sock(struct sock *sk)
 int udpv6_setsockopt(struct sock *sk, int level, int optname,
                      char __user *optval, int optlen)
 {
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+        if (IS_SOL_UDPFAMILY(level))
                 return udp_lib_setsockopt(sk, level, optname, optval, optlen,
                                           udp_v6_push_pending_frames);
         return ipv6_setsockopt(sk, level, optname, optval, optlen);
@@ -900,7 +900,7 @@ int udpv6_setsockopt(struct sock *sk, int level, int optname,
 int compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
                             char __user *optval, int optlen)
 {
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+        if (IS_SOL_UDPFAMILY(level))
                 return udp_lib_setsockopt(sk, level, optname, optval, optlen,
                                           udp_v6_push_pending_frames);
         return compat_ipv6_setsockopt(sk, level, optname, optval, optlen);
@@ -910,7 +910,7 @@ int compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
 int udpv6_getsockopt(struct sock *sk, int level, int optname,
                      char __user *optval, int __user *optlen)
 {
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+        if (IS_SOL_UDPFAMILY(level))
                 return udp_lib_getsockopt(sk, level, optname, optval, optlen);
         return ipv6_getsockopt(sk, level, optname, optval, optlen);
 }
@@ -919,7 +919,7 @@ int udpv6_getsockopt(struct sock *sk, int level, int optname,
 int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
                             char __user *optval, int __user *optlen)
 {
-        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+        if (IS_SOL_UDPFAMILY(level))
                 return udp_lib_getsockopt(sk, level, optname, optval, optlen);
         return compat_ipv6_getsockopt(sk, level, optname, optval, optlen);
 }
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite_ipv6.c
index 87d4202522ee..87d4202522ee 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite_ipv6.c
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 7d20199ee1f3..e96dafdc7032 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -38,7 +38,7 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
         if (saddr)
                 memcpy(&fl.fl6_src, saddr, sizeof(fl.fl6_src));
 
-        dst = ip6_route_output(NULL, &fl);
+        dst = ip6_route_output(&init_net, NULL, &fl);
 
         err = dst->error;
         if (dst->error) {
@@ -57,8 +57,9 @@ static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
         if (IS_ERR(dst))
                 return -EHOSTUNREACH;
 
-        ipv6_get_saddr(dst, (struct in6_addr *)&daddr->a6,
-                       (struct in6_addr *)&saddr->a6);
+        ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev,
+                           (struct in6_addr *)&daddr->a6,
+                           (struct in6_addr *)&saddr->a6);
         dst_release(dst);
         return 0;
 }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8b5f486ac80f..50c442fc99ce 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -48,6 +48,17 @@ struct pfkey_sock {
         struct sock     sk;
         int             registered;
         int             promisc;
+
+        struct {
+                uint8_t         msg_version;
+                uint32_t        msg_pid;
+                int             (*dump)(struct pfkey_sock *sk);
+                void            (*done)(struct pfkey_sock *sk);
+                union {
+                        struct xfrm_policy_walk policy;
+                        struct xfrm_state_walk  state;
+                } u;
+        } dump;
 };
 
 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
@@ -55,6 +66,27 @@ static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
         return (struct pfkey_sock *)sk;
 }
 
+static int pfkey_can_dump(struct sock *sk)
+{
+        if (3 * atomic_read(&sk->sk_rmem_alloc) <= 2 * sk->sk_rcvbuf)
+                return 1;
+        return 0;
+}
+
+static int pfkey_do_dump(struct pfkey_sock *pfk)
+{
+        int rc;
+
+        rc = pfk->dump.dump(pfk);
+        if (rc == -ENOBUFS)
+                return 0;
+
+        pfk->dump.done(pfk);
+        pfk->dump.dump = NULL;
+        pfk->dump.done = NULL;
+        return rc;
+}
+
 static void pfkey_sock_destruct(struct sock *sk)
 {
         skb_queue_purge(&sk->sk_receive_queue);
@@ -1709,45 +1741,60 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
         return 0;
 }
 
-struct pfkey_dump_data
-{
-        struct sk_buff *skb;
-        struct sadb_msg *hdr;
-        struct sock *sk;
-};
-
 static int dump_sa(struct xfrm_state *x, int count, void *ptr)
 {
-        struct pfkey_dump_data *data = ptr;
+        struct pfkey_sock *pfk = ptr;
         struct sk_buff *out_skb;
         struct sadb_msg *out_hdr;
 
+        if (!pfkey_can_dump(&pfk->sk))
+                return -ENOBUFS;
+
         out_skb = pfkey_xfrm_state2msg(x);
         if (IS_ERR(out_skb))
                 return PTR_ERR(out_skb);
 
         out_hdr = (struct sadb_msg *) out_skb->data;
-        out_hdr->sadb_msg_version = data->hdr->sadb_msg_version;
+        out_hdr->sadb_msg_version = pfk->dump.msg_version;
         out_hdr->sadb_msg_type = SADB_DUMP;
         out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_reserved = 0;
         out_hdr->sadb_msg_seq = count;
-        out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk);
+        out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, &pfk->sk);
         return 0;
 }
 
+static int pfkey_dump_sa(struct pfkey_sock *pfk)
+{
+        return xfrm_state_walk(&pfk->dump.u.state, dump_sa, (void *) pfk);
+}
+
+static void pfkey_dump_sa_done(struct pfkey_sock *pfk)
+{
+        xfrm_state_walk_done(&pfk->dump.u.state);
+}
+
 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
         u8 proto;
-        struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk };
+        struct pfkey_sock *pfk = pfkey_sk(sk);
+
+        if (pfk->dump.dump != NULL)
+                return -EBUSY;
 
         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
         if (proto == 0)
                 return -EINVAL;
 
-        return xfrm_state_walk(proto, dump_sa, &data);
+        pfk->dump.msg_version = hdr->sadb_msg_version;
+        pfk->dump.msg_pid = hdr->sadb_msg_pid;
+        pfk->dump.dump = pfkey_dump_sa;
+        pfk->dump.done = pfkey_dump_sa_done;
+        xfrm_state_walk_init(&pfk->dump.u.state, proto);
+
+        return pfkey_do_dump(pfk);
 }
 
 static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
@@ -1780,7 +1827,9 @@ static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr)
 
 static u32 gen_reqid(void)
 {
+        struct xfrm_policy_walk walk;
         u32 start;
+        int rc;
         static u32 reqid = IPSEC_MANUAL_REQID_MAX;
 
         start = reqid;
@@ -1788,8 +1837,10 @@ static u32 gen_reqid(void)
                 ++reqid;
                 if (reqid == 0)
                         reqid = IPSEC_MANUAL_REQID_MAX+1;
-                if (xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, check_reqid,
-                                     (void*)&reqid) != -EEXIST)
+                xfrm_policy_walk_init(&walk, XFRM_POLICY_TYPE_MAIN);
+                rc = xfrm_policy_walk(&walk, check_reqid, (void*)&reqid);
+                xfrm_policy_walk_done(&walk);
+                if (rc != -EEXIST)
                         return reqid;
         } while (reqid != start);
         return 0;
@@ -2638,11 +2689,14 @@ out:
 
 static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
 {
-        struct pfkey_dump_data *data = ptr;
+        struct pfkey_sock *pfk = ptr;
         struct sk_buff *out_skb;
         struct sadb_msg *out_hdr;
         int err;
 
+        if (!pfkey_can_dump(&pfk->sk))
+                return -ENOBUFS;
+
         out_skb = pfkey_xfrm_policy2msg_prep(xp);
         if (IS_ERR(out_skb))
                 return PTR_ERR(out_skb);
@@ -2652,21 +2706,40 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
                 return err;
 
         out_hdr = (struct sadb_msg *) out_skb->data;
-        out_hdr->sadb_msg_version = data->hdr->sadb_msg_version;
+        out_hdr->sadb_msg_version = pfk->dump.msg_version;
         out_hdr->sadb_msg_type = SADB_X_SPDDUMP;
         out_hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = count;
-        out_hdr->sadb_msg_pid = data->hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, data->sk);
+        out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, &pfk->sk);
         return 0;
 }
 
+static int pfkey_dump_sp(struct pfkey_sock *pfk)
+{
+        return xfrm_policy_walk(&pfk->dump.u.policy, dump_sp, (void *) pfk);
+}
+
+static void pfkey_dump_sp_done(struct pfkey_sock *pfk)
+{
+        xfrm_policy_walk_done(&pfk->dump.u.policy);
+}
+
 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
-        struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk };
+        struct pfkey_sock *pfk = pfkey_sk(sk);
+
+        if (pfk->dump.dump != NULL)
+                return -EBUSY;
+
+        pfk->dump.msg_version = hdr->sadb_msg_version;
+        pfk->dump.msg_pid = hdr->sadb_msg_pid;
+        pfk->dump.dump = pfkey_dump_sp;
+        pfk->dump.done = pfkey_dump_sp_done;
+        xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
 
-        return xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_sp, &data);
+        return pfkey_do_dump(pfk);
 }
 
 static int key_notify_policy_flush(struct km_event *c)
@@ -3671,6 +3744,7 @@ static int pfkey_recvmsg(struct kiocb *kiocb,
                          int flags)
 {
         struct sock *sk = sock->sk;
+        struct pfkey_sock *pfk = pfkey_sk(sk);
         struct sk_buff *skb;
         int copied, err;
 
@@ -3698,6 +3772,10 @@ static int pfkey_recvmsg(struct kiocb *kiocb,
 
         err = (flags & MSG_TRUNC) ? skb->len : copied;
 
+        if (pfk->dump.dump != NULL &&
+            3 * atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)
+                pfkey_do_dump(pfk);
+
 out_free:
         skb_free_datagram(sk, skb);
 out:
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 54f46bc80cfe..9d7a19581a29 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -19,7 +19,6 @@ mac80211-y := \
         ieee80211_iface.o \
         ieee80211_rate.o \
         michael.o \
-        regdomain.o \
         tkip.o \
         aes_ccm.o \
         cfg.o \
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 22c9619ba776..e7535ffc8e1c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -34,10 +34,13 @@ nl80211_type_to_mac80211_type(enum nl80211_iftype type)
 }
 
 static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
-                               enum nl80211_iftype type)
+                               enum nl80211_iftype type, u32 *flags)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         enum ieee80211_if_types itype;
+        struct net_device *dev;
+        struct ieee80211_sub_if_data *sdata;
+        int err;
 
         if (unlikely(local->reg_state != IEEE80211_DEV_REGISTERED))
                 return -ENODEV;
@@ -46,7 +49,13 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
         if (itype == IEEE80211_IF_TYPE_INVALID)
                 return -EINVAL;
 
-        return ieee80211_if_add(local->mdev, name, NULL, itype);
+        err = ieee80211_if_add(local->mdev, name, &dev, itype);
+        if (err || itype != IEEE80211_IF_TYPE_MNTR || !flags)
+                return err;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        sdata->u.mntr_flags = *flags;
+        return 0;
 }
 
 static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
@@ -69,7 +78,7 @@ static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
 }
 
 static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
-                                  enum nl80211_iftype type)
+                                  enum nl80211_iftype type, u32 *flags)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct net_device *dev;
@@ -99,6 +108,10 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
         ieee80211_if_reinit(dev);
         ieee80211_if_set_type(dev, itype);
 
+        if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR || !flags)
+                return 0;
+
+        sdata->u.mntr_flags = *flags;
         return 0;
 }
 
@@ -110,6 +123,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         struct sta_info *sta = NULL;
         enum ieee80211_key_alg alg;
         int ret;
+        struct ieee80211_key *key;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -128,16 +142,21 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
 
+        key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key);
+        if (!key)
+                return -ENOMEM;
+
         if (mac_addr) {
                 sta = sta_info_get(sdata->local, mac_addr);
-                if (!sta)
+                if (!sta) {
+                        ieee80211_key_free(key);
                         return -ENOENT;
+                }
         }
 
+        ieee80211_key_link(key, sdata, sta);
+
         ret = 0;
-        if (!ieee80211_key_alloc(sdata, sta, alg, key_idx,
-                                 params->key_len, params->key))
-                ret = -ENOMEM;
 
         if (sta)
                 sta_info_put(sta);
@@ -151,6 +170,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         int ret;
+        struct ieee80211_key *key;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -160,9 +180,11 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                         return -ENOENT;
 
                 ret = 0;
-                if (sta->key)
-                        ieee80211_key_free(sta->key);
-                else
+                if (sta->key) {
+                        key = sta->key;
+                        ieee80211_key_free(key);
+                        WARN_ON(sta->key);
+                } else
                         ret = -ENOENT;
 
                 sta_info_put(sta);
@@ -172,7 +194,9 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
         if (!sdata->keys[key_idx])
                 return -ENOENT;
 
-        ieee80211_key_free(sdata->keys[key_idx]);
+        key = sdata->keys[key_idx];
+        ieee80211_key_free(key);
+        WARN_ON(sdata->keys[key_idx]);
 
         return 0;
 }
@@ -498,7 +522,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 {
         u32 rates;
         int i, j;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
 
         if (params->station_flags & STATION_FLAG_CHANGED) {
                 sta->flags &= ~WLAN_STA_AUTHORIZED;
@@ -525,15 +549,16 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 
         if (params->supported_rates) {
                 rates = 0;
-                mode = local->oper_hw_mode;
+                sband = local->hw.wiphy->bands[local->oper_channel->band];
+
                 for (i = 0; i < params->supported_rates_len; i++) {
                         int rate = (params->supported_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < mode->num_rates; j++) {
-                                if (mode->rates[j].rate == rate)
+                        for (j = 0; j < sband->n_bitrates; j++) {
+                                if (sband->bitrates[j].bitrate == rate)
                                         rates |= BIT(j);
                         }
                 }
-                sta->supp_rates = rates;
+                sta->supp_rates[local->oper_channel->band] = rates;
         }
 }
 
@@ -548,13 +573,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (!netif_running(dev))
                 return -ENETDOWN;
 
-        /* XXX: get sta belonging to dev */
-        sta = sta_info_get(local, mac);
-        if (sta) {
-                sta_info_put(sta);
-                return -EEXIST;
-        }
-
         if (params->vlan) {
                 sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
@@ -565,8 +583,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         sta = sta_info_add(local, dev, mac, GFP_KERNEL);
-        if (!sta)
-                return -ENOMEM;
+        if (IS_ERR(sta))
+                return PTR_ERR(sta);
 
         sta->dev = sdata->dev;
         if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN ||
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 60514b2c97b9..4736c64937b4 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -19,41 +19,6 @@ int mac80211_open_file_generic(struct inode *inode, struct file *file)
         return 0;
 }
 
-static const char *ieee80211_mode_str(int mode)
-{
-        switch (mode) {
-        case MODE_IEEE80211A:
-                return "IEEE 802.11a";
-        case MODE_IEEE80211B:
-                return "IEEE 802.11b";
-        case MODE_IEEE80211G:
-                return "IEEE 802.11g";
-        default:
-                return "UNKNOWN";
-        }
-}
-
-static ssize_t modes_read(struct file *file, char __user *userbuf,
-                          size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        struct ieee80211_hw_mode *mode;
-        char buf[150], *p = buf;
-
-        /* FIXME: locking! */
-        list_for_each_entry(mode, &local->modes_list, list) {
-                p += scnprintf(p, sizeof(buf)+buf-p,
-                               "%s\n", ieee80211_mode_str(mode->mode));
-        }
-
-        return simple_read_from_buffer(userbuf, count, ppos, buf, p-buf);
-}
-
-static const struct file_operations modes_ops = {
-        .read = modes_read,
-        .open = mac80211_open_file_generic,
-};
-
 #define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
 static ssize_t name## _read(struct file *file, char __user *userbuf,    \
                             size_t count, loff_t *ppos)                 \
@@ -80,10 +45,8 @@ static const struct file_operations name## _ops = {			\
         local->debugfs.name = NULL;
 
 
-DEBUGFS_READONLY_FILE(channel, 20, "%d",
-                      local->hw.conf.channel);
 DEBUGFS_READONLY_FILE(frequency, 20, "%d",
-                      local->hw.conf.freq);
+                      local->hw.conf.channel->center_freq);
 DEBUGFS_READONLY_FILE(antenna_sel_tx, 20, "%d",
                       local->hw.conf.antenna_sel_tx);
 DEBUGFS_READONLY_FILE(antenna_sel_rx, 20, "%d",
@@ -100,8 +63,6 @@ DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
                       local->long_retry_limit);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                       local->total_ps_buffered);
-DEBUGFS_READONLY_FILE(mode, 20, "%s",
-                      ieee80211_mode_str(local->hw.conf.phymode));
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#06x",
                       local->wep_iv & 0xffffff);
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
@@ -294,7 +255,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         local->debugfs.stations = debugfs_create_dir("stations", phyd);
         local->debugfs.keys = debugfs_create_dir("keys", phyd);
 
-        DEBUGFS_ADD(channel);
         DEBUGFS_ADD(frequency);
         DEBUGFS_ADD(antenna_sel_tx);
         DEBUGFS_ADD(antenna_sel_rx);
@@ -304,9 +264,7 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(short_retry_limit);
         DEBUGFS_ADD(long_retry_limit);
         DEBUGFS_ADD(total_ps_buffered);
-        DEBUGFS_ADD(mode);
         DEBUGFS_ADD(wep_iv);
-        DEBUGFS_ADD(modes);
 
         statsd = debugfs_create_dir("statistics", phyd);
         local->debugfs.statistics = statsd;
@@ -356,7 +314,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
 
 void debugfs_hw_del(struct ieee80211_local *local)
 {
-        DEBUGFS_DEL(channel);
         DEBUGFS_DEL(frequency);
         DEBUGFS_DEL(antenna_sel_tx);
         DEBUGFS_DEL(antenna_sel_rx);
@@ -366,9 +323,7 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_DEL(short_retry_limit);
         DEBUGFS_DEL(long_retry_limit);
         DEBUGFS_DEL(total_ps_buffered);
-        DEBUGFS_DEL(mode);
         DEBUGFS_DEL(wep_iv);
-        DEBUGFS_DEL(modes);
 
         DEBUGFS_STATS_DEL(transmitted_fragment_count);
         DEBUGFS_STATS_DEL(multicast_transmitted_frame_count);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 829872a3ae81..29f7b98ba1fb 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -91,7 +91,6 @@ static const struct file_operations name##_ops = {			\
 /* common attributes */
 IEEE80211_IF_FILE(channel_use, channel_use, DEC);
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
-IEEE80211_IF_FILE(ieee802_1x_pac, ieee802_1x_pac, DEC);
 
 /* STA/IBSS attributes */
 IEEE80211_IF_FILE(state, u.sta.state, DEC);
@@ -148,7 +147,6 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, sta);
         DEBUGFS_ADD(drop_unencrypted, sta);
-        DEBUGFS_ADD(ieee802_1x_pac, sta);
         DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
         DEBUGFS_ADD(prev_bssid, sta);
@@ -169,7 +167,6 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, ap);
         DEBUGFS_ADD(drop_unencrypted, ap);
-        DEBUGFS_ADD(ieee802_1x_pac, ap);
         DEBUGFS_ADD(num_sta_ps, ap);
         DEBUGFS_ADD(dtim_count, ap);
         DEBUGFS_ADD(num_beacons, ap);
@@ -182,7 +179,6 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, wds);
         DEBUGFS_ADD(drop_unencrypted, wds);
-        DEBUGFS_ADD(ieee802_1x_pac, wds);
         DEBUGFS_ADD(peer, wds);
 }
 
@@ -190,7 +186,6 @@ static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, vlan);
         DEBUGFS_ADD(drop_unencrypted, vlan);
-        DEBUGFS_ADD(ieee802_1x_pac, vlan);
 }
 
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -234,7 +229,6 @@ static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, sta);
         DEBUGFS_DEL(drop_unencrypted, sta);
-        DEBUGFS_DEL(ieee802_1x_pac, sta);
         DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
         DEBUGFS_DEL(prev_bssid, sta);
@@ -255,7 +249,6 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, ap);
         DEBUGFS_DEL(drop_unencrypted, ap);
-        DEBUGFS_DEL(ieee802_1x_pac, ap);
         DEBUGFS_DEL(num_sta_ps, ap);
         DEBUGFS_DEL(dtim_count, ap);
         DEBUGFS_DEL(num_beacons, ap);
@@ -268,7 +261,6 @@ static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, wds);
         DEBUGFS_DEL(drop_unencrypted, wds);
-        DEBUGFS_DEL(ieee802_1x_pac, wds);
         DEBUGFS_DEL(peer, wds);
 }
 
@@ -276,7 +268,6 @@ static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, vlan);
         DEBUGFS_DEL(drop_unencrypted, vlan);
-        DEBUGFS_DEL(ieee802_1x_pac, vlan);
 }
 
 static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 8f5944c53d4e..ed7c9f3b4602 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -33,25 +33,16 @@ static ssize_t sta_ ##name## _read(struct file *file,			\
 #define STA_READ_LU(name, field) STA_READ(name, 20, field, "%lu\n")
 #define STA_READ_S(name, field) STA_READ(name, 20, field, "%s\n")
 
-#define STA_READ_RATE(name, field)                                      \
-static ssize_t sta_##name##_read(struct file *file,                     \
-                                 char __user *userbuf,                  \
-                                 size_t count, loff_t *ppos)            \
-{                                                                       \
-        struct sta_info *sta = file->private_data;                      \
-        struct ieee80211_local *local = wdev_priv(sta->dev->ieee80211_ptr);\
-        struct ieee80211_hw_mode *mode = local->oper_hw_mode;           \
-        char buf[20];                                                   \
-        int res = scnprintf(buf, sizeof(buf), "%d\n",                   \
-                            (sta->field >= 0 &&                         \
-                            sta->field < mode->num_rates) ?             \
-                            mode->rates[sta->field].rate : -1);         \
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+#define STA_OPS(name)                                                   \
+static const struct file_operations sta_ ##name## _ops = {              \
+        .read = sta_##name##_read,                                      \
+        .open = mac80211_open_file_generic,                             \
 }
 
-#define STA_OPS(name)                                                   \
+#define STA_OPS_WR(name)                                                \
 static const struct file_operations sta_ ##name## _ops = {              \
         .read = sta_##name##_read,                                      \
+        .write = sta_##name##_write,                                    \
         .open = mac80211_open_file_generic,                             \
 }
 
@@ -70,8 +61,6 @@ STA_FILE(rx_fragments, rx_fragments, LU);
 STA_FILE(rx_dropped, rx_dropped, LU);
 STA_FILE(tx_fragments, tx_fragments, LU);
 STA_FILE(tx_filtered, tx_filtered_count, LU);
-STA_FILE(txrate, txrate, RATE);
-STA_FILE(last_txrate, last_txrate, RATE);
 STA_FILE(tx_retry_failed, tx_retry_failed, LU);
 STA_FILE(tx_retry_count, tx_retry_count, LU);
 STA_FILE(last_rssi, last_rssi, D);
@@ -85,12 +74,10 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
 {
         char buf[100];
         struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s%s",
+        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s",
                 sta->flags & WLAN_STA_AUTH ? "AUTH\n" : "",
                 sta->flags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
                 sta->flags & WLAN_STA_PS ? "PS\n" : "",
-                sta->flags & WLAN_STA_TIM ? "TIM\n" : "",
-                sta->flags & WLAN_STA_PERM ? "PERM\n" : "",
                 sta->flags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
                 sta->flags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
                 sta->flags & WLAN_STA_WME ? "WME\n" : "",
@@ -111,31 +98,6 @@ static ssize_t sta_num_ps_buf_frames_read(struct file *file,
 }
 STA_OPS(num_ps_buf_frames);
 
-static ssize_t sta_last_ack_rssi_read(struct file *file, char __user *userbuf,
-                                      size_t count, loff_t *ppos)
-{
-        char buf[100];
-        struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%d %d %d\n",
-                            sta->last_ack_rssi[0],
-                            sta->last_ack_rssi[1],
-                            sta->last_ack_rssi[2]);
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
-}
-STA_OPS(last_ack_rssi);
-
-static ssize_t sta_last_ack_ms_read(struct file *file, char __user *userbuf,
-                                    size_t count, loff_t *ppos)
-{
-        char buf[20];
-        struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%d\n",
-                            sta->last_ack ?
-                            jiffies_to_msecs(jiffies - sta->last_ack) : -1);
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
-}
-STA_OPS(last_ack_ms);
-
 static ssize_t sta_inactive_ms_read(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
@@ -191,6 +153,113 @@ static ssize_t sta_wme_tx_queue_read(struct file *file, char __user *userbuf,
 STA_OPS(wme_tx_queue);
 #endif
 
+static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        char buf[768], *p = buf;
+        int i;
+        struct sta_info *sta = file->private_data;
+        p += scnprintf(p, sizeof(buf)+buf-p, "Agg state for STA is:\n");
+        p += scnprintf(p, sizeof(buf)+buf-p, " STA next dialog_token is %d \n "
+                        "TIDs info is: \n TID :",
+                        (sta->ampdu_mlme.dialog_token_allocator + 1));
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d", i);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n RX  :");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+        sta->ampdu_mlme.tid_rx[i].state);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_rx[i].dialog_token);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n TX  :");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_tx[i].state);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_tx[i].dialog_token);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n SSN :");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_tx[i].ssn);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+
+        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+}
+
+static ssize_t sta_agg_status_write(struct file *file,
+                const char __user *user_buf, size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct net_device *dev = sta->dev;
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_hw *hw = &local->hw;
+        u8 *da = sta->addr;
+        static int tid_static_tx[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+                                        0, 0, 0, 0, 0, 0, 0, 0};
+        static int tid_static_rx[16] = {1, 1, 1, 1, 1, 1, 1, 1,
+                                        1, 1, 1, 1, 1, 1, 1, 1};
+        char *endp;
+        char buf[32];
+        int buf_size, rs;
+        unsigned int tid_num;
+        char state[4];
+
+        memset(buf, 0x00, sizeof(buf));
+        buf_size = min(count, (sizeof(buf)-1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        tid_num = simple_strtoul(buf, &endp, 0);
+        if (endp == buf)
+                return -EINVAL;
+
+        if ((tid_num >= 100) && (tid_num <= 115)) {
+                /* toggle Rx aggregation command */
+                tid_num = tid_num - 100;
+                if (tid_static_rx[tid_num] == 1) {
+                        strcpy(state, "off ");
+                        ieee80211_sta_stop_rx_ba_session(dev, da, tid_num, 0,
+                                        WLAN_REASON_QSTA_REQUIRE_SETUP);
+                        sta->ampdu_mlme.tid_rx[tid_num].buf_size = 0xFF;
+                        tid_static_rx[tid_num] = 0;
+                } else {
+                        strcpy(state, "on ");
+                        sta->ampdu_mlme.tid_rx[tid_num].buf_size = 0x00;
+                        tid_static_rx[tid_num] = 1;
+                }
+                printk(KERN_DEBUG "debugfs - try switching tid %u %s\n",
+                                tid_num, state);
+        } else if ((tid_num >= 0) && (tid_num <= 15)) {
+                /* toggle Tx aggregation command */
+                if (tid_static_tx[tid_num] == 0) {
+                        strcpy(state, "on ");
+                        rs =  ieee80211_start_tx_ba_session(hw, da, tid_num);
+                        if (rs == 0)
+                                tid_static_tx[tid_num] = 1;
+                } else {
+                        strcpy(state, "off");
+                        rs =  ieee80211_stop_tx_ba_session(hw, da, tid_num, 1);
+                        if (rs == 0)
+                                tid_static_tx[tid_num] = 0;
+                }
+                printk(KERN_DEBUG "debugfs - switching tid %u %s, return=%d\n",
+                                tid_num, state, rs);
+        }
+
+        return count;
+}
+STA_OPS_WR(agg_status);
+
 #define DEBUGFS_ADD(name) \
         sta->debugfs.name = debugfs_create_file(#name, 0444, \
                 sta->debugfs.dir, sta, &sta_ ##name## _ops);
@@ -203,12 +272,13 @@ STA_OPS(wme_tx_queue);
 void ieee80211_sta_debugfs_add(struct sta_info *sta)
 {
         struct dentry *stations_dir = sta->local->debugfs.stations;
-        DECLARE_MAC_BUF(mac);
+        DECLARE_MAC_BUF(mbuf);
+        u8 *mac;
 
         if (!stations_dir)
                 return;
 
-        print_mac(mac, sta->addr);
+        mac = print_mac(mbuf, sta->addr);
 
         sta->debugfs.dir = debugfs_create_dir(mac, stations_dir);
         if (!sta->debugfs.dir)
@@ -216,28 +286,26 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
 
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(num_ps_buf_frames);
-        DEBUGFS_ADD(last_ack_rssi);
-        DEBUGFS_ADD(last_ack_ms);
         DEBUGFS_ADD(inactive_ms);
         DEBUGFS_ADD(last_seq_ctrl);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_ADD(wme_rx_queue);
         DEBUGFS_ADD(wme_tx_queue);
 #endif
+        DEBUGFS_ADD(agg_status);
 }
 
 void ieee80211_sta_debugfs_remove(struct sta_info *sta)
 {
         DEBUGFS_DEL(flags);
         DEBUGFS_DEL(num_ps_buf_frames);
-        DEBUGFS_DEL(last_ack_rssi);
-        DEBUGFS_DEL(last_ack_ms);
         DEBUGFS_DEL(inactive_ms);
         DEBUGFS_DEL(last_seq_ctrl);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_DEL(wme_rx_queue);
         DEBUGFS_DEL(wme_tx_queue);
 #endif
+        DEBUGFS_DEL(agg_status);
 
         debugfs_remove(sta->debugfs.dir);
         sta->debugfs.dir = NULL;
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 28bcdf9fc3df..2133c9fd27a4 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -67,9 +67,19 @@ static void ieee80211_configure_filter(struct ieee80211_local *local)
                 new_flags |= FIF_ALLMULTI;
 
         if (local->monitors)
-                new_flags |= FIF_CONTROL |
-                             FIF_OTHER_BSS |
-                             FIF_BCN_PRBRESP_PROMISC;
+                new_flags |= FIF_BCN_PRBRESP_PROMISC;
+
+        if (local->fif_fcsfail)
+                new_flags |= FIF_FCSFAIL;
+
+        if (local->fif_plcpfail)
+                new_flags |= FIF_PLCPFAIL;
+
+        if (local->fif_control)
+                new_flags |= FIF_CONTROL;
+
+        if (local->fif_other_bss)
+                new_flags |= FIF_OTHER_BSS;
 
         changed_flags = local->filter_flags ^ new_flags;
 
@@ -173,8 +183,52 @@ static int ieee80211_open(struct net_device *dev)
         list_for_each_entry(nsdata, &local->interfaces, list) {
                 struct net_device *ndev = nsdata->dev;
 
-                if (ndev != dev && ndev != local->mdev && netif_running(ndev) &&
-                    compare_ether_addr(dev->dev_addr, ndev->dev_addr) == 0) {
+                if (ndev != dev && ndev != local->mdev && netif_running(ndev)) {
+                        /*
+                         * Allow only a single IBSS interface to be up at any
+                         * time. This is restricted because beacon distribution
+                         * cannot work properly if both are in the same IBSS.
+                         *
+                         * To remove this restriction we'd have to disallow them
+                         * from setting the same SSID on different IBSS interfaces
+                         * belonging to the same hardware. Then, however, we're
+                         * faced with having to adopt two different TSF timers...
+                         */
+                        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
+                            nsdata->vif.type == IEEE80211_IF_TYPE_IBSS)
+                                return -EBUSY;
+
+                        /*
+                         * Disallow multiple IBSS/STA mode interfaces.
+                         *
+                         * This is a technical restriction, it is possible although
+                         * most likely not IEEE 802.11 compliant to have multiple
+                         * STAs with just a single hardware (the TSF timer will not
+                         * be adjusted properly.)
+                         *
+                         * However, because mac80211 uses the master device's BSS
+                         * information for each STA/IBSS interface, doing this will
+                         * currently corrupt that BSS information completely, unless,
+                         * a not very useful case, both STAs are associated to the
+                         * same BSS.
+                         *
+                         * To remove this restriction, the BSS information needs to
+                         * be embedded in the STA/IBSS mode sdata instead of using
+                         * the master device's BSS structure.
+                         */
+                        if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
+                             sdata->vif.type == IEEE80211_IF_TYPE_IBSS) &&
+                            (nsdata->vif.type == IEEE80211_IF_TYPE_STA ||
+                             nsdata->vif.type == IEEE80211_IF_TYPE_IBSS))
+                                return -EBUSY;
+
+                        /*
+                         * The remaining checks are only performed for interfaces
+                         * with the same MAC address.
+                         */
+                        if (compare_ether_addr(dev->dev_addr, ndev->dev_addr))
+                                continue;
+
                         /*
                          * check whether it may have the same address
                          */
@@ -186,8 +240,7 @@ static int ieee80211_open(struct net_device *dev)
                          * can only add VLANs to enabled APs
                          */
                         if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN &&
-                            nsdata->vif.type == IEEE80211_IF_TYPE_AP &&
-                            netif_running(nsdata->dev))
+                            nsdata->vif.type == IEEE80211_IF_TYPE_AP)
                                 sdata->u.vlan.ap = nsdata;
                 }
         }
@@ -229,15 +282,28 @@ static int ieee80211_open(struct net_device *dev)
                 /* no need to tell driver */
                 break;
         case IEEE80211_IF_TYPE_MNTR:
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
+                        local->cooked_mntrs++;
+                        break;
+                }
+
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
-                if (local->monitors == 1) {
-                        netif_tx_lock_bh(local->mdev);
-                        ieee80211_configure_filter(local);
-                        netif_tx_unlock_bh(local->mdev);
-
+                if (local->monitors == 1)
                         local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
-                }
+
+                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
+                        local->fif_fcsfail++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
+                        local->fif_plcpfail++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                        local->fif_control++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
+                        local->fif_other_bss++;
+
+                netif_tx_lock_bh(local->mdev);
+                ieee80211_configure_filter(local);
+                netif_tx_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
@@ -352,14 +418,27 @@ static int ieee80211_stop(struct net_device *dev)
                 /* no need to tell driver */
                 break;
         case IEEE80211_IF_TYPE_MNTR:
-                local->monitors--;
-                if (local->monitors == 0) {
-                        netif_tx_lock_bh(local->mdev);
-                        ieee80211_configure_filter(local);
-                        netif_tx_unlock_bh(local->mdev);
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
+                        local->cooked_mntrs--;
+                        break;
+                }
 
+                local->monitors--;
+                if (local->monitors == 0)
                         local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
-                }
+
+                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
+                        local->fif_fcsfail--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
+                        local->fif_plcpfail--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                        local->fif_control--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
+                        local->fif_other_bss--;
+
+                netif_tx_lock_bh(local->mdev);
+                ieee80211_configure_filter(local);
+                netif_tx_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
@@ -414,6 +493,329 @@ static int ieee80211_stop(struct net_device *dev)
         return 0;
 }
 
+int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata;
+        u16 start_seq_num = 0;
+        u8 *state;
+        int ret;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                printk(KERN_DEBUG "Could not find the station\n");
+                return -ENOENT;
+        }
+
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        /* we have tried too many times, receiver does not want A-MPDU */
+        if (sta->ampdu_mlme.tid_tx[tid].addba_req_num > HT_AGG_MAX_RETRIES) {
+                ret = -EBUSY;
+                goto start_ba_exit;
+        }
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        /* check if the TID is not in aggregation flow already */
+        if (*state != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - session is not "
+                                 "idle on tid %u\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -EAGAIN;
+                goto start_ba_exit;
+        }
+
+        /* ensure that TX flow won't interrupt us
+         * until the end of the call to requeue function */
+        spin_lock_bh(&local->mdev->queue_lock);
+
+        /* create a new queue for this aggregation */
+        ret = ieee80211_ht_agg_queue_add(local, sta, tid);
+
+        /* case no queue is available to aggregation
+         * don't switch to aggregation */
+        if (ret) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - no queue available for"
+                                        " tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                spin_unlock_bh(&local->mdev->queue_lock);
+                goto start_ba_exit;
+        }
+        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
+        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
+         * call back right away, it must see that the flow has begun */
+        *state |= HT_ADDBA_REQUESTED_MSK;
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
+                                                ra, tid, &start_seq_num);
+
+        if (ret) {
+                /* No need to requeue the packets in the agg queue, since we
+                 * held the tx lock: no packet could be enqueued to the newly
+                 * allocated queue */
+                 ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - HW or queue unavailable"
+                                " for tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                spin_unlock_bh(&local->mdev->queue_lock);
+                *state = HT_AGG_STATE_IDLE;
+                goto start_ba_exit;
+        }
+
+        /* Will put all the packets in the new SW queue */
+        ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
+        spin_unlock_bh(&local->mdev->queue_lock);
+
+        /* We have most probably almost emptied the legacy queue */
+        /* ieee80211_wake_queue(local_to_hw(local), ieee802_1d_to_ac[tid]); */
+
+        /* send an addBA request */
+        sta->ampdu_mlme.dialog_token_allocator++;
+        sta->ampdu_mlme.tid_tx[tid].dialog_token =
+                        sta->ampdu_mlme.dialog_token_allocator;
+        sta->ampdu_mlme.tid_tx[tid].ssn = start_seq_num;
+
+        ieee80211_send_addba_request(sta->dev, ra, tid,
+                         sta->ampdu_mlme.tid_tx[tid].dialog_token,
+                         sta->ampdu_mlme.tid_tx[tid].ssn,
+                         0x40, 5000);
+
+        /* activate the timer for the recipient's addBA response */
+        sta->ampdu_mlme.tid_tx[tid].addba_resp_timer.expires =
+                                jiffies + ADDBA_RESP_INTERVAL;
+        add_timer(&sta->ampdu_mlme.tid_tx[tid].addba_resp_timer);
+        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
+
+start_ba_exit:
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        sta_info_put(sta);
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
+
+int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
+                                 u8 *ra, u16 tid,
+                                 enum ieee80211_back_parties initiator)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        int ret = 0;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Stop a BA session requested for %s tid %u\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        sta = sta_info_get(local, ra);
+        if (!sta)
+                return -ENOENT;
+
+        /* check if the TID is in aggregation */
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        if (*state != HT_AGG_STATE_OPERATIONAL) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Try to stop Tx aggregation on"
+                                " non active TID\n");
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -ENOENT;
+                goto stop_BA_exit;
+        }
+
+        ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
+
+        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
+                                                ra, tid, NULL);
+
+        /* case HW denied going back to legacy */
+        if (ret) {
+                WARN_ON(ret != -EBUSY);
+                *state = HT_AGG_STATE_OPERATIONAL;
+                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                goto stop_BA_exit;
+        }
+
+stop_BA_exit:
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        sta_info_put(sta);
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
+
+void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM) {
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+                return;
+        }
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                printk(KERN_DEBUG "Could not find station: %s\n",
+                                print_mac(mac, ra));
+                return;
+        }
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
+                                *state);
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                sta_info_put(sta);
+                return;
+        }
+
+        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
+
+        *state |= HT_ADDBA_DRV_READY_MSK;
+
+        if (*state == HT_AGG_STATE_OPERATIONAL) {
+                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+        }
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        sta_info_put(sta);
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
+
+void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        int agg_queue;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM) {
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+                return;
+        }
+
+        printk(KERN_DEBUG "Stop a BA session requested on DA %s tid %d\n",
+                                print_mac(mac, ra), tid);
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                printk(KERN_DEBUG "Could not find station: %s\n",
+                                print_mac(mac, ra));
+                return;
+        }
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
+                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
+                sta_info_put(sta);
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                return;
+        }
+
+        if (*state & HT_AGG_STATE_INITIATOR_MSK)
+                ieee80211_send_delba(sta->dev, ra, tid,
+                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
+
+        agg_queue = sta->tid_to_tx_q[tid];
+
+        /* avoid ordering issues: we are the only one that can modify
+         * the content of the qdiscs */
+        spin_lock_bh(&local->mdev->queue_lock);
+        /* remove the queue for this aggregation */
+        ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
+        spin_unlock_bh(&local->mdev->queue_lock);
+
+        /* we just requeued the all the frames that were in the removed
+         * queue, and since we might miss a softirq we do netif_schedule.
+         * ieee80211_wake_queue is not used here as this queue is not
+         * necessarily stopped */
+        netif_schedule(local->mdev);
+        *state = HT_AGG_STATE_IDLE;
+        sta->ampdu_mlme.tid_tx[tid].addba_req_num = 0;
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        sta_info_put(sta);
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
+
+void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                      const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping start BA session", skb->dev->name);
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_ADDBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
+
+void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                     const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping stop BA session", skb->dev->name);
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_DELBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
+
 static void ieee80211_set_multicast_list(struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -479,8 +881,11 @@ int ieee80211_if_update_wds(struct net_device *dev, u8 *remote_addr)
 
         /* Create STA entry for the new peer */
         sta = sta_info_add(local, dev, remote_addr, GFP_KERNEL);
-        if (!sta)
-                return -ENOMEM;
+        if (IS_ERR(sta))
+                return PTR_ERR(sta);
+
+        sta->flags |= WLAN_STA_AUTHORIZED;
+
         sta_info_put(sta);
 
         /* Remove STA entry for the old peer */
@@ -553,37 +958,28 @@ int ieee80211_if_config_beacon(struct net_device *dev)
 
 int ieee80211_hw_config(struct ieee80211_local *local)
 {
-        struct ieee80211_hw_mode *mode;
         struct ieee80211_channel *chan;
         int ret = 0;
 
-        if (local->sta_sw_scanning) {
+        if (local->sta_sw_scanning)
                 chan = local->scan_channel;
-                mode = local->scan_hw_mode;
-        } else {
+        else
                 chan = local->oper_channel;
-                mode = local->oper_hw_mode;
-        }
 
-        local->hw.conf.channel = chan->chan;
-        local->hw.conf.channel_val = chan->val;
-        if (!local->hw.conf.power_level) {
-                local->hw.conf.power_level = chan->power_level;
-        } else {
-                local->hw.conf.power_level = min(chan->power_level,
-                                                 local->hw.conf.power_level);
-        }
-        local->hw.conf.freq = chan->freq;
-        local->hw.conf.phymode = mode->mode;
-        local->hw.conf.antenna_max = chan->antenna_max;
-        local->hw.conf.chan = chan;
-        local->hw.conf.mode = mode;
+        local->hw.conf.channel = chan;
+
+        if (!local->hw.conf.power_level)
+                local->hw.conf.power_level = chan->max_power;
+        else
+                local->hw.conf.power_level = min(chan->max_power,
+                                               local->hw.conf.power_level);
+
+        local->hw.conf.max_antenna_gain = chan->max_antenna_gain;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "HW CONFIG: channel=%d freq=%d "
-               "phymode=%d\n", local->hw.conf.channel, local->hw.conf.freq,
-               local->hw.conf.phymode);
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        printk(KERN_DEBUG "%s: HW CONFIG: freq=%d\n",
+               wiphy_name(local->hw.wiphy), chan->center_freq);
+#endif
 
         if (local->open_count)
                 ret = local->ops->config(local_to_hw(local), &local->hw.conf);
@@ -601,11 +997,13 @@ int ieee80211_hw_config_ht(struct ieee80211_local *local, int enable_ht,
                            struct ieee80211_ht_bss_info *req_bss_cap)
 {
         struct ieee80211_conf *conf = &local->hw.conf;
-        struct ieee80211_hw_mode *mode = conf->mode;
+        struct ieee80211_supported_band *sband;
         int i;
 
+        sband = local->hw.wiphy->bands[conf->channel->band];
+
         /* HT is not supported */
-        if (!mode->ht_info.ht_supported) {
+        if (!sband->ht_info.ht_supported) {
                 conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
                 return -EOPNOTSUPP;
         }
@@ -615,17 +1013,17 @@ int ieee80211_hw_config_ht(struct ieee80211_local *local, int enable_ht,
                 conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
         } else {
                 conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
-                conf->ht_conf.cap = req_ht_cap->cap & mode->ht_info.cap;
+                conf->ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
                 conf->ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
                 conf->ht_conf.cap |=
-                        mode->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
+                        sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
                 conf->ht_bss_conf.primary_channel =
                         req_bss_cap->primary_channel;
                 conf->ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
                 conf->ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
                 for (i = 0; i < SUPP_MCS_SET_LEN; i++)
                         conf->ht_conf.supp_mcs_set[i] =
-                                mode->ht_info.supp_mcs_set[i] &
+                                sband->ht_info.supp_mcs_set[i] &
                                   req_ht_cap->supp_mcs_set[i];
 
                 /* In STA mode, this gives us indication
@@ -713,6 +1111,7 @@ static void ieee80211_tasklet_handler(unsigned long data)
         struct sk_buff *skb;
         struct ieee80211_rx_status rx_status;
         struct ieee80211_tx_status *tx_status;
+        struct ieee80211_ra_tid *ra_tid;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
@@ -733,6 +1132,18 @@ static void ieee80211_tasklet_handler(unsigned long data)
                                             skb, tx_status);
                         kfree(tx_status);
                         break;
+                case IEEE80211_DELBA_MSG:
+                        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+                        ieee80211_stop_tx_ba_cb(local_to_hw(local),
+                                                ra_tid->ra, ra_tid->tid);
+                        dev_kfree_skb(skb);
+                        break;
+                case IEEE80211_ADDBA_MSG:
+                        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+                        ieee80211_start_tx_ba_cb(local_to_hw(local),
+                                                 ra_tid->ra, ra_tid->tid);
+                        dev_kfree_skb(skb);
+                        break ;
                 default: /* should never get here! */
                         printk(KERN_ERR "%s: Unknown message type (%d)\n",
                                wiphy_name(local->hw.wiphy), skb->pkt_type);
@@ -810,6 +1221,77 @@ no_key:
         }
 }
 
+static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
+                                            struct sta_info *sta,
+                                            struct sk_buff *skb,
+                                            struct ieee80211_tx_status *status)
+{
+        sta->tx_filtered_count++;
+
+        /*
+         * Clear the TX filter mask for this STA when sending the next
+         * packet. If the STA went to power save mode, this will happen
+         * happen when it wakes up for the next time.
+         */
+        sta->flags |= WLAN_STA_CLEAR_PS_FILT;
+
+        /*
+         * This code races in the following way:
+         *
+         *  (1) STA sends frame indicating it will go to sleep and does so
+         *  (2) hardware/firmware adds STA to filter list, passes frame up
+         *  (3) hardware/firmware processes TX fifo and suppresses a frame
+         *  (4) we get TX status before having processed the frame and
+         *      knowing that the STA has gone to sleep.
+         *
+         * This is actually quite unlikely even when both those events are
+         * processed from interrupts coming in quickly after one another or
+         * even at the same time because we queue both TX status events and
+         * RX frames to be processed by a tasklet and process them in the
+         * same order that they were received or TX status last. Hence, there
+         * is no race as long as the frame RX is processed before the next TX
+         * status, which drivers can ensure, see below.
+         *
+         * Note that this can only happen if the hardware or firmware can
+         * actually add STAs to the filter list, if this is done by the
+         * driver in response to set_tim() (which will only reduce the race
+         * this whole filtering tries to solve, not completely solve it)
+         * this situation cannot happen.
+         *
+         * To completely solve this race drivers need to make sure that they
+         *  (a) don't mix the irq-safe/not irq-safe TX status/RX processing
+         *      functions and
+         *  (b) always process RX events before TX status events if ordering
+         *      can be unknown, for example with different interrupt status
+         *      bits.
+         */
+        if (sta->flags & WLAN_STA_PS &&
+            skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
+                ieee80211_remove_tx_extra(local, sta->key, skb,
+                                          &status->control);
+                skb_queue_tail(&sta->tx_filtered, skb);
+                return;
+        }
+
+        if (!(sta->flags & WLAN_STA_PS) &&
+            !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
+                /* Software retry the packet once */
+                status->control.flags |= IEEE80211_TXCTL_REQUEUE;
+                ieee80211_remove_tx_extra(local, sta->key, skb,
+                                          &status->control);
+                dev_queue_xmit(skb);
+                return;
+        }
+
+        if (net_ratelimit())
+                printk(KERN_DEBUG "%s: dropped TX filtered frame, "
+                       "queue_len=%d PS=%d @%lu\n",
+                       wiphy_name(local->hw.wiphy),
+                       skb_queue_len(&sta->tx_filtered),
+                       !!(sta->flags & WLAN_STA_PS), jiffies);
+        dev_kfree_skb(skb);
+}
+
 void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                          struct ieee80211_tx_status *status)
 {
@@ -819,7 +1301,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
         u16 frag, type;
         struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
-        int monitors;
+        struct net_device *prev_dev = NULL;
 
         if (!status) {
                 printk(KERN_ERR
@@ -834,11 +1316,16 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
                         if (sta->flags & WLAN_STA_PS) {
-                                /* The STA is in power save mode, so assume
+                                /*
+                                 * The STA is in power save mode, so assume
                                  * that this TX packet failed because of that.
                                  */
                                 status->excessive_retries = 0;
                                 status->flags |= IEEE80211_TX_STATUS_TX_FILTERED;
+                                ieee80211_handle_filtered_frame(local, sta,
+                                                                skb, status);
+                                sta_info_put(sta);
+                                return;
                         }
                         sta_info_put(sta);
                 }
@@ -848,47 +1335,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 struct sta_info *sta;
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
-                        sta->tx_filtered_count++;
-
-                        /* Clear the TX filter mask for this STA when sending
-                         * the next packet. If the STA went to power save mode,
-                         * this will happen when it is waking up for the next
-                         * time. */
-                        sta->clear_dst_mask = 1;
-
-                        /* TODO: Is the WLAN_STA_PS flag always set here or is
-                         * the race between RX and TX status causing some
-                         * packets to be filtered out before 80211.o gets an
-                         * update for PS status? This seems to be the case, so
-                         * no changes are likely to be needed. */
-                        if (sta->flags & WLAN_STA_PS &&
-                            skb_queue_len(&sta->tx_filtered) <
-                            STA_MAX_TX_BUFFER) {
-                                ieee80211_remove_tx_extra(local, sta->key,
-                                                          skb,
-                                                          &status->control);
-                                skb_queue_tail(&sta->tx_filtered, skb);
-                        } else if (!(sta->flags & WLAN_STA_PS) &&
-                                   !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
-                                /* Software retry the packet once */
-                                status->control.flags |= IEEE80211_TXCTL_REQUEUE;
-                                ieee80211_remove_tx_extra(local, sta->key,
-                                                          skb,
-                                                          &status->control);
-                                dev_queue_xmit(skb);
-                        } else {
-                                if (net_ratelimit()) {
-                                        printk(KERN_DEBUG "%s: dropped TX "
-                                               "filtered frame queue_len=%d "
-                                               "PS=%d @%lu\n",
-                                               wiphy_name(local->hw.wiphy),
-                                               skb_queue_len(
-                                                       &sta->tx_filtered),
-                                               !!(sta->flags & WLAN_STA_PS),
-                                               jiffies);
-                                }
-                                dev_kfree_skb(skb);
-                        }
+                        ieee80211_handle_filtered_frame(local, sta, skb,
+                                                        status);
                         sta_info_put(sta);
                         return;
                 }
@@ -932,7 +1380,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
         /* this was a transmitted frame, but now we want to reuse it */
         skb_orphan(skb);
 
-        if (!local->monitors) {
+        /*
+         * This is a bit racy but we can avoid a lot of work
+         * with this test...
+         */
+        if (!local->monitors && !local->cooked_mntrs) {
                 dev_kfree_skb(skb);
                 return;
         }
@@ -966,51 +1418,44 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         rthdr->data_retries = status->retry_count;
 
+        /* XXX: is this sufficient for BPF? */
+        skb_set_mac_header(skb, 0);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+        memset(skb->cb, 0, sizeof(skb->cb));
+
         rcu_read_lock();
-        monitors = local->monitors;
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                /*
-                 * Using the monitors counter is possibly racy, but
-                 * if the value is wrong we simply either clone the skb
-                 * once too much or forget sending it to one monitor iface
-                 * The latter case isn't nice but fixing the race is much
-                 * more complicated.
-                 */
-                if (!monitors || !skb)
-                        goto out;
-
                 if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR) {
                         if (!netif_running(sdata->dev))
                                 continue;
-                        monitors--;
-                        if (monitors)
+
+                        if (prev_dev) {
                                 skb2 = skb_clone(skb, GFP_ATOMIC);
-                        else
-                                skb2 = NULL;
-                        skb->dev = sdata->dev;
-                        /* XXX: is this sufficient for BPF? */
-                        skb_set_mac_header(skb, 0);
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        skb->pkt_type = PACKET_OTHERHOST;
-                        skb->protocol = htons(ETH_P_802_2);
-                        memset(skb->cb, 0, sizeof(skb->cb));
-                        netif_rx(skb);
-                        skb = skb2;
+                                if (skb2) {
+                                        skb2->dev = prev_dev;
+                                        netif_rx(skb2);
+                                }
+                        }
+
+                        prev_dev = sdata->dev;
                 }
         }
- out:
+        if (prev_dev) {
+                skb->dev = prev_dev;
+                netif_rx(skb);
+                skb = NULL;
+        }
         rcu_read_unlock();
-        if (skb)
-                dev_kfree_skb(skb);
+        dev_kfree_skb(skb);
 }
 EXPORT_SYMBOL(ieee80211_tx_status);
 
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
-        struct net_device *mdev;
         struct ieee80211_local *local;
-        struct ieee80211_sub_if_data *sdata;
         int priv_size;
         struct wiphy *wiphy;
 
@@ -1056,25 +1501,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         BUG_ON(!ops->configure_filter);
         local->ops = ops;
 
-        /* for now, mdev needs sub_if_data :/ */
-        mdev = alloc_netdev(sizeof(struct ieee80211_sub_if_data),
-                            "wmaster%d", ether_setup);
-        if (!mdev) {
-                wiphy_free(wiphy);
-                return NULL;
-        }
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
-        mdev->ieee80211_ptr = &sdata->wdev;
-        sdata->wdev.wiphy = wiphy;
-
         local->hw.queues = 1; /* default */
 
-        local->mdev = mdev;
-        local->rx_pre_handlers = ieee80211_rx_pre_handlers;
-        local->rx_handlers = ieee80211_rx_handlers;
-        local->tx_handlers = ieee80211_tx_handlers;
-
         local->bridge_packets = 1;
 
         local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
@@ -1083,33 +1511,12 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->long_retry_limit = 4;
         local->hw.conf.radio_enabled = 1;
 
-        local->enabled_modes = ~0;
-
-        INIT_LIST_HEAD(&local->modes_list);
-
         INIT_LIST_HEAD(&local->interfaces);
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_sta_scan_work);
-        ieee80211_rx_bss_list_init(mdev);
 
         sta_info_init(local);
 
-        mdev->hard_start_xmit = ieee80211_master_start_xmit;
-        mdev->open = ieee80211_master_open;
-        mdev->stop = ieee80211_master_stop;
-        mdev->type = ARPHRD_IEEE80211;
-        mdev->header_ops = &ieee80211_header_ops;
-        mdev->set_multicast_list = ieee80211_master_set_multicast_list;
-
-        sdata->vif.type = IEEE80211_IF_TYPE_AP;
-        sdata->dev = mdev;
-        sdata->local = local;
-        sdata->u.ap.force_unicast_rateidx = -1;
-        sdata->u.ap.max_ratectrl_rateidx = -1;
-        ieee80211_if_sdata_init(sdata);
-        /* no RCU needed since we're still during init phase */
-        list_add_tail(&sdata->list, &local->interfaces);
-
         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
                      (unsigned long)local);
         tasklet_disable(&local->tx_pending_tasklet);
@@ -1131,11 +1538,63 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         struct ieee80211_local *local = hw_to_local(hw);
         const char *name;
         int result;
+        enum ieee80211_band band;
+        struct net_device *mdev;
+        struct ieee80211_sub_if_data *sdata;
+
+        /*
+         * generic code guarantees at least one band,
+         * set this very early because much code assumes
+         * that hw.conf.channel is assigned
+         */
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[band];
+                if (sband) {
+                        /* init channel we're on */
+                        local->hw.conf.channel =
+                        local->oper_channel =
+                        local->scan_channel = &sband->channels[0];
+                        break;
+                }
+        }
 
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 return result;
 
+        /* for now, mdev needs sub_if_data :/ */
+        mdev = alloc_netdev(sizeof(struct ieee80211_sub_if_data),
+                            "wmaster%d", ether_setup);
+        if (!mdev)
+                goto fail_mdev_alloc;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
+        mdev->ieee80211_ptr = &sdata->wdev;
+        sdata->wdev.wiphy = local->hw.wiphy;
+
+        local->mdev = mdev;
+
+        ieee80211_rx_bss_list_init(mdev);
+
+        mdev->hard_start_xmit = ieee80211_master_start_xmit;
+        mdev->open = ieee80211_master_open;
+        mdev->stop = ieee80211_master_stop;
+        mdev->type = ARPHRD_IEEE80211;
+        mdev->header_ops = &ieee80211_header_ops;
+        mdev->set_multicast_list = ieee80211_master_set_multicast_list;
+
+        sdata->vif.type = IEEE80211_IF_TYPE_AP;
+        sdata->dev = mdev;
+        sdata->local = local;
+        sdata->u.ap.force_unicast_rateidx = -1;
+        sdata->u.ap.max_ratectrl_rateidx = -1;
+        ieee80211_if_sdata_init(sdata);
+
+        /* no RCU needed since we're still during init phase */
+        list_add_tail(&sdata->list, &local->interfaces);
+
         name = wiphy_dev(local->hw.wiphy)->driver->name;
         local->hw.workqueue = create_singlethread_workqueue(name);
         if (!local->hw.workqueue) {
@@ -1227,49 +1686,18 @@ fail_sta_info:
         debugfs_hw_del(local);
         destroy_workqueue(local->hw.workqueue);
 fail_workqueue:
+        ieee80211_if_free(local->mdev);
+        local->mdev = NULL;
+fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
         return result;
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
 
-int ieee80211_register_hwmode(struct ieee80211_hw *hw,
-                              struct ieee80211_hw_mode *mode)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_rate *rate;
-        int i;
-
-        INIT_LIST_HEAD(&mode->list);
-        list_add_tail(&mode->list, &local->modes_list);
-
-        local->hw_modes |= (1 << mode->mode);
-        for (i = 0; i < mode->num_rates; i++) {
-                rate = &(mode->rates[i]);
-                rate->rate_inv = CHAN_UTIL_RATE_LCM / rate->rate;
-        }
-        ieee80211_prepare_rates(local, mode);
-
-        if (!local->oper_hw_mode) {
-                /* Default to this mode */
-                local->hw.conf.phymode = mode->mode;
-                local->oper_hw_mode = local->scan_hw_mode = mode;
-                local->oper_channel = local->scan_channel = &mode->channels[0];
-                local->hw.conf.mode = local->oper_hw_mode;
-                local->hw.conf.chan = local->oper_channel;
-        }
-
-        if (!(hw->flags & IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED))
-                ieee80211_set_default_regdomain(mode);
-
-        return 0;
-}
-EXPORT_SYMBOL(ieee80211_register_hwmode);
-
 void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata, *tmp;
-        int i;
 
         tasklet_kill(&local->tx_pending_tasklet);
         tasklet_kill(&local->tasklet);
@@ -1310,11 +1738,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         rate_control_deinitialize(local);
         debugfs_hw_del(local);
 
-        for (i = 0; i < NUM_IEEE80211_MODES; i++) {
-                kfree(local->supp_rates[i]);
-                kfree(local->basic_rates[i]);
-        }
-
         if (skb_queue_len(&local->skb_queue)
                         || skb_queue_len(&local->skb_queue_unreliable))
                 printk(KERN_WARNING "%s: skb_queue not empty\n",
@@ -1326,6 +1749,8 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
+        ieee80211_if_free(local->mdev);
+        local->mdev = NULL;
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
@@ -1333,7 +1758,6 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        ieee80211_if_free(local->mdev);
         wiphy_free(local->hw.wiphy);
 }
 EXPORT_SYMBOL(ieee80211_free_hw);
@@ -1361,7 +1785,6 @@ static int __init ieee80211_init(void)
         }
 
         ieee80211_debugfs_netdev_init();
-        ieee80211_regdomain_init();
 
         return 0;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 72ecbf7bf962..b07b3cbfd039 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -79,8 +79,7 @@ struct ieee80211_sta_bss {
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         size_t ssid_len;
         u16 capability; /* host byte order */
-        int hw_mode;
-        int channel;
+        enum ieee80211_band band;
         int freq;
         int rssi, signal, noise;
         u8 *wpa_ie;
@@ -109,9 +108,17 @@ struct ieee80211_sta_bss {
 };
 
 
-typedef enum {
-        TXRX_CONTINUE, TXRX_DROP, TXRX_QUEUED
-} ieee80211_txrx_result;
+typedef unsigned __bitwise__ ieee80211_tx_result;
+#define TX_CONTINUE     ((__force ieee80211_tx_result) 0u)
+#define TX_DROP         ((__force ieee80211_tx_result) 1u)
+#define TX_QUEUED       ((__force ieee80211_tx_result) 2u)
+
+typedef unsigned __bitwise__ ieee80211_rx_result;
+#define RX_CONTINUE             ((__force ieee80211_rx_result) 0u)
+#define RX_DROP_UNUSABLE        ((__force ieee80211_rx_result) 1u)
+#define RX_DROP_MONITOR         ((__force ieee80211_rx_result) 2u)
+#define RX_QUEUED               ((__force ieee80211_rx_result) 3u)
+
 
 /* flags used in struct ieee80211_txrx_data.flags */
 /* whether the MSDU was fragmented */
@@ -124,6 +131,7 @@ typedef enum {
 #define IEEE80211_TXRXD_RXRA_MATCH              BIT(5)
 #define IEEE80211_TXRXD_TX_INJECTED             BIT(6)
 #define IEEE80211_TXRXD_RX_AMSDU                BIT(7)
+#define IEEE80211_TXRXD_RX_CMNTR_REPORTED       BIT(8)
 struct ieee80211_txrx_data {
         struct sk_buff *skb;
         struct net_device *dev;
@@ -136,13 +144,12 @@ struct ieee80211_txrx_data {
         union {
                 struct {
                         struct ieee80211_tx_control *control;
-                        struct ieee80211_hw_mode *mode;
+                        struct ieee80211_channel *channel;
                         struct ieee80211_rate *rate;
                         /* use this rate (if set) for last fragment; rate can
                          * be set to lower rate for the first fragments, e.g.,
                          * when using CTS protection with IEEE 802.11g. */
                         struct ieee80211_rate *last_frag_rate;
-                        int last_frag_hwrate;
 
                         /* Extra fragments (in addition to the first fragment
                          * in skb) */
@@ -151,6 +158,7 @@ struct ieee80211_txrx_data {
                 } tx;
                 struct {
                         struct ieee80211_rx_status *status;
+                        struct ieee80211_rate *rate;
                         int sent_ps_buffered;
                         int queue;
                         int load;
@@ -165,6 +173,7 @@ struct ieee80211_txrx_data {
 #define IEEE80211_TXPD_DO_NOT_ENCRYPT   BIT(1)
 #define IEEE80211_TXPD_REQUEUE          BIT(2)
 #define IEEE80211_TXPD_EAPOL_FRAME      BIT(3)
+#define IEEE80211_TXPD_AMPDU            BIT(4)
 /* Stored in sk_buff->cb */
 struct ieee80211_tx_packet_data {
         int ifindex;
@@ -178,18 +187,10 @@ struct ieee80211_tx_stored_packet {
         struct sk_buff *skb;
         int num_extra_frag;
         struct sk_buff **extra_frag;
-        int last_frag_rateidx;
-        int last_frag_hwrate;
         struct ieee80211_rate *last_frag_rate;
         unsigned int last_frag_rate_ctrl_probe;
 };
 
-typedef ieee80211_txrx_result (*ieee80211_tx_handler)
-(struct ieee80211_txrx_data *tx);
-
-typedef ieee80211_txrx_result (*ieee80211_rx_handler)
-(struct ieee80211_txrx_data *rx);
-
 struct beacon_data {
         u8 *head, *tail;
         int head_len, tail_len;
@@ -206,7 +207,7 @@ struct ieee80211_if_ap {
 
         /* yes, this looks ugly, but guarantees that we can later use
          * bitmap_empty :)
-         * NB: don't ever use set_bit, use bss_tim_set/bss_tim_clear! */
+         * NB: don't touch this bitmap, use sta_info_{set,clear}_tim_bit */
         u8 tim[sizeof(unsigned long) * BITS_TO_LONGS(IEEE80211_MAX_AID + 1)];
         atomic_t num_sta_ps; /* number of stations in PS mode */
         struct sk_buff_head ps_bc_buf;
@@ -282,7 +283,7 @@ struct ieee80211_if_sta {
 
         unsigned long ibss_join_req;
         struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
-        u32 supp_rates_bits;
+        u32 supp_rates_bits[IEEE80211_NUM_BANDS];
 
         int wmm_last_param_set;
 };
@@ -292,6 +293,7 @@ struct ieee80211_if_sta {
 #define IEEE80211_SDATA_ALLMULTI        BIT(0)
 #define IEEE80211_SDATA_PROMISC         BIT(1)
 #define IEEE80211_SDATA_USERSPACE_MLME  BIT(2)
+#define IEEE80211_SDATA_OPERATING_GMODE BIT(3)
 struct ieee80211_sub_if_data {
         struct list_head list;
 
@@ -306,11 +308,11 @@ struct ieee80211_sub_if_data {
         unsigned int flags;
 
         int drop_unencrypted;
+
         /*
-         * IEEE 802.1X Port access control in effect,
-         * drop packets to/from unauthorized port
+         * basic rates of this AP or the AP we're associated to
          */
-        int ieee802_1x_pac;
+        u64 basic_rates;
 
         u16 sequence;
 
@@ -338,6 +340,7 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_wds wds;
                 struct ieee80211_if_vlan vlan;
                 struct ieee80211_if_sta sta;
+                u32 mntr_flags;
         } u;
         int channel_use;
         int channel_use_raw;
@@ -348,7 +351,6 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                         struct dentry *state;
                         struct dentry *bssid;
                         struct dentry *prev_bssid;
@@ -367,7 +369,6 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                         struct dentry *num_sta_ps;
                         struct dentry *dtim_count;
                         struct dentry *num_beacons;
@@ -378,13 +379,11 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                         struct dentry *peer;
                 } wds;
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                 } vlan;
                 struct {
                         struct dentry *mode;
@@ -407,6 +406,8 @@ struct ieee80211_sub_if_data *vif_to_sdata(struct ieee80211_vif *p)
 enum {
         IEEE80211_RX_MSG        = 1,
         IEEE80211_TX_STATUS_MSG = 2,
+        IEEE80211_DELBA_MSG     = 3,
+        IEEE80211_ADDBA_MSG     = 4,
 };
 
 struct ieee80211_local {
@@ -417,12 +418,11 @@ struct ieee80211_local {
 
         const struct ieee80211_ops *ops;
 
-        /* List of registered struct ieee80211_hw_mode */
-        struct list_head modes_list;
-
         struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
-        int monitors;
+        int monitors, cooked_mntrs;
+        /* number of interfaces with corresponding FIF_ flags */
+        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
         u8 wstats_flags;
@@ -450,8 +450,8 @@ struct ieee80211_local {
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
 
-        unsigned long state[NUM_TX_DATA_QUEUES];
-        struct ieee80211_tx_stored_packet pending_packet[NUM_TX_DATA_QUEUES];
+        unsigned long state[NUM_TX_DATA_QUEUES_AMPDU];
+        struct ieee80211_tx_stored_packet pending_packet[NUM_TX_DATA_QUEUES_AMPDU];
         struct tasklet_struct tx_pending_tasklet;
 
         /* number of interfaces with corresponding IFF_ flags */
@@ -459,11 +459,6 @@ struct ieee80211_local {
 
         struct rate_control_ref *rate_ctrl;
 
-        /* Supported and basic rate filters for different modes. These are
-         * pointers to -1 terminated lists and rates in 100 kbps units. */
-        int *supp_rates[NUM_IEEE80211_MODES];
-        int *basic_rates[NUM_IEEE80211_MODES];
-
         int rts_threshold;
         int fragmentation_threshold;
         int short_retry_limit; /* dot11ShortRetryLimit */
@@ -477,21 +472,18 @@ struct ieee80211_local {
                              * deliver multicast frames both back to wireless
                              * media and to the local net stack */
 
-        ieee80211_rx_handler *rx_pre_handlers;
-        ieee80211_rx_handler *rx_handlers;
-        ieee80211_tx_handler *tx_handlers;
-
         struct list_head interfaces;
 
         bool sta_sw_scanning;
         bool sta_hw_scanning;
         int scan_channel_idx;
+        enum ieee80211_band scan_band;
+
         enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
         unsigned long last_scan_completed;
         struct delayed_work scan_work;
         struct net_device *scan_dev;
         struct ieee80211_channel *oper_channel, *scan_channel;
-        struct ieee80211_hw_mode *oper_hw_mode, *scan_hw_mode;
         u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
         size_t scan_ssid_len;
         struct list_head sta_bss_list;
@@ -560,14 +552,8 @@ struct ieee80211_local {
         int wifi_wme_noack_test;
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
-        unsigned int enabled_modes; /* bitfield of allowed modes;
-                                      * (1 << MODE_*) */
-        unsigned int hw_modes; /* bitfield of supported hardware modes;
-                                * (1 << MODE_*) */
-
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
-                struct dentry *channel;
                 struct dentry *frequency;
                 struct dentry *antenna_sel_tx;
                 struct dentry *antenna_sel_rx;
@@ -577,9 +563,7 @@ struct ieee80211_local {
                 struct dentry *short_retry_limit;
                 struct dentry *long_retry_limit;
                 struct dentry *total_ps_buffered;
-                struct dentry *mode;
                 struct dentry *wep_iv;
-                struct dentry *modes;
                 struct dentry *statistics;
                 struct local_debugfsdentries_statsdentries {
                         struct dentry *transmitted_fragment_count;
@@ -627,6 +611,12 @@ struct ieee80211_local {
 #endif
 };
 
+/* this struct represents 802.11n's RA/TID combination */
+struct ieee80211_ra_tid {
+        u8 ra[ETH_ALEN];
+        u16 tid;
+};
+
 static inline struct ieee80211_local *hw_to_local(
         struct ieee80211_hw *hw)
 {
@@ -650,57 +640,6 @@ struct sta_attribute {
         ssize_t (*store)(struct sta_info *, const char *buf, size_t count);
 };
 
-static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
-{
-        /*
-         * This format has been mandated by the IEEE specifications,
-         * so this line may not be changed to use the __set_bit() format.
-         */
-        bss->tim[aid / 8] |= (1 << (aid % 8));
-}
-
-static inline void bss_tim_set(struct ieee80211_local *local,
-                               struct ieee80211_if_ap *bss, u16 aid)
-{
-        read_lock_bh(&local->sta_lock);
-        __bss_tim_set(bss, aid);
-        read_unlock_bh(&local->sta_lock);
-}
-
-static inline void __bss_tim_clear(struct ieee80211_if_ap *bss, u16 aid)
-{
-        /*
-         * This format has been mandated by the IEEE specifications,
-         * so this line may not be changed to use the __clear_bit() format.
-         */
-        bss->tim[aid / 8] &= ~(1 << (aid % 8));
-}
-
-static inline void bss_tim_clear(struct ieee80211_local *local,
-                                 struct ieee80211_if_ap *bss, u16 aid)
-{
-        read_lock_bh(&local->sta_lock);
-        __bss_tim_clear(bss, aid);
-        read_unlock_bh(&local->sta_lock);
-}
-
-/**
- * ieee80211_is_erp_rate - Check if a rate is an ERP rate
- * @phymode: The PHY-mode for this rate (MODE_IEEE80211...)
- * @rate: Transmission rate to check, in 100 kbps
- *
- * Check if a given rate is an Extended Rate PHY (ERP) rate.
- */
-static inline int ieee80211_is_erp_rate(int phymode, int rate)
-{
-        if (phymode == MODE_IEEE80211G) {
-                if (rate != 10 && rate != 20 &&
-                    rate != 55 && rate != 110)
-                        return 1;
-        }
-        return 0;
-}
-
 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 {
         return compare_ether_addr(raddr, addr) == 0 ||
@@ -712,13 +651,9 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 int ieee80211_hw_config(struct ieee80211_local *local);
 int ieee80211_if_config(struct net_device *dev);
 int ieee80211_if_config_beacon(struct net_device *dev);
-void ieee80211_prepare_rates(struct ieee80211_local *local,
-                             struct ieee80211_hw_mode *mode);
 void ieee80211_tx_set_iswep(struct ieee80211_txrx_data *tx);
 int ieee80211_if_update_wds(struct net_device *dev, u8 *remote_addr);
 void ieee80211_if_setup(struct net_device *dev);
-struct ieee80211_rate *ieee80211_get_rate(struct ieee80211_local *local,
-                                          int phymode, int hwrate);
 int ieee80211_hw_config_ht(struct ieee80211_local *local, int enable_ht,
                            struct ieee80211_ht_info *req_ht_cap,
                            struct ieee80211_ht_bss_info *req_bss_cap);
@@ -749,7 +684,7 @@ extern const struct iw_handler_def ieee80211_iw_handler_def;
 /* ieee80211_ioctl.c */
 int ieee80211_set_compression(struct ieee80211_local *local,
                               struct net_device *dev, struct sta_info *sta);
-int ieee80211_set_channel(struct ieee80211_local *local, int channel, int freq);
+int ieee80211_set_freq(struct ieee80211_local *local, int freq);
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
 void ieee80211_sta_work(struct work_struct *work);
@@ -763,9 +698,9 @@ int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len);
 void ieee80211_sta_req_auth(struct net_device *dev,
                             struct ieee80211_if_sta *ifsta);
 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len);
-ieee80211_txrx_result ieee80211_sta_rx_scan(struct net_device *dev,
-                                            struct sk_buff *skb,
-                           struct ieee80211_rx_status *rx_status);
+ieee80211_rx_result ieee80211_sta_rx_scan(
+        struct net_device *dev, struct sk_buff *skb,
+        struct ieee80211_rx_status *rx_status);
 void ieee80211_rx_bss_list_init(struct net_device *dev);
 void ieee80211_rx_bss_list_deinit(struct net_device *dev);
 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len);
@@ -782,9 +717,15 @@ int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
                         struct ieee80211_ht_addt_info *ht_add_info_ie,
                         struct ieee80211_ht_bss_info *bss_info);
+void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
+                                  u16 tid, u8 dialog_token, u16 start_seq_num,
+                                  u16 agg_size, u16 timeout);
+void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
+                                u16 initiator, u16 reason_code);
 void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *da,
                                 u16 tid, u16 initiator, u16 reason);
 void sta_rx_agg_session_timer_expired(unsigned long data);
+void sta_addba_resp_timer_expired(unsigned long data);
 /* ieee80211_iface.c */
 int ieee80211_if_add(struct net_device *dev, const char *name,
                      struct net_device **new_dev, int type);
@@ -796,16 +737,7 @@ int ieee80211_if_remove(struct net_device *dev, const char *name, int id);
 void ieee80211_if_free(struct net_device *dev);
 void ieee80211_if_sdata_init(struct ieee80211_sub_if_data *sdata);
 
-/* regdomain.c */
-void ieee80211_regdomain_init(void);
-void ieee80211_set_default_regdomain(struct ieee80211_hw_mode *mode);
-
-/* rx handling */
-extern ieee80211_rx_handler ieee80211_rx_pre_handlers[];
-extern ieee80211_rx_handler ieee80211_rx_handlers[];
-
 /* tx handling */
-extern ieee80211_tx_handler ieee80211_tx_handlers[];
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
 int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev);
diff --git a/net/mac80211/ieee80211_iface.c b/net/mac80211/ieee80211_iface.c
index 92f1eb2da311..0d6824bca92b 100644
--- a/net/mac80211/ieee80211_iface.c
+++ b/net/mac80211/ieee80211_iface.c
@@ -118,6 +118,8 @@ void ieee80211_if_set_type(struct net_device *dev, int type)
         sdata->bss = NULL;
         sdata->vif.type = type;
 
+        sdata->basic_rates = 0;
+
         switch (type) {
         case IEEE80211_IF_TYPE_WDS:
                 /* nothing special */
@@ -158,6 +160,8 @@ void ieee80211_if_set_type(struct net_device *dev, int type)
         case IEEE80211_IF_TYPE_MNTR:
                 dev->type = ARPHRD_IEEE80211_RADIOTAP;
                 dev->hard_start_xmit = ieee80211_monitor_start_xmit;
+                sdata->u.mntr_flags = MONITOR_FLAG_CONTROL |
+                                      MONITOR_FLAG_OTHER_BSS;
                 break;
         default:
                 printk(KERN_WARNING "%s: %s: Unknown interface type 0x%x",
@@ -189,6 +193,7 @@ void ieee80211_if_reinit(struct net_device *dev)
                 /* Remove all virtual interfaces that use this BSS
                  * as their sdata->bss */
                 struct ieee80211_sub_if_data *tsdata, *n;
+                struct beacon_data *beacon;
 
                 list_for_each_entry_safe(tsdata, n, &local->interfaces, list) {
                         if (tsdata != sdata && tsdata->bss == &sdata->u.ap) {
@@ -206,7 +211,10 @@ void ieee80211_if_reinit(struct net_device *dev)
                         }
                 }
 
-                kfree(sdata->u.ap.beacon);
+                beacon = sdata->u.ap.beacon;
+                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
+                synchronize_rcu();
+                kfree(beacon);
 
                 while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
                         local->total_ps_buffered--;
diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
index 5024d3733834..7551db3f3abc 100644
--- a/net/mac80211/ieee80211_ioctl.c
+++ b/net/mac80211/ieee80211_ioctl.c
@@ -33,8 +33,8 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                                     size_t key_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int ret = 0;
-        struct sta_info *sta;
+        int ret;
+        struct sta_info *sta = NULL;
         struct ieee80211_key *key;
         struct ieee80211_sub_if_data *sdata;
 
@@ -46,58 +46,64 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                 return -EINVAL;
         }
 
-        if (is_broadcast_ether_addr(sta_addr)) {
-                sta = NULL;
-                key = sdata->keys[idx];
-        } else {
-                set_tx_key = 0;
-                /*
-                 * According to the standard, the key index of a pairwise
-                 * key must be zero. However, some AP are broken when it
-                 * comes to WEP key indices, so we work around this.
-                 */
-                if (idx != 0 && alg != ALG_WEP) {
-                        printk(KERN_DEBUG "%s: set_encrypt - non-zero idx for "
-                               "individual key\n", dev->name);
-                        return -EINVAL;
+        if (remove) {
+                if (is_broadcast_ether_addr(sta_addr)) {
+                        key = sdata->keys[idx];
+                } else {
+                        sta = sta_info_get(local, sta_addr);
+                        if (!sta) {
+                                ret = -ENOENT;
+                                key = NULL;
+                                goto err_out;
+                        }
+
+                        key = sta->key;
                 }
 
-                sta = sta_info_get(local, sta_addr);
-                if (!sta) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                        DECLARE_MAC_BUF(mac);
-                        printk(KERN_DEBUG "%s: set_encrypt - unknown addr "
-                               "%s\n",
-                               dev->name, print_mac(mac, sta_addr));
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+                if (!key)
+                        ret = -ENOENT;
+                else
+                        ret = 0;
+        } else {
+                key = ieee80211_key_alloc(alg, idx, key_len, _key);
+                if (!key)
+                        return -ENOMEM;
 
-                        return -ENOENT;
+                if (!is_broadcast_ether_addr(sta_addr)) {
+                        set_tx_key = 0;
+                        /*
+                         * According to the standard, the key index of a
+                         * pairwise key must be zero. However, some AP are
+                         * broken when it comes to WEP key indices, so we
+                         * work around this.
+                         */
+                        if (idx != 0 && alg != ALG_WEP) {
+                                ret = -EINVAL;
+                                goto err_out;
+                        }
+
+                        sta = sta_info_get(local, sta_addr);
+                        if (!sta) {
+                                ret = -ENOENT;
+                                goto err_out;
+                        }
                 }
 
-                key = sta->key;
-        }
+                ieee80211_key_link(key, sdata, sta);
 
-        if (remove) {
-                ieee80211_key_free(key);
+                if (set_tx_key || (!sta && !sdata->default_key && key))
+                        ieee80211_set_default_key(sdata, idx);
+
+                /* don't free key later */
                 key = NULL;
-        } else {
-                /*
-                 * Automatically frees any old key if present.
-                 */
-                key = ieee80211_key_alloc(sdata, sta, alg, idx, key_len, _key);
-                if (!key) {
-                        ret = -ENOMEM;
-                        goto err_out;
-                }
-        }
 
-        if (set_tx_key || (!sta && !sdata->default_key && key))
-                ieee80211_set_default_key(sdata, idx);
+                ret = 0;
+        }
 
-        ret = 0;
  err_out:
         if (sta)
                 sta_info_put(sta);
+        ieee80211_key_free(key);
         return ret;
 }
 
@@ -129,22 +135,7 @@ static int ieee80211_ioctl_giwname(struct net_device *dev,
                                    struct iw_request_info *info,
                                    char *name, char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        switch (local->hw.conf.phymode) {
-        case MODE_IEEE80211A:
-                strcpy(name, "IEEE 802.11a");
-                break;
-        case MODE_IEEE80211B:
-                strcpy(name, "IEEE 802.11b");
-                break;
-        case MODE_IEEE80211G:
-                strcpy(name, "IEEE 802.11g");
-                break;
-        default:
-                strcpy(name, "IEEE 802.11");
-                break;
-        }
+        strcpy(name, "IEEE 802.11");
 
         return 0;
 }
@@ -156,7 +147,7 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct iw_range *range = (struct iw_range *) extra;
-        struct ieee80211_hw_mode *mode = NULL;
+        enum ieee80211_band band;
         int c = 0;
 
         data->length = sizeof(struct iw_range);
@@ -191,24 +182,27 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
                           IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
 
-        list_for_each_entry(mode, &local->modes_list, list) {
-                int i = 0;
 
-                if (!(local->enabled_modes & (1 << mode->mode)) ||
-                    (local->hw_modes & local->enabled_modes &
-                     (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
+        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
+                int i;
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[band];
+
+                if (!sband)
                         continue;
 
-                while (i < mode->num_channels && c < IW_MAX_FREQUENCIES) {
-                        struct ieee80211_channel *chan = &mode->channels[i];
+                for (i = 0; i < sband->n_channels && c < IW_MAX_FREQUENCIES; i++) {
+                        struct ieee80211_channel *chan = &sband->channels[i];
 
-                        if (chan->flag & IEEE80211_CHAN_W_SCAN) {
-                                range->freq[c].i = chan->chan;
-                                range->freq[c].m = chan->freq * 100000;
-                                range->freq[c].e = 1;
+                        if (!(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                                range->freq[c].i =
+                                        ieee80211_frequency_to_channel(
+                                                chan->center_freq);
+                                range->freq[c].m = chan->center_freq;
+                                range->freq[c].e = 6;
                                 c++;
                         }
-                        i++;
                 }
         }
         range->num_channels = c;
@@ -294,22 +288,29 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
         return 0;
 }
 
-int ieee80211_set_channel(struct ieee80211_local *local, int channel, int freq)
+int ieee80211_set_freq(struct ieee80211_local *local, int freqMHz)
 {
-        struct ieee80211_hw_mode *mode;
-        int c, set = 0;
+        int set = 0;
         int ret = -EINVAL;
+        enum ieee80211_band band;
+        struct ieee80211_supported_band *sband;
+        int i;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
+                sband = local->hw.wiphy->bands[band];
 
-        list_for_each_entry(mode, &local->modes_list, list) {
-                if (!(local->enabled_modes & (1 << mode->mode)))
+                if (!sband)
                         continue;
-                for (c = 0; c < mode->num_channels; c++) {
-                        struct ieee80211_channel *chan = &mode->channels[c];
-                        if (chan->flag & IEEE80211_CHAN_W_SCAN &&
-                            ((chan->chan == channel) || (chan->freq == freq))) {
-                                local->oper_channel = chan;
-                                local->oper_hw_mode = mode;
+
+                for (i = 0; i < sband->n_channels; i++) {
+                        struct ieee80211_channel *chan = &sband->channels[i];
+
+                        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                continue;
+
+                        if (chan->center_freq == freqMHz) {
                                 set = 1;
+                                local->oper_channel = chan;
                                 break;
                         }
                 }
@@ -347,13 +348,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
                 } else
-                        return ieee80211_set_channel(local, freq->m, -1);
+                        return ieee80211_set_freq(local,
+                                ieee80211_channel_to_frequency(freq->m));
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div > 0)
-                        return ieee80211_set_channel(local, -1, freq->m / div);
+                        return ieee80211_set_freq(local, freq->m / div);
                 else
                         return -EINVAL;
         }
@@ -366,10 +368,7 @@ static int ieee80211_ioctl_giwfreq(struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
-        /* TODO: in station mode (Managed/Ad-hoc) might need to poll low-level
-         * driver for the current channel with firmware-based management */
-
-        freq->m = local->hw.conf.freq;
+        freq->m = local->hw.conf.channel->center_freq;
         freq->e = 6;
 
         return 0;
@@ -566,15 +565,17 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
                                   struct iw_param *rate, char *extra)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw_mode *mode;
-        int i;
+        int i, err = -EINVAL;
         u32 target_rate = rate->value / 100000;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_supported_band *sband;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (!sdata->bss)
                 return -ENODEV;
-        mode = local->oper_hw_mode;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
          * target_rate = X, rate->fixed = 1 means only rate X
          * target_rate = X, rate->fixed = 0 means all rates <= X */
@@ -582,18 +583,20 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
         sdata->bss->force_unicast_rateidx = -1;
         if (rate->value < 0)
                 return 0;
-        for (i=0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *rates = &mode->rates[i];
-                int this_rate = rates->rate;
+
+        for (i=0; i< sband->n_bitrates; i++) {
+                struct ieee80211_rate *brate = &sband->bitrates[i];
+                int this_rate = brate->bitrate;
 
                 if (target_rate == this_rate) {
                         sdata->bss->max_ratectrl_rateidx = i;
                         if (rate->fixed)
                                 sdata->bss->force_unicast_rateidx = i;
-                        return 0;
+                        err = 0;
+                        break;
                 }
         }
-        return -EINVAL;
+        return err;
 }
 
 static int ieee80211_ioctl_giwrate(struct net_device *dev,
@@ -603,18 +606,24 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_supported_band *sband;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
                 sta = sta_info_get(local, sdata->u.sta.bssid);
         else
                 return -EOPNOTSUPP;
         if (!sta)
                 return -ENODEV;
-        if (sta->txrate < local->oper_hw_mode->num_rates)
-                rate->value = local->oper_hw_mode->rates[sta->txrate].rate * 100000;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        if (sta->txrate_idx < sband->n_bitrates)
+                rate->value = sband->bitrates[sta->txrate_idx].bitrate;
         else
                 rate->value = 0;
+        rate->value *= 100000;
         sta_info_put(sta);
         return 0;
 }
@@ -625,7 +634,7 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         bool need_reconfig = 0;
-        u8 new_power_level;
+        int new_power_level;
 
         if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
                 return -EINVAL;
@@ -635,13 +644,15 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
         if (data->txpower.fixed) {
                 new_power_level = data->txpower.value;
         } else {
-                /* Automatic power level. Get the px power from the current
-                 * channel. */
-                struct ieee80211_channel* chan = local->oper_channel;
+                /*
+                 * Automatic power level. Use maximum power for the current
+                 * channel. Should be part of rate control.
+                 */
+                struct ieee80211_channel* chan = local->hw.conf.channel;
                 if (!chan)
                         return -EINVAL;
 
-                new_power_level = chan->power_level;
+                new_power_level = chan->max_power;
         }
 
         if (local->hw.conf.power_level != new_power_level) {
diff --git a/net/mac80211/ieee80211_key.h b/net/mac80211/ieee80211_key.h
index fc770e98d47b..d670e6dbfa39 100644
--- a/net/mac80211/ieee80211_key.h
+++ b/net/mac80211/ieee80211_key.h
@@ -13,6 +13,7 @@
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/crypto.h>
+#include <linux/rcupdate.h>
 #include <net/mac80211.h>
 
 /* ALG_TKIP
@@ -45,7 +46,19 @@ struct ieee80211_local;
 struct ieee80211_sub_if_data;
 struct sta_info;
 
-#define KEY_FLAG_UPLOADED_TO_HARDWARE   (1<<0)
+/**
+ * enum ieee80211_internal_key_flags - internal key flags
+ *
+ * @KEY_FLAG_UPLOADED_TO_HARDWARE: Indicates that this key is present
+ *      in the hardware for TX crypto hardware acceleration.
+ * @KEY_FLAG_REMOVE_FROM_HARDWARE: Indicates to the key code that this
+ *      key is present in the hardware (but it cannot be used for
+ *      hardware acceleration any more!)
+ */
+enum ieee80211_internal_key_flags {
+        KEY_FLAG_UPLOADED_TO_HARDWARE   = BIT(0),
+        KEY_FLAG_REMOVE_FROM_HARDWARE   = BIT(1),
+};
 
 struct ieee80211_key {
         struct ieee80211_local *local;
@@ -112,12 +125,17 @@ struct ieee80211_key {
         struct ieee80211_key_conf conf;
 };
 
-struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
-                                          struct sta_info *sta,
-                                          enum ieee80211_key_alg alg,
+struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                           int idx,
                                           size_t key_len,
                                           const u8 *key_data);
+/*
+ * Insert a key into data structures (sdata, sta if necessary)
+ * to make it used, free old key.
+ */
+void ieee80211_key_link(struct ieee80211_key *key,
+                        struct ieee80211_sub_if_data *sdata,
+                        struct sta_info *sta);
 void ieee80211_key_free(struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/ieee80211_rate.c b/net/mac80211/ieee80211_rate.c
index b957e67c5fba..ebe29b716b27 100644
--- a/net/mac80211/ieee80211_rate.c
+++ b/net/mac80211/ieee80211_rate.c
@@ -163,7 +163,8 @@ static void rate_control_release(struct kref *kref)
 }
 
 void rate_control_get_rate(struct net_device *dev,
-                           struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                           struct ieee80211_supported_band *sband,
+                           struct sk_buff *skb,
                            struct rate_selection *sel)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -174,17 +175,17 @@ void rate_control_get_rate(struct net_device *dev,
 
         memset(sel, 0, sizeof(struct rate_selection));
 
-        ref->ops->get_rate(ref->priv, dev, mode, skb, sel);
+        ref->ops->get_rate(ref->priv, dev, sband, skb, sel);
 
         /* Select a non-ERP backup rate. */
         if (!sel->nonerp) {
-                for (i = 0; i < mode->num_rates - 1; i++) {
-                        struct ieee80211_rate *rate = &mode->rates[i];
-                        if (sel->rate->rate < rate->rate)
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        struct ieee80211_rate *rate = &sband->bitrates[i];
+                        if (sel->rate->bitrate < rate->bitrate)
                                 break;
 
-                        if (rate_supported(sta, mode, i) &&
-                            !(rate->flags & IEEE80211_RATE_ERP))
+                        if (rate_supported(sta, sband->band, i) &&
+                            !(rate->flags & IEEE80211_RATE_ERP_G))
                                 sel->nonerp = rate;
                 }
         }
diff --git a/net/mac80211/ieee80211_rate.h b/net/mac80211/ieee80211_rate.h
index 73f19e8aa51c..5f9a2ca49a57 100644
--- a/net/mac80211/ieee80211_rate.h
+++ b/net/mac80211/ieee80211_rate.h
@@ -18,6 +18,7 @@
 #include "ieee80211_i.h"
 #include "sta_info.h"
 
+/* TODO: kdoc */
 struct rate_selection {
         /* Selected transmission rate */
         struct ieee80211_rate *rate;
@@ -34,7 +35,8 @@ struct rate_control_ops {
                           struct sk_buff *skb,
                           struct ieee80211_tx_status *status);
         void (*get_rate)(void *priv, struct net_device *dev,
-                         struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                         struct ieee80211_supported_band *band,
+                         struct sk_buff *skb,
                          struct rate_selection *sel);
         void (*rate_init)(void *priv, void *priv_sta,
                           struct ieee80211_local *local, struct sta_info *sta);
@@ -66,7 +68,8 @@ void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
 struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local);
 void rate_control_get_rate(struct net_device *dev,
-                           struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                           struct ieee80211_supported_band *sband,
+                           struct sk_buff *skb,
                            struct rate_selection *sel);
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
@@ -127,23 +130,23 @@ static inline void rate_control_remove_sta_debugfs(struct sta_info *sta)
 #endif
 }
 
-static inline int
-rate_supported(struct sta_info *sta, struct ieee80211_hw_mode *mode, int index)
+static inline int rate_supported(struct sta_info *sta,
+                                 enum ieee80211_band band,
+                                 int index)
 {
-        return (sta == NULL || sta->supp_rates & BIT(index)) &&
-               (mode->rates[index].flags & IEEE80211_RATE_SUPPORTED);
+        return (sta == NULL || sta->supp_rates[band] & BIT(index));
 }
 
 static inline int
-rate_lowest_index(struct ieee80211_local *local, struct ieee80211_hw_mode *mode,
+rate_lowest_index(struct ieee80211_local *local,
+                  struct ieee80211_supported_band *sband,
                   struct sta_info *sta)
 {
         int i;
 
-        for (i = 0; i < mode->num_rates; i++) {
-                if (rate_supported(sta, mode, i))
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (rate_supported(sta, sband->band, i))
                         return i;
-        }
 
         /* warn when we cannot find a rate. */
         WARN_ON(1);
@@ -152,10 +155,11 @@ rate_lowest_index(struct ieee80211_local *local, struct ieee80211_hw_mode *mode,
 }
 
 static inline struct ieee80211_rate *
-rate_lowest(struct ieee80211_local *local, struct ieee80211_hw_mode *mode,
+rate_lowest(struct ieee80211_local *local,
+            struct ieee80211_supported_band *sband,
             struct sta_info *sta)
 {
-        return &mode->rates[rate_lowest_index(local, mode, sta)];
+        return &sband->bitrates[rate_lowest_index(local, sband, sta)];
 }
 
 
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 9aeed5320228..ddb5832f37cb 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -74,7 +74,7 @@
 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
                                      u8 *ssid, size_t ssid_len);
 static struct ieee80211_sta_bss *
-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
+ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len);
 static void ieee80211_rx_bss_put(struct net_device *dev,
                                  struct ieee80211_sta_bss *bss);
@@ -227,12 +227,7 @@ static void ieee802_11_parse_elems(u8 *start, size_t len,
 
 static int ecw2cw(int ecw)
 {
-        int cw = 1;
-        while (ecw > 0) {
-                cw <<= 1;
-                ecw--;
-        }
-        return cw - 1;
+        return (1 << ecw) - 1;
 }
 
 static void ieee80211_sta_wmm_params(struct net_device *dev,
@@ -297,12 +292,13 @@ static void ieee80211_sta_wmm_params(struct net_device *dev,
                 params.aifs = pos[0] & 0x0f;
                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
                 params.cw_min = ecw2cw(pos[1] & 0x0f);
-                /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
-                params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
+                params.txop = pos[2] | (pos[3] << 8);
+#ifdef CONFIG_MAC80211_DEBUG
                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
-                       "cWmin=%d cWmax=%d burst=%d\n",
+                       "cWmin=%d cWmax=%d txop=%d\n",
                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
-                       params.cw_max, params.burst_time);
+                       params.cw_max, params.txop);
+#endif
                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
                  * AC for now) */
                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
@@ -466,7 +462,7 @@ static void ieee80211_set_associated(struct net_device *dev,
                         return;
 
                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
-                                           local->hw.conf.channel,
+                                           local->hw.conf.channel->center_freq,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (bss) {
                         if (bss->has_erp_value)
@@ -492,6 +488,7 @@ static void ieee80211_set_associated(struct net_device *dev,
         ifsta->last_probe = jiffies;
         ieee80211_led_assoc(local, assoc);
 
+        sdata->bss_conf.assoc = assoc;
         ieee80211_bss_info_change_notify(sdata, changed);
 }
 
@@ -592,7 +589,6 @@ static void ieee80211_send_assoc(struct net_device *dev,
                                  struct ieee80211_if_sta *ifsta)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw_mode *mode;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos, *ies;
@@ -600,6 +596,7 @@ static void ieee80211_send_assoc(struct net_device *dev,
         u16 capab;
         struct ieee80211_sta_bss *bss;
         int wmm = 0;
+        struct ieee80211_supported_band *sband;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
@@ -611,13 +608,19 @@ static void ieee80211_send_assoc(struct net_device *dev,
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        mode = local->oper_hw_mode;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         capab = ifsta->capab;
-        if (mode->mode == MODE_IEEE80211G) {
-                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
-                        WLAN_CAPABILITY_SHORT_PREAMBLE;
+
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
         }
-        bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
+
+        bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+                                   local->hw.conf.channel->center_freq,
                                    ifsta->ssid, ifsta->ssid_len);
         if (bss) {
                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
@@ -656,23 +659,23 @@ static void ieee80211_send_assoc(struct net_device *dev,
         *pos++ = ifsta->ssid_len;
         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 
-        len = mode->num_rates;
+        len = sband->n_bitrates;
         if (len > 8)
                 len = 8;
         pos = skb_put(skb, len + 2);
         *pos++ = WLAN_EID_SUPP_RATES;
         *pos++ = len;
         for (i = 0; i < len; i++) {
-                int rate = mode->rates[i].rate;
+                int rate = sband->bitrates[i].bitrate;
                 *pos++ = (u8) (rate / 5);
         }
 
-        if (mode->num_rates > len) {
-                pos = skb_put(skb, mode->num_rates - len + 2);
+        if (sband->n_bitrates > len) {
+                pos = skb_put(skb, sband->n_bitrates - len + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = mode->num_rates - len;
-                for (i = len; i < mode->num_rates; i++) {
-                        int rate = mode->rates[i].rate;
+                *pos++ = sband->n_bitrates - len;
+                for (i = len; i < sband->n_bitrates; i++) {
+                        int rate = sband->bitrates[i].bitrate;
                         *pos++ = (u8) (rate / 5);
                 }
         }
@@ -695,17 +698,18 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 *pos++ = 0;
         }
         /* wmm support is a must to HT */
-        if (wmm && mode->ht_info.ht_supported) {
-                __le16 tmp = cpu_to_le16(mode->ht_info.cap);
+        if (wmm && sband->ht_info.ht_supported) {
+                __le16 tmp = cpu_to_le16(sband->ht_info.cap);
                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
                 *pos++ = WLAN_EID_HT_CAPABILITY;
                 *pos++ = sizeof(struct ieee80211_ht_cap);
                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
                 memcpy(pos, &tmp, sizeof(u16));
                 pos += sizeof(u16);
-                *pos++ = (mode->ht_info.ampdu_factor |
-                                (mode->ht_info.ampdu_density << 2));
-                memcpy(pos, mode->ht_info.supp_mcs_set, 16);
+                /* TODO: needs a define here for << 2 */
+                *pos++ = sband->ht_info.ampdu_factor |
+                         (sband->ht_info.ampdu_density << 2);
+                memcpy(pos, sband->ht_info.supp_mcs_set, 16);
         }
 
         kfree(ifsta->assocreq_ies);
@@ -788,7 +792,8 @@ static int ieee80211_privacy_mismatch(struct net_device *dev,
         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
                 return 0;
 
-        bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
+        bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+                                   local->hw.conf.channel->center_freq,
                                    ifsta->ssid, ifsta->ssid_len);
         if (!bss)
                 return 0;
@@ -898,7 +903,7 @@ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
                                      u8 *ssid, size_t ssid_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos, *supp_rates, *esupp_rates = NULL;
@@ -932,11 +937,10 @@ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
         supp_rates = skb_put(skb, 2);
         supp_rates[0] = WLAN_EID_SUPP_RATES;
         supp_rates[1] = 0;
-        mode = local->oper_hw_mode;
-        for (i = 0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *rate = &mode->rates[i];
-                if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
-                        continue;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
                 if (esupp_rates) {
                         pos = skb_put(skb, 1);
                         esupp_rates[1]++;
@@ -949,7 +953,7 @@ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
                         pos = skb_put(skb, 1);
                         supp_rates[1]++;
                 }
-                *pos = rate->rate / 5;
+                *pos = rate->bitrate / 5;
         }
 
         ieee80211_sta_tx(dev, skb, 0);
@@ -1044,6 +1048,58 @@ static void ieee80211_send_addba_resp(struct net_device *dev, u8 *da, u16 tid,
         return;
 }
 
+void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
+                                u16 tid, u8 dialog_token, u16 start_seq_num,
+                                u16 agg_size, u16 timeout)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
+                                sizeof(mgmt->u.action.u.addba_req));
+
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer "
+                                "for addba request frame\n", dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
+                memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
+        else
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+
+        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                        IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
+
+        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
+        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
+
+        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
+
+        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_req.start_seq_num =
+                                        cpu_to_le16(start_seq_num << 4);
+
+        ieee80211_sta_tx(dev, skb, 0);
+}
+
 static void ieee80211_sta_process_addba_request(struct net_device *dev,
                                                 struct ieee80211_mgmt *mgmt,
                                                 size_t len)
@@ -1093,9 +1149,11 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
         }
         /* determine default buffer size */
         if (buf_size == 0) {
-                struct ieee80211_hw_mode *mode = conf->mode;
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[conf->channel->band];
                 buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << mode->ht_info.ampdu_factor;
+                buf_size = buf_size << sband->ht_info.ampdu_factor;
         }
 
         tid_agg_rx = &sta->ampdu_mlme.tid_rx[tid];
@@ -1127,7 +1185,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
 
         if (local->ops->ampdu_action)
                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
-                                               sta->addr, tid, start_seq_num);
+                                               sta->addr, tid, &start_seq_num);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx A-MPDU on tid %d result %d", tid, ret);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
@@ -1155,8 +1213,80 @@ end_no_lock:
         sta_info_put(sta);
 }
 
-static void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
-                                 u16 initiator, u16 reason_code)
+static void ieee80211_sta_process_addba_resp(struct net_device *dev,
+                                             struct ieee80211_mgmt *mgmt,
+                                             size_t len)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_hw *hw = &local->hw;
+        struct sta_info *sta;
+        u16 capab;
+        u16 tid;
+        u8 *state;
+
+        sta = sta_info_get(local, mgmt->sa);
+        if (!sta)
+                return;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        if (mgmt->u.action.u.addba_resp.dialog_token !=
+                sta->ampdu_mlme.tid_tx[tid].dialog_token) {
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                sta_info_put(sta);
+                return;
+        }
+
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid].addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
+                        == WLAN_STATUS_SUCCESS) {
+                if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                        printk(KERN_DEBUG "state not HT_ADDBA_REQUESTED_MSK:"
+                                "%d\n", *state);
+                        sta_info_put(sta);
+                        return;
+                }
+
+                if (*state & HT_ADDBA_RECEIVED_MSK)
+                        printk(KERN_DEBUG "double addBA response\n");
+
+                *state |= HT_ADDBA_RECEIVED_MSK;
+                sta->ampdu_mlme.tid_tx[tid].addba_req_num = 0;
+
+                if (*state == HT_AGG_STATE_OPERATIONAL) {
+                        printk(KERN_DEBUG "Aggregation on for tid %d \n", tid);
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                }
+
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                printk(KERN_DEBUG "recipient accepted agg: tid %d \n", tid);
+        } else {
+                printk(KERN_DEBUG "recipient rejected agg: tid %d \n", tid);
+
+                sta->ampdu_mlme.tid_tx[tid].addba_req_num++;
+                /* this will allow the state check in stop_BA_session */
+                *state = HT_AGG_STATE_OPERATIONAL;
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
+                                             WLAN_BACK_INITIATOR);
+        }
+        sta_info_put(sta);
+}
+
+void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
+                          u16 initiator, u16 reason_code)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1229,7 +1359,7 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         BUG_ON(!local->ops->ampdu_action);
 
         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
-                                        ra, tid, EINVAL);
+                                        ra, tid, NULL);
         if (ret)
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggergation for tid %d\n", tid);
@@ -1258,6 +1388,7 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         sta_info_put(sta);
 }
 
+
 static void ieee80211_sta_process_delba(struct net_device *dev,
                         struct ieee80211_mgmt *mgmt, size_t len)
 {
@@ -1277,14 +1408,70 @@ static void ieee80211_sta_process_delba(struct net_device *dev,
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         if (net_ratelimit())
-                printk(KERN_DEBUG "delba from %s on tid %d reason code %d\n",
-                        print_mac(mac, mgmt->sa), tid,
+                printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
+                        print_mac(mac, mgmt->sa),
+                        initiator ? "recipient" : "initiator", tid,
                         mgmt->u.action.u.delba.reason_code);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (initiator == WLAN_BACK_INITIATOR)
                 ieee80211_sta_stop_rx_ba_session(dev, sta->addr, tid,
                                                  WLAN_BACK_INITIATOR, 0);
+        else { /* WLAN_BACK_RECIPIENT */
+                spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+                sta->ampdu_mlme.tid_tx[tid].state =
+                                HT_AGG_STATE_OPERATIONAL;
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
+                                             WLAN_BACK_RECIPIENT);
+        }
+        sta_info_put(sta);
+}
+
+/*
+ * After sending add Block Ack request we activated a timer until
+ * add Block Ack response will arrive from the recipient.
+ * If this timer expires sta_addba_resp_timer_expired will be executed.
+ */
+void sta_addba_resp_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and both sta_info and TID are needed, so init
+         * flow in sta_info_add gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u16 tid = *(int *)data;
+        struct sta_info *temp_sta = container_of((void *)data,
+                struct sta_info, timer_to_tid[tid]);
+
+        struct ieee80211_local *local = temp_sta->local;
+        struct ieee80211_hw *hw = &local->hw;
+        struct sta_info *sta;
+        u8 *state;
+
+        sta = sta_info_get(local, temp_sta->addr);
+        if (!sta)
+                return;
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        /* check if the TID waits for addBA response */
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                *state = HT_AGG_STATE_IDLE;
+                printk(KERN_DEBUG "timer expired on tid %d but we are not "
+                                "expecting addBA response there", tid);
+                goto timer_expired_exit;
+        }
+
+        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
+
+        /* go through the state check in stop_BA_session */
+        *state = HT_AGG_STATE_OPERATIONAL;
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
+                                     WLAN_BACK_INITIATOR);
+
+timer_expired_exit:
         sta_info_put(sta);
 }
 
@@ -1536,15 +1723,16 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct net_device *dev = sdata->dev;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         struct sta_info *sta;
-        u32 rates;
+        u64 rates, basic_rates;
         u16 capab_info, status_code, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
         u8 *pos;
         int i, j;
         DECLARE_MAC_BUF(mac);
+        bool have_higher_than_11mbit = false;
 
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
@@ -1614,22 +1802,18 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (ifsta->assocresp_ies)
                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
 
-        /* set AID, ieee80211_set_associated() will tell the driver */
-        bss_conf->aid = aid;
-        ieee80211_set_associated(dev, ifsta, 1);
-
         /* Add STA entry for the AP */
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
                 struct ieee80211_sta_bss *bss;
                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
-                if (!sta) {
+                if (IS_ERR(sta)) {
                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
-                               " AP\n", dev->name);
+                               " AP (error %ld)\n", dev->name, PTR_ERR(sta));
                         return;
                 }
                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
-                                           local->hw.conf.channel,
+                                           local->hw.conf.channel->center_freq,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (bss) {
                         sta->last_rssi = bss->rssi;
@@ -1640,23 +1824,50 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         }
 
         sta->dev = dev;
-        sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP;
+        sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
+                      WLAN_STA_AUTHORIZED;
 
         rates = 0;
-        mode = local->oper_hw_mode;
+        basic_rates = 0;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         for (i = 0; i < elems.supp_rates_len; i++) {
                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
-                for (j = 0; j < mode->num_rates; j++)
-                        if (mode->rates[j].rate == rate)
+
+                if (rate > 110)
+                        have_higher_than_11mbit = true;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate)
                                 rates |= BIT(j);
+                        if (elems.supp_rates[i] & 0x80)
+                                basic_rates |= BIT(j);
+                }
         }
+
         for (i = 0; i < elems.ext_supp_rates_len; i++) {
                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
-                for (j = 0; j < mode->num_rates; j++)
-                        if (mode->rates[j].rate == rate)
+
+                if (rate > 110)
+                        have_higher_than_11mbit = true;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate)
                                 rates |= BIT(j);
+                        if (elems.ext_supp_rates[i] & 0x80)
+                                basic_rates |= BIT(j);
+                }
         }
-        sta->supp_rates = rates;
+
+        sta->supp_rates[local->hw.conf.channel->band] = rates;
+        sdata->basic_rates = basic_rates;
+
+        /* cf. IEEE 802.11 9.2.12 */
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+            have_higher_than_11mbit)
+                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        else
+                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
             local->ops->conf_ht) {
@@ -1679,6 +1890,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                                          elems.wmm_param_len);
         }
 
+        /* set AID, ieee80211_set_associated() will tell the driver */
+        bss_conf->aid = aid;
+        ieee80211_set_associated(dev, ifsta, 1);
 
         sta_info_put(sta);
 
@@ -1719,7 +1933,7 @@ static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
 
 
 static struct ieee80211_sta_bss *
-ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
+ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -1731,7 +1945,7 @@ ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
         atomic_inc(&bss->users);
         atomic_inc(&bss->users);
         memcpy(bss->bssid, bssid, ETH_ALEN);
-        bss->channel = channel;
+        bss->freq = freq;
         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
                 memcpy(bss->ssid, ssid, ssid_len);
                 bss->ssid_len = ssid_len;
@@ -1747,7 +1961,7 @@ ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
 
 
 static struct ieee80211_sta_bss *
-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
+ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -1757,7 +1971,7 @@ ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
         bss = local->sta_bss_hash[STA_HASH(bssid)];
         while (bss) {
                 if (!memcmp(bss->bssid, bssid, ETH_ALEN) &&
-                    bss->channel == channel &&
+                    bss->freq == freq &&
                     bss->ssid_len == ssid_len &&
                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
                         atomic_inc(&bss->users);
@@ -1813,6 +2027,165 @@ void ieee80211_rx_bss_list_deinit(struct net_device *dev)
 }
 
 
+static int ieee80211_sta_join_ibss(struct net_device *dev,
+                                   struct ieee80211_if_sta *ifsta,
+                                   struct ieee80211_sta_bss *bss)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        int res, rates, i, j;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_tx_control control;
+        struct rate_selection ratesel;
+        u8 *pos;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        /* Remove possible STA entries from other IBSS networks. */
+        sta_info_flush(local, NULL);
+
+        if (local->ops->reset_tsf) {
+                /* Reset own TSF to allow time synchronization work. */
+                local->ops->reset_tsf(local_to_hw(local));
+        }
+        memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
+        res = ieee80211_if_config(dev);
+        if (res)
+                return res;
+
+        local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        sdata->drop_unencrypted = bss->capability &
+                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+
+        res = ieee80211_set_freq(local, bss->freq);
+
+        if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
+                printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                       "%d MHz\n", dev->name, local->oper_channel->center_freq);
+                return -1;
+        }
+
+        /* Set beacon template */
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        do {
+                if (!skb)
+                        break;
+
+                skb_reserve(skb, local->hw.extra_tx_headroom);
+
+                mgmt = (struct ieee80211_mgmt *)
+                        skb_put(skb, 24 + sizeof(mgmt->u.beacon));
+                memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
+                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                                   IEEE80211_STYPE_BEACON);
+                memset(mgmt->da, 0xff, ETH_ALEN);
+                memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+                mgmt->u.beacon.beacon_int =
+                        cpu_to_le16(local->hw.conf.beacon_int);
+                mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
+
+                pos = skb_put(skb, 2 + ifsta->ssid_len);
+                *pos++ = WLAN_EID_SSID;
+                *pos++ = ifsta->ssid_len;
+                memcpy(pos, ifsta->ssid, ifsta->ssid_len);
+
+                rates = bss->supp_rates_len;
+                if (rates > 8)
+                        rates = 8;
+                pos = skb_put(skb, 2 + rates);
+                *pos++ = WLAN_EID_SUPP_RATES;
+                *pos++ = rates;
+                memcpy(pos, bss->supp_rates, rates);
+
+                if (bss->band == IEEE80211_BAND_2GHZ) {
+                        pos = skb_put(skb, 2 + 1);
+                        *pos++ = WLAN_EID_DS_PARAMS;
+                        *pos++ = 1;
+                        *pos++ = ieee80211_frequency_to_channel(bss->freq);
+                }
+
+                pos = skb_put(skb, 2 + 2);
+                *pos++ = WLAN_EID_IBSS_PARAMS;
+                *pos++ = 2;
+                /* FIX: set ATIM window based on scan results */
+                *pos++ = 0;
+                *pos++ = 0;
+
+                if (bss->supp_rates_len > 8) {
+                        rates = bss->supp_rates_len - 8;
+                        pos = skb_put(skb, 2 + rates);
+                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                        *pos++ = rates;
+                        memcpy(pos, &bss->supp_rates[8], rates);
+                }
+
+                memset(&control, 0, sizeof(control));
+                rate_control_get_rate(dev, sband, skb, &ratesel);
+                if (!ratesel.rate) {
+                        printk(KERN_DEBUG "%s: Failed to determine TX rate "
+                               "for IBSS beacon\n", dev->name);
+                        break;
+                }
+                control.vif = &sdata->vif;
+                control.tx_rate = ratesel.rate;
+                if (sdata->bss_conf.use_short_preamble &&
+                    ratesel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        control.flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
+                control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
+                control.flags |= IEEE80211_TXCTL_NO_ACK;
+                control.retry_limit = 1;
+
+                ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
+                if (ifsta->probe_resp) {
+                        mgmt = (struct ieee80211_mgmt *)
+                                ifsta->probe_resp->data;
+                        mgmt->frame_control =
+                                IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                             IEEE80211_STYPE_PROBE_RESP);
+                } else {
+                        printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
+                               "template for IBSS\n", dev->name);
+                }
+
+                if (local->ops->beacon_update &&
+                    local->ops->beacon_update(local_to_hw(local),
+                                             skb, &control) == 0) {
+                        printk(KERN_DEBUG "%s: Configured IBSS beacon "
+                               "template\n", dev->name);
+                        skb = NULL;
+                }
+
+                rates = 0;
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+                for (i = 0; i < bss->supp_rates_len; i++) {
+                        int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
+                        for (j = 0; j < sband->n_bitrates; j++)
+                                if (sband->bitrates[j].bitrate == bitrate)
+                                        rates |= BIT(j);
+                }
+                ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
+        } while (0);
+
+        if (skb) {
+                printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
+                       "template\n", dev->name);
+                dev_kfree_skb(skb);
+        }
+
+        ifsta->state = IEEE80211_IBSS_JOINED;
+        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+
+        ieee80211_rx_bss_put(dev, bss);
+
+        return res;
+}
+
+
 static void ieee80211_rx_bss_info(struct net_device *dev,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
@@ -1822,11 +2195,11 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee802_11_elems elems;
         size_t baselen;
-        int channel, clen;
+        int freq, clen;
         struct ieee80211_sta_bss *bss;
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        u64 timestamp;
+        u64 beacon_timestamp, rx_timestamp;
         DECLARE_MAC_BUF(mac);
         DECLARE_MAC_BUF(mac2);
 
@@ -1843,56 +2216,28 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         if (baselen > len)
                 return;
 
-        timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
-
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
-            memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                static unsigned long last_tsf_debug = 0;
-                u64 tsf;
-                if (local->ops->get_tsf)
-                        tsf = local->ops->get_tsf(local_to_hw(local));
-                else
-                        tsf = -1LLU;
-                if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
-                        printk(KERN_DEBUG "RX beacon SA=%s BSSID="
-                               "%s TSF=0x%llx BCN=0x%llx diff=%lld "
-                               "@%lu\n",
-                               print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->bssid),
-                               (unsigned long long)tsf,
-                               (unsigned long long)timestamp,
-                               (unsigned long long)(tsf - timestamp),
-                               jiffies);
-                        last_tsf_debug = jiffies;
-                }
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        }
-
+        beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
 
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
             (sta = sta_info_get(local, mgmt->sa))) {
-                struct ieee80211_hw_mode *mode;
-                struct ieee80211_rate *rates;
+                struct ieee80211_supported_band *sband;
+                struct ieee80211_rate *bitrates;
                 size_t num_rates;
-                u32 supp_rates, prev_rates;
+                u64 supp_rates, prev_rates;
                 int i, j;
 
-                mode = local->sta_sw_scanning ?
-                       local->scan_hw_mode : local->oper_hw_mode;
+                sband = local->hw.wiphy->bands[rx_status->band];
 
-                if (local->sta_hw_scanning) {
-                        /* search for the correct mode matches the beacon */
-                        list_for_each_entry(mode, &local->modes_list, list)
-                                if (mode->mode == rx_status->phymode)
-                                        break;
-
-                        if (mode == NULL)
-                                mode = local->oper_hw_mode;
+                if (!sband) {
+                        WARN_ON(1);
+                        sband = local->hw.wiphy->bands[
+                                        local->hw.conf.channel->band];
                 }
-                rates = mode->rates;
-                num_rates = mode->num_rates;
+
+                bitrates = sband->bitrates;
+                num_rates = sband->n_bitrates;
 
                 supp_rates = 0;
                 for (i = 0; i < elems.supp_rates_len +
@@ -1906,24 +2251,27 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                                         [i - elems.supp_rates_len];
                         own_rate = 5 * (rate & 0x7f);
                         for (j = 0; j < num_rates; j++)
-                                if (rates[j].rate == own_rate)
+                                if (bitrates[j].bitrate == own_rate)
                                         supp_rates |= BIT(j);
                 }
 
-                prev_rates = sta->supp_rates;
-                sta->supp_rates &= supp_rates;
-                if (sta->supp_rates == 0) {
+                prev_rates = sta->supp_rates[rx_status->band];
+                sta->supp_rates[rx_status->band] &= supp_rates;
+                if (sta->supp_rates[rx_status->band] == 0) {
                         /* No matching rates - this should not really happen.
                          * Make sure that at least one rate is marked
                          * supported to avoid issues with TX rate ctrl. */
-                        sta->supp_rates = sdata->u.sta.supp_rates_bits;
+                        sta->supp_rates[rx_status->band] =
+                                sdata->u.sta.supp_rates_bits[rx_status->band];
                 }
-                if (sta->supp_rates != prev_rates) {
+                if (sta->supp_rates[rx_status->band] != prev_rates) {
                         printk(KERN_DEBUG "%s: updated supp_rates set for "
-                               "%s based on beacon info (0x%x & 0x%x -> "
-                               "0x%x)\n",
-                               dev->name, print_mac(mac, sta->addr), prev_rates,
-                               supp_rates, sta->supp_rates);
+                               "%s based on beacon info (0x%llx & 0x%llx -> "
+                               "0x%llx)\n",
+                               dev->name, print_mac(mac, sta->addr),
+                               (unsigned long long) prev_rates,
+                               (unsigned long long) supp_rates,
+                               (unsigned long long) sta->supp_rates[rx_status->band]);
                 }
                 sta_info_put(sta);
         }
@@ -1932,14 +2280,14 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 return;
 
         if (elems.ds_params && elems.ds_params_len == 1)
-                channel = elems.ds_params[0];
+                freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
         else
-                channel = rx_status->channel;
+                freq = rx_status->freq;
 
-        bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel,
+        bss = ieee80211_rx_bss_get(dev, mgmt->bssid, freq,
                                    elems.ssid, elems.ssid_len);
         if (!bss) {
-                bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel,
+                bss = ieee80211_rx_bss_add(dev, mgmt->bssid, freq,
                                            elems.ssid, elems.ssid_len);
                 if (!bss)
                         return;
@@ -1952,8 +2300,12 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
 #endif
         }
 
-        if (bss->probe_resp && beacon) {
-                /* Do not allow beacon to override data from Probe Response. */
+        bss->band = rx_status->band;
+
+        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+            bss->probe_resp && beacon) {
+                /* STA mode:
+                 * Do not allow beacon to override data from Probe Response. */
                 ieee80211_rx_bss_put(dev, bss);
                 return;
         }
@@ -2050,27 +2402,69 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 bss->ht_ie_len = 0;
         }
 
-        bss->hw_mode = rx_status->phymode;
-        bss->freq = rx_status->freq;
-        if (channel != rx_status->channel &&
-            (bss->hw_mode == MODE_IEEE80211G ||
-             bss->hw_mode == MODE_IEEE80211B) &&
-            channel >= 1 && channel <= 14) {
-                static const int freq_list[] = {
-                        2412, 2417, 2422, 2427, 2432, 2437, 2442,
-                        2447, 2452, 2457, 2462, 2467, 2472, 2484
-                };
-                /* IEEE 802.11g/b mode can receive packets from neighboring
-                 * channels, so map the channel into frequency. */
-                bss->freq = freq_list[channel - 1];
-        }
-        bss->timestamp = timestamp;
+        bss->timestamp = beacon_timestamp;
         bss->last_update = jiffies;
         bss->rssi = rx_status->ssi;
         bss->signal = rx_status->signal;
         bss->noise = rx_status->noise;
         if (!beacon)
                 bss->probe_resp++;
+
+        /* check if we need to merge IBSS */
+        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
+            !local->sta_sw_scanning && !local->sta_hw_scanning &&
+            bss->capability & WLAN_CAPABILITY_IBSS &&
+            bss->freq == local->oper_channel->center_freq &&
+            elems.ssid_len == sdata->u.sta.ssid_len &&
+            memcmp(elems.ssid, sdata->u.sta.ssid, sdata->u.sta.ssid_len) == 0) {
+                if (rx_status->flag & RX_FLAG_TSFT) {
+                        /* in order for correct IBSS merging we need mactime
+                         *
+                         * since mactime is defined as the time the first data
+                         * symbol of the frame hits the PHY, and the timestamp
+                         * of the beacon is defined as "the time that the data
+                         * symbol containing the first bit of the timestamp is
+                         * transmitted to the PHY plus the transmitting STA’s
+                         * delays through its local PHY from the MAC-PHY
+                         * interface to its interface with the WM"
+                         * (802.11 11.1.2) - equals the time this bit arrives at
+                         * the receiver - we have to take into account the
+                         * offset between the two.
+                         * e.g: at 1 MBit that means mactime is 192 usec earlier
+                         * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
+                         */
+                        int rate = local->hw.wiphy->bands[rx_status->band]->
+                                        bitrates[rx_status->rate_idx].bitrate;
+                        rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
+                } else if (local && local->ops && local->ops->get_tsf)
+                        /* second best option: get current TSF */
+                        rx_timestamp = local->ops->get_tsf(local_to_hw(local));
+                else
+                        /* can't merge without knowing the TSF */
+                        rx_timestamp = -1LLU;
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "RX beacon SA=%s BSSID="
+                       "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+                       print_mac(mac, mgmt->sa),
+                       print_mac(mac2, mgmt->bssid),
+                       (unsigned long long)rx_timestamp,
+                       (unsigned long long)beacon_timestamp,
+                       (unsigned long long)(rx_timestamp - beacon_timestamp),
+                       jiffies);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+                if (beacon_timestamp > rx_timestamp) {
+#ifndef CONFIG_MAC80211_IBSS_DEBUG
+                        if (net_ratelimit())
+#endif
+                                printk(KERN_DEBUG "%s: beacon TSF higher than "
+                                       "local TSF - IBSS merge with BSSID %s\n",
+                                       dev->name, print_mac(mac, mgmt->bssid));
+                        ieee80211_sta_join_ibss(dev, &sdata->u.sta, bss);
+                        ieee80211_ibss_add_sta(dev, NULL,
+                                               mgmt->bssid, mgmt->sa);
+                }
+        }
+
         ieee80211_rx_bss_put(dev, bss);
 }
 
@@ -2235,6 +2629,12 @@ static void ieee80211_rx_mgmt_action(struct net_device *dev,
                                 break;
                         ieee80211_sta_process_addba_request(dev, mgmt, len);
                         break;
+                case WLAN_ACTION_ADDBA_RESP:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.addba_resp)))
+                                break;
+                        ieee80211_sta_process_addba_resp(dev, mgmt, len);
+                        break;
                 case WLAN_ACTION_DELBA:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.delba)))
@@ -2348,7 +2748,7 @@ static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
                       struct ieee80211_rx_status *rx_status)
 {
@@ -2356,31 +2756,31 @@ ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
         u16 fc;
 
         if (skb->len < 2)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (skb->len < 24)
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
                                                      skb->len, rx_status);
                         dev_kfree_skb(skb);
-                        return TXRX_QUEUED;
+                        return RX_QUEUED;
                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
                                                  rx_status);
                         dev_kfree_skb(skb);
-                        return TXRX_QUEUED;
+                        return RX_QUEUED;
                 }
         }
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
@@ -2629,7 +3029,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         }
 
         spin_lock_bh(&local->sta_bss_lock);
-        freq = local->oper_channel->freq;
+        freq = local->oper_channel->center_freq;
         list_for_each_entry(bss, &local->sta_bss_list, list) {
                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
                         continue;
@@ -2660,7 +3060,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         spin_unlock_bh(&local->sta_bss_lock);
 
         if (selected) {
-                ieee80211_set_channel(local, -1, selected->freq);
+                ieee80211_set_freq(local, selected->freq);
                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
                         ieee80211_sta_set_ssid(dev, selected->ssid,
                                                selected->ssid_len);
@@ -2684,162 +3084,6 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         return -1;
 }
 
-static int ieee80211_sta_join_ibss(struct net_device *dev,
-                                   struct ieee80211_if_sta *ifsta,
-                                   struct ieee80211_sta_bss *bss)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int res, rates, i, j;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        struct ieee80211_tx_control control;
-        struct ieee80211_hw_mode *mode;
-        struct rate_selection ratesel;
-        u8 *pos;
-        struct ieee80211_sub_if_data *sdata;
-
-        /* Remove possible STA entries from other IBSS networks. */
-        sta_info_flush(local, NULL);
-
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
-        memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
-        res = ieee80211_if_config(dev);
-        if (res)
-                return res;
-
-        local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        sdata->drop_unencrypted = bss->capability &
-                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-
-        res = ieee80211_set_channel(local, -1, bss->freq);
-
-        if (!(local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)) {
-                printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
-                       "(%d MHz)\n", dev->name, local->hw.conf.channel,
-                       local->hw.conf.freq);
-                return -1;
-        }
-
-        /* Set beacon template based on scan results */
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
-        do {
-                if (!skb)
-                        break;
-
-                skb_reserve(skb, local->hw.extra_tx_headroom);
-
-                mgmt = (struct ieee80211_mgmt *)
-                        skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-                memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_BEACON);
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-                mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(local->hw.conf.beacon_int);
-                mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
-
-                pos = skb_put(skb, 2 + ifsta->ssid_len);
-                *pos++ = WLAN_EID_SSID;
-                *pos++ = ifsta->ssid_len;
-                memcpy(pos, ifsta->ssid, ifsta->ssid_len);
-
-                rates = bss->supp_rates_len;
-                if (rates > 8)
-                        rates = 8;
-                pos = skb_put(skb, 2 + rates);
-                *pos++ = WLAN_EID_SUPP_RATES;
-                *pos++ = rates;
-                memcpy(pos, bss->supp_rates, rates);
-
-                pos = skb_put(skb, 2 + 1);
-                *pos++ = WLAN_EID_DS_PARAMS;
-                *pos++ = 1;
-                *pos++ = bss->channel;
-
-                pos = skb_put(skb, 2 + 2);
-                *pos++ = WLAN_EID_IBSS_PARAMS;
-                *pos++ = 2;
-                /* FIX: set ATIM window based on scan results */
-                *pos++ = 0;
-                *pos++ = 0;
-
-                if (bss->supp_rates_len > 8) {
-                        rates = bss->supp_rates_len - 8;
-                        pos = skb_put(skb, 2 + rates);
-                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                        *pos++ = rates;
-                        memcpy(pos, &bss->supp_rates[8], rates);
-                }
-
-                memset(&control, 0, sizeof(control));
-                rate_control_get_rate(dev, local->oper_hw_mode, skb, &ratesel);
-                if (!ratesel.rate) {
-                        printk(KERN_DEBUG "%s: Failed to determine TX rate "
-                               "for IBSS beacon\n", dev->name);
-                        break;
-                }
-                control.vif = &sdata->vif;
-                control.tx_rate =
-                        (sdata->bss_conf.use_short_preamble &&
-                        (ratesel.rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
-                        ratesel.rate->val2 : ratesel.rate->val;
-                control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control.power_level = local->hw.conf.power_level;
-                control.flags |= IEEE80211_TXCTL_NO_ACK;
-                control.retry_limit = 1;
-
-                ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
-                if (ifsta->probe_resp) {
-                        mgmt = (struct ieee80211_mgmt *)
-                                ifsta->probe_resp->data;
-                        mgmt->frame_control =
-                                IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                             IEEE80211_STYPE_PROBE_RESP);
-                } else {
-                        printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
-                               "template for IBSS\n", dev->name);
-                }
-
-                if (local->ops->beacon_update &&
-                    local->ops->beacon_update(local_to_hw(local),
-                                             skb, &control) == 0) {
-                        printk(KERN_DEBUG "%s: Configured IBSS beacon "
-                               "template based on scan results\n", dev->name);
-                        skb = NULL;
-                }
-
-                rates = 0;
-                mode = local->oper_hw_mode;
-                for (i = 0; i < bss->supp_rates_len; i++) {
-                        int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < mode->num_rates; j++)
-                                if (mode->rates[j].rate == bitrate)
-                                        rates |= BIT(j);
-                }
-                ifsta->supp_rates_bits = rates;
-        } while (0);
-
-        if (skb) {
-                printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
-                       "template\n", dev->name);
-                dev_kfree_skb(skb);
-        }
-
-        ifsta->state = IEEE80211_IBSS_JOINED;
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-
-        ieee80211_rx_bss_put(dev, bss);
-
-        return res;
-}
-
 
 static int ieee80211_sta_create_ibss(struct net_device *dev,
                                      struct ieee80211_if_sta *ifsta)
@@ -2847,7 +3091,7 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sta_bss *bss;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         u8 bssid[ETH_ALEN], *pos;
         int i;
         DECLARE_MAC_BUF(mac);
@@ -2869,28 +3113,28 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
                dev->name, print_mac(mac, bssid));
 
-        bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel,
+        bss = ieee80211_rx_bss_add(dev, bssid,
+                                   local->hw.conf.channel->center_freq,
                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
         if (!bss)
                 return -ENOMEM;
 
-        mode = local->oper_hw_mode;
+        bss->band = local->hw.conf.channel->band;
+        sband = local->hw.wiphy->bands[bss->band];
 
         if (local->hw.conf.beacon_int == 0)
                 local->hw.conf.beacon_int = 100;
         bss->beacon_int = local->hw.conf.beacon_int;
-        bss->hw_mode = local->hw.conf.phymode;
-        bss->freq = local->hw.conf.freq;
         bss->last_update = jiffies;
         bss->capability = WLAN_CAPABILITY_IBSS;
         if (sdata->default_key) {
                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
         } else
                 sdata->drop_unencrypted = 0;
-        bss->supp_rates_len = mode->num_rates;
+        bss->supp_rates_len = sband->n_bitrates;
         pos = bss->supp_rates;
-        for (i = 0; i < mode->num_rates; i++) {
-                int rate = mode->rates[i].rate;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                int rate = sband->bitrates[i].bitrate;
                 *pos++ = (u8) (rate / 5);
         }
 
@@ -2939,7 +3183,8 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
-            (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel,
+            (bss = ieee80211_rx_bss_get(dev, bssid,
+                                        local->hw.conf.channel->center_freq,
                                         ifsta->ssid, ifsta->ssid_len))) {
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                        " based on configured SSID\n",
@@ -2967,13 +3212,13 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                 if (time_after(jiffies, ifsta->ibss_join_req +
                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
-                            local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)
+                            (!(local->oper_channel->flags &
+                                        IEEE80211_CHAN_NO_IBSS)))
                                 return ieee80211_sta_create_ibss(dev, ifsta);
                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
-                                printk(KERN_DEBUG "%s: IBSS not allowed on the"
-                                       " configured channel %d (%d MHz)\n",
-                                       dev->name, local->hw.conf.channel,
-                                       local->hw.conf.freq);
+                                printk(KERN_DEBUG "%s: IBSS not allowed on"
+                                       " %d MHz\n", dev->name,
+                                       local->hw.conf.channel->center_freq);
                         }
 
                         /* No IBSS found - decrease scan interval and continue
@@ -2992,7 +3237,7 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
 
 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta;
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
@@ -3006,18 +3251,23 @@ int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
                 int i;
 
                 memset(&qparam, 0, sizeof(qparam));
-                /* TODO: are these ok defaults for all hw_modes? */
+
                 qparam.aifs = 2;
-                qparam.cw_min =
-                        local->hw.conf.phymode == MODE_IEEE80211B ? 31 : 15;
+
+                if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+                    !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
+                        qparam.cw_min = 31;
+                else
+                        qparam.cw_min = 15;
+
                 qparam.cw_max = 1023;
-                qparam.burst_time = 0;
+                qparam.txop = 0;
+
                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
-                {
                         local->ops->conf_tx(local_to_hw(local),
                                            i + IEEE80211_TX_QUEUE_DATA0,
                                            &qparam);
-                }
+
                 /* IBSS uses different parameters for Beacon sending */
                 qparam.cw_min++;
                 qparam.cw_min *= 2;
@@ -3026,7 +3276,6 @@ int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
         }
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         ifsta = &sdata->u.sta;
 
         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
@@ -3185,7 +3434,7 @@ void ieee80211_sta_scan_work(struct work_struct *work)
                 container_of(work, struct ieee80211_local, scan_work.work);
         struct net_device *dev = local->scan_dev;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
         int skip;
         unsigned long next_delay = 0;
@@ -3195,44 +3444,59 @@ void ieee80211_sta_scan_work(struct work_struct *work)
 
         switch (local->scan_state) {
         case SCAN_SET_CHANNEL:
-                mode = local->scan_hw_mode;
-                if (local->scan_hw_mode->list.next == &local->modes_list &&
-                    local->scan_channel_idx >= mode->num_channels) {
+                /*
+                 * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
+                 * after we successfully scanned the last channel of the last
+                 * band (and the last band is supported by the hw)
+                 */
+                if (local->scan_band < IEEE80211_NUM_BANDS)
+                        sband = local->hw.wiphy->bands[local->scan_band];
+                else
+                        sband = NULL;
+
+                /*
+                 * If we are at an unsupported band and have more bands
+                 * left to scan, advance to the next supported one.
+                 */
+                while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
+                        local->scan_band++;
+                        sband = local->hw.wiphy->bands[local->scan_band];
+                        local->scan_channel_idx = 0;
+                }
+
+                /* if no more bands/channels left, complete scan */
+                if (!sband || local->scan_channel_idx >= sband->n_channels) {
                         ieee80211_scan_completed(local_to_hw(local));
                         return;
                 }
-                skip = !(local->enabled_modes & (1 << mode->mode));
-                chan = &mode->channels[local->scan_channel_idx];
-                if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
+                skip = 0;
+                chan = &sband->channels[local->scan_channel_idx];
+
+                if (chan->flags & IEEE80211_CHAN_DISABLED ||
                     (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
-                     !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
-                    (local->hw_modes & local->enabled_modes &
-                     (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
+                     chan->flags & IEEE80211_CHAN_NO_IBSS))
                         skip = 1;
 
                 if (!skip) {
-#if 0
-                        printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
-                               dev->name, chan->chan, chan->freq);
-#endif
-
                         local->scan_channel = chan;
                         if (ieee80211_hw_config(local)) {
-                                printk(KERN_DEBUG "%s: failed to set channel "
-                                       "%d (%d MHz) for scan\n", dev->name,
-                                       chan->chan, chan->freq);
+                                printk(KERN_DEBUG "%s: failed to set freq to "
+                                       "%d MHz for scan\n", dev->name,
+                                       chan->center_freq);
                                 skip = 1;
                         }
                 }
 
+                /* advance state machine to next channel/band */
                 local->scan_channel_idx++;
-                if (local->scan_channel_idx >= local->scan_hw_mode->num_channels) {
-                        if (local->scan_hw_mode->list.next != &local->modes_list) {
-                                local->scan_hw_mode = list_entry(local->scan_hw_mode->list.next,
-                                                                 struct ieee80211_hw_mode,
-                                                                 list);
-                                local->scan_channel_idx = 0;
-                        }
+                if (local->scan_channel_idx >= sband->n_channels) {
+                        /*
+                         * scan_band may end up == IEEE80211_NUM_BANDS, but
+                         * we'll catch that case above and complete the scan
+                         * if that is the case.
+                         */
+                        local->scan_band++;
+                        local->scan_channel_idx = 0;
                 }
 
                 if (skip)
@@ -3243,13 +3507,14 @@ void ieee80211_sta_scan_work(struct work_struct *work)
                 local->scan_state = SCAN_SEND_PROBE;
                 break;
         case SCAN_SEND_PROBE:
-                if (local->scan_channel->flag & IEEE80211_CHAN_W_ACTIVE_SCAN) {
-                        ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
-                                                 local->scan_ssid_len);
-                        next_delay = IEEE80211_CHANNEL_TIME;
-                } else
-                        next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+                next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
                 local->scan_state = SCAN_SET_CHANNEL;
+
+                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                        break;
+                ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
+                                         local->scan_ssid_len);
+                next_delay = IEEE80211_CHANNEL_TIME;
                 break;
         }
 
@@ -3324,10 +3589,8 @@ static int ieee80211_sta_start_scan(struct net_device *dev,
         } else
                 local->scan_ssid_len = 0;
         local->scan_state = SCAN_SET_CHANNEL;
-        local->scan_hw_mode = list_entry(local->modes_list.next,
-                                         struct ieee80211_hw_mode,
-                                         list);
         local->scan_channel_idx = 0;
+        local->scan_band = IEEE80211_BAND_2GHZ;
         local->scan_dev = dev;
 
         netif_tx_lock_bh(local->mdev);
@@ -3382,9 +3645,6 @@ ieee80211_sta_scan_result(struct net_device *dev,
                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
                 return current_ev;
 
-        if (!(local->enabled_modes & (1 << bss->hw_mode)))
-                return current_ev;
-
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWAP;
         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
@@ -3412,12 +3672,15 @@ ieee80211_sta_scan_result(struct net_device *dev,
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->channel;
-        iwe.u.freq.e = 0;
+        iwe.u.freq.m = bss->freq;
+        iwe.u.freq.e = 6;
         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
-        iwe.u.freq.m = bss->freq * 100000;
-        iwe.u.freq.e = 1;
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWFREQ;
+        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
+        iwe.u.freq.e = 0;
         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
 
@@ -3557,10 +3820,13 @@ struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
 
         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
-        if (!sta)
+        if (IS_ERR(sta))
                 return NULL;
 
-        sta->supp_rates = sdata->u.sta.supp_rates_bits;
+        sta->flags |= WLAN_STA_AUTHORIZED;
+
+        sta->supp_rates[local->hw.conf.channel->band] =
+                sdata->u.sta.supp_rates_bits[local->hw.conf.channel->band];
 
         rate_control_rate_init(sta, local);
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ed57fb8e82fc..eac9c59dbc4d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -13,6 +13,7 @@
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/rcupdate.h>
+#include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "debugfs_key.h"
@@ -34,6 +35,10 @@
  *
  * All operations here are called under RTNL so no extra locking is
  * required.
+ *
+ * NOTE: This code requires that sta info *destruction* is done under
+ *       RTNL, otherwise it can try to access already freed STA structs
+ *       when a STA key is being freed.
  */
 
 static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
@@ -84,16 +89,25 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                        key->conf.keyidx, print_mac(mac, addr), ret);
 }
 
+static void ieee80211_key_mark_hw_accel_off(struct ieee80211_key *key)
+{
+        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+                key->flags |= KEY_FLAG_REMOVE_FROM_HARDWARE;
+        }
+}
+
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
         const u8 *addr;
         int ret;
         DECLARE_MAC_BUF(mac);
 
-        if (!key->local->ops->set_key)
+        if (!key || !key->local->ops->set_key)
                 return;
 
-        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
+        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
+            !(key->flags & KEY_FLAG_REMOVE_FROM_HARDWARE))
                 return;
 
         addr = get_mac_for_key(key);
@@ -108,12 +122,11 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                        wiphy_name(key->local->hw.wiphy),
                        key->conf.keyidx, print_mac(mac, addr), ret);
 
-        key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+        key->flags &= ~(KEY_FLAG_UPLOADED_TO_HARDWARE |
+                        KEY_FLAG_REMOVE_FROM_HARDWARE);
 }
 
-struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
-                                          struct sta_info *sta,
-                                          enum ieee80211_key_alg alg,
+struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                           int idx,
                                           size_t key_len,
                                           const u8 *key_data)
@@ -137,10 +150,7 @@ struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
         key->conf.keyidx = idx;
         key->conf.keylen = key_len;
         memcpy(key->conf.key, key_data, key_len);
-
-        key->local = sdata->local;
-        key->sdata = sdata;
-        key->sta = sta;
+        INIT_LIST_HEAD(&key->list);
 
         if (alg == ALG_CCMP) {
                 /*
@@ -154,13 +164,68 @@ struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        ieee80211_debugfs_key_add(key->local, key);
+        return key;
+}
 
-        /* remove key first */
-        if (sta)
-                ieee80211_key_free(sta->key);
-        else
-                ieee80211_key_free(sdata->keys[idx]);
+static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
+                                    struct sta_info *sta,
+                                    struct ieee80211_key *key,
+                                    struct ieee80211_key *new)
+{
+        int idx, defkey;
+
+        if (sta) {
+                rcu_assign_pointer(sta->key, new);
+        } else {
+                WARN_ON(new && key && new->conf.keyidx != key->conf.keyidx);
+
+                if (key)
+                        idx = key->conf.keyidx;
+                else
+                        idx = new->conf.keyidx;
+
+                defkey = key && sdata->default_key == key;
+
+                if (defkey && !new)
+                        ieee80211_set_default_key(sdata, -1);
+
+                rcu_assign_pointer(sdata->keys[idx], new);
+                if (new)
+                        list_add(&new->list, &sdata->key_list);
+
+                if (defkey && new)
+                        ieee80211_set_default_key(sdata, new->conf.keyidx);
+        }
+
+        if (key) {
+                ieee80211_key_mark_hw_accel_off(key);
+                /*
+                 * We'll use an empty list to indicate that the key
+                 * has already been removed.
+                 */
+                list_del_init(&key->list);
+        }
+}
+
+void ieee80211_key_link(struct ieee80211_key *key,
+                        struct ieee80211_sub_if_data *sdata,
+                        struct sta_info *sta)
+{
+        struct ieee80211_key *old_key;
+        int idx;
+
+        ASSERT_RTNL();
+        might_sleep();
+
+        BUG_ON(!sdata);
+        BUG_ON(!key);
+
+        idx = key->conf.keyidx;
+        key->local = sdata->local;
+        key->sdata = sdata;
+        key->sta = sta;
+
+        ieee80211_debugfs_key_add(key->local, key);
 
         if (sta) {
                 ieee80211_debugfs_key_sta_link(key, sta);
@@ -186,50 +251,59 @@ struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        /* enable hwaccel if appropriate */
-        if (netif_running(key->sdata->dev))
-                ieee80211_key_enable_hw_accel(key);
-
         if (sta)
-                rcu_assign_pointer(sta->key, key);
+                old_key = sta->key;
         else
-                rcu_assign_pointer(sdata->keys[idx], key);
+                old_key = sdata->keys[idx];
 
-        list_add(&key->list, &sdata->key_list);
+        __ieee80211_key_replace(sdata, sta, old_key, key);
 
-        return key;
+        if (old_key) {
+                synchronize_rcu();
+                ieee80211_key_free(old_key);
+        }
+
+        if (netif_running(sdata->dev))
+                ieee80211_key_enable_hw_accel(key);
 }
 
 void ieee80211_key_free(struct ieee80211_key *key)
 {
+        ASSERT_RTNL();
+        might_sleep();
+
         if (!key)
                 return;
 
-        if (key->sta) {
-                rcu_assign_pointer(key->sta->key, NULL);
-        } else {
-                if (key->sdata->default_key == key)
-                        ieee80211_set_default_key(key->sdata, -1);
-                if (key->conf.keyidx >= 0 &&
-                    key->conf.keyidx < NUM_DEFAULT_KEYS)
-                        rcu_assign_pointer(key->sdata->keys[key->conf.keyidx],
-                                           NULL);
-                else
-                        WARN_ON(1);
-        }
+        if (key->sdata) {
+                /*
+                 * Replace key with nothingness.
+                 *
+                 * Because other code may have key reference (RCU protected)
+                 * right now, we then wait for a grace period before freeing
+                 * it.
+                 * An empty list indicates it was never added to the key list
+                 * or has been removed already. It may, however, still be in
+                 * hardware for acceleration.
+                 */
+                if (!list_empty(&key->list))
+                        __ieee80211_key_replace(key->sdata, key->sta,
+                                                key, NULL);
 
-        /* wait for all key users to complete */
-        synchronize_rcu();
+                synchronize_rcu();
 
-        /* remove from hwaccel if appropriate */
-        ieee80211_key_disable_hw_accel(key);
+                /*
+                 * Remove from hwaccel if appropriate, this will
+                 * only happen when the key is actually unlinked,
+                 * it will already be done when the key was replaced.
+                 */
+                ieee80211_key_disable_hw_accel(key);
+        }
 
         if (key->conf.alg == ALG_CCMP)
                 ieee80211_aes_key_free(key->u.ccmp.tfm);
         ieee80211_debugfs_key_remove(key);
 
-        list_del(&key->list);
-
         kfree(key);
 }
 
@@ -253,6 +327,10 @@ void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key, *tmp;
+        LIST_HEAD(tmp_list);
+
+        ASSERT_RTNL();
+        might_sleep();
 
         list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
                 ieee80211_key_free(key);
@@ -262,8 +340,10 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key;
 
-        WARN_ON(!netif_running(sdata->dev));
-        if (!netif_running(sdata->dev))
+        ASSERT_RTNL();
+        might_sleep();
+
+        if (WARN_ON(!netif_running(sdata->dev)))
                 return;
 
         list_for_each_entry(key, &sdata->key_list, list)
@@ -274,6 +354,9 @@ void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key;
 
+        ASSERT_RTNL();
+        might_sleep();
+
         list_for_each_entry(key, &sdata->key_list, list)
                 ieee80211_key_disable_hw_accel(key);
 }
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 3b77410588e7..9762803e4876 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -63,6 +63,7 @@
  * RC_PID_ARITH_SHIFT.
  */
 
+
 /* Adjust the rate while ensuring that we won't switch to a lower rate if it
  * exhibited a worse failed frames behaviour and we'll choose the highest rate
  * whose failed frames behaviour is not worse than the one of the original rate
@@ -72,14 +73,14 @@ static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
                                          struct rc_pid_rateinfo *rinfo)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_hw_mode *mode;
-        int cur_sorted, new_sorted, probe, tmp, n_bitrates;
-        int cur = sta->txrate;
+        struct ieee80211_supported_band *sband;
+        int cur_sorted, new_sorted, probe, tmp, n_bitrates, band;
+        int cur = sta->txrate_idx;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
-
-        mode = local->oper_hw_mode;
-        n_bitrates = mode->num_rates;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        band = sband->band;
+        n_bitrates = sband->n_bitrates;
 
         /* Map passed arguments to sorted values. */
         cur_sorted = rinfo[cur].rev_index;
@@ -97,20 +98,20 @@ static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
                 /* Ensure that the rate decrease isn't disadvantageous. */
                 for (probe = cur_sorted; probe >= new_sorted; probe--)
                         if (rinfo[probe].diff <= rinfo[cur_sorted].diff &&
-                            rate_supported(sta, mode, rinfo[probe].index))
+                            rate_supported(sta, band, rinfo[probe].index))
                                 tmp = probe;
         } else {
                 /* Look for rate increase with zero (or below) cost. */
                 for (probe = new_sorted + 1; probe < n_bitrates; probe++)
                         if (rinfo[probe].diff <= rinfo[new_sorted].diff &&
-                            rate_supported(sta, mode, rinfo[probe].index))
+                            rate_supported(sta, band, rinfo[probe].index))
                                 tmp = probe;
         }
 
         /* Fit the rate found to the nearest supported rate. */
         do {
-                if (rate_supported(sta, mode, rinfo[tmp].index)) {
-                        sta->txrate = rinfo[tmp].index;
+                if (rate_supported(sta, band, rinfo[tmp].index)) {
+                        sta->txrate_idx = rinfo[tmp].index;
                         break;
                 }
                 if (adj < 0)
@@ -122,7 +123,7 @@ static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_rate_change(
                 &((struct rc_pid_sta_info *)sta->rate_ctrl_priv)->events,
-                cur, mode->rates[cur].rate);
+                sta->txrate_idx, sband->bitrates[sta->txrate_idx].bitrate);
 #endif
 }
 
@@ -149,7 +150,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
 {
         struct rc_pid_sta_info *spinfo = sta->rate_ctrl_priv;
         struct rc_pid_rateinfo *rinfo = pinfo->rinfo;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         u32 pf;
         s32 err_avg;
         u32 err_prop;
@@ -158,7 +159,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         int adj, i, j, tmp;
         unsigned long period;
 
-        mode = local->oper_hw_mode;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         spinfo = sta->rate_ctrl_priv;
 
         /* In case nothing happened during the previous control interval, turn
@@ -184,18 +185,18 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         spinfo->tx_num_failed = 0;
 
         /* If we just switched rate, update the rate behaviour info. */
-        if (pinfo->oldrate != sta->txrate) {
+        if (pinfo->oldrate != sta->txrate_idx) {
 
                 i = rinfo[pinfo->oldrate].rev_index;
-                j = rinfo[sta->txrate].rev_index;
+                j = rinfo[sta->txrate_idx].rev_index;
 
                 tmp = (pf - spinfo->last_pf);
                 tmp = RC_PID_DO_ARITH_RIGHT_SHIFT(tmp, RC_PID_ARITH_SHIFT);
 
                 rinfo[j].diff = rinfo[i].diff + tmp;
-                pinfo->oldrate = sta->txrate;
+                pinfo->oldrate = sta->txrate_idx;
         }
-        rate_control_pid_normalize(pinfo, mode->num_rates);
+        rate_control_pid_normalize(pinfo, sband->n_bitrates);
 
         /* Compute the proportional, integral and derivative errors. */
         err_prop = (pinfo->target << RC_PID_ARITH_SHIFT) - pf;
@@ -236,8 +237,10 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
         struct sta_info *sta;
         struct rc_pid_sta_info *spinfo;
         unsigned long period;
+        struct ieee80211_supported_band *sband;
 
         sta = sta_info_get(local, hdr->addr1);
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         if (!sta)
                 return;
@@ -245,13 +248,13 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
         /* Don't update the state if we're not controlling the rate. */
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1) {
-                sta->txrate = sdata->bss->max_ratectrl_rateidx;
+                sta->txrate_idx = sdata->bss->max_ratectrl_rateidx;
                 return;
         }
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (status->control.rate != &local->oper_hw_mode->rates[sta->txrate])
+        if (status->control.tx_rate != &sband->bitrates[sta->txrate_idx])
                 goto ignore;
 
         spinfo = sta->rate_ctrl_priv;
@@ -277,9 +280,6 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
                 sta->tx_num_consecutive_failures++;
                 sta->tx_num_mpdu_fail++;
         } else {
-                sta->last_ack_rssi[0] = sta->last_ack_rssi[1];
-                sta->last_ack_rssi[1] = sta->last_ack_rssi[2];
-                sta->last_ack_rssi[2] = status->ack_signal;
                 sta->tx_num_consecutive_failures = 0;
                 sta->tx_num_mpdu_ok++;
         }
@@ -298,7 +298,7 @@ ignore:
 }
 
 static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
-                                      struct ieee80211_hw_mode *mode,
+                                      struct ieee80211_supported_band *sband,
                                       struct sk_buff *skb,
                                       struct rate_selection *sel)
 {
@@ -316,7 +316,7 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1) || !sta) {
-                sel->rate = rate_lowest(local, mode, sta);
+                sel->rate = rate_lowest(local, sband, sta);
                 if (sta)
                         sta_info_put(sta);
                 return;
@@ -325,23 +325,23 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
         /* If a forced rate is in effect, select it. */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1)
-                sta->txrate = sdata->bss->force_unicast_rateidx;
+                sta->txrate_idx = sdata->bss->force_unicast_rateidx;
 
-        rateidx = sta->txrate;
+        rateidx = sta->txrate_idx;
 
-        if (rateidx >= mode->num_rates)
-                rateidx = mode->num_rates - 1;
+        if (rateidx >= sband->n_bitrates)
+                rateidx = sband->n_bitrates - 1;
 
-        sta->last_txrate = rateidx;
+        sta->last_txrate_idx = rateidx;
 
         sta_info_put(sta);
 
-        sel->rate = &mode->rates[rateidx];
+        sel->rate = &sband->bitrates[rateidx];
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_tx_rate(
                 &((struct rc_pid_sta_info *) sta->rate_ctrl_priv)->events,
-                rateidx, mode->rates[rateidx].rate);
+                rateidx, sband->bitrates[rateidx].bitrate);
 #endif
 }
 
@@ -353,28 +353,32 @@ static void rate_control_pid_rate_init(void *priv, void *priv_sta,
          * as we need to have IEEE 802.1X auth succeed immediately after assoc..
          * Until that method is implemented, we will use the lowest supported
          * rate as a workaround. */
-        sta->txrate = rate_lowest_index(local, local->oper_hw_mode, sta);
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sta->txrate_idx = rate_lowest_index(local, sband, sta);
 }
 
 static void *rate_control_pid_alloc(struct ieee80211_local *local)
 {
         struct rc_pid_info *pinfo;
         struct rc_pid_rateinfo *rinfo;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         int i, j, tmp;
         bool s;
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct rc_pid_debugfs_entries *de;
 #endif
 
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         pinfo = kmalloc(sizeof(*pinfo), GFP_ATOMIC);
         if (!pinfo)
                 return NULL;
 
-        /* We can safely assume that oper_hw_mode won't change unless we get
+        /* We can safely assume that sband won't change unless we get
          * reinitialized. */
-        mode = local->oper_hw_mode;
-        rinfo = kmalloc(sizeof(*rinfo) * mode->num_rates, GFP_ATOMIC);
+        rinfo = kmalloc(sizeof(*rinfo) * sband->n_bitrates, GFP_ATOMIC);
         if (!rinfo) {
                 kfree(pinfo);
                 return NULL;
@@ -383,7 +387,7 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
         /* Sort the rates. This is optimized for the most common case (i.e.
          * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
          * mapping too. */
-        for (i = 0; i < mode->num_rates; i++) {
+        for (i = 0; i < sband->n_bitrates; i++) {
                 rinfo[i].index = i;
                 rinfo[i].rev_index = i;
                 if (pinfo->fast_start)
@@ -391,11 +395,11 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
                 else
                         rinfo[i].diff = i * pinfo->norm_offset;
         }
-        for (i = 1; i < mode->num_rates; i++) {
+        for (i = 1; i < sband->n_bitrates; i++) {
                 s = 0;
-                for (j = 0; j < mode->num_rates - i; j++)
-                        if (unlikely(mode->rates[rinfo[j].index].rate >
-                                     mode->rates[rinfo[j + 1].index].rate)) {
+                for (j = 0; j < sband->n_bitrates - i; j++)
+                        if (unlikely(sband->bitrates[rinfo[j].index].bitrate >
+                                     sband->bitrates[rinfo[j + 1].index].bitrate)) {
                                 tmp = rinfo[j].index;
                                 rinfo[j].index = rinfo[j + 1].index;
                                 rinfo[j + 1].index = tmp;
diff --git a/net/mac80211/rc80211_simple.c b/net/mac80211/rc80211_simple.c
index 9a78b116acff..bcc541d4b95c 100644
--- a/net/mac80211/rc80211_simple.c
+++ b/net/mac80211/rc80211_simple.c
@@ -7,6 +7,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/jiffies.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/types.h>
@@ -35,8 +36,8 @@ static void rate_control_rate_inc(struct ieee80211_local *local,
                                   struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_hw_mode *mode;
-        int i = sta->txrate;
+        struct ieee80211_supported_band *sband;
+        int i = sta->txrate_idx;
         int maxrate;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
@@ -45,18 +46,17 @@ static void rate_control_rate_inc(struct ieee80211_local *local,
                 return;
         }
 
-        mode = local->oper_hw_mode;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         maxrate = sdata->bss ? sdata->bss->max_ratectrl_rateidx : -1;
 
-        if (i > mode->num_rates)
-                i = mode->num_rates - 2;
+        if (i > sband->n_bitrates)
+                i = sband->n_bitrates - 2;
 
-        while (i + 1 < mode->num_rates) {
+        while (i + 1 < sband->n_bitrates) {
                 i++;
-                if (sta->supp_rates & BIT(i) &&
-                    mode->rates[i].flags & IEEE80211_RATE_SUPPORTED &&
+                if (rate_supported(sta, sband->band, i) &&
                     (maxrate < 0 || i <= maxrate)) {
-                        sta->txrate = i;
+                        sta->txrate_idx = i;
                         break;
                 }
         }
@@ -67,8 +67,8 @@ static void rate_control_rate_dec(struct ieee80211_local *local,
                                   struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_hw_mode *mode;
-        int i = sta->txrate;
+        struct ieee80211_supported_band *sband;
+        int i = sta->txrate_idx;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1) {
@@ -76,15 +76,14 @@ static void rate_control_rate_dec(struct ieee80211_local *local,
                 return;
         }
 
-        mode = local->oper_hw_mode;
-        if (i > mode->num_rates)
-                i = mode->num_rates;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        if (i > sband->n_bitrates)
+                i = sband->n_bitrates;
 
         while (i > 0) {
                 i--;
-                if (sta->supp_rates & BIT(i) &&
-                    mode->rates[i].flags & IEEE80211_RATE_SUPPORTED) {
-                        sta->txrate = i;
+                if (rate_supported(sta, sband->band, i)) {
+                        sta->txrate_idx = i;
                         break;
                 }
         }
@@ -132,9 +131,6 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
                 sta->tx_num_consecutive_failures++;
                 sta->tx_num_mpdu_fail++;
         } else {
-                sta->last_ack_rssi[0] = sta->last_ack_rssi[1];
-                sta->last_ack_rssi[1] = sta->last_ack_rssi[2];
-                sta->last_ack_rssi[2] = status->ack_signal;
                 sta->tx_num_consecutive_failures = 0;
                 sta->tx_num_mpdu_ok++;
         }
@@ -168,7 +164,7 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
                 } else if (per_failed < RATE_CONTROL_NUM_UP) {
                         rate_control_rate_inc(local, sta);
                 }
-                srctrl->tx_avg_rate_sum += status->control.rate->rate;
+                srctrl->tx_avg_rate_sum += status->control.tx_rate->bitrate;
                 srctrl->tx_avg_rate_num++;
                 srctrl->tx_num_failures = 0;
                 srctrl->tx_num_xmit = 0;
@@ -177,7 +173,7 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
                 rate_control_rate_dec(local, sta);
         }
 
-        if (srctrl->avg_rate_update + 60 * HZ < jiffies) {
+        if (time_after(jiffies, srctrl->avg_rate_update + 60 * HZ)) {
                 srctrl->avg_rate_update = jiffies;
                 if (srctrl->tx_avg_rate_num > 0) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -201,7 +197,7 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
 
 static void
 rate_control_simple_get_rate(void *priv, struct net_device *dev,
-                             struct ieee80211_hw_mode *mode,
+                             struct ieee80211_supported_band *sband,
                              struct sk_buff *skb,
                              struct rate_selection *sel)
 {
@@ -219,7 +215,7 @@ rate_control_simple_get_rate(void *priv, struct net_device *dev,
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1) || !sta) {
-                sel->rate = rate_lowest(local, mode, sta);
+                sel->rate = rate_lowest(local, sband, sta);
                 if (sta)
                         sta_info_put(sta);
                 return;
@@ -228,18 +224,18 @@ rate_control_simple_get_rate(void *priv, struct net_device *dev,
         /* If a forced rate is in effect, select it. */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1)
-                sta->txrate = sdata->bss->force_unicast_rateidx;
+                sta->txrate_idx = sdata->bss->force_unicast_rateidx;
 
-        rateidx = sta->txrate;
+        rateidx = sta->txrate_idx;
 
-        if (rateidx >= mode->num_rates)
-                rateidx = mode->num_rates - 1;
+        if (rateidx >= sband->n_bitrates)
+                rateidx = sband->n_bitrates - 1;
 
-        sta->last_txrate = rateidx;
+        sta->last_txrate_idx = rateidx;
 
         sta_info_put(sta);
 
-        sel->rate = &mode->rates[rateidx];
+        sel->rate = &sband->bitrates[rateidx];
 }
 
 
@@ -247,21 +243,15 @@ static void rate_control_simple_rate_init(void *priv, void *priv_sta,
                                           struct ieee80211_local *local,
                                           struct sta_info *sta)
 {
-        struct ieee80211_hw_mode *mode;
-        int i;
-        sta->txrate = 0;
-        mode = local->oper_hw_mode;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         /* TODO: This routine should consider using RSSI from previous packets
          * as we need to have IEEE 802.1X auth succeed immediately after assoc..
          * Until that method is implemented, we will use the lowest supported rate
          * as a workaround, */
-        for (i = 0; i < mode->num_rates; i++) {
-                if ((sta->supp_rates & BIT(i)) &&
-                    (mode->rates[i].flags & IEEE80211_RATE_SUPPORTED)) {
-                        sta->txrate = i;
-                        break;
-                }
-        }
+        sta->txrate_idx = rate_lowest_index(local, sband, sta);
 }
 
 
diff --git a/net/mac80211/regdomain.c b/net/mac80211/regdomain.c
deleted file mode 100644
index f42678fa62d1..000000000000
--- a/net/mac80211/regdomain.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright 2002-2005, Instant802 Networks, Inc.
- * Copyright 2005-2006, Devicescape Software, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/*
- * This regulatory domain control implementation is known to be incomplete
- * and confusing. mac80211 regulatory domain control will be significantly
- * reworked in the not-too-distant future.
- *
- * For now, drivers wishing to control which channels are and aren't available
- * are advised as follows:
- *  - set the IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED flag
- *  - continue to include *ALL* possible channels in the modes registered
- *    through ieee80211_register_hwmode()
- *  - for each allowable ieee80211_channel structure registered in the above
- *    call, set the flag member to some meaningful value such as
- *    IEEE80211_CHAN_W_SCAN | IEEE80211_CHAN_W_ACTIVE_SCAN |
- *    IEEE80211_CHAN_W_IBSS.
- *  - leave flag as 0 for non-allowable channels
- *
- * The usual implementation is for a driver to read a device EEPROM to
- * determine which regulatory domain it should be operating under, then
- * looking up the allowable channels in a driver-local table, then performing
- * the above.
- */
-
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <net/mac80211.h>
-#include "ieee80211_i.h"
-
-static int ieee80211_regdom = 0x10; /* FCC */
-module_param(ieee80211_regdom, int, 0444);
-MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain; 64=MKK");
-
-/*
- * If firmware is upgraded by the vendor, additional channels can be used based
- * on the new Japanese regulatory rules. This is indicated by setting
- * ieee80211_japan_5ghz module parameter to one when loading the 80211 kernel
- * module.
- */
-static int ieee80211_japan_5ghz /* = 0 */;
-module_param(ieee80211_japan_5ghz, int, 0444);
-MODULE_PARM_DESC(ieee80211_japan_5ghz, "Vendor-updated firmware for 5 GHz");
-
-
-struct ieee80211_channel_range {
-        short start_freq;
-        short end_freq;
-        unsigned char power_level;
-        unsigned char antenna_max;
-};
-
-static const struct ieee80211_channel_range ieee80211_fcc_channels[] = {
-        { 2412, 2462, 27, 6 } /* IEEE 802.11b/g, channels 1..11 */,
-        { 5180, 5240, 17, 6 } /* IEEE 802.11a, channels 36..48 */,
-        { 5260, 5320, 23, 6 } /* IEEE 802.11a, channels 52..64 */,
-        { 5745, 5825, 30, 6 } /* IEEE 802.11a, channels 149..165, outdoor */,
-        { 0 }
-};
-
-static const struct ieee80211_channel_range ieee80211_mkk_channels[] = {
-        { 2412, 2472, 20, 6 } /* IEEE 802.11b/g, channels 1..13 */,
-        { 5170, 5240, 20, 6 } /* IEEE 802.11a, channels 34..48 */,
-        { 5260, 5320, 20, 6 } /* IEEE 802.11a, channels 52..64 */,
-        { 0 }
-};
-
-
-static const struct ieee80211_channel_range *channel_range =
-        ieee80211_fcc_channels;
-
-
-static void ieee80211_unmask_channel(int mode, struct ieee80211_channel *chan)
-{
-        int i;
-
-        chan->flag = 0;
-
-        for (i = 0; channel_range[i].start_freq; i++) {
-                const struct ieee80211_channel_range *r = &channel_range[i];
-                if (r->start_freq <= chan->freq && r->end_freq >= chan->freq) {
-                        if (ieee80211_regdom == 64 && !ieee80211_japan_5ghz &&
-                            chan->freq >= 5260 && chan->freq <= 5320) {
-                                /*
-                                 * Skip new channels in Japan since the
-                                 * firmware was not marked having been upgraded
-                                 * by the vendor.
-                                 */
-                                continue;
-                        }
-
-                        if (ieee80211_regdom == 0x10 &&
-                            (chan->freq == 5190 || chan->freq == 5210 ||
-                             chan->freq == 5230)) {
-                                    /* Skip MKK channels when in FCC domain. */
-                                    continue;
-                        }
-
-                        chan->flag |= IEEE80211_CHAN_W_SCAN |
-                                IEEE80211_CHAN_W_ACTIVE_SCAN |
-                                IEEE80211_CHAN_W_IBSS;
-                        chan->power_level = r->power_level;
-                        chan->antenna_max = r->antenna_max;
-
-                        if (ieee80211_regdom == 64 &&
-                            (chan->freq == 5170 || chan->freq == 5190 ||
-                             chan->freq == 5210 || chan->freq == 5230)) {
-                                /*
-                                 * New regulatory rules in Japan have backwards
-                                 * compatibility with old channels in 5.15-5.25
-                                 * GHz band, but the station is not allowed to
-                                 * use active scan on these old channels.
-                                 */
-                                chan->flag &= ~IEEE80211_CHAN_W_ACTIVE_SCAN;
-                        }
-
-                        if (ieee80211_regdom == 64 &&
-                            (chan->freq == 5260 || chan->freq == 5280 ||
-                             chan->freq == 5300 || chan->freq == 5320)) {
-                                /*
-                                 * IBSS is not allowed on 5.25-5.35 GHz band
-                                 * due to radar detection requirements.
-                                 */
-                                chan->flag &= ~IEEE80211_CHAN_W_IBSS;
-                        }
-
-                        break;
-                }
-        }
-}
-
-
-void ieee80211_set_default_regdomain(struct ieee80211_hw_mode *mode)
-{
-        int c;
-        for (c = 0; c < mode->num_channels; c++)
-                ieee80211_unmask_channel(mode->mode, &mode->channels[c]);
-}
-
-
-void ieee80211_regdomain_init(void)
-{
-        if (ieee80211_regdom == 0x40)
-                channel_range = ieee80211_mkk_channels;
-}
-
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 535407d07fa4..48574f6c0e74 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/jiffies.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -82,10 +83,10 @@ static inline int should_drop_frame(struct ieee80211_rx_status *status,
  */
 static struct sk_buff *
 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
-                     struct ieee80211_rx_status *status)
+                     struct ieee80211_rx_status *status,
+                     struct ieee80211_rate *rate)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_rate *rate;
         int needed_headroom = 0;
         struct ieee80211_radiotap_header *rthdr;
         __le64 *rttsft = NULL;
@@ -194,14 +195,11 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                         rtfixed->rx_flags |=
                                 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
 
-                rate = ieee80211_get_rate(local, status->phymode,
-                                          status->rate);
-                if (rate)
-                        rtfixed->rate = rate->rate / 5;
+                rtfixed->rate = rate->bitrate / 5;
 
                 rtfixed->chan_freq = cpu_to_le16(status->freq);
 
-                if (status->phymode == MODE_IEEE80211A)
+                if (status->band == IEEE80211_BAND_5GHZ)
                         rtfixed->chan_flags =
                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
                                             IEEE80211_CHAN_5GHZ);
@@ -226,6 +224,9 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
                         continue;
 
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
+                        continue;
+
                 if (prev_dev) {
                         skb2 = skb_clone(skb, GFP_ATOMIC);
                         if (skb2) {
@@ -249,15 +250,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 }
 
 
-/* pre-rx handlers
- *
- * these don't have dev/sdata fields in the rx data
- * The sta value should also not be used because it may
- * be NULL even though a STA (in IBSS mode) will be added.
- */
-
-static ieee80211_txrx_result
-ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
+static void ieee80211_parse_qos(struct ieee80211_txrx_data *rx)
 {
         u8 *data = rx->skb->data;
         int tid;
@@ -290,64 +283,15 @@ ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
          * For now, set skb->priority to 0 for other cases. */
         rx->skb->priority = (tid > 7) ? 0 : tid;
-
-        return TXRX_CONTINUE;
 }
 
-
-static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
-                              struct sk_buff *skb,
-                              struct ieee80211_rx_status *status)
+static void ieee80211_verify_ip_alignment(struct ieee80211_txrx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u32 load = 0, hdrtime;
-        struct ieee80211_rate *rate;
-        struct ieee80211_hw_mode *mode = local->hw.conf.mode;
-        int i;
-
-        /* Estimate total channel use caused by this frame */
-
-        if (unlikely(mode->num_rates < 0))
-                return TXRX_CONTINUE;
-
-        rate = &mode->rates[0];
-        for (i = 0; i < mode->num_rates; i++) {
-                if (mode->rates[i].val == status->rate) {
-                        rate = &mode->rates[i];
-                        break;
-                }
-        }
-
-        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
-         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
-
-        if (mode->mode == MODE_IEEE80211A ||
-            (mode->mode == MODE_IEEE80211G &&
-             rate->flags & IEEE80211_RATE_ERP))
-                hdrtime = CHAN_UTIL_HDR_SHORT;
-        else
-                hdrtime = CHAN_UTIL_HDR_LONG;
-
-        load = hdrtime;
-        if (!is_multicast_ether_addr(hdr->addr1))
-                load += hdrtime;
-
-        load += skb->len * rate->rate_inv;
-
-        /* Divide channel_use by 8 to avoid wrapping around the counter */
-        load >>= CHAN_UTIL_SHIFT;
-
-        return load;
-}
-
 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
-static ieee80211_txrx_result
-ieee80211_rx_h_verify_ip_alignment(struct ieee80211_txrx_data *rx)
-{
         int hdrlen;
 
         if (!WLAN_FC_DATA_PRESENT(rx->fc))
-                return TXRX_CONTINUE;
+                return;
 
         /*
          * Drivers are required to align the payload data in a way that
@@ -372,32 +316,55 @@ ieee80211_rx_h_verify_ip_alignment(struct ieee80211_txrx_data *rx)
         if (rx->flags & IEEE80211_TXRXD_RX_AMSDU)
                 hdrlen += ETH_HLEN;
         WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
-
-        return TXRX_CONTINUE;
-}
 #endif
+}
 
-ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
+
+static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
+                                   struct sk_buff *skb,
+                                   struct ieee80211_rx_status *status,
+                                   struct ieee80211_rate *rate)
 {
-        ieee80211_rx_h_parse_qos,
-#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
-        ieee80211_rx_h_verify_ip_alignment,
-#endif
-        NULL
-};
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        u32 load = 0, hdrtime;
+
+        /* Estimate total channel use caused by this frame */
+
+        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
+         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
+
+        if (status->band == IEEE80211_BAND_5GHZ ||
+            (status->band == IEEE80211_BAND_5GHZ &&
+             rate->flags & IEEE80211_RATE_ERP_G))
+                hdrtime = CHAN_UTIL_HDR_SHORT;
+        else
+                hdrtime = CHAN_UTIL_HDR_LONG;
+
+        load = hdrtime;
+        if (!is_multicast_ether_addr(hdr->addr1))
+                load += hdrtime;
+
+        /* TODO: optimise again */
+        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
+
+        /* Divide channel_use by 8 to avoid wrapping around the counter */
+        load >>= CHAN_UTIL_SHIFT;
+
+        return load;
+}
 
 /* rx handlers */
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
 {
         if (rx->sta)
                 rx->sta->channel_use_raw += rx->u.rx.load;
         rx->sdata->channel_use_raw += rx->u.rx.load;
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
@@ -409,21 +376,21 @@ ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
         if (unlikely(local->sta_sw_scanning)) {
                 /* drop all the other packets during a software scan anyway */
                 if (ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status)
-                    != TXRX_QUEUED)
+                    != RX_QUEUED)
                         dev_kfree_skb(skb);
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
         if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) {
                 /* scanning finished during invoking of handlers */
                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr;
@@ -438,14 +405,14 @@ ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
                                 rx->local->dot11FrameDuplicateCount++;
                                 rx->sta->num_duplicates++;
                         }
-                        return TXRX_DROP;
+                        return RX_DROP_MONITOR;
                 } else
                         rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
         }
 
         if (unlikely(rx->skb->len < 16)) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
         /* Drop disallowed frame classes based on STA auth/assoc state;
@@ -467,23 +434,23 @@ ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
                     || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
                         /* Drop IBSS frames and frames for other hosts
                          * silently. */
-                        return TXRX_DROP;
+                        return RX_DROP_MONITOR;
                 }
 
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
         int keyidx;
         int hdrlen;
-        ieee80211_txrx_result result = TXRX_DROP;
+        ieee80211_rx_result result = RX_DROP_UNUSABLE;
         struct ieee80211_key *stakey = NULL;
 
         /*
@@ -513,14 +480,14 @@ ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
          */
 
         if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         /*
          * No point in finding a key and decrypting if the frame is neither
          * addressed to us nor a multicast frame.
          */
         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (rx->sta)
                 stakey = rcu_dereference(rx->sta->key);
@@ -539,12 +506,12 @@ ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
                  */
                 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
                     (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
 
                 hdrlen = ieee80211_get_hdrlen(rx->fc);
 
                 if (rx->skb->len < 8 + hdrlen)
-                        return TXRX_DROP; /* TODO: count this? */
+                        return RX_DROP_UNUSABLE; /* TODO: count this? */
 
                 /*
                  * no need to call ieee80211_wep_get_keyidx,
@@ -573,7 +540,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
                         printk(KERN_DEBUG "%s: RX protected frame,"
                                " but have no key\n", rx->dev->name);
 #endif /* CONFIG_MAC80211_DEBUG */
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
         /* Check for weak IVs if possible */
@@ -612,7 +579,7 @@ static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
         if (sdata->bss)
                 atomic_inc(&sdata->bss->num_sta_ps);
         sta->flags |= WLAN_STA_PS;
-        sta->pspoll = 0;
+        sta->flags &= ~WLAN_STA_PSPOLL;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
                dev->name, print_mac(mac, sta->addr), sta->aid);
@@ -629,20 +596,20 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
         DECLARE_MAC_BUF(mac);
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
         if (sdata->bss)
                 atomic_dec(&sdata->bss->num_sta_ps);
-        sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
-        sta->pspoll = 0;
-        if (!skb_queue_empty(&sta->ps_tx_buf)) {
-                if (local->ops->set_tim)
-                        local->ops->set_tim(local_to_hw(local), sta->aid, 0);
-                if (sdata->bss)
-                        bss_tim_clear(local, sdata->bss, sta->aid);
-        }
+
+        sta->flags &= ~(WLAN_STA_PS | WLAN_STA_PSPOLL);
+
+        if (!skb_queue_empty(&sta->ps_tx_buf))
+                sta_info_clear_tim_bit(sta);
+
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
                dev->name, print_mac(mac, sta->addr), sta->aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+
         /* Send all buffered frames to the station */
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
@@ -666,7 +633,7 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
         return sent;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
 {
         struct sta_info *sta = rx->sta;
@@ -674,7 +641,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
 
         if (!sta)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         /* Update last_rx only for IBSS packets which are for the current
          * BSSID to avoid keeping the current IBSS network alive in cases where
@@ -695,7 +662,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
         }
 
         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
@@ -722,10 +689,10 @@ ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
                  * as a dropped packed. */
                 sta->rx_packets++;
                 dev_kfree_skb(rx->skb);
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 } /* ieee80211_rx_h_sta_process */
 
 static inline struct ieee80211_fragment_entry *
@@ -801,7 +768,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
                         continue;
 
-                if (entry->first_frag_time + 2 * HZ < jiffies) {
+                if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
                         __skb_queue_purge(&entry->skb_list);
                         continue;
                 }
@@ -811,7 +778,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
         return NULL;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr;
@@ -848,7 +815,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
                                CCMP_PN_LEN);
                 }
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
         /* This is a fragment for a frame that should already be pending in
@@ -858,7 +825,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                           rx->u.rx.queue, hdr);
         if (!entry) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
         /* Verify that MPDUs within one MSDU have sequential PN values.
@@ -867,7 +834,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                 int i;
                 u8 pn[CCMP_PN_LEN], *rpn;
                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
                         pn[i]++;
@@ -885,7 +852,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                        rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
                                        rpn[5], pn[0], pn[1], pn[2], pn[3],
                                        pn[4], pn[5]);
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
         }
@@ -896,7 +863,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
         entry->extra_len += rx->skb->len;
         if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
                 rx->skb = NULL;
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
         rx->skb = __skb_dequeue(&entry->skb_list);
@@ -906,7 +873,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                               GFP_ATOMIC))) {
                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
                         __skb_queue_purge(&entry->skb_list);
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
         }
         while ((skb = __skb_dequeue(&entry->skb_list))) {
@@ -924,10 +891,10 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                 rx->local->dot11MulticastReceivedFrameCount++;
         else
                 ieee80211_led_rx(rx->local);
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
@@ -939,11 +906,11 @@ ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
                    (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
                    (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
                    !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
             (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         skb = skb_dequeue(&rx->sta->tx_filtered);
         if (!skb) {
@@ -958,9 +925,11 @@ ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
                 struct ieee80211_hdr *hdr =
                         (struct ieee80211_hdr *) skb->data;
 
-                /* tell TX path to send one frame even though the STA may
-                 * still remain is PS mode after this frame exchange */
-                rx->sta->pspoll = 1;
+                /*
+                 * Tell TX path to send one frame even though the STA may
+                 * still remain is PS mode after this frame exchange.
+                 */
+                rx->sta->flags |= WLAN_STA_PSPOLL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
@@ -970,38 +939,37 @@ ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
 
                 /* Use MoreData flag to indicate whether there are more
                  * buffered frames for this STA */
-                if (no_pending_pkts) {
+                if (no_pending_pkts)
                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
-                        rx->sta->flags &= ~WLAN_STA_TIM;
-                } else
+                else
                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
 
                 dev_queue_xmit(skb);
 
-                if (no_pending_pkts) {
-                        if (rx->local->ops->set_tim)
-                                rx->local->ops->set_tim(local_to_hw(rx->local),
-                                                       rx->sta->aid, 0);
-                        if (rx->sdata->bss)
-                                bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
-                }
+                if (no_pending_pkts)
+                        sta_info_clear_tim_bit(rx->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         } else if (!rx->u.rx.sent_ps_buffered) {
+                /*
+                 * FIXME: This can be the result of a race condition between
+                 *        us expiring a frame and the station polling for it.
+                 *        Should we send it a null-func frame indicating we
+                 *        have nothing buffered for it?
+                 */
                 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
                        "though there is no buffered frames for it\n",
                        rx->dev->name, print_mac(mac, rx->sta->addr));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-
         }
 
-        /* Free PS Poll skb here instead of returning TXRX_DROP that would
+        /* Free PS Poll skb here instead of returning RX_DROP that would
          * count as an dropped frame. */
         dev_kfree_skb(rx->skb);
 
-        return TXRX_QUEUED;
+        return RX_QUEUED;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
 {
         u16 fc = rx->fc;
@@ -1009,7 +977,7 @@ ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
 
         if (!WLAN_FC_IS_QOS_DATA(fc))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         /* remove the qos control field, update frame type and meta-data */
         memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
@@ -1018,17 +986,17 @@ ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
         rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
         hdr->frame_control = cpu_to_le16(fc);
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 static int
 ieee80211_802_1x_port_control(struct ieee80211_txrx_data *rx)
 {
-        if (unlikely(rx->sdata->ieee802_1x_pac &&
-                     (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)))) {
+        if (unlikely(!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED))) {
 #ifdef CONFIG_MAC80211_DEBUG
-                printk(KERN_DEBUG "%s: dropped frame "
-                       "(unauthorized port)\n", rx->dev->name);
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: dropped frame "
+                               "(unauthorized port)\n", rx->dev->name);
 #endif /* CONFIG_MAC80211_DEBUG */
                 return -EACCES;
         }
@@ -1275,7 +1243,7 @@ ieee80211_deliver_skb(struct ieee80211_txrx_data *rx)
         }
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
 {
         struct net_device *dev = rx->dev;
@@ -1291,17 +1259,17 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
 
         fc = rx->fc;
         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         if (!(rx->flags & IEEE80211_TXRXD_RX_AMSDU))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         err = ieee80211_data_to_8023(rx);
         if (unlikely(err))
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         skb->dev = dev;
 
@@ -1311,7 +1279,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
         /* skip the wrapping header */
         eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
         if (!eth)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         while (skb != frame) {
                 u8 padding;
@@ -1326,7 +1294,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                 /* the last MSDU has no padding */
                 if (subframe_len > remaining) {
                         printk(KERN_DEBUG "%s: wrong buffer size", dev->name);
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
 
                 skb_pull(skb, sizeof(struct ethhdr));
@@ -1338,7 +1306,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                                               subframe_len);
 
                         if (frame == NULL)
-                                return TXRX_DROP;
+                                return RX_DROP_UNUSABLE;
 
                         skb_reserve(frame, local->hw.extra_tx_headroom +
                                     sizeof(struct ethhdr));
@@ -1351,7 +1319,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                                 printk(KERN_DEBUG "%s: wrong buffer size ",
                                        dev->name);
                                 dev_kfree_skb(frame);
-                                return TXRX_DROP;
+                                return RX_DROP_UNUSABLE;
                         }
                 }
 
@@ -1381,7 +1349,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
 
                 if (!ieee80211_frame_allowed(rx)) {
                         if (skb == frame) /* last frame */
-                                return TXRX_DROP;
+                                return RX_DROP_UNUSABLE;
                         dev_kfree_skb(frame);
                         continue;
                 }
@@ -1389,10 +1357,10 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                 ieee80211_deliver_skb(rx);
         }
 
-        return TXRX_QUEUED;
+        return RX_QUEUED;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
 {
         struct net_device *dev = rx->dev;
@@ -1401,17 +1369,17 @@ ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
 
         fc = rx->fc;
         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         err = ieee80211_data_to_8023(rx);
         if (unlikely(err))
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         if (!ieee80211_frame_allowed(rx))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         rx->skb->dev = dev;
 
@@ -1420,10 +1388,10 @@ ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
 
         ieee80211_deliver_skb(rx);
 
-        return TXRX_QUEUED;
+        return RX_QUEUED;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_ctrl(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
@@ -1435,15 +1403,15 @@ ieee80211_rx_h_ctrl(struct ieee80211_txrx_data *rx)
         u16 tid;
 
         if (likely((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if ((rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BACK_REQ) {
                 if (!rx->sta)
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
                 tid = le16_to_cpu(bar->control) >> 12;
                 tid_agg_rx = &(rx->sta->ampdu_mlme.tid_rx[tid]);
                 if (tid_agg_rx->state != HT_AGG_STATE_OPERATIONAL)
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
 
                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
 
@@ -1460,19 +1428,19 @@ ieee80211_rx_h_ctrl(struct ieee80211_txrx_data *rx)
                 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
                                                  start_seq_num, 1);
                 rcu_read_unlock();
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata;
 
         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
         if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
@@ -1480,56 +1448,13 @@ ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
             !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
                 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
         else
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
-        return TXRX_QUEUED;
-}
-
-static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
-                                struct ieee80211_local *local,
-                                ieee80211_rx_handler *handlers,
-                                struct ieee80211_txrx_data *rx,
-                                struct sta_info *sta)
-{
-        ieee80211_rx_handler *handler;
-        ieee80211_txrx_result res = TXRX_DROP;
-
-        for (handler = handlers; *handler != NULL; handler++) {
-                res = (*handler)(rx);
-
-                switch (res) {
-                case TXRX_CONTINUE:
-                        continue;
-                case TXRX_DROP:
-                        I802_DEBUG_INC(local->rx_handlers_drop);
-                        if (sta)
-                                sta->rx_dropped++;
-                        break;
-                case TXRX_QUEUED:
-                        I802_DEBUG_INC(local->rx_handlers_queued);
-                        break;
-                }
-                break;
-        }
-
-        if (res == TXRX_DROP)
-                dev_kfree_skb(rx->skb);
-        return res;
-}
-
-static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
-                                                ieee80211_rx_handler *handlers,
-                                                struct ieee80211_txrx_data *rx,
-                                                struct sta_info *sta)
-{
-        if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
-            TXRX_CONTINUE)
-                dev_kfree_skb(rx->skb);
+        return RX_QUEUED;
 }
 
 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
                                             struct ieee80211_hdr *hdr,
-                                            struct sta_info *sta,
                                             struct ieee80211_txrx_data *rx)
 {
         int keyidx, hdrlen;
@@ -1548,7 +1473,7 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
                        dev->name, print_mac(mac, hdr->addr2),
                        print_mac(mac2, hdr->addr1), keyidx);
 
-        if (!sta) {
+        if (!rx->sta) {
                 /*
                  * Some hardware seem to generate incorrect Michael MIC
                  * reports; ignore them to avoid triggering countermeasures.
@@ -1600,7 +1525,88 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
         rx->skb = NULL;
 }
 
-ieee80211_rx_handler ieee80211_rx_handlers[] =
+static void ieee80211_rx_cooked_monitor(struct ieee80211_txrx_data *rx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_local *local = rx->local;
+        struct ieee80211_rtap_hdr {
+                struct ieee80211_radiotap_header hdr;
+                u8 flags;
+                u8 rate;
+                __le16 chan_freq;
+                __le16 chan_flags;
+        } __attribute__ ((packed)) *rthdr;
+        struct sk_buff *skb = rx->skb, *skb2;
+        struct net_device *prev_dev = NULL;
+        struct ieee80211_rx_status *status = rx->u.rx.status;
+
+        if (rx->flags & IEEE80211_TXRXD_RX_CMNTR_REPORTED)
+                goto out_free_skb;
+
+        if (skb_headroom(skb) < sizeof(*rthdr) &&
+            pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
+                goto out_free_skb;
+
+        rthdr = (void *)skb_push(skb, sizeof(*rthdr));
+        memset(rthdr, 0, sizeof(*rthdr));
+        rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
+        rthdr->hdr.it_present =
+                cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
+                            (1 << IEEE80211_RADIOTAP_RATE) |
+                            (1 << IEEE80211_RADIOTAP_CHANNEL));
+
+        rthdr->rate = rx->u.rx.rate->bitrate / 5;
+        rthdr->chan_freq = cpu_to_le16(status->freq);
+
+        if (status->band == IEEE80211_BAND_5GHZ)
+                rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
+                                                IEEE80211_CHAN_5GHZ);
+        else
+                rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
+                                                IEEE80211_CHAN_2GHZ);
+
+        skb_set_mac_header(skb, 0);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR ||
+                    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
+                        continue;
+
+                if (prev_dev) {
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (skb2) {
+                                skb2->dev = prev_dev;
+                                netif_rx(skb2);
+                        }
+                }
+
+                prev_dev = sdata->dev;
+                sdata->dev->stats.rx_packets++;
+                sdata->dev->stats.rx_bytes += skb->len;
+        }
+
+        if (prev_dev) {
+                skb->dev = prev_dev;
+                netif_rx(skb);
+                skb = NULL;
+        } else
+                goto out_free_skb;
+
+        rx->flags |= IEEE80211_TXRXD_RX_CMNTR_REPORTED;
+        return;
+
+ out_free_skb:
+        dev_kfree_skb(skb);
+}
+
+typedef ieee80211_rx_result (*ieee80211_rx_handler)(struct ieee80211_txrx_data *);
+static ieee80211_rx_handler ieee80211_rx_handlers[] =
 {
         ieee80211_rx_h_if_stats,
         ieee80211_rx_h_passive_scan,
@@ -1622,6 +1628,47 @@ ieee80211_rx_handler ieee80211_rx_handlers[] =
         NULL
 };
 
+static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_txrx_data *rx,
+                                         struct sk_buff *skb)
+{
+        ieee80211_rx_handler *handler;
+        ieee80211_rx_result res = RX_DROP_MONITOR;
+
+        rx->skb = skb;
+        rx->sdata = sdata;
+        rx->dev = sdata->dev;
+
+        for (handler = ieee80211_rx_handlers; *handler != NULL; handler++) {
+                res = (*handler)(rx);
+
+                switch (res) {
+                case RX_CONTINUE:
+                        continue;
+                case RX_DROP_UNUSABLE:
+                case RX_DROP_MONITOR:
+                        I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                        if (rx->sta)
+                                rx->sta->rx_dropped++;
+                        break;
+                case RX_QUEUED:
+                        I802_DEBUG_INC(sdata->local->rx_handlers_queued);
+                        break;
+                }
+                break;
+        }
+
+        switch (res) {
+        case RX_CONTINUE:
+        case RX_DROP_MONITOR:
+                ieee80211_rx_cooked_monitor(rx);
+                break;
+        case RX_DROP_UNUSABLE:
+                dev_kfree_skb(rx->skb);
+                break;
+        }
+}
+
 /* main receive path */
 
 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
@@ -1649,7 +1696,10 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_IF_TYPE_IBSS:
                 if (!bssid)
                         return 0;
-                if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+                if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
+                    (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
+                        return 1;
+                else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
@@ -1707,11 +1757,11 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                          struct sk_buff *skb,
                                          struct ieee80211_rx_status *status,
-                                         u32 load)
+                                         u32 load,
+                                         struct ieee80211_rate *rate)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
-        struct sta_info *sta;
         struct ieee80211_hdr *hdr;
         struct ieee80211_txrx_data rx;
         u16 type;
@@ -1727,40 +1777,31 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
         rx.u.rx.status = status;
         rx.u.rx.load = load;
+        rx.u.rx.rate = rate;
         rx.fc = le16_to_cpu(hdr->frame_control);
         type = rx.fc & IEEE80211_FCTL_FTYPE;
 
         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
                 local->dot11ReceivedFragmentCount++;
 
-        sta = rx.sta = sta_info_get(local, hdr->addr2);
-        if (sta) {
+        rx.sta = sta_info_get(local, hdr->addr2);
+        if (rx.sta) {
                 rx.dev = rx.sta->dev;
                 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
         }
 
         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
-                ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
+                ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
                 goto end;
         }
 
         if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
                 rx.flags |= IEEE80211_TXRXD_RXIN_SCAN;
 
-        if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
-                                           sta) != TXRX_CONTINUE)
-                goto end;
-        skb = rx.skb;
+        ieee80211_parse_qos(&rx);
+        ieee80211_verify_ip_alignment(&rx);
 
-        if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) &&
-            !atomic_read(&local->iff_promiscs) &&
-            !is_multicast_ether_addr(hdr->addr1)) {
-                rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
-                ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
-                                             rx.sta);
-                sta_info_put(sta);
-                return;
-        }
+        skb = rx.skb;
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 if (!netif_running(sdata->dev))
@@ -1772,8 +1813,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
                 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
                 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
-                /* prepare_for_handlers can change sta */
-                sta = rx.sta;
 
                 if (!prepares)
                         continue;
@@ -1804,26 +1843,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         continue;
                 }
                 rx.fc = le16_to_cpu(hdr->frame_control);
-                rx.skb = skb_new;
-                rx.dev = prev->dev;
-                rx.sdata = prev;
-                ieee80211_invoke_rx_handlers(local, local->rx_handlers,
-                                             &rx, sta);
+                ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
                 prev = sdata;
         }
         if (prev) {
                 rx.fc = le16_to_cpu(hdr->frame_control);
-                rx.skb = skb;
-                rx.dev = prev->dev;
-                rx.sdata = prev;
-                ieee80211_invoke_rx_handlers(local, local->rx_handlers,
-                                             &rx, sta);
+                ieee80211_invoke_rx_handlers(prev, &rx, skb);
         } else
                 dev_kfree_skb(skb);
 
  end:
-        if (sta)
-                sta_info_put(sta);
+        if (rx.sta)
+                sta_info_put(rx.sta);
 }
 
 #define SEQ_MODULO 0x1000
@@ -1859,6 +1890,8 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         u16 head_seq_num, buf_size;
         int index;
         u32 pkt_load;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate;
 
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
@@ -1889,12 +1922,14 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                 memcpy(&status,
                                         tid_agg_rx->reorder_buf[index]->cb,
                                         sizeof(status));
+                                sband = local->hw.wiphy->bands[status.band];
+                                rate = &sband->bitrates[status.rate_idx];
                                 pkt_load = ieee80211_rx_load_stats(local,
                                                 tid_agg_rx->reorder_buf[index],
-                                                &status);
+                                                &status, rate);
                                 __ieee80211_rx_handle_packet(hw,
                                         tid_agg_rx->reorder_buf[index],
-                                        &status, pkt_load);
+                                        &status, pkt_load, rate);
                                 tid_agg_rx->stored_mpdu_num--;
                                 tid_agg_rx->reorder_buf[index] = NULL;
                         }
@@ -1934,11 +1969,13 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                 /* release the reordered frame back to stack */
                 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
                         sizeof(status));
+                sband = local->hw.wiphy->bands[status.band];
+                rate = &sband->bitrates[status.rate_idx];
                 pkt_load = ieee80211_rx_load_stats(local,
                                         tid_agg_rx->reorder_buf[index],
-                                        &status);
+                                        &status, rate);
                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                                &status, pkt_load);
+                                             &status, pkt_load, rate);
                 tid_agg_rx->stored_mpdu_num--;
                 tid_agg_rx->reorder_buf[index] = NULL;
                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
@@ -2019,6 +2056,25 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
 {
         struct ieee80211_local *local = hw_to_local(hw);
         u32 pkt_load;
+        struct ieee80211_rate *rate = NULL;
+        struct ieee80211_supported_band *sband;
+
+        if (status->band < 0 ||
+            status->band > IEEE80211_NUM_BANDS) {
+                WARN_ON(1);
+                return;
+        }
+
+        sband = local->hw.wiphy->bands[status->band];
+
+        if (!sband ||
+            status->rate_idx < 0 ||
+            status->rate_idx >= sband->n_bitrates) {
+                WARN_ON(1);
+                return;
+        }
+
+        rate = &sband->bitrates[status->rate_idx];
 
         /*
          * key references and virtual interfaces are protected using RCU
@@ -2033,17 +2089,17 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
          * if it was previously present.
          * Also, frames with less than 16 bytes are dropped.
          */
-        skb = ieee80211_rx_monitor(local, skb, status);
+        skb = ieee80211_rx_monitor(local, skb, status, rate);
         if (!skb) {
                 rcu_read_unlock();
                 return;
         }
 
-        pkt_load = ieee80211_rx_load_stats(local, skb, status);
+        pkt_load = ieee80211_rx_load_stats(local, skb, status, rate);
         local->channel_use_raw += pkt_load;
 
         if (!ieee80211_rx_reorder_ampdu(local, skb))
-                __ieee80211_rx_handle_packet(hw, skb, status, pkt_load);
+                __ieee80211_rx_handle_packet(hw, skb, status, pkt_load, rate);
 
         rcu_read_unlock();
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 1f74bd296357..e384e6632d97 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -55,48 +55,34 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         return -ENOENT;
 }
 
-struct sta_info *sta_info_get(struct ieee80211_local *local, u8 *addr)
+/* must hold local->sta_lock */
+static struct sta_info *__sta_info_find(struct ieee80211_local *local,
+                                        u8 *addr)
 {
         struct sta_info *sta;
 
-        read_lock_bh(&local->sta_lock);
         sta = local->sta_hash[STA_HASH(addr)];
         while (sta) {
-                if (memcmp(sta->addr, addr, ETH_ALEN) == 0) {
-                        __sta_info_get(sta);
+                if (compare_ether_addr(sta->addr, addr) == 0)
                         break;
-                }
                 sta = sta->hnext;
         }
-        read_unlock_bh(&local->sta_lock);
-
         return sta;
 }
-EXPORT_SYMBOL(sta_info_get);
 
-int sta_info_min_txrate_get(struct ieee80211_local *local)
+struct sta_info *sta_info_get(struct ieee80211_local *local, u8 *addr)
 {
         struct sta_info *sta;
-        struct ieee80211_hw_mode *mode;
-        int min_txrate = 9999999;
-        int i;
 
         read_lock_bh(&local->sta_lock);
-        mode = local->oper_hw_mode;
-        for (i = 0; i < STA_HASH_SIZE; i++) {
-                sta = local->sta_hash[i];
-                while (sta) {
-                        if (sta->txrate < min_txrate)
-                                min_txrate = sta->txrate;
-                        sta = sta->hnext;
-                }
-        }
+        sta = __sta_info_find(local, addr);
+        if (sta)
+                __sta_info_get(sta);
         read_unlock_bh(&local->sta_lock);
-        if (min_txrate == 9999999)
-                min_txrate = 0;
 
-        return mode->rates[min_txrate].rate;
+        return sta;
 }
+EXPORT_SYMBOL(sta_info_get);
 
 
 static void sta_info_release(struct kref *kref)
@@ -117,8 +103,10 @@ static void sta_info_release(struct kref *kref)
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
                 dev_kfree_skb_any(skb);
         }
-        for (i = 0; i <  STA_TID_NUM; i++)
+        for (i = 0; i <  STA_TID_NUM; i++) {
                 del_timer_sync(&sta->ampdu_mlme.tid_rx[i].session_timer);
+                del_timer_sync(&sta->ampdu_mlme.tid_tx[i].addba_resp_timer);
+        }
         rate_control_free_sta(sta->rate_ctrl, sta->rate_ctrl_priv);
         rate_control_put(sta->rate_ctrl);
         kfree(sta);
@@ -132,8 +120,8 @@ void sta_info_put(struct sta_info *sta)
 EXPORT_SYMBOL(sta_info_put);
 
 
-struct sta_info * sta_info_add(struct ieee80211_local *local,
-                               struct net_device *dev, u8 *addr, gfp_t gfp)
+struct sta_info *sta_info_add(struct ieee80211_local *local,
+                              struct net_device *dev, u8 *addr, gfp_t gfp)
 {
         struct sta_info *sta;
         int i;
@@ -141,7 +129,7 @@ struct sta_info * sta_info_add(struct ieee80211_local *local,
 
         sta = kzalloc(sizeof(*sta), gfp);
         if (!sta)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         kref_init(&sta->kref);
 
@@ -150,30 +138,45 @@ struct sta_info * sta_info_add(struct ieee80211_local *local,
         if (!sta->rate_ctrl_priv) {
                 rate_control_put(sta->rate_ctrl);
                 kfree(sta);
-                return NULL;
+                return ERR_PTR(-ENOMEM);
         }
 
         memcpy(sta->addr, addr, ETH_ALEN);
         sta->local = local;
         sta->dev = dev;
         spin_lock_init(&sta->ampdu_mlme.ampdu_rx);
+        spin_lock_init(&sta->ampdu_mlme.ampdu_tx);
         for (i = 0; i < STA_TID_NUM; i++) {
                 /* timer_to_tid must be initialized with identity mapping to
                  * enable session_timer's data differentiation. refer to
                  * sta_rx_agg_session_timer_expired for useage */
                 sta->timer_to_tid[i] = i;
+                /* tid to tx queue: initialize according to HW (0 is valid) */
+                sta->tid_to_tx_q[i] = local->hw.queues;
                 /* rx timers */
                 sta->ampdu_mlme.tid_rx[i].session_timer.function =
                         sta_rx_agg_session_timer_expired;
                 sta->ampdu_mlme.tid_rx[i].session_timer.data =
                         (unsigned long)&sta->timer_to_tid[i];
                 init_timer(&sta->ampdu_mlme.tid_rx[i].session_timer);
+                /* tx timers */
+                sta->ampdu_mlme.tid_tx[i].addba_resp_timer.function =
+                        sta_addba_resp_timer_expired;
+                sta->ampdu_mlme.tid_tx[i].addba_resp_timer.data =
+                        (unsigned long)&sta->timer_to_tid[i];
+                init_timer(&sta->ampdu_mlme.tid_tx[i].addba_resp_timer);
         }
         skb_queue_head_init(&sta->ps_tx_buf);
         skb_queue_head_init(&sta->tx_filtered);
-        __sta_info_get(sta);    /* sta used by caller, decremented by
-                                 * sta_info_put() */
         write_lock_bh(&local->sta_lock);
+        /* mark sta as used (by caller) */
+        __sta_info_get(sta);
+        /* check if STA exists already */
+        if (__sta_info_find(local, addr)) {
+                write_unlock_bh(&local->sta_lock);
+                sta_info_put(sta);
+                return ERR_PTR(-EEXIST);
+        }
         list_add(&sta->list, &local->sta_list);
         local->num_sta++;
         sta_info_hash_add(local, sta);
@@ -204,6 +207,64 @@ struct sta_info * sta_info_add(struct ieee80211_local *local,
         return sta;
 }
 
+static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
+{
+        /*
+         * This format has been mandated by the IEEE specifications,
+         * so this line may not be changed to use the __set_bit() format.
+         */
+        bss->tim[aid / 8] |= (1 << (aid % 8));
+}
+
+static inline void __bss_tim_clear(struct ieee80211_if_ap *bss, u16 aid)
+{
+        /*
+         * This format has been mandated by the IEEE specifications,
+         * so this line may not be changed to use the __clear_bit() format.
+         */
+        bss->tim[aid / 8] &= ~(1 << (aid % 8));
+}
+
+static void __sta_info_set_tim_bit(struct ieee80211_if_ap *bss,
+                                   struct sta_info *sta)
+{
+        if (bss)
+                __bss_tim_set(bss, sta->aid);
+        if (sta->local->ops->set_tim)
+                sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 1);
+}
+
+void sta_info_set_tim_bit(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
+        read_lock_bh(&sta->local->sta_lock);
+        __sta_info_set_tim_bit(sdata->bss, sta);
+        read_unlock_bh(&sta->local->sta_lock);
+}
+
+static void __sta_info_clear_tim_bit(struct ieee80211_if_ap *bss,
+                                     struct sta_info *sta)
+{
+        if (bss)
+                __bss_tim_clear(bss, sta->aid);
+        if (sta->local->ops->set_tim)
+                sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 0);
+}
+
+void sta_info_clear_tim_bit(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
+        read_lock_bh(&sta->local->sta_lock);
+        __sta_info_clear_tim_bit(sdata->bss, sta);
+        read_unlock_bh(&sta->local->sta_lock);
+}
+
 /* Caller must hold local->sta_lock */
 void sta_info_remove(struct sta_info *sta)
 {
@@ -220,10 +281,9 @@ void sta_info_remove(struct sta_info *sta)
                 sta->flags &= ~WLAN_STA_PS;
                 if (sdata->bss)
                         atomic_dec(&sdata->bss->num_sta_ps);
+                __sta_info_clear_tim_bit(sdata->bss, sta);
         }
         local->num_sta--;
-        sta_info_remove_aid_ptr(sta);
-
 }
 
 void sta_info_free(struct sta_info *sta)
@@ -252,7 +312,7 @@ void sta_info_free(struct sta_info *sta)
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         ieee80211_key_free(sta->key);
-        sta->key = NULL;
+        WARN_ON(sta->key);
 
         if (local->ops->sta_notify) {
                 struct ieee80211_sub_if_data *sdata;
@@ -299,6 +359,7 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
 {
         unsigned long flags;
         struct sk_buff *skb;
+        struct ieee80211_sub_if_data *sdata;
         DECLARE_MAC_BUF(mac);
 
         if (skb_queue_empty(&sta->ps_tx_buf))
@@ -307,21 +368,23 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         for (;;) {
                 spin_lock_irqsave(&sta->ps_tx_buf.lock, flags);
                 skb = skb_peek(&sta->ps_tx_buf);
-                if (sta_info_buffer_expired(local, sta, skb)) {
+                if (sta_info_buffer_expired(local, sta, skb))
                         skb = __skb_dequeue(&sta->ps_tx_buf);
-                        if (skb_queue_empty(&sta->ps_tx_buf))
-                                sta->flags &= ~WLAN_STA_TIM;
-                } else
+                else
                         skb = NULL;
                 spin_unlock_irqrestore(&sta->ps_tx_buf.lock, flags);
 
-                if (skb) {
-                        local->total_ps_buffered--;
-                        printk(KERN_DEBUG "Buffered frame expired (STA "
-                               "%s)\n", print_mac(mac, sta->addr));
-                        dev_kfree_skb(skb);
-                } else
+                if (!skb)
                         break;
+
+                sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+                local->total_ps_buffered--;
+                printk(KERN_DEBUG "Buffered frame expired (STA "
+                       "%s)\n", print_mac(mac, sta->addr));
+                dev_kfree_skb(skb);
+
+                if (skb_queue_empty(&sta->ps_tx_buf))
+                        sta_info_clear_tim_bit(sta);
         }
 }
 
@@ -400,23 +463,6 @@ void sta_info_stop(struct ieee80211_local *local)
         sta_info_flush(local, NULL);
 }
 
-void sta_info_remove_aid_ptr(struct sta_info *sta)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        if (sta->aid <= 0)
-                return;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
-
-        if (sdata->local->ops->set_tim)
-                sdata->local->ops->set_tim(local_to_hw(sdata->local),
-                                          sta->aid, 0);
-        if (sdata->bss)
-                __bss_tim_clear(sdata->bss, sta->aid);
-}
-
-
 /**
  * sta_info_flush - flush matching STA entries from the STA table
  * @local: local interface data
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 96fe3ed95038..86eed40ada78 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -15,31 +15,72 @@
 #include <linux/kref.h>
 #include "ieee80211_key.h"
 
-/* Stations flags (struct sta_info::flags) */
-#define WLAN_STA_AUTH BIT(0)
-#define WLAN_STA_ASSOC BIT(1)
-#define WLAN_STA_PS BIT(2)
-#define WLAN_STA_TIM BIT(3) /* TIM bit is on for PS stations */
-#define WLAN_STA_PERM BIT(4) /* permanent; do not remove entry on expiration */
-#define WLAN_STA_AUTHORIZED BIT(5) /* If 802.1X is used, this flag is
-                                    * controlling whether STA is authorized to
-                                    * send and receive non-IEEE 802.1X frames
-                                    */
-#define WLAN_STA_SHORT_PREAMBLE BIT(7)
-/* whether this is an AP that we are associated with as a client */
-#define WLAN_STA_ASSOC_AP BIT(8)
-#define WLAN_STA_WME BIT(9)
-#define WLAN_STA_WDS BIT(27)
+/**
+ * enum ieee80211_sta_info_flags - Stations flags
+ *
+ * These flags are used with &struct sta_info's @flags member.
+ *
+ * @WLAN_STA_AUTH: Station is authenticated.
+ * @WLAN_STA_ASSOC: Station is associated.
+ * @WLAN_STA_PS: Station is in power-save mode
+ * @WLAN_STA_AUTHORIZED: Station is authorized to send/receive traffic.
+ *      This bit is always checked so needs to be enabled for all stations
+ *      when virtual port control is not in use.
+ * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
+ *      frames.
+ * @WLAN_STA_ASSOC_AP: We're associated to that station, it is an AP.
+ * @WLAN_STA_WME: Station is a QoS-STA.
+ * @WLAN_STA_WDS: Station is one of our WDS peers.
+ * @WLAN_STA_PSPOLL: Station has just PS-polled us.
+ * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
+ *      IEEE80211_TXCTL_CLEAR_PS_FILT control flag) when the next
+ *      frame to this station is transmitted.
+ */
+enum ieee80211_sta_info_flags {
+        WLAN_STA_AUTH           = 1<<0,
+        WLAN_STA_ASSOC          = 1<<1,
+        WLAN_STA_PS             = 1<<2,
+        WLAN_STA_AUTHORIZED     = 1<<3,
+        WLAN_STA_SHORT_PREAMBLE = 1<<4,
+        WLAN_STA_ASSOC_AP       = 1<<5,
+        WLAN_STA_WME            = 1<<6,
+        WLAN_STA_WDS            = 1<<7,
+        WLAN_STA_PSPOLL         = 1<<8,
+        WLAN_STA_CLEAR_PS_FILT  = 1<<9,
+};
 
 #define STA_TID_NUM 16
 #define ADDBA_RESP_INTERVAL HZ
+#define HT_AGG_MAX_RETRIES              (0x3)
 
 #define HT_AGG_STATE_INITIATOR_SHIFT    (4)
 
+#define HT_ADDBA_REQUESTED_MSK          BIT(0)
+#define HT_ADDBA_DRV_READY_MSK          BIT(1)
+#define HT_ADDBA_RECEIVED_MSK           BIT(2)
 #define HT_AGG_STATE_REQ_STOP_BA_MSK    BIT(3)
-
+#define HT_AGG_STATE_INITIATOR_MSK      BIT(HT_AGG_STATE_INITIATOR_SHIFT)
 #define HT_AGG_STATE_IDLE               (0x0)
-#define HT_AGG_STATE_OPERATIONAL        (0x7)
+#define HT_AGG_STATE_OPERATIONAL        (HT_ADDBA_REQUESTED_MSK |       \
+                                         HT_ADDBA_DRV_READY_MSK |       \
+                                         HT_ADDBA_RECEIVED_MSK)
+
+/**
+ * struct tid_ampdu_tx - TID aggregation information (Tx).
+ *
+ * @state: TID's state in session state machine.
+ * @dialog_token: dialog token for aggregation session
+ * @ssn: Starting Sequence Number expected to be aggregated.
+ * @addba_resp_timer: timer for peer's response to addba request
+ * @addba_req_num: number of times addBA request has been sent.
+ */
+struct tid_ampdu_tx {
+        u8 state;
+        u8 dialog_token;
+        u16 ssn;
+        struct timer_list addba_resp_timer;
+        u8 addba_req_num;
+};
 
 /**
  * struct tid_ampdu_rx - TID aggregation information (Rx).
@@ -69,12 +110,18 @@ struct tid_ampdu_rx {
 /**
  * struct sta_ampdu_mlme - STA aggregation information.
  *
- * @tid_agg_info_rx: aggregation info for Rx per TID
+ * @tid_rx: aggregation info for Rx per TID
+ * @tid_tx: aggregation info for Tx per TID
  * @ampdu_rx: for locking sections in aggregation Rx flow
+ * @ampdu_tx: for locking sectionsi in aggregation Tx flow
+ * @dialog_token_allocator: dialog token enumerator for each new session;
  */
 struct sta_ampdu_mlme {
         struct tid_ampdu_rx tid_rx[STA_TID_NUM];
+        struct tid_ampdu_tx tid_tx[STA_TID_NUM];
         spinlock_t ampdu_rx;
+        spinlock_t ampdu_tx;
+        u8 dialog_token_allocator;
 };
 
 struct sta_info {
@@ -90,12 +137,9 @@ struct sta_info {
 
         struct sk_buff_head ps_tx_buf; /* buffer of TX frames for station in
                                         * power saving state */
-        int pspoll; /* whether STA has send a PS Poll frame */
         struct sk_buff_head tx_filtered; /* buffer of TX frames that were
                                           * already given to low-level driver,
                                           * but were filtered */
-        int clear_dst_mask;
-
         unsigned long rx_packets, tx_packets; /* number of RX/TX MSDUs */
         unsigned long rx_bytes, tx_bytes;
         unsigned long tx_retry_failed, tx_retry_count;
@@ -104,10 +148,11 @@ struct sta_info {
         unsigned int wep_weak_iv_count; /* number of RX frames with weak IV */
 
         unsigned long last_rx;
-        u32 supp_rates; /* bitmap of supported rates in local->curr_rates */
-        int txrate; /* index in local->curr_rates */
-        int last_txrate; /* last rate used to send a frame to this STA */
-        int last_nonerp_idx;
+        /* bitmap of supported rates per band */
+        u64 supp_rates[IEEE80211_NUM_BANDS];
+        int txrate_idx;
+        /* last rates used to send a frame to this STA */
+        int last_txrate_idx, last_nonerp_txrate_idx;
 
         struct net_device *dev; /* which net device is this station associated
                                  * to */
@@ -132,8 +177,6 @@ struct sta_info {
         int last_rssi; /* RSSI of last received frame from this STA */
         int last_signal; /* signal of last received frame from this STA */
         int last_noise; /* noise of last received frame from this STA */
-        int last_ack_rssi[3]; /* RSSI of last received ACKs from this STA */
-        unsigned long last_ack;
         int channel_use;
         int channel_use_raw;
 
@@ -148,20 +191,20 @@ struct sta_info {
                                              of this STA */
         struct sta_ampdu_mlme ampdu_mlme;
         u8 timer_to_tid[STA_TID_NUM];   /* convert timer id to tid */
+        u8 tid_to_tx_q[STA_TID_NUM];    /* map tid to tx queue */
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct sta_info_debugfsdentries {
                 struct dentry *dir;
                 struct dentry *flags;
                 struct dentry *num_ps_buf_frames;
-                struct dentry *last_ack_rssi;
-                struct dentry *last_ack_ms;
                 struct dentry *inactive_ms;
                 struct dentry *last_seq_ctrl;
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
                 struct dentry *wme_rx_queue;
                 struct dentry *wme_tx_queue;
 #endif
+                struct dentry *agg_status;
         } debugfs;
 #endif
 };
@@ -191,16 +234,17 @@ static inline void __sta_info_get(struct sta_info *sta)
 }
 
 struct sta_info * sta_info_get(struct ieee80211_local *local, u8 *addr);
-int sta_info_min_txrate_get(struct ieee80211_local *local);
 void sta_info_put(struct sta_info *sta);
-struct sta_info * sta_info_add(struct ieee80211_local *local,
-                               struct net_device *dev, u8 *addr, gfp_t gfp);
+struct sta_info *sta_info_add(struct ieee80211_local *local,
+                              struct net_device *dev, u8 *addr, gfp_t gfp);
 void sta_info_remove(struct sta_info *sta);
 void sta_info_free(struct sta_info *sta);
 void sta_info_init(struct ieee80211_local *local);
 int sta_info_start(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
-void sta_info_remove_aid_ptr(struct sta_info *sta);
 void sta_info_flush(struct ieee80211_local *local, struct net_device *dev);
 
+void sta_info_set_tim_bit(struct sta_info *sta);
+void sta_info_clear_tim_bit(struct sta_info *sta);
+
 #endif /* STA_INFO_H */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 67b509edd431..1cd58e01f1ee 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -92,9 +92,13 @@ static u16 ieee80211_duration(struct ieee80211_txrx_data *tx, int group_addr,
         int rate, mrate, erp, dur, i;
         struct ieee80211_rate *txrate = tx->u.tx.rate;
         struct ieee80211_local *local = tx->local;
-        struct ieee80211_hw_mode *mode = tx->u.tx.mode;
+        struct ieee80211_supported_band *sband;
 
-        erp = txrate->flags & IEEE80211_RATE_ERP;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        erp = 0;
+        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = txrate->flags & IEEE80211_RATE_ERP_G;
 
         /*
          * data and mgmt (except PS Poll):
@@ -150,20 +154,36 @@ static u16 ieee80211_duration(struct ieee80211_txrx_data *tx, int group_addr,
          * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
          */
         rate = -1;
-        mrate = 10; /* use 1 Mbps if everything fails */
-        for (i = 0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *r = &mode->rates[i];
-                if (r->rate > txrate->rate)
-                        break;
+        /* use lowest available if everything fails */
+        mrate = sband->bitrates[0].bitrate;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *r = &sband->bitrates[i];
 
-                if (IEEE80211_RATE_MODULATION(txrate->flags) !=
-                    IEEE80211_RATE_MODULATION(r->flags))
-                        continue;
+                if (r->bitrate > txrate->bitrate)
+                        break;
 
-                if (r->flags & IEEE80211_RATE_BASIC)
-                        rate = r->rate;
-                else if (r->flags & IEEE80211_RATE_MANDATORY)
-                        mrate = r->rate;
+                if (tx->sdata->basic_rates & BIT(i))
+                        rate = r->bitrate;
+
+                switch (sband->band) {
+                case IEEE80211_BAND_2GHZ: {
+                        u32 flag;
+                        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                                flag = IEEE80211_RATE_MANDATORY_G;
+                        else
+                                flag = IEEE80211_RATE_MANDATORY_B;
+                        if (r->flags & flag)
+                                mrate = r->bitrate;
+                        break;
+                }
+                case IEEE80211_BAND_5GHZ:
+                        if (r->flags & IEEE80211_RATE_MANDATORY_A)
+                                mrate = r->bitrate;
+                        break;
+                case IEEE80211_NUM_BANDS:
+                        WARN_ON(1);
+                        break;
+                }
         }
         if (rate == -1) {
                 /* No matching basic rate found; use highest suitable mandatory
@@ -184,7 +204,7 @@ static u16 ieee80211_duration(struct ieee80211_txrx_data *tx, int group_addr,
                 dur *= 2; /* ACK + SIFS */
                 /* next fragment */
                 dur += ieee80211_frame_duration(local, next_frag_len,
-                                txrate->rate, erp,
+                                txrate->bitrate, erp,
                                 tx->sdata->bss_conf.use_short_preamble);
         }
 
@@ -212,7 +232,7 @@ static int inline is_ieee80211_device(struct net_device *dev,
 
 /* tx handlers */
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
 {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -222,15 +242,15 @@ ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
         u32 sta_flags;
 
         if (unlikely(tx->flags & IEEE80211_TXRXD_TX_INJECTED))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         if (unlikely(tx->local->sta_sw_scanning) &&
             ((tx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
              (tx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PROBE_REQ))
-                return TXRX_DROP;
+                return TX_DROP;
 
         if (tx->flags & IEEE80211_TXRXD_TXPS_BUFFERED)
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         sta_flags = tx->sta ? tx->sta->flags : 0;
 
@@ -245,7 +265,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
                                tx->dev->name, print_mac(mac, hdr->addr1));
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
-                        return TXRX_DROP;
+                        return TX_DROP;
                 }
         } else {
                 if (unlikely((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
@@ -255,15 +275,15 @@ ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
                          * No associated STAs - no need to send multicast
                          * frames.
                          */
-                        return TXRX_DROP;
+                        return TX_DROP;
                 }
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_sequence(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
@@ -271,7 +291,7 @@ ieee80211_tx_h_sequence(struct ieee80211_txrx_data *tx)
         if (ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control)) >= 24)
                 ieee80211_include_sequence(tx->sdata, hdr);
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 /* This function is called whenever the AP is about to exceed the maximum limit
@@ -321,7 +341,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
                wiphy_name(local->hw.wiphy), purged);
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_txrx_data *tx)
 {
         /*
@@ -334,11 +354,11 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_txrx_data *tx)
 
         /* not AP/IBSS or ordered frame */
         if (!tx->sdata->bss || (tx->fc & IEEE80211_FCTL_ORDER))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         /* no stations in PS mode */
         if (!atomic_read(&tx->sdata->bss->num_sta_ps))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         /* buffered in mac80211 */
         if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) {
@@ -355,16 +375,16 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_txrx_data *tx)
                 } else
                         tx->local->total_ps_buffered++;
                 skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
-                return TXRX_QUEUED;
+                return TX_QUEUED;
         }
 
         /* buffered in hardware */
         tx->u.tx.control->flags |= IEEE80211_TXCTL_SEND_AFTER_DTIM;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
 {
         struct sta_info *sta = tx->sta;
@@ -373,9 +393,10 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
         if (unlikely(!sta ||
                      ((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
                       (tx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP)))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
-        if (unlikely((sta->flags & WLAN_STA_PS) && !sta->pspoll)) {
+        if (unlikely((sta->flags & WLAN_STA_PS) &&
+                     !(sta->flags & WLAN_STA_PSPOLL))) {
                 struct ieee80211_tx_packet_data *pkt_data;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS buffer (entries "
@@ -383,7 +404,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
                        print_mac(mac, sta->addr), sta->aid,
                        skb_queue_len(&sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-                sta->flags |= WLAN_STA_TIM;
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
                         purge_old_ps_buffers(tx->local);
                 if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
@@ -396,18 +416,15 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
                         dev_kfree_skb(old);
                 } else
                         tx->local->total_ps_buffered++;
+
                 /* Queue frame to be sent after STA sends an PS Poll frame */
-                if (skb_queue_empty(&sta->ps_tx_buf)) {
-                        if (tx->local->ops->set_tim)
-                                tx->local->ops->set_tim(local_to_hw(tx->local),
-                                                       sta->aid, 1);
-                        if (tx->sdata->bss)
-                                bss_tim_set(tx->local, tx->sdata->bss, sta->aid);
-                }
+                if (skb_queue_empty(&sta->ps_tx_buf))
+                        sta_info_set_tim_bit(sta);
+
                 pkt_data = (struct ieee80211_tx_packet_data *)tx->skb->cb;
                 pkt_data->jiffies = jiffies;
                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
-                return TXRX_QUEUED;
+                return TX_QUEUED;
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         else if (unlikely(sta->flags & WLAN_STA_PS)) {
@@ -416,16 +433,16 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
                        print_mac(mac, sta->addr));
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        sta->pspoll = 0;
+        sta->flags &= ~WLAN_STA_PSPOLL;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_ps_buf(struct ieee80211_txrx_data *tx)
 {
         if (unlikely(tx->flags & IEEE80211_TXRXD_TXPS_BUFFERED))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         if (tx->flags & IEEE80211_TXRXD_TXUNICAST)
                 return ieee80211_tx_h_unicast_ps_buf(tx);
@@ -433,7 +450,7 @@ ieee80211_tx_h_ps_buf(struct ieee80211_txrx_data *tx)
                 return ieee80211_tx_h_multicast_ps_buf(tx);
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_select_key(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_key *key;
@@ -449,7 +466,7 @@ ieee80211_tx_h_select_key(struct ieee80211_txrx_data *tx)
                  !(tx->u.tx.control->flags & IEEE80211_TXCTL_EAPOL_FRAME) &&
                  !(tx->flags & IEEE80211_TXRXD_TX_INJECTED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
-                return TXRX_DROP;
+                return TX_DROP;
         } else
                 tx->key = NULL;
 
@@ -478,10 +495,10 @@ ieee80211_tx_h_select_key(struct ieee80211_txrx_data *tx)
         if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
                 tx->u.tx.control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
@@ -493,7 +510,7 @@ ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
         int frag_threshold = tx->local->fragmentation_threshold;
 
         if (!(tx->flags & IEEE80211_TXRXD_FRAGMENTED))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         first = tx->skb;
 
@@ -547,7 +564,7 @@ ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
         tx->u.tx.num_extra_frag = num_fragm - 1;
         tx->u.tx.extra_frag = frags;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 
  fail:
         printk(KERN_DEBUG "%s: failed to fragment frame\n", tx->dev->name);
@@ -558,14 +575,14 @@ ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
                 kfree(frags);
         }
         I802_DEBUG_INC(tx->local->tx_handlers_drop_fragment);
-        return TXRX_DROP;
+        return TX_DROP;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_encrypt(struct ieee80211_txrx_data *tx)
 {
         if (!tx->key)
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         switch (tx->key->conf.alg) {
         case ALG_WEP:
@@ -578,33 +595,35 @@ ieee80211_tx_h_encrypt(struct ieee80211_txrx_data *tx)
 
         /* not reached */
         WARN_ON(1);
-        return TXRX_DROP;
+        return TX_DROP;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_rate_ctrl(struct ieee80211_txrx_data *tx)
 {
         struct rate_selection rsel;
+        struct ieee80211_supported_band *sband;
+
+        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
 
         if (likely(!tx->u.tx.rate)) {
-                rate_control_get_rate(tx->dev, tx->u.tx.mode, tx->skb, &rsel);
+                rate_control_get_rate(tx->dev, sband, tx->skb, &rsel);
                 tx->u.tx.rate = rsel.rate;
-                if (unlikely(rsel.probe != NULL)) {
+                if (unlikely(rsel.probe)) {
                         tx->u.tx.control->flags |=
                                 IEEE80211_TXCTL_RATE_CTRL_PROBE;
                         tx->flags |= IEEE80211_TXRXD_TXPROBE_LAST_FRAG;
-                        tx->u.tx.control->alt_retry_rate = tx->u.tx.rate->val;
+                        tx->u.tx.control->alt_retry_rate = tx->u.tx.rate;
                         tx->u.tx.rate = rsel.probe;
                 } else
-                        tx->u.tx.control->alt_retry_rate = -1;
+                        tx->u.tx.control->alt_retry_rate = NULL;
 
                 if (!tx->u.tx.rate)
-                        return TXRX_DROP;
+                        return TX_DROP;
         } else
-                tx->u.tx.control->alt_retry_rate = -1;
+                tx->u.tx.control->alt_retry_rate = NULL;
 
-        if (tx->u.tx.mode->mode == MODE_IEEE80211G &&
-            tx->sdata->bss_conf.use_cts_prot &&
+        if (tx->sdata->bss_conf.use_cts_prot &&
             (tx->flags & IEEE80211_TXRXD_FRAGMENTED) && rsel.nonerp) {
                 tx->u.tx.last_frag_rate = tx->u.tx.rate;
                 if (rsel.probe)
@@ -612,25 +631,24 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_txrx_data *tx)
                 else
                         tx->flags |= IEEE80211_TXRXD_TXPROBE_LAST_FRAG;
                 tx->u.tx.rate = rsel.nonerp;
-                tx->u.tx.control->rate = rsel.nonerp;
+                tx->u.tx.control->tx_rate = rsel.nonerp;
                 tx->u.tx.control->flags &= ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
         } else {
                 tx->u.tx.last_frag_rate = tx->u.tx.rate;
-                tx->u.tx.control->rate = tx->u.tx.rate;
+                tx->u.tx.control->tx_rate = tx->u.tx.rate;
         }
-        tx->u.tx.control->tx_rate = tx->u.tx.rate->val;
+        tx->u.tx.control->tx_rate = tx->u.tx.rate;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
         u16 fc = le16_to_cpu(hdr->frame_control);
         u16 dur;
         struct ieee80211_tx_control *control = tx->u.tx.control;
-        struct ieee80211_hw_mode *mode = tx->u.tx.mode;
 
         if (!control->retry_limit) {
                 if (!is_multicast_ether_addr(hdr->addr1)) {
@@ -657,14 +675,14 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
                  * frames.
                  * TODO: The last fragment could still use multiple retry
                  * rates. */
-                control->alt_retry_rate = -1;
+                control->alt_retry_rate = NULL;
         }
 
         /* Use CTS protection for unicast frames sent using extended rates if
          * there are associated non-ERP stations and RTS/CTS is not configured
          * for the frame. */
-        if (mode->mode == MODE_IEEE80211G &&
-            (tx->u.tx.rate->flags & IEEE80211_RATE_ERP) &&
+        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
+            (tx->u.tx.rate->flags & IEEE80211_RATE_ERP_G) &&
             (tx->flags & IEEE80211_TXRXD_TXUNICAST) &&
             tx->sdata->bss_conf.use_cts_prot &&
             !(control->flags & IEEE80211_TXCTL_USE_RTS_CTS))
@@ -674,10 +692,10 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
          * short preambles at the selected rate and short preambles are
          * available on the network at the current point in time. */
         if (((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
-            (tx->u.tx.rate->flags & IEEE80211_RATE_PREAMBLE2) &&
+            (tx->u.tx.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
             tx->sdata->bss_conf.use_short_preamble &&
             (!tx->sta || (tx->sta->flags & WLAN_STA_SHORT_PREAMBLE))) {
-                tx->u.tx.control->tx_rate = tx->u.tx.rate->val2;
+                tx->u.tx.control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
         }
 
         /* Setup duration field for the first fragment of the frame. Duration
@@ -690,19 +708,33 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
 
         if ((control->flags & IEEE80211_TXCTL_USE_RTS_CTS) ||
             (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)) {
-                struct ieee80211_rate *rate;
+                struct ieee80211_supported_band *sband;
+                struct ieee80211_rate *rate, *baserate;
+                int idx;
+
+                sband = tx->local->hw.wiphy->bands[
+                                tx->local->hw.conf.channel->band];
 
                 /* Do not use multiple retry rates when using RTS/CTS */
-                control->alt_retry_rate = -1;
+                control->alt_retry_rate = NULL;
 
                 /* Use min(data rate, max base rate) as CTS/RTS rate */
                 rate = tx->u.tx.rate;
-                while (rate > mode->rates &&
-                       !(rate->flags & IEEE80211_RATE_BASIC))
-                        rate--;
+                baserate = NULL;
 
-                control->rts_cts_rate = rate->val;
-                control->rts_rate = rate;
+                for (idx = 0; idx < sband->n_bitrates; idx++) {
+                        if (sband->bitrates[idx].bitrate > rate->bitrate)
+                                continue;
+                        if (tx->sdata->basic_rates & BIT(idx) &&
+                            (!baserate ||
+                             (baserate->bitrate < sband->bitrates[idx].bitrate)))
+                                baserate = &sband->bitrates[idx];
+                }
+
+                if (baserate)
+                        control->rts_cts_rate = baserate;
+                else
+                        control->rts_cts_rate = &sband->bitrates[0];
         }
 
         if (tx->sta) {
@@ -719,17 +751,17 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_local *local = tx->local;
-        struct ieee80211_hw_mode *mode = tx->u.tx.mode;
         struct sk_buff *skb = tx->skb;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u32 load = 0, hdrtime;
+        struct ieee80211_rate *rate = tx->u.tx.rate;
 
         /* TODO: this could be part of tx_status handling, so that the number
          * of retries would be known; TX rate should in that case be stored
@@ -740,9 +772,9 @@ ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
         /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
          * 1 usec = 1/8 * (1080 / 10) = 13.5 */
 
-        if (mode->mode == MODE_IEEE80211A ||
-            (mode->mode == MODE_IEEE80211G &&
-             tx->u.tx.rate->flags & IEEE80211_RATE_ERP))
+        if (tx->u.tx.channel->band == IEEE80211_BAND_5GHZ ||
+            (tx->u.tx.channel->band == IEEE80211_BAND_2GHZ &&
+             rate->flags & IEEE80211_RATE_ERP_G))
                 hdrtime = CHAN_UTIL_HDR_SHORT;
         else
                 hdrtime = CHAN_UTIL_HDR_LONG;
@@ -756,14 +788,15 @@ ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
         else if (tx->u.tx.control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
                 load += hdrtime;
 
-        load += skb->len * tx->u.tx.rate->rate_inv;
+        /* TODO: optimise again */
+        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
 
         if (tx->u.tx.extra_frag) {
                 int i;
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         load += 2 * hdrtime;
                         load += tx->u.tx.extra_frag[i]->len *
-                                tx->u.tx.rate->rate;
+                                tx->u.tx.rate->bitrate;
                 }
         }
 
@@ -774,13 +807,12 @@ ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
                 tx->sta->channel_use_raw += load;
         tx->sdata->channel_use_raw += load;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-/* TODO: implement register/unregister functions for adding TX/RX handlers
- * into ordered list */
 
-ieee80211_tx_handler ieee80211_tx_handlers[] =
+typedef ieee80211_tx_result (*ieee80211_tx_handler)(struct ieee80211_txrx_data *);
+static ieee80211_tx_handler ieee80211_tx_handlers[] =
 {
         ieee80211_tx_h_check_assoc,
         ieee80211_tx_h_sequence,
@@ -801,7 +833,7 @@ ieee80211_tx_handler ieee80211_tx_handlers[] =
  * deal with packet injection down monitor interface
  * with Radiotap Header -- only called for monitor mode interface
  */
-static ieee80211_txrx_result
+static ieee80211_tx_result
 __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                               struct sk_buff *skb)
 {
@@ -816,10 +848,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
         struct ieee80211_radiotap_iterator iterator;
         struct ieee80211_radiotap_header *rthdr =
                 (struct ieee80211_radiotap_header *) skb->data;
-        struct ieee80211_hw_mode *mode = tx->local->hw.conf.mode;
+        struct ieee80211_supported_band *sband;
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
         struct ieee80211_tx_control *control = tx->u.tx.control;
 
+        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
+
         control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
         tx->flags |= IEEE80211_TXRXD_TX_INJECTED;
         tx->flags &= ~IEEE80211_TXRXD_FRAGMENTED;
@@ -852,10 +886,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                          * ieee80211 rate int is in 100kbps units eg, 0x0a=1Mbps
                          */
                         target_rate = (*iterator.this_arg) * 5;
-                        for (i = 0; i < mode->num_rates; i++) {
-                                struct ieee80211_rate *r = &mode->rates[i];
+                        for (i = 0; i < sband->n_bitrates; i++) {
+                                struct ieee80211_rate *r;
+
+                                r = &sband->bitrates[i];
 
-                                if (r->rate == target_rate) {
+                                if (r->bitrate == target_rate) {
                                         tx->u.tx.rate = r;
                                         break;
                                 }
@@ -870,9 +906,11 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                         control->antenna_sel_tx = (*iterator.this_arg) + 1;
                         break;
 
+#if 0
                 case IEEE80211_RADIOTAP_DBM_TX_POWER:
                         control->power_level = *iterator.this_arg;
                         break;
+#endif
 
                 case IEEE80211_RADIOTAP_FLAGS:
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
@@ -884,7 +922,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                                  * on transmission
                                  */
                                 if (skb->len < (iterator.max_length + FCS_LEN))
-                                        return TXRX_DROP;
+                                        return TX_DROP;
 
                                 skb_trim(skb, skb->len - FCS_LEN);
                         }
@@ -907,7 +945,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
         }
 
         if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
-                return TXRX_DROP;
+                return TX_DROP;
 
         /*
          * remove the radiotap header
@@ -916,13 +954,13 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
          */
         skb_pull(skb, iterator.max_length);
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 /*
  * initialises @tx
  */
-static ieee80211_txrx_result
+static ieee80211_tx_result
 __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
                        struct sk_buff *skb,
                        struct net_device *dev,
@@ -949,8 +987,8 @@ __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
         /* process and remove the injection radiotap header */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (unlikely(sdata->vif.type == IEEE80211_IF_TYPE_MNTR)) {
-                if (__ieee80211_parse_tx_radiotap(tx, skb) == TXRX_DROP)
-                        return TXRX_DROP;
+                if (__ieee80211_parse_tx_radiotap(tx, skb) == TX_DROP)
+                        return TX_DROP;
 
                 /*
                  * __ieee80211_parse_tx_radiotap has now removed
@@ -982,10 +1020,10 @@ __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
         }
 
         if (!tx->sta)
-                control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
-        else if (tx->sta->clear_dst_mask) {
-                control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
-                tx->sta->clear_dst_mask = 0;
+                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
+        else if (tx->sta->flags & WLAN_STA_CLEAR_PS_FILT) {
+                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
+                tx->sta->flags &= ~WLAN_STA_CLEAR_PS_FILT;
         }
 
         hdrlen = ieee80211_get_hdrlen(tx->fc);
@@ -995,7 +1033,7 @@ __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
         }
         control->flags |= IEEE80211_TXCTL_FIRST_FRAGMENT;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 /*
@@ -1046,7 +1084,7 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
         if (tx->u.tx.extra_frag) {
                 control->flags &= ~(IEEE80211_TXCTL_USE_RTS_CTS |
                                     IEEE80211_TXCTL_USE_CTS_PROTECT |
-                                    IEEE80211_TXCTL_CLEAR_DST_MASK |
+                                    IEEE80211_TXCTL_CLEAR_PS_FILT |
                                     IEEE80211_TXCTL_FIRST_FRAGMENT);
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         if (!tx->u.tx.extra_frag[i])
@@ -1054,8 +1092,8 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                         if (__ieee80211_queue_stopped(local, control->queue))
                                 return IEEE80211_TX_FRAG_AGAIN;
                         if (i == tx->u.tx.num_extra_frag) {
-                                control->tx_rate = tx->u.tx.last_frag_hwrate;
-                                control->rate = tx->u.tx.last_frag_rate;
+                                control->tx_rate = tx->u.tx.last_frag_rate;
+
                                 if (tx->flags & IEEE80211_TXRXD_TXPROBE_LAST_FRAG)
                                         control->flags |=
                                                 IEEE80211_TXCTL_RATE_CTRL_PROBE;
@@ -1089,7 +1127,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         struct sta_info *sta;
         ieee80211_tx_handler *handler;
         struct ieee80211_txrx_data tx;
-        ieee80211_txrx_result res = TXRX_DROP, res_prepare;
+        ieee80211_tx_result res = TX_DROP, res_prepare;
         int ret, i;
 
         WARN_ON(__ieee80211_queue_pending(local, control->queue));
@@ -1102,7 +1140,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         /* initialises tx */
         res_prepare = __ieee80211_tx_prepare(&tx, skb, dev, control);
 
-        if (res_prepare == TXRX_DROP) {
+        if (res_prepare == TX_DROP) {
                 dev_kfree_skb(skb);
                 return 0;
         }
@@ -1114,12 +1152,12 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         rcu_read_lock();
 
         sta = tx.sta;
-        tx.u.tx.mode = local->hw.conf.mode;
+        tx.u.tx.channel = local->hw.conf.channel;
 
-        for (handler = local->tx_handlers; *handler != NULL;
+        for (handler = ieee80211_tx_handlers; *handler != NULL;
              handler++) {
                 res = (*handler)(&tx);
-                if (res != TXRX_CONTINUE)
+                if (res != TX_CONTINUE)
                         break;
         }
 
@@ -1128,12 +1166,12 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         if (sta)
                 sta_info_put(sta);
 
-        if (unlikely(res == TXRX_DROP)) {
+        if (unlikely(res == TX_DROP)) {
                 I802_DEBUG_INC(local->tx_handlers_drop);
                 goto drop;
         }
 
-        if (unlikely(res == TXRX_QUEUED)) {
+        if (unlikely(res == TX_QUEUED)) {
                 I802_DEBUG_INC(local->tx_handlers_queued);
                 rcu_read_unlock();
                 return 0;
@@ -1151,7 +1189,6 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
                         } else {
                                 next_len = 0;
                                 tx.u.tx.rate = tx.u.tx.last_frag_rate;
-                                tx.u.tx.last_frag_hwrate = tx.u.tx.rate->val;
                         }
                         dur = ieee80211_duration(&tx, 0, next_len);
                         hdr->duration_id = cpu_to_le16(dur);
@@ -1188,7 +1225,6 @@ retry:
                 store->skb = skb;
                 store->extra_frag = tx.u.tx.extra_frag;
                 store->num_extra_frag = tx.u.tx.num_extra_frag;
-                store->last_frag_hwrate = tx.u.tx.last_frag_hwrate;
                 store->last_frag_rate = tx.u.tx.last_frag_rate;
                 store->last_frag_rate_ctrl_probe =
                         !!(tx.flags & IEEE80211_TXRXD_TXPROBE_LAST_FRAG);
@@ -1260,6 +1296,8 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                 control.flags |= IEEE80211_TXCTL_REQUEUE;
         if (pkt_data->flags & IEEE80211_TXPD_EAPOL_FRAME)
                 control.flags |= IEEE80211_TXCTL_EAPOL_FRAME;
+        if (pkt_data->flags & IEEE80211_TXPD_AMPDU)
+                control.flags |= IEEE80211_TXCTL_AMPDU;
         control.queue = pkt_data->queue;
 
         ret = ieee80211_tx(odev, skb, &control);
@@ -1409,10 +1447,17 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
-        sta = sta_info_get(local, hdr.addr1);
-        if (sta) {
-                sta_flags = sta->flags;
-                sta_info_put(sta);
+        /*
+         * There's no need to try to look up the destination
+         * if it is a multicast address (which can only happen
+         * in AP mode)
+         */
+        if (!is_multicast_ether_addr(hdr.addr1)) {
+                sta = sta_info_get(local, hdr.addr1);
+                if (sta) {
+                        sta_flags = sta->flags;
+                        sta_info_put(sta);
+                }
         }
 
         /* receiver is QoS enabled, use a QoS type frame */
@@ -1422,10 +1467,10 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         }
 
         /*
-         * If port access control is enabled, drop frames to unauthorised
-         * stations unless they are EAPOL frames from the local station.
+         * Drop unicast frames to unauthorised stations unless they are
+         * EAPOL frames from the local station.
          */
-        if (unlikely(sdata->ieee802_1x_pac &&
+        if (unlikely(!is_multicast_ether_addr(hdr.addr1) &&
                      !(sta_flags & WLAN_STA_AUTHORIZED) &&
                      !(ethertype == ETH_P_PAE &&
                        compare_ether_addr(dev->dev_addr,
@@ -1598,7 +1643,6 @@ void ieee80211_tx_pending(unsigned long data)
                 tx.u.tx.control = &store->control;
                 tx.u.tx.extra_frag = store->extra_frag;
                 tx.u.tx.num_extra_frag = store->num_extra_frag;
-                tx.u.tx.last_frag_hwrate = store->last_frag_hwrate;
                 tx.u.tx.last_frag_rate = store->last_frag_rate;
                 tx.flags = 0;
                 if (store->last_frag_rate_ctrl_probe)
@@ -1701,6 +1745,9 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_if_ap *ap = NULL;
         struct rate_selection rsel;
         struct beacon_data *beacon;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         rcu_read_lock();
 
@@ -1739,8 +1786,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                        beacon->tail_len);
 
         if (control) {
-                rate_control_get_rate(local->mdev, local->oper_hw_mode, skb,
-                                      &rsel);
+                rate_control_get_rate(local->mdev, sband, skb, &rsel);
                 if (!rsel.rate) {
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
@@ -1753,15 +1799,14 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 }
 
                 control->vif = vif;
-                control->tx_rate =
-                        (sdata->bss_conf.use_short_preamble &&
-                        (rsel.rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
-                        rsel.rate->val2 : rsel.rate->val;
+                control->tx_rate = rsel.rate;
+                if (sdata->bss_conf.use_short_preamble &&
+                    rsel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
                 control->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control->power_level = local->hw.conf.power_level;
                 control->flags |= IEEE80211_TXCTL_NO_ACK;
                 control->retry_limit = 1;
-                control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
+                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
         }
 
         ap->num_beacons++;
@@ -1815,7 +1860,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         struct sta_info *sta;
         ieee80211_tx_handler *handler;
         struct ieee80211_txrx_data tx;
-        ieee80211_txrx_result res = TXRX_DROP;
+        ieee80211_tx_result res = TX_DROP;
         struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_ap *bss = NULL;
@@ -1863,20 +1908,20 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         }
         sta = tx.sta;
         tx.flags |= IEEE80211_TXRXD_TXPS_BUFFERED;
-        tx.u.tx.mode = local->hw.conf.mode;
+        tx.u.tx.channel = local->hw.conf.channel;
 
-        for (handler = local->tx_handlers; *handler != NULL; handler++) {
+        for (handler = ieee80211_tx_handlers; *handler != NULL; handler++) {
                 res = (*handler)(&tx);
-                if (res == TXRX_DROP || res == TXRX_QUEUED)
+                if (res == TX_DROP || res == TX_QUEUED)
                         break;
         }
         skb = tx.skb; /* handlers are allowed to change skb */
 
-        if (res == TXRX_DROP) {
+        if (res == TX_DROP) {
                 I802_DEBUG_INC(local->tx_handlers_drop);
                 dev_kfree_skb(skb);
                 skb = NULL;
-        } else if (res == TXRX_QUEUED) {
+        } else if (res == TX_QUEUED) {
                 I802_DEBUG_INC(local->tx_handlers_queued);
                 skb = NULL;
         }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 5e631ce98d7e..f64804fed0a9 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -41,92 +41,6 @@ const unsigned char bridge_tunnel_header[] =
         { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 
 
-static int rate_list_match(const int *rate_list, int rate)
-{
-        int i;
-
-        if (!rate_list)
-                return 0;
-
-        for (i = 0; rate_list[i] >= 0; i++)
-                if (rate_list[i] == rate)
-                        return 1;
-
-        return 0;
-}
-
-void ieee80211_prepare_rates(struct ieee80211_local *local,
-                             struct ieee80211_hw_mode *mode)
-{
-        int i;
-
-        for (i = 0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *rate = &mode->rates[i];
-
-                rate->flags &= ~(IEEE80211_RATE_SUPPORTED |
-                                 IEEE80211_RATE_BASIC);
-
-                if (local->supp_rates[mode->mode]) {
-                        if (!rate_list_match(local->supp_rates[mode->mode],
-                                             rate->rate))
-                                continue;
-                }
-
-                rate->flags |= IEEE80211_RATE_SUPPORTED;
-
-                /* Use configured basic rate set if it is available. If not,
-                 * use defaults that are sane for most cases. */
-                if (local->basic_rates[mode->mode]) {
-                        if (rate_list_match(local->basic_rates[mode->mode],
-                                            rate->rate))
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                } else switch (mode->mode) {
-                case MODE_IEEE80211A:
-                        if (rate->rate == 60 || rate->rate == 120 ||
-                            rate->rate == 240)
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                        break;
-                case MODE_IEEE80211B:
-                        if (rate->rate == 10 || rate->rate == 20)
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                        break;
-                case MODE_IEEE80211G:
-                        if (rate->rate == 10 || rate->rate == 20 ||
-                            rate->rate == 55 || rate->rate == 110)
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                        break;
-                case NUM_IEEE80211_MODES:
-                        /* not useful */
-                        break;
-                }
-
-                /* Set ERP and MANDATORY flags based on phymode */
-                switch (mode->mode) {
-                case MODE_IEEE80211A:
-                        if (rate->rate == 60 || rate->rate == 120 ||
-                            rate->rate == 240)
-                                rate->flags |= IEEE80211_RATE_MANDATORY;
-                        break;
-                case MODE_IEEE80211B:
-                        if (rate->rate == 10)
-                                rate->flags |= IEEE80211_RATE_MANDATORY;
-                        break;
-                case MODE_IEEE80211G:
-                        if (rate->rate == 10 || rate->rate == 20 ||
-                            rate->rate == 55 || rate->rate == 110 ||
-                            rate->rate == 60 || rate->rate == 120 ||
-                            rate->rate == 240)
-                                rate->flags |= IEEE80211_RATE_MANDATORY;
-                        break;
-                case NUM_IEEE80211_MODES:
-                        /* not useful */
-                        break;
-                }
-                if (ieee80211_is_erp_rate(mode->mode, rate->rate))
-                        rate->flags |= IEEE80211_RATE_ERP;
-        }
-}
-
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum ieee80211_if_types type)
 {
@@ -262,7 +176,7 @@ int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
          * DIV_ROUND_UP() operations.
          */
 
-        if (local->hw.conf.phymode == MODE_IEEE80211A || erp) {
+        if (local->hw.conf.channel->band == IEEE80211_BAND_5GHZ || erp) {
                 /*
                  * OFDM:
                  *
@@ -304,15 +218,19 @@ int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
 /* Exported duration function for driver use */
 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif,
-                                        size_t frame_len, int rate)
+                                        size_t frame_len,
+                                        struct ieee80211_rate *rate)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         u16 dur;
         int erp;
 
-        erp = ieee80211_is_erp_rate(hw->conf.phymode, rate);
-        dur = ieee80211_frame_duration(local, frame_len, rate, erp,
+        erp = 0;
+        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = rate->flags & IEEE80211_RATE_ERP_G;
+
+        dur = ieee80211_frame_duration(local, frame_len, rate->bitrate, erp,
                                        sdata->bss_conf.use_short_preamble);
 
         return cpu_to_le16(dur);
@@ -332,17 +250,20 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_rate;
-        erp = !!(rate->flags & IEEE80211_RATE_ERP);
+        rate = frame_txctl->rts_cts_rate;
+
+        erp = 0;
+        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = rate->flags & IEEE80211_RATE_ERP_G;
 
         /* CTS duration */
-        dur = ieee80211_frame_duration(local, 10, rate->rate,
+        dur = ieee80211_frame_duration(local, 10, rate->bitrate,
                                        erp, short_preamble);
         /* Data frame duration */
-        dur += ieee80211_frame_duration(local, frame_len, rate->rate,
+        dur += ieee80211_frame_duration(local, frame_len, rate->bitrate,
                                         erp, short_preamble);
         /* ACK duration */
-        dur += ieee80211_frame_duration(local, 10, rate->rate,
+        dur += ieee80211_frame_duration(local, 10, rate->bitrate,
                                         erp, short_preamble);
 
         return cpu_to_le16(dur);
@@ -363,15 +284,17 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_rate;
-        erp = !!(rate->flags & IEEE80211_RATE_ERP);
+        rate = frame_txctl->rts_cts_rate;
+        erp = 0;
+        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = rate->flags & IEEE80211_RATE_ERP_G;
 
         /* Data frame duration */
-        dur = ieee80211_frame_duration(local, frame_len, rate->rate,
+        dur = ieee80211_frame_duration(local, frame_len, rate->bitrate,
                                        erp, short_preamble);
         if (!(frame_txctl->flags & IEEE80211_TXCTL_NO_ACK)) {
                 /* ACK duration */
-                dur += ieee80211_frame_duration(local, 10, rate->rate,
+                dur += ieee80211_frame_duration(local, 10, rate->bitrate,
                                                 erp, short_preamble);
         }
 
@@ -379,27 +302,6 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 
-struct ieee80211_rate *
-ieee80211_get_rate(struct ieee80211_local *local, int phymode, int hw_rate)
-{
-        struct ieee80211_hw_mode *mode;
-        int r;
-
-        list_for_each_entry(mode, &local->modes_list, list) {
-                if (mode->mode != phymode)
-                        continue;
-                for (r = 0; r < mode->num_rates; r++) {
-                        struct ieee80211_rate *rate = &mode->rates[r];
-                        if (rate->val == hw_rate ||
-                            (rate->flags & IEEE80211_RATE_PREAMBLE2 &&
-                             rate->val2 == hw_rate))
-                                return rate;
-                }
-        }
-
-        return NULL;
-}
-
 void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index a0cff72a580b..a33ef5cfa9ad 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -305,13 +305,13 @@ u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
         return NULL;
 }
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx)
 {
         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
              (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) {
                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
@@ -320,7 +320,7 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx)
                                 printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
                                        "failed\n", rx->dev->name);
 #endif /* CONFIG_MAC80211_DEBUG */
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
         } else if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED)) {
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
@@ -328,7 +328,7 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx)
                 skb_trim(rx->skb, rx->skb->len - 4);
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 static int wep_encrypt_skb(struct ieee80211_txrx_data *tx, struct sk_buff *skb)
@@ -346,7 +346,7 @@ static int wep_encrypt_skb(struct ieee80211_txrx_data *tx, struct sk_buff *skb)
         return 0;
 }
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx)
 {
         tx->u.tx.control->iv_len = WEP_IV_LEN;
@@ -355,7 +355,7 @@ ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx)
 
         if (wep_encrypt_skb(tx, tx->skb) < 0) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_wep);
-                return TXRX_DROP;
+                return TX_DROP;
         }
 
         if (tx->u.tx.extra_frag) {
@@ -364,10 +364,10 @@ ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx)
                         if (wep_encrypt_skb(tx, tx->u.tx.extra_frag[i]) < 0) {
                                 I802_DEBUG_INC(tx->local->
                                                tx_handlers_drop_wep);
-                                return TXRX_DROP;
+                                return TX_DROP;
                         }
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index 785fbb4e0dd7..43aef50cd0d6 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -28,9 +28,9 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
 u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx);
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx);
 
 #endif /* WEP_H */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 4e236599dd31..8cc036decc82 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -19,10 +19,13 @@
 #include "wme.h"
 
 /* maximum number of hardware queues we support. */
-#define TC_80211_MAX_QUEUES 8
+#define TC_80211_MAX_QUEUES 16
+
+const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
 
 struct ieee80211_sched_data
 {
+        unsigned long qdisc_pool[BITS_TO_LONGS(TC_80211_MAX_QUEUES)];
         struct tcf_proto *filter_list;
         struct Qdisc *queues[TC_80211_MAX_QUEUES];
         struct sk_buff_head requeued[TC_80211_MAX_QUEUES];
@@ -98,7 +101,6 @@ static inline int classify80211(struct sk_buff *skb, struct Qdisc *qd)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         unsigned short fc = le16_to_cpu(hdr->frame_control);
         int qos;
-        const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
 
         /* see if frame is data or non data frame */
         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)) {
@@ -146,9 +148,25 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
         unsigned short fc = le16_to_cpu(hdr->frame_control);
         struct Qdisc *qdisc;
         int err, queue;
+        struct sta_info *sta;
+        u8 tid;
 
         if (pkt_data->flags & IEEE80211_TXPD_REQUEUE) {
-                skb_queue_tail(&q->requeued[pkt_data->queue], skb);
+                queue = pkt_data->queue;
+                sta = sta_info_get(local, hdr->addr1);
+                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
+                if (sta) {
+                        int ampdu_queue = sta->tid_to_tx_q[tid];
+                        if ((ampdu_queue < local->hw.queues) &&
+                            test_bit(ampdu_queue, q->qdisc_pool)) {
+                                queue = ampdu_queue;
+                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                        } else {
+                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                        }
+                        sta_info_put(sta);
+                }
+                skb_queue_tail(&q->requeued[queue], skb);
                 qd->q.qlen++;
                 return 0;
         }
@@ -159,14 +177,28 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
          */
         if (WLAN_FC_IS_QOS_DATA(fc)) {
                 u8 *p = skb->data + ieee80211_get_hdrlen(fc) - 2;
-                u8 qos_hdr = skb->priority & QOS_CONTROL_TAG1D_MASK;
+                u8 ack_policy = 0;
+                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
                 if (local->wifi_wme_noack_test)
-                        qos_hdr |= QOS_CONTROL_ACK_POLICY_NOACK <<
+                        ack_policy |= QOS_CONTROL_ACK_POLICY_NOACK <<
                                         QOS_CONTROL_ACK_POLICY_SHIFT;
                 /* qos header is 2 bytes, second reserved */
-                *p = qos_hdr;
+                *p = ack_policy | tid;
                 p++;
                 *p = 0;
+
+                sta = sta_info_get(local, hdr->addr1);
+                if (sta) {
+                        int ampdu_queue = sta->tid_to_tx_q[tid];
+                        if ((ampdu_queue < local->hw.queues) &&
+                                test_bit(ampdu_queue, q->qdisc_pool)) {
+                                queue = ampdu_queue;
+                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                        } else {
+                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                        }
+                        sta_info_put(sta);
+                }
         }
 
         if (unlikely(queue >= local->hw.queues)) {
@@ -184,6 +216,7 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
                         kfree_skb(skb);
                         err = NET_XMIT_DROP;
         } else {
+                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
                 pkt_data->queue = (unsigned int) queue;
                 qdisc = q->queues[queue];
                 err = qdisc->enqueue(skb, qdisc);
@@ -235,10 +268,11 @@ static struct sk_buff *wme_qdiscop_dequeue(struct Qdisc* qd)
         /* check all the h/w queues in numeric/priority order */
         for (queue = 0; queue < hw->queues; queue++) {
                 /* see if there is room in this hardware queue */
-                if (test_bit(IEEE80211_LINK_STATE_XOFF,
-                             &local->state[queue]) ||
-                    test_bit(IEEE80211_LINK_STATE_PENDING,
-                             &local->state[queue]))
+                if ((test_bit(IEEE80211_LINK_STATE_XOFF,
+                                &local->state[queue])) ||
+                    (test_bit(IEEE80211_LINK_STATE_PENDING,
+                                &local->state[queue])) ||
+                         (!test_bit(queue, q->qdisc_pool)))
                         continue;
 
                 /* there is space - try and get a frame */
@@ -360,6 +394,10 @@ static int wme_qdiscop_init(struct Qdisc *qd, struct nlattr *opt)
                 }
         }
 
+        /* reserve all legacy QoS queues */
+        for (i = 0; i < min(IEEE80211_TX_QUEUE_DATA4, queues); i++)
+                set_bit(i, q->qdisc_pool);
+
         return err;
 }
 
@@ -605,3 +643,80 @@ void ieee80211_wme_unregister(void)
 {
         unregister_qdisc(&wme_qdisc_ops);
 }
+
+int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
+                        struct sta_info *sta, u16 tid)
+{
+        int i;
+        struct ieee80211_sched_data *q =
+                        qdisc_priv(local->mdev->qdisc_sleeping);
+        DECLARE_MAC_BUF(mac);
+
+        /* prepare the filter and save it for the SW queue
+         * matching the recieved HW queue */
+
+        /* try to get a Qdisc from the pool */
+        for (i = IEEE80211_TX_QUEUE_BEACON; i < local->hw.queues; i++)
+                if (!test_and_set_bit(i, q->qdisc_pool)) {
+                        ieee80211_stop_queue(local_to_hw(local), i);
+                        sta->tid_to_tx_q[tid] = i;
+
+                        /* IF there are already pending packets
+                         * on this tid first we need to drain them
+                         * on the previous queue
+                         * since HT is strict in order */
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "allocated aggregation queue"
+                                        " %d tid %d addr %s pool=0x%lX",
+                                        i, tid, print_mac(mac, sta->addr),
+                                        q->qdisc_pool[0]);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                        return 0;
+                }
+
+        return -EAGAIN;
+}
+
+/**
+ * the caller needs to hold local->mdev->queue_lock
+ */
+void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
+                                   struct sta_info *sta, u16 tid,
+                                   u8 requeue)
+{
+        struct ieee80211_sched_data *q =
+                qdisc_priv(local->mdev->qdisc_sleeping);
+        int agg_queue = sta->tid_to_tx_q[tid];
+
+        /* return the qdisc to the pool */
+        clear_bit(agg_queue, q->qdisc_pool);
+        sta->tid_to_tx_q[tid] = local->hw.queues;
+
+        if (requeue)
+                ieee80211_requeue(local, agg_queue);
+        else
+                q->queues[agg_queue]->ops->reset(q->queues[agg_queue]);
+}
+
+void ieee80211_requeue(struct ieee80211_local *local, int queue)
+{
+        struct Qdisc *root_qd = local->mdev->qdisc_sleeping;
+        struct ieee80211_sched_data *q = qdisc_priv(root_qd);
+        struct Qdisc *qdisc = q->queues[queue];
+        struct sk_buff *skb = NULL;
+        u32 len = qdisc->q.qlen;
+
+        if (!qdisc || !qdisc->dequeue)
+                return;
+
+        printk(KERN_DEBUG "requeue: qlen = %d\n", qdisc->q.qlen);
+        for (len = qdisc->q.qlen; len > 0; len--) {
+                skb = qdisc->dequeue(qdisc);
+                root_qd->q.qlen--;
+                /* packet will be classified again and */
+                /* skb->packet_data->queue will be overridden if needed */
+                if (skb)
+                        wme_qdiscop_enqueue(skb, root_qd);
+        }
+}
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 76c713a6450c..fcc6b05508cc 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -24,6 +24,8 @@
 
 #define QOS_CONTROL_TAG1D_MASK 0x07
 
+extern const int ieee802_1d_to_ac[8];
+
 static inline int WLAN_FC_IS_QOS_DATA(u16 fc)
 {
         return (fc & 0x8C) == 0x88;
@@ -32,7 +34,12 @@ static inline int WLAN_FC_IS_QOS_DATA(u16 fc)
 #ifdef CONFIG_NET_SCHED
 void ieee80211_install_qdisc(struct net_device *dev);
 int ieee80211_qdisc_installed(struct net_device *dev);
-
+int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
+                               struct sta_info *sta, u16 tid);
+void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
+                                   struct sta_info *sta, u16 tid,
+                                   u8 requeue);
+void ieee80211_requeue(struct ieee80211_local *local, int queue);
 int ieee80211_wme_register(void);
 void ieee80211_wme_unregister(void);
 #else
@@ -43,7 +50,19 @@ static inline int ieee80211_qdisc_installed(struct net_device *dev)
 {
         return 0;
 }
-
+static inline int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
+                                             struct sta_info *sta, u16 tid)
+{
+        return -EAGAIN;
+}
+static inline void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
+                                                 struct sta_info *sta, u16 tid,
+                                                 u8 requeue)
+{
+}
+static inline void ieee80211_requeue(struct ieee80211_local *local, int queue)
+{
+}
 static inline int ieee80211_wme_register(void)
 {
         return 0;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 6f04311cf0a0..b35e51c6ce0c 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -70,7 +70,7 @@ static int ieee80211_get_hdr_info(const struct sk_buff *skb, u8 **sa, u8 **da,
 }
 
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
 {
         u8 *data, *sa, *da, *key, *mic, qos_tid;
@@ -84,10 +84,10 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
 
         if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 ||
             !WLAN_FC_DATA_PRESENT(fc))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len))
-                return TXRX_DROP;
+                return TX_DROP;
 
         if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
             !(tx->flags & IEEE80211_TXRXD_FRAGMENTED) &&
@@ -95,7 +95,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
             !wpa_test) {
                 /* hwaccel - with no need for preallocated room for Michael MIC
                  */
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
         if (skb_tailroom(skb) < MICHAEL_MIC_LEN) {
@@ -105,7 +105,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
                                               GFP_ATOMIC))) {
                         printk(KERN_DEBUG "%s: failed to allocate more memory "
                                "for Michael MIC\n", tx->dev->name);
-                        return TXRX_DROP;
+                        return TX_DROP;
                 }
         }
 
@@ -119,11 +119,11 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
         mic = skb_put(skb, MICHAEL_MIC_LEN);
         michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
 {
         u8 *data, *sa, *da, *key = NULL, qos_tid;
@@ -140,15 +140,15 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
          * No way to verify the MIC if the hardware stripped it
          */
         if (rx->u.rx.status->flag & RX_FLAG_MMIC_STRIPPED)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
             !(rx->fc & IEEE80211_FCTL_PROTECTED) || !WLAN_FC_DATA_PRESENT(fc))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len)
             || data_len < MICHAEL_MIC_LEN)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         data_len -= MICHAEL_MIC_LEN;
 
@@ -162,14 +162,14 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
         michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
         if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
                 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
 
                 printk(KERN_DEBUG "%s: invalid Michael MIC in data frame from "
                        "%s\n", rx->dev->name, print_mac(mac, sa));
 
                 mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx,
                                                 (void *) skb->data);
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
         /* remove Michael MIC from payload */
@@ -179,7 +179,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
         rx->key->u.tkip.iv32_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv32;
         rx->key->u.tkip.iv16_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv16;
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
@@ -242,7 +242,7 @@ static int tkip_encrypt_skb(struct ieee80211_txrx_data *tx,
 }
 
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_txrx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
@@ -257,26 +257,26 @@ ieee80211_crypto_tkip_encrypt(struct ieee80211_txrx_data *tx)
             !wpa_test) {
                 /* hwaccel - with no need for preallocated room for IV/ICV */
                 tx->u.tx.control->key_idx = tx->key->conf.hw_key_idx;
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
         if (tkip_encrypt_skb(tx, skb, test) < 0)
-                return TXRX_DROP;
+                return TX_DROP;
 
         if (tx->u.tx.extra_frag) {
                 int i;
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         if (tkip_encrypt_skb(tx, tx->u.tx.extra_frag[i], test)
                             < 0)
-                                return TXRX_DROP;
+                                return TX_DROP;
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
@@ -290,10 +290,10 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
         hdrlen = ieee80211_get_hdrlen(fc);
 
         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (!rx->sta || skb->len - hdrlen < 12)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED) {
                 if (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) {
@@ -302,7 +302,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
                          * replay protection, and stripped the ICV/IV so
                          * we cannot do any checks here.
                          */
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
                 }
 
                 /* let TKIP code verify IV, but skip decryption */
@@ -322,7 +322,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
                                "frame from %s (res=%d)\n", rx->dev->name,
                                print_mac(mac, rx->sta->addr), res);
 #endif /* CONFIG_MAC80211_DEBUG */
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
         /* Trim ICV */
@@ -332,7 +332,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
         memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen);
         skb_pull(skb, TKIP_IV_LEN);
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
@@ -491,7 +491,7 @@ static int ccmp_encrypt_skb(struct ieee80211_txrx_data *tx,
 }
 
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_txrx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
@@ -506,26 +506,26 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_txrx_data *tx)
                 /* hwaccel - with no need for preallocated room for CCMP "
                  * header or MIC fields */
                 tx->u.tx.control->key_idx = tx->key->conf.hw_key_idx;
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
         if (ccmp_encrypt_skb(tx, skb, test) < 0)
-                return TXRX_DROP;
+                return TX_DROP;
 
         if (tx->u.tx.extra_frag) {
                 int i;
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         if (ccmp_encrypt_skb(tx, tx->u.tx.extra_frag[i], test)
                             < 0)
-                                return TXRX_DROP;
+                                return TX_DROP;
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
@@ -541,15 +541,15 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
         hdrlen = ieee80211_get_hdrlen(fc);
 
         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
         if (!rx->sta || data_len < 0)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
             (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         (void) ccmp_hdr2pn(pn, skb->data + hdrlen);
 
@@ -565,7 +565,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
                        ppn[0], ppn[1], ppn[2], ppn[3], ppn[4], ppn[5]);
 #endif /* CONFIG_MAC80211_DEBUG */
                 key->u.ccmp.replays++;
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
         if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) {
@@ -589,7 +589,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
                                        "for RX frame from %s\n", rx->dev->name,
                                        print_mac(mac, rx->sta->addr));
 #endif /* CONFIG_MAC80211_DEBUG */
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
         }
 
@@ -600,5 +600,5 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
         memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
         skb_pull(skb, CCMP_HDR_LEN);
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index 49d80cf0cd75..16e4dba4aa70 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -13,19 +13,19 @@
 #include <linux/types.h>
 #include "ieee80211_i.h"
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx);
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx);
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_txrx_data *tx);
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx);
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_txrx_data *tx);
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx);
 
 #endif /* WPA_H */
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index e88e96af613d..a9bf6e4fd0cc 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -293,7 +293,7 @@ static const struct file_operations ct_cpu_seq_fops = {
         .open    = ct_cpu_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release,
 };
 #endif /* CONFIG_PROC_FS */
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 1ab0da2632e1..524e826bb976 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1344,22 +1344,6 @@ static void netlink_data_ready(struct sock *sk, int len)
  *      queueing.
  */
 
-static void __netlink_release(struct sock *sk)
-{
-        /*
-         * Last sock_put should drop referrence to sk->sk_net. It has already
-         * been dropped in netlink_kernel_create. Taking referrence to stopping
-         * namespace is not an option.
-         * Take referrence to a socket to remove it from netlink lookup table
-         * _alive_ and after that destroy it in the context of init_net.
-         */
-
-        sock_hold(sk);
-        sock_release(sk->sk_socket);
-        sk->sk_net = get_net(&init_net);
-        sock_put(sk);
-}
-
 struct sock *
 netlink_kernel_create(struct net *net, int unit, unsigned int groups,
                       void (*input)(struct sk_buff *skb),
@@ -1388,8 +1372,7 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
                 goto out_sock_release_nosk;
 
         sk = sock->sk;
-        put_net(sk->sk_net);
-        sk->sk_net = net;
+        sk_change_net(sk, net);
 
         if (groups < 32)
                 groups = 32;
@@ -1424,7 +1407,7 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
 
 out_sock_release:
         kfree(listeners);
-        __netlink_release(sk);
+        netlink_kernel_release(sk);
         return NULL;
 
 out_sock_release_nosk:
@@ -1437,10 +1420,7 @@ EXPORT_SYMBOL(netlink_kernel_create);
 void
 netlink_kernel_release(struct sock *sk)
 {
-        if (sk == NULL || sk->sk_socket == NULL)
-                return;
-
-        __netlink_release(sk);
+        sk_release_kernel(sk);
 }
 EXPORT_SYMBOL(netlink_kernel_release);
 
diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
index 83eda247fe48..017322e2786d 100644
--- a/net/rxrpc/ar-proc.c
+++ b/net/rxrpc/ar-proc.c
@@ -103,7 +103,7 @@ const struct file_operations rxrpc_call_seq_fops = {
         .open           = rxrpc_call_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = seq_release,
 };
 
 /*
@@ -188,5 +188,5 @@ const struct file_operations rxrpc_connection_seq_fops = {
         .open           = rxrpc_connection_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .release        = seq_release,
 };
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 87f940587d5f..4862835b0c39 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -257,7 +257,7 @@ static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
                         NIP6(fl.fl6_src));
         }
 
-        dst = ip6_route_output(NULL, &fl);
+        dst = ip6_route_output(&init_net, NULL, &fl);
         if (!dst->error) {
                 struct rt6_info *rt;
                 rt = (struct rt6_info *)dst;
@@ -313,7 +313,8 @@ static void sctp_v6_get_saddr(struct sctp_association *asoc,
                           __FUNCTION__, asoc, dst, NIP6(daddr->v6.sin6_addr));
 
         if (!asoc) {
-                ipv6_get_saddr(dst, &daddr->v6.sin6_addr,&saddr->v6.sin6_addr);
+                ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,
+                                   &daddr->v6.sin6_addr, &saddr->v6.sin6_addr);
                 SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: " NIP6_FMT "\n",
                                   NIP6(saddr->v6.sin6_addr));
                 return;
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1bb3c5c35d2a..fd4deefab3cf 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -494,6 +494,8 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
                  */
                 if (transport == transport->asoc->peer.retran_path)
                         sctp_assoc_update_retran_path(transport->asoc);
+                transport->asoc->rtx_data_chunks +=
+                        transport->asoc->unack_data;
                 break;
         case SCTP_RTXR_FAST_RTX:
                 SCTP_INC_STATS(SCTP_MIB_FAST_RETRANSMITS);
@@ -504,6 +506,7 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
                 break;
         case SCTP_RTXR_T1_RTX:
                 SCTP_INC_STATS(SCTP_MIB_T1_RETRANSMITS);
+                transport->asoc->init_retries++;
                 break;
         default:
                 BUG();
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 973f1dbc2ec3..ddca90e5e3a5 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -279,8 +279,10 @@ static void * sctp_assocs_seq_start(struct seq_file *seq, loff_t *pos)
                 *pos = 0;
 
         if (*pos == 0)
-                seq_printf(seq, " ASSOC     SOCK   STY SST ST HBKT ASSOC-ID TX_QUEUE RX_QUEUE UID INODE LPORT "
-                                "RPORT LADDRS <-> RADDRS\n");
+                seq_printf(seq, " ASSOC     SOCK   STY SST ST HBKT "
+                                "ASSOC-ID TX_QUEUE RX_QUEUE UID INODE LPORT "
+                                "RPORT LADDRS <-> RADDRS "
+                                "HBINT INS OUTS MAXRT T1X T2X RTXC\n");
 
         return (void *)pos;
 }
@@ -319,15 +321,21 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                 assoc = sctp_assoc(epb);
                 sk = epb->sk;
                 seq_printf(seq,
-                           "%8p %8p %-3d %-3d %-2d %-4d %4d %8d %8d %7d %5lu %-5d %5d ",
+                           "%8p %8p %-3d %-3d %-2d %-4d "
+                           "%4d %8d %8d %7d %5lu %-5d %5d "
+                           "%8lu %5d %5d %4d %4d %4d %8d ",
                            assoc, sk, sctp_sk(sk)->type, sk->sk_state,
-                           assoc->state, hash, assoc->assoc_id,
+                           assoc->state, hash,
+                           assoc->assoc_id,
                            assoc->sndbuf_used,
                            atomic_read(&assoc->rmem_alloc),
                            sock_i_uid(sk), sock_i_ino(sk),
                            epb->bind_addr.port,
-                           assoc->peer.port);
-
+                           assoc->peer.port,
+                           assoc->hbinterval, assoc->c.sinit_max_instreams,
+                           assoc->c.sinit_num_ostreams, assoc->max_retrans,
+                           assoc->init_retries, assoc->shutdown_retries,
+                           assoc->rtx_data_chunks);
                 seq_printf(seq, " ");
                 sctp_seq_dump_local_addrs(seq, epb);
                 seq_printf(seq, "<-> ");
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 688546dccd82..8d9d929f6cea 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -629,6 +629,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
         struct sctp_sockaddr_entry *addr = NULL;
         struct sctp_sockaddr_entry *temp;
 
+        if (ifa->ifa_dev->dev->nd_net != &init_net)
+                return NOTIFY_DONE;
+
         switch (ev) {
         case NETDEV_UP:
                 addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index f2ed6473feef..ade0cbd3a52b 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5312,6 +5312,8 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
         SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
         SCTP_INC_STATS(SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
 
+        ((struct sctp_association *)asoc)->shutdown_retries++;
+
         if (asoc->overall_error_count >= asoc->max_retrans) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                 SCTP_ERROR(ETIMEDOUT));
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 22909036b9bc..9ae8e9f74028 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -43,7 +43,7 @@
 #include <linux/slab.h>
 #include <linux/poll.h>
 #include <linux/fcntl.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 #include <asm/string.h>
 #include <asm/atomic.h>
 #include <net/sock.h>
@@ -63,7 +63,7 @@
 struct tipc_sock {
         struct sock sk;
         struct tipc_port *p;
-        struct semaphore sem;
+        struct mutex lock;
 };
 
 #define tipc_sk(sk) ((struct tipc_sock*)sk)
@@ -217,7 +217,7 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol)
         tsock->p = port;
         port->usr_handle = tsock;
 
-        init_MUTEX(&tsock->sem);
+        mutex_init(&tsock->lock);
 
         dbg("sock_create: %x\n",tsock);
 
@@ -253,9 +253,9 @@ static int release(struct socket *sock)
         dbg("sock_delete: %x\n",tsock);
         if (!tsock)
                 return 0;
-        down(&tsock->sem);
+        mutex_lock(&tsock->lock);
         if (!sock->sk) {
-                up(&tsock->sem);
+                mutex_unlock(&tsock->lock);
                 return 0;
         }
 
@@ -288,7 +288,7 @@ static int release(struct socket *sock)
                 atomic_dec(&tipc_queue_size);
         }
 
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
 
         sock_put(sk);
 
@@ -315,7 +315,7 @@ static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
         int res;
 
-        if (down_interruptible(&tsock->sem))
+        if (mutex_lock_interruptible(&tsock->lock))
                 return -ERESTARTSYS;
 
         if (unlikely(!uaddr_len)) {
@@ -346,7 +346,7 @@ static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
                 res = tipc_withdraw(tsock->p->ref, -addr->scope,
                                     &addr->addr.nameseq);
 exit:
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return res;
 }
 
@@ -367,7 +367,7 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
         u32 res;
 
-        if (down_interruptible(&tsock->sem))
+        if (mutex_lock_interruptible(&tsock->lock))
                 return -ERESTARTSYS;
 
         *uaddr_len = sizeof(*addr);
@@ -380,7 +380,7 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
                 res = tipc_ownidentity(tsock->p->ref, &addr->addr.id);
         addr->addr.name.domain = 0;
 
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return res;
 }
 
@@ -477,7 +477,7 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                 }
         }
 
-        if (down_interruptible(&tsock->sem))
+        if (mutex_lock_interruptible(&tsock->lock))
                 return -ERESTARTSYS;
 
         if (needs_conn) {
@@ -523,7 +523,7 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                 }
                 if (likely(res != -ELINKCONG)) {
 exit:
-                        up(&tsock->sem);
+                        mutex_unlock(&tsock->lock);
                         return res;
                 }
                 if (m->msg_flags & MSG_DONTWAIT) {
@@ -562,7 +562,7 @@ static int send_packet(struct kiocb *iocb, struct socket *sock,
         if (unlikely(dest))
                 return send_msg(iocb, sock, m, total_len);
 
-        if (down_interruptible(&tsock->sem)) {
+        if (mutex_lock_interruptible(&tsock->lock)) {
                 return -ERESTARTSYS;
         }
 
@@ -578,7 +578,7 @@ static int send_packet(struct kiocb *iocb, struct socket *sock,
                 res = tipc_send(tsock->p->ref, m->msg_iovlen, m->msg_iov);
                 if (likely(res != -ELINKCONG)) {
 exit:
-                        up(&tsock->sem);
+                        mutex_unlock(&tsock->lock);
                         return res;
                 }
                 if (m->msg_flags & MSG_DONTWAIT) {
@@ -846,7 +846,7 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
 
         /* Look for a message in receive queue; wait if necessary */
 
-        if (unlikely(down_interruptible(&tsock->sem)))
+        if (unlikely(mutex_lock_interruptible(&tsock->lock)))
                 return -ERESTARTSYS;
 
 restart:
@@ -930,7 +930,7 @@ restart:
                 advance_queue(tsock);
         }
 exit:
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return res;
 }
 
@@ -981,7 +981,7 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
 
         /* Look for a message in receive queue; wait if necessary */
 
-        if (unlikely(down_interruptible(&tsock->sem)))
+        if (unlikely(mutex_lock_interruptible(&tsock->lock)))
                 return -ERESTARTSYS;
 
 restart:
@@ -1077,7 +1077,7 @@ restart:
                 goto restart;
 
 exit:
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return sz_copied ? sz_copied : res;
 }
 
@@ -1293,7 +1293,7 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
            return res;
    }
 
-   if (down_interruptible(&tsock->sem))
+   if (mutex_lock_interruptible(&tsock->lock))
            return -ERESTARTSYS;
 
    /* Wait for destination's 'ACK' response */
@@ -1317,7 +1317,7 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
            sock->state = SS_DISCONNECTING;
    }
 
-   up(&tsock->sem);
+   mutex_unlock(&tsock->lock);
    return res;
 }
 
@@ -1365,7 +1365,7 @@ static int accept(struct socket *sock, struct socket *newsock, int flags)
                      (flags & O_NONBLOCK)))
                 return -EWOULDBLOCK;
 
-        if (down_interruptible(&tsock->sem))
+        if (mutex_lock_interruptible(&tsock->lock))
                 return -ERESTARTSYS;
 
         if (wait_event_interruptible(*sock->sk->sk_sleep,
@@ -1412,7 +1412,7 @@ static int accept(struct socket *sock, struct socket *newsock, int flags)
                 }
         }
 exit:
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return res;
 }
 
@@ -1434,7 +1434,7 @@ static int shutdown(struct socket *sock, int how)
 
         /* Could return -EINVAL for an invalid "how", but why bother? */
 
-        if (down_interruptible(&tsock->sem))
+        if (mutex_lock_interruptible(&tsock->lock))
                 return -ERESTARTSYS;
 
         sock_lock(tsock);
@@ -1484,7 +1484,7 @@ restart:
 
         sock_unlock(tsock);
 
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return res;
 }
 
@@ -1518,7 +1518,7 @@ static int setsockopt(struct socket *sock,
         if ((res = get_user(value, (u32 __user *)ov)))
                 return res;
 
-        if (down_interruptible(&tsock->sem))
+        if (mutex_lock_interruptible(&tsock->lock))
                 return -ERESTARTSYS;
 
         switch (opt) {
@@ -1541,7 +1541,7 @@ static int setsockopt(struct socket *sock,
                 res = -EINVAL;
         }
 
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return res;
 }
 
@@ -1574,7 +1574,7 @@ static int getsockopt(struct socket *sock,
         if ((res = get_user(len, ol)))
                 return res;
 
-        if (down_interruptible(&tsock->sem))
+        if (mutex_lock_interruptible(&tsock->lock))
                 return -ERESTARTSYS;
 
         switch (opt) {
@@ -1607,7 +1607,7 @@ static int getsockopt(struct socket *sock,
                 res = put_user(sizeof(value), ol);
         }
 
-        up(&tsock->sem);
+        mutex_unlock(&tsock->lock);
         return res;
 }
 
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 65710a42e5a7..b9f943c45f3b 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -1,5 +1,5 @@
 obj-$(CONFIG_WIRELESS_EXT) += wext.o
 obj-$(CONFIG_CFG80211) += cfg80211.o
 
-cfg80211-y += core.o sysfs.o radiotap.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o
 cfg80211-$(CONFIG_NL80211) += nl80211.o
diff --git a/net/wireless/core.c b/net/wireless/core.c
index cfc5fc5f9e75..80afacdae46c 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -232,6 +232,47 @@ int wiphy_register(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
         int res;
+        enum ieee80211_band band;
+        struct ieee80211_supported_band *sband;
+        bool have_band = false;
+        int i;
+
+        /* sanity check supported bands/channels */
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                sband = wiphy->bands[band];
+                if (!sband)
+                        continue;
+
+                sband->band = band;
+
+                if (!sband->n_channels || !sband->n_bitrates) {
+                        WARN_ON(1);
+                        return -EINVAL;
+                }
+
+                for (i = 0; i < sband->n_channels; i++) {
+                        sband->channels[i].orig_flags =
+                                sband->channels[i].flags;
+                        sband->channels[i].orig_mag =
+                                sband->channels[i].max_antenna_gain;
+                        sband->channels[i].orig_mpwr =
+                                sband->channels[i].max_power;
+                        sband->channels[i].band = band;
+                }
+
+                have_band = true;
+        }
+
+        if (!have_band) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
+        /* check and set up bitrates */
+        ieee80211_set_bitrate_flags(wiphy);
+
+        /* set up regulatory info */
+        wiphy_update_regulatory(wiphy);
 
         mutex_lock(&cfg80211_drv_mutex);
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index eb0f846b40df..7a02c356d63d 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -78,4 +78,7 @@ extern void cfg80211_dev_free(struct cfg80211_registered_device *drv);
 extern int cfg80211_dev_rename(struct cfg80211_registered_device *drv,
                                char *newname);
 
+void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
+void wiphy_update_regulatory(struct wiphy *wiphy);
+
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e3a214f63f91..5b3474798b8d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -82,6 +82,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
                                                .len = NL80211_MAX_SUPP_RATES },
         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
+        [NL80211_ATTR_MNTR_FLAGS] = { .type = NLA_NESTED },
 };
 
 /* message building helper */
@@ -98,6 +99,13 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                               struct cfg80211_registered_device *dev)
 {
         void *hdr;
+        struct nlattr *nl_bands, *nl_band;
+        struct nlattr *nl_freqs, *nl_freq;
+        struct nlattr *nl_rates, *nl_rate;
+        enum ieee80211_band band;
+        struct ieee80211_channel *chan;
+        struct ieee80211_rate *rate;
+        int i;
 
         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
         if (!hdr)
@@ -105,6 +113,73 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
+
+        nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
+        if (!nl_bands)
+                goto nla_put_failure;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (!dev->wiphy.bands[band])
+                        continue;
+
+                nl_band = nla_nest_start(msg, band);
+                if (!nl_band)
+                        goto nla_put_failure;
+
+                /* add frequencies */
+                nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
+                if (!nl_freqs)
+                        goto nla_put_failure;
+
+                for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
+                        nl_freq = nla_nest_start(msg, i);
+                        if (!nl_freq)
+                                goto nla_put_failure;
+
+                        chan = &dev->wiphy.bands[band]->channels[i];
+                        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
+                                    chan->center_freq);
+
+                        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
+                        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
+                        if (chan->flags & IEEE80211_CHAN_NO_IBSS)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
+                        if (chan->flags & IEEE80211_CHAN_RADAR)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
+
+                        nla_nest_end(msg, nl_freq);
+                }
+
+                nla_nest_end(msg, nl_freqs);
+
+                /* add bitrates */
+                nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
+                if (!nl_rates)
+                        goto nla_put_failure;
+
+                for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
+                        nl_rate = nla_nest_start(msg, i);
+                        if (!nl_rate)
+                                goto nla_put_failure;
+
+                        rate = &dev->wiphy.bands[band]->bitrates[i];
+                        NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
+                                    rate->bitrate);
+                        if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                                NLA_PUT_FLAG(msg,
+                                        NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
+
+                        nla_nest_end(msg, nl_rate);
+                }
+
+                nla_nest_end(msg, nl_rates);
+
+                nla_nest_end(msg, nl_band);
+        }
+        nla_nest_end(msg, nl_bands);
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -262,12 +337,42 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
         return -ENOBUFS;
 }
 
+static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
+        [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
+};
+
+static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
+{
+        struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
+        int flag;
+
+        *mntrflags = 0;
+
+        if (!nla)
+                return -EINVAL;
+
+        if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
+                             nla, mntr_flags_policy))
+                return -EINVAL;
+
+        for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
+                if (flags[flag])
+                        *mntrflags |= (1<<flag);
+
+        return 0;
+}
+
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *drv;
         int err, ifindex;
         enum nl80211_iftype type;
         struct net_device *dev;
+        u32 flags;
 
         if (info->attrs[NL80211_ATTR_IFTYPE]) {
                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
@@ -288,7 +393,11 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         rtnl_lock();
-        err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex, type);
+        err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
+                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
+                                  &flags);
+        err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
+                                            type, err ? NULL : &flags);
         rtnl_unlock();
 
  unlock:
@@ -301,6 +410,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *drv;
         int err;
         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
+        u32 flags;
 
         if (!info->attrs[NL80211_ATTR_IFNAME])
                 return -EINVAL;
@@ -321,8 +431,12 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         rtnl_lock();
+        err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
+                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
+                                  &flags);
         err = drv->ops->add_virtual_intf(&drv->wiphy,
-                nla_data(info->attrs[NL80211_ATTR_IFNAME]), type);
+                nla_data(info->attrs[NL80211_ATTR_IFNAME]),
+                type, err ? NULL : &flags);
         rtnl_unlock();
 
  unlock:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
new file mode 100644
index 000000000000..8cc6037eb2ae
--- /dev/null
+++ b/net/wireless/reg.c
@@ -0,0 +1,159 @@
+/*
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * This regulatory domain control implementation is highly incomplete, it
+ * only exists for the purpose of not regressing mac80211.
+ *
+ * For now, drivers can restrict the set of allowed channels by either
+ * not registering those channels or setting the IEEE80211_CHAN_DISABLED
+ * flag; that flag will only be *set* by this code, never *cleared.
+ *
+ * The usual implementation is for a driver to read a device EEPROM to
+ * determine which regulatory domain it should be operating under, then
+ * looking up the allowable channels in a driver-local table and finally
+ * registering those channels in the wiphy structure.
+ *
+ * Alternatively, drivers that trust the regulatory domain control here
+ * will register a complete set of capabilities and the control code
+ * will restrict the set by setting the IEEE80211_CHAN_* flags.
+ */
+#include <linux/kernel.h>
+#include <net/wireless.h>
+#include "core.h"
+
+static char *ieee80211_regdom = "US";
+module_param(ieee80211_regdom, charp, 0444);
+MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
+
+struct ieee80211_channel_range {
+        short start_freq;
+        short end_freq;
+        int max_power;
+        int max_antenna_gain;
+        u32 flags;
+};
+
+struct ieee80211_regdomain {
+        const char *code;
+        const struct ieee80211_channel_range *ranges;
+        int n_ranges;
+};
+
+#define RANGE_PWR(_start, _end, _pwr, _ag, _flags)      \
+        { _start, _end, _pwr, _ag, _flags }
+
+
+/*
+ * Ideally, in the future, these definitions will be loaded from a
+ * userspace table via some daemon.
+ */
+static const struct ieee80211_channel_range ieee80211_US_channels[] = {
+        /* IEEE 802.11b/g, channels 1..11 */
+        RANGE_PWR(2412, 2462, 27, 6, 0),
+        /* IEEE 802.11a, channel 36*/
+        RANGE_PWR(5180, 5180, 23, 6, 0),
+        /* IEEE 802.11a, channel 40*/
+        RANGE_PWR(5200, 5200, 23, 6, 0),
+        /* IEEE 802.11a, channel 44*/
+        RANGE_PWR(5220, 5220, 23, 6, 0),
+        /* IEEE 802.11a, channels 48..64 */
+        RANGE_PWR(5240, 5320, 23, 6, 0),
+        /* IEEE 802.11a, channels 149..165, outdoor */
+        RANGE_PWR(5745, 5825, 30, 6, 0),
+};
+
+static const struct ieee80211_channel_range ieee80211_JP_channels[] = {
+        /* IEEE 802.11b/g, channels 1..14 */
+        RANGE_PWR(2412, 2484, 20, 6, 0),
+        /* IEEE 802.11a, channels 34..48 */
+        RANGE_PWR(5170, 5240, 20, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channels 52..64 */
+        RANGE_PWR(5260, 5320, 20, 6, IEEE80211_CHAN_NO_IBSS |
+                                     IEEE80211_CHAN_RADAR),
+};
+
+#define REGDOM(_code)                                                   \
+        {                                                               \
+                .code = __stringify(_code),                             \
+                .ranges = ieee80211_ ##_code## _channels,               \
+                .n_ranges = ARRAY_SIZE(ieee80211_ ##_code## _channels), \
+        }
+
+static const struct ieee80211_regdomain ieee80211_regdoms[] = {
+        REGDOM(US),
+        REGDOM(JP),
+};
+
+
+static const struct ieee80211_regdomain *get_regdom(void)
+{
+        static const struct ieee80211_channel_range
+        ieee80211_world_channels[] = {
+                /* IEEE 802.11b/g, channels 1..11 */
+                RANGE_PWR(2412, 2462, 27, 6, 0),
+        };
+        static const struct ieee80211_regdomain regdom_world = REGDOM(world);
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(ieee80211_regdoms); i++)
+                if (strcmp(ieee80211_regdom, ieee80211_regdoms[i].code) == 0)
+                        return &ieee80211_regdoms[i];
+
+        return &regdom_world;
+}
+
+
+static void handle_channel(struct ieee80211_channel *chan,
+                           const struct ieee80211_regdomain *rd)
+{
+        int i;
+        u32 flags = chan->orig_flags;
+        const struct ieee80211_channel_range *rg = NULL;
+
+        for (i = 0; i < rd->n_ranges; i++) {
+                if (rd->ranges[i].start_freq <= chan->center_freq &&
+                    chan->center_freq <= rd->ranges[i].end_freq) {
+                        rg = &rd->ranges[i];
+                        break;
+                }
+        }
+
+        if (!rg) {
+                /* not found */
+                flags |= IEEE80211_CHAN_DISABLED;
+                chan->flags = flags;
+                return;
+        }
+
+        chan->flags = flags;
+        chan->max_antenna_gain = min(chan->orig_mag,
+                                         rg->max_antenna_gain);
+        chan->max_power = min(chan->orig_mpwr, rg->max_power);
+}
+
+static void handle_band(struct ieee80211_supported_band *sband,
+                        const struct ieee80211_regdomain *rd)
+{
+        int i;
+
+        for (i = 0; i < sband->n_channels; i++)
+                handle_channel(&sband->channels[i], rd);
+}
+
+void wiphy_update_regulatory(struct wiphy *wiphy)
+{
+        enum ieee80211_band band;
+        const struct ieee80211_regdomain *rd = get_regdom();
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                if (wiphy->bands[band])
+                        handle_band(wiphy->bands[band], rd);
+}
diff --git a/net/wireless/util.c b/net/wireless/util.c
new file mode 100644
index 000000000000..77336c22fcf2
--- /dev/null
+++ b/net/wireless/util.c
@@ -0,0 +1,98 @@
+/*
+ * Wireless utility functions
+ *
+ * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ */
+#include <net/wireless.h>
+#include <asm/bitops.h>
+#include "core.h"
+
+int ieee80211_channel_to_frequency(int chan)
+{
+        if (chan < 14)
+                return 2407 + chan * 5;
+
+        if (chan == 14)
+                return 2484;
+
+        /* FIXME: 802.11j 17.3.8.3.2 */
+        return (chan + 1000) * 5;
+}
+EXPORT_SYMBOL(ieee80211_channel_to_frequency);
+
+int ieee80211_frequency_to_channel(int freq)
+{
+        if (freq == 2484)
+                return 14;
+
+        if (freq < 2484)
+                return (freq - 2407) / 5;
+
+        /* FIXME: 802.11j 17.3.8.3.2 */
+        return freq/5 - 1000;
+}
+EXPORT_SYMBOL(ieee80211_frequency_to_channel);
+
+static void set_mandatory_flags_band(struct ieee80211_supported_band *sband,
+                                     enum ieee80211_band band)
+{
+        int i, want;
+
+        switch (band) {
+        case IEEE80211_BAND_5GHZ:
+                want = 3;
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if (sband->bitrates[i].bitrate == 60 ||
+                            sband->bitrates[i].bitrate == 120 ||
+                            sband->bitrates[i].bitrate == 240) {
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_MANDATORY_A;
+                                want--;
+                        }
+                }
+                WARN_ON(want);
+                break;
+        case IEEE80211_BAND_2GHZ:
+                want = 7;
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if (sband->bitrates[i].bitrate == 10) {
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_MANDATORY_B |
+                                        IEEE80211_RATE_MANDATORY_G;
+                                want--;
+                        }
+
+                        if (sband->bitrates[i].bitrate == 20 ||
+                            sband->bitrates[i].bitrate == 55 ||
+                            sband->bitrates[i].bitrate == 110 ||
+                            sband->bitrates[i].bitrate == 60 ||
+                            sband->bitrates[i].bitrate == 120 ||
+                            sband->bitrates[i].bitrate == 240) {
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_MANDATORY_G;
+                                want--;
+                        }
+
+                        if (sband->bitrates[i].bitrate != 10 &&
+                            sband->bitrates[i].bitrate != 20 &&
+                            sband->bitrates[i].bitrate != 55 &&
+                            sband->bitrates[i].bitrate != 110)
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_ERP_G;
+                }
+                WARN_ON(want != 0 && want != 3 && want != 6);
+                break;
+        case IEEE80211_NUM_BANDS:
+                WARN_ON(1);
+                break;
+        }
+}
+
+void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
+{
+        enum ieee80211_band band;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                if (wiphy->bands[band])
+                        set_mandatory_flags_band(wiphy->bands[band], band);
+}
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9fc4c315f6cd..bae94a8031a2 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -46,6 +46,7 @@ EXPORT_SYMBOL(xfrm_cfg_mutex);
 
 static DEFINE_RWLOCK(xfrm_policy_lock);
 
+static struct list_head xfrm_policy_bytype[XFRM_POLICY_TYPE_MAX];
 unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];
 EXPORT_SYMBOL(xfrm_policy_count);
 
@@ -208,6 +209,7 @@ struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp)
         policy = kzalloc(sizeof(struct xfrm_policy), gfp);
 
         if (policy) {
+                INIT_LIST_HEAD(&policy->bytype);
                 INIT_HLIST_NODE(&policy->bydst);
                 INIT_HLIST_NODE(&policy->byidx);
                 rwlock_init(&policy->lock);
@@ -230,6 +232,10 @@ void xfrm_policy_destroy(struct xfrm_policy *policy)
         if (del_timer(&policy->timer))
                 BUG();
 
+        write_lock_bh(&xfrm_policy_lock);
+        list_del(&policy->bytype);
+        write_unlock_bh(&xfrm_policy_lock);
+
         security_xfrm_policy_free(policy);
         kfree(policy);
 }
@@ -584,6 +590,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         policy->curlft.use_time = 0;
         if (!mod_timer(&policy->timer, jiffies + HZ))
                 xfrm_pol_hold(policy);
+        list_add_tail(&policy->bytype, &xfrm_policy_bytype[policy->type]);
         write_unlock_bh(&xfrm_policy_lock);
 
         if (delpol)
@@ -822,57 +829,60 @@ out:
 }
 EXPORT_SYMBOL(xfrm_policy_flush);
 
-int xfrm_policy_walk(u8 type, int (*func)(struct xfrm_policy *, int, int, void*),
+int xfrm_policy_walk(struct xfrm_policy_walk *walk,
+                     int (*func)(struct xfrm_policy *, int, int, void*),
                      void *data)
 {
-        struct xfrm_policy *pol, *last = NULL;
-        struct hlist_node *entry;
-        int dir, last_dir = 0, count, error;
+        struct xfrm_policy *old, *pol, *last = NULL;
+        int error = 0;
+
+        if (walk->type >= XFRM_POLICY_TYPE_MAX &&
+            walk->type != XFRM_POLICY_TYPE_ANY)
+                return -EINVAL;
 
+        if (walk->policy == NULL && walk->count != 0)
+                return 0;
+
+        old = pol = walk->policy;
+        walk->policy = NULL;
         read_lock_bh(&xfrm_policy_lock);
-        count = 0;
 
-        for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) {
-                struct hlist_head *table = xfrm_policy_bydst[dir].table;
-                int i;
+        for (; walk->cur_type < XFRM_POLICY_TYPE_MAX; walk->cur_type++) {
+                if (walk->type != walk->cur_type &&
+                    walk->type != XFRM_POLICY_TYPE_ANY)
+                        continue;
 
-                hlist_for_each_entry(pol, entry,
-                                     &xfrm_policy_inexact[dir], bydst) {
-                        if (pol->type != type)
+                if (pol == NULL) {
+                        pol = list_first_entry(&xfrm_policy_bytype[walk->cur_type],
+                                               struct xfrm_policy, bytype);
+                }
+                list_for_each_entry_from(pol, &xfrm_policy_bytype[walk->cur_type], bytype) {
+                        if (pol->dead)
                                 continue;
                         if (last) {
-                                error = func(last, last_dir % XFRM_POLICY_MAX,
-                                             count, data);
-                                if (error)
+                                error = func(last, xfrm_policy_id2dir(last->index),
+                                             walk->count, data);
+                                if (error) {
+                                        xfrm_pol_hold(last);
+                                        walk->policy = last;
                                         goto out;
-                        }
-                        last = pol;
-                        last_dir = dir;
-                        count++;
-                }
-                for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
-                        hlist_for_each_entry(pol, entry, table + i, bydst) {
-                                if (pol->type != type)
-                                        continue;
-                                if (last) {
-                                        error = func(last, last_dir % XFRM_POLICY_MAX,
-                                                     count, data);
-                                        if (error)
-                                                goto out;
                                 }
-                                last = pol;
-                                last_dir = dir;
-                                count++;
                         }
+                        last = pol;
+                        walk->count++;
                 }
+                pol = NULL;
         }
-        if (count == 0) {
+        if (walk->count == 0) {
                 error = -ENOENT;
                 goto out;
         }
-        error = func(last, last_dir % XFRM_POLICY_MAX, 0, data);
+        if (last)
+                error = func(last, xfrm_policy_id2dir(last->index), 0, data);
 out:
         read_unlock_bh(&xfrm_policy_lock);
+        if (old != NULL)
+                xfrm_pol_put(old);
         return error;
 }
 EXPORT_SYMBOL(xfrm_policy_walk);
@@ -2365,6 +2375,9 @@ static void __init xfrm_policy_init(void)
                         panic("XFRM: failed to allocate bydst hash\n");
         }
 
+        for (dir = 0; dir < XFRM_POLICY_TYPE_MAX; dir++)
+                INIT_LIST_HEAD(&xfrm_policy_bytype[dir]);
+
         INIT_WORK(&xfrm_policy_gc_work, xfrm_policy_gc_task);
         register_netdevice_notifier(&xfrm_dev_notifier);
 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 7ba65e82941c..9880b792e6a5 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -50,6 +50,7 @@ static DEFINE_SPINLOCK(xfrm_state_lock);
  * Main use is finding SA after policy selected tunnel or transport mode.
  * Also, it can be used by ah/esp icmp error handler to find offending SA.
  */
+static LIST_HEAD(xfrm_state_all);
 static struct hlist_head *xfrm_state_bydst __read_mostly;
 static struct hlist_head *xfrm_state_bysrc __read_mostly;
 static struct hlist_head *xfrm_state_byspi __read_mostly;
@@ -510,6 +511,7 @@ struct xfrm_state *xfrm_state_alloc(void)
         if (x) {
                 atomic_set(&x->refcnt, 1);
                 atomic_set(&x->tunnel_users, 0);
+                INIT_LIST_HEAD(&x->all);
                 INIT_HLIST_NODE(&x->bydst);
                 INIT_HLIST_NODE(&x->bysrc);
                 INIT_HLIST_NODE(&x->byspi);
@@ -533,6 +535,10 @@ void __xfrm_state_destroy(struct xfrm_state *x)
 {
         BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
 
+        spin_lock_bh(&xfrm_state_lock);
+        list_del(&x->all);
+        spin_unlock_bh(&xfrm_state_lock);
+
         spin_lock_bh(&xfrm_state_gc_lock);
         hlist_add_head(&x->bydst, &xfrm_state_gc_list);
         spin_unlock_bh(&xfrm_state_gc_lock);
@@ -909,6 +915,8 @@ static void __xfrm_state_insert(struct xfrm_state *x)
 
         x->genid = ++xfrm_state_genid;
 
+        list_add_tail(&x->all, &xfrm_state_all);
+
         h = xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
                           x->props.reqid, x->props.family);
         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
@@ -1518,36 +1526,47 @@ unlock:
 }
 EXPORT_SYMBOL(xfrm_alloc_spi);
 
-int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*),
+int xfrm_state_walk(struct xfrm_state_walk *walk,
+                    int (*func)(struct xfrm_state *, int, void*),
                     void *data)
 {
-        int i;
-        struct xfrm_state *x, *last = NULL;
-        struct hlist_node *entry;
-        int count = 0;
+        struct xfrm_state *old, *x, *last = NULL;
         int err = 0;
 
+        if (walk->state == NULL && walk->count != 0)
+                return 0;
+
+        old = x = walk->state;
+        walk->state = NULL;
         spin_lock_bh(&xfrm_state_lock);
-        for (i = 0; i <= xfrm_state_hmask; i++) {
-                hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
-                        if (!xfrm_id_proto_match(x->id.proto, proto))
-                                continue;
-                        if (last) {
-                                err = func(last, count, data);
-                                if (err)
-                                        goto out;
+        if (x == NULL)
+                x = list_first_entry(&xfrm_state_all, struct xfrm_state, all);
+        list_for_each_entry_from(x, &xfrm_state_all, all) {
+                if (x->km.state == XFRM_STATE_DEAD)
+                        continue;
+                if (!xfrm_id_proto_match(x->id.proto, walk->proto))
+                        continue;
+                if (last) {
+                        err = func(last, walk->count, data);
+                        if (err) {
+                                xfrm_state_hold(last);
+                                walk->state = last;
+                                goto out;
                         }
-                        last = x;
-                        count++;
                 }
+                last = x;
+                walk->count++;
         }
-        if (count == 0) {
+        if (walk->count == 0) {
                 err = -ENOENT;
                 goto out;
         }
-        err = func(last, 0, data);
+        if (last)
+                err = func(last, 0, data);
 out:
         spin_unlock_bh(&xfrm_state_lock);
+        if (old != NULL)
+                xfrm_state_put(old);
         return err;
 }
 EXPORT_SYMBOL(xfrm_state_walk);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f971ca5645f8..f5fd5b3147cc 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -532,8 +532,6 @@ struct xfrm_dump_info {
         struct sk_buff *out_skb;
         u32 nlmsg_seq;
         u16 nlmsg_flags;
-        int start_idx;
-        int this_idx;
 };
 
 static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
@@ -600,9 +598,6 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
         struct nlmsghdr *nlh;
         int err;
 
-        if (sp->this_idx < sp->start_idx)
-                goto out;
-
         nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
                         XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
         if (nlh == NULL)
@@ -615,8 +610,6 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
                 goto nla_put_failure;
 
         nlmsg_end(skb, nlh);
-out:
-        sp->this_idx++;
         return 0;
 
 nla_put_failure:
@@ -624,18 +617,32 @@ nla_put_failure:
         return err;
 }
 
+static int xfrm_dump_sa_done(struct netlink_callback *cb)
+{
+        struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
+        xfrm_state_walk_done(walk);
+        return 0;
+}
+
 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
         struct xfrm_dump_info info;
 
+        BUILD_BUG_ON(sizeof(struct xfrm_state_walk) >
+                     sizeof(cb->args) - sizeof(cb->args[0]));
+
         info.in_skb = cb->skb;
         info.out_skb = skb;
         info.nlmsg_seq = cb->nlh->nlmsg_seq;
         info.nlmsg_flags = NLM_F_MULTI;
-        info.this_idx = 0;
-        info.start_idx = cb->args[0];
-        (void) xfrm_state_walk(0, dump_one_state, &info);
-        cb->args[0] = info.this_idx;
+
+        if (!cb->args[0]) {
+                cb->args[0] = 1;
+                xfrm_state_walk_init(walk, 0);
+        }
+
+        (void) xfrm_state_walk(walk, dump_one_state, &info);
 
         return skb->len;
 }
@@ -654,7 +661,6 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
         info.out_skb = skb;
         info.nlmsg_seq = seq;
         info.nlmsg_flags = 0;
-        info.this_idx = info.start_idx = 0;
 
         if (dump_one_state(x, 0, &info)) {
                 kfree_skb(skb);
@@ -1232,9 +1238,6 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
         struct sk_buff *skb = sp->out_skb;
         struct nlmsghdr *nlh;
 
-        if (sp->this_idx < sp->start_idx)
-                goto out;
-
         nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
                         XFRM_MSG_NEWPOLICY, sizeof(*p), sp->nlmsg_flags);
         if (nlh == NULL)
@@ -1250,8 +1253,6 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
                 goto nlmsg_failure;
 
         nlmsg_end(skb, nlh);
-out:
-        sp->this_idx++;
         return 0;
 
 nlmsg_failure:
@@ -1259,21 +1260,33 @@ nlmsg_failure:
         return -EMSGSIZE;
 }
 
+static int xfrm_dump_policy_done(struct netlink_callback *cb)
+{
+        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+
+        xfrm_policy_walk_done(walk);
+        return 0;
+}
+
 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
         struct xfrm_dump_info info;
 
+        BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
+                     sizeof(cb->args) - sizeof(cb->args[0]));
+
         info.in_skb = cb->skb;
         info.out_skb = skb;
         info.nlmsg_seq = cb->nlh->nlmsg_seq;
         info.nlmsg_flags = NLM_F_MULTI;
-        info.this_idx = 0;
-        info.start_idx = cb->args[0];
-        (void) xfrm_policy_walk(XFRM_POLICY_TYPE_MAIN, dump_one_policy, &info);
-#ifdef CONFIG_XFRM_SUB_POLICY
-        (void) xfrm_policy_walk(XFRM_POLICY_TYPE_SUB, dump_one_policy, &info);
-#endif
-        cb->args[0] = info.this_idx;
+
+        if (!cb->args[0]) {
+                cb->args[0] = 1;
+                xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
+        }
+
+        (void) xfrm_policy_walk(walk, dump_one_policy, &info);
 
         return skb->len;
 }
@@ -1293,7 +1306,6 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
         info.out_skb = skb;
         info.nlmsg_seq = seq;
         info.nlmsg_flags = 0;
-        info.this_idx = info.start_idx = 0;
 
         if (dump_one_policy(xp, dir, 0, &info) < 0) {
                 kfree_skb(skb);
@@ -1891,15 +1903,18 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
 static struct xfrm_link {
         int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
         int (*dump)(struct sk_buff *, struct netlink_callback *);
+        int (*done)(struct netlink_callback *);
 } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
         [XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
         [XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
         [XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
-                                                   .dump = xfrm_dump_sa       },
+                                                   .dump = xfrm_dump_sa,
+                                                   .done = xfrm_dump_sa_done  },
         [XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
         [XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
         [XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
-                                                   .dump = xfrm_dump_policy   },
+                                                   .dump = xfrm_dump_policy,
+                                                   .done = xfrm_dump_policy_done },
         [XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
         [XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = { .doit = xfrm_add_acquire   },
         [XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = { .doit = xfrm_add_sa_expire },
@@ -1938,7 +1953,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (link->dump == NULL)
                         return -EINVAL;
 
-                return netlink_dump_start(xfrm_nl, skb, nlh, link->dump, NULL);
+                return netlink_dump_start(xfrm_nl, skb, nlh, link->dump, link->done);
         }
 
         err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs, XFRMA_MAX,