302 files changed, 6880 insertions, 4895 deletions

diff --git a/net/802/tr.c b/net/802/tr.c
index 18c66475d8c3..158150fee462 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -285,10 +285,7 @@ void tr_source_route(struct sk_buff *skb,struct trh_hdr *trh,
                 if(entry)
                 {
 #if TR_SR_DEBUG
-{
-DECLARE_MAC_BUF(mac);
-printk("source routing for %s\n",print_mac(mac, trh->daddr));
-}
+printk("source routing for %pM\n", trh->daddr);
 #endif
                         if(!entry->local_ring && (ntohs(entry->rcf) & TR_RCF_LEN_MASK) >> 8)
                         {
@@ -370,9 +367,8 @@ static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev)
         if(entry==NULL)
         {
 #if TR_SR_DEBUG
-                DECLARE_MAC_BUF(mac);
-                printk("adding rif_entry: addr:%s rcf:%04X\n",
-                       print_mac(mac, trh->saddr), ntohs(trh->rcf));
+                printk("adding rif_entry: addr:%pM rcf:%04X\n",
+                       trh->saddr, ntohs(trh->rcf));
 #endif
                 /*
                  *      Allocate our new entry. A failure to allocate loses
@@ -417,11 +413,8 @@ static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev)
                          !(trh->rcf & htons(TR_RCF_BROADCAST_MASK)))
                     {
 #if TR_SR_DEBUG
-{
-DECLARE_MAC_BUF(mac);
-printk("updating rif_entry: addr:%s rcf:%04X\n",
-                print_mac(mac, trh->saddr), ntohs(trh->rcf));
-}
+printk("updating rif_entry: addr:%pM rcf:%04X\n",
+                trh->saddr, ntohs(trh->rcf));
 #endif
                             entry->rcf = trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK);
                             memcpy(&(entry->rseg[0]),&(trh->rseg[0]),8*sizeof(unsigned short));
@@ -532,7 +525,6 @@ static int rif_seq_show(struct seq_file *seq, void *v)
 {
         int j, rcf_len, segment, brdgnmb;
         struct rif_cache *entry = v;
-        DECLARE_MAC_BUF(mac);
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -542,9 +534,9 @@ static int rif_seq_show(struct seq_file *seq, void *v)
                 long ttl = (long) (entry->last_used + sysctl_tr_rif_timeout)
                                 - (long) jiffies;
 
-                seq_printf(seq, "%s %s %7li ",
+                seq_printf(seq, "%s %pM %7li ",
                            dev?dev->name:"?",
-                           print_mac(mac, entry->addr),
+                           entry->addr,
                            ttl/HZ);
 
                         if (entry->local_ring)
@@ -643,7 +635,7 @@ static struct ctl_table tr_table[] = {
                 .data           = &sysctl_tr_rif_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         { 0 },
 };
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index f0e335aa20df..41e8f65bd3f0 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -46,10 +46,10 @@ int vlan_net_id;
 /* Our listing of VLAN group(s) */
 static struct hlist_head vlan_group_hash[VLAN_GRP_HASH_SIZE];
 
-static char vlan_fullname[] = "802.1Q VLAN Support";
-static char vlan_version[] = DRV_VERSION;
-static char vlan_copyright[] = "Ben Greear <greearb@candelatech.com>";
-static char vlan_buggyright[] = "David S. Miller <davem@redhat.com>";
+const char vlan_fullname[] = "802.1Q VLAN Support";
+const char vlan_version[] = DRV_VERSION;
+static const char vlan_copyright[] = "Ben Greear <greearb@candelatech.com>";
+static const char vlan_buggyright[] = "David S. Miller <davem@redhat.com>";
 
 static struct packet_type vlan_packet_type = {
         .type = __constant_htons(ETH_P_8021Q),
@@ -144,6 +144,7 @@ void unregister_vlan_dev(struct net_device *dev)
 {
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         struct net_device *real_dev = vlan->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
         struct vlan_group *grp;
         u16 vlan_id = vlan->vlan_id;
 
@@ -156,7 +157,7 @@ void unregister_vlan_dev(struct net_device *dev)
          * HW accelerating devices or SW vlan input packet processing.
          */
         if (real_dev->features & NETIF_F_HW_VLAN_FILTER)
-                real_dev->vlan_rx_kill_vid(real_dev, vlan_id);
+                ops->ndo_vlan_rx_kill_vid(real_dev, vlan_id);
 
         vlan_group_set_device(grp, vlan_id, NULL);
         grp->nr_vlans--;
@@ -170,7 +171,7 @@ void unregister_vlan_dev(struct net_device *dev)
                 vlan_gvrp_uninit_applicant(real_dev);
 
                 if (real_dev->features & NETIF_F_HW_VLAN_RX)
-                        real_dev->vlan_rx_register(real_dev, NULL);
+                        ops->ndo_vlan_rx_register(real_dev, NULL);
 
                 hlist_del_rcu(&grp->hlist);
 
@@ -205,21 +206,21 @@ static void vlan_transfer_operstate(const struct net_device *dev,
 
 int vlan_check_real_dev(struct net_device *real_dev, u16 vlan_id)
 {
-        char *name = real_dev->name;
+        const char *name = real_dev->name;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
 
         if (real_dev->features & NETIF_F_VLAN_CHALLENGED) {
                 pr_info("8021q: VLANs not supported on %s\n", name);
                 return -EOPNOTSUPP;
         }
 
-        if ((real_dev->features & NETIF_F_HW_VLAN_RX) &&
-            !real_dev->vlan_rx_register) {
+        if ((real_dev->features & NETIF_F_HW_VLAN_RX) && !ops->ndo_vlan_rx_register) {
                 pr_info("8021q: device %s has buggy VLAN hw accel\n", name);
                 return -EOPNOTSUPP;
         }
 
         if ((real_dev->features & NETIF_F_HW_VLAN_FILTER) &&
-            (!real_dev->vlan_rx_add_vid || !real_dev->vlan_rx_kill_vid)) {
+            (!ops->ndo_vlan_rx_add_vid || !ops->ndo_vlan_rx_kill_vid)) {
                 pr_info("8021q: Device %s has buggy VLAN hw accel\n", name);
                 return -EOPNOTSUPP;
         }
@@ -240,6 +241,7 @@ int register_vlan_dev(struct net_device *dev)
 {
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         struct net_device *real_dev = vlan->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
         u16 vlan_id = vlan->vlan_id;
         struct vlan_group *grp, *ngrp = NULL;
         int err;
@@ -275,9 +277,9 @@ int register_vlan_dev(struct net_device *dev)
         grp->nr_vlans++;
 
         if (ngrp && real_dev->features & NETIF_F_HW_VLAN_RX)
-                real_dev->vlan_rx_register(real_dev, ngrp);
+                ops->ndo_vlan_rx_register(real_dev, ngrp);
         if (real_dev->features & NETIF_F_HW_VLAN_FILTER)
-                real_dev->vlan_rx_add_vid(real_dev, vlan_id);
+                ops->ndo_vlan_rx_add_vid(real_dev, vlan_id);
 
         return 0;
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index a6603a4d917f..82570bc2a180 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -108,8 +108,10 @@ static inline int vlan_gvrp_init(void) { return 0; }
 static inline void vlan_gvrp_uninit(void) {}
 #endif
 
-int vlan_netlink_init(void);
-void vlan_netlink_fini(void);
+extern const char vlan_fullname[];
+extern const char vlan_version[];
+extern int vlan_netlink_init(void);
+extern void vlan_netlink_fini(void);
 
 extern struct rtnl_link_ops vlan_link_ops;
 
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 68ced4bf158c..dd86a1dc4cd0 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -47,8 +47,6 @@ int vlan_hwaccel_do_receive(struct sk_buff *skb)
         skb->priority = vlan_get_ingress_priority(dev, skb->vlan_tci);
         skb->vlan_tci = 0;
 
-        dev->last_rx = jiffies;
-
         stats = &dev->stats;
         stats->rx_packets++;
         stats->rx_bytes += skb->len;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 8883e9c8a223..71193a6b10e6 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -163,8 +163,6 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
                 goto err_unlock;
         }
 
-        skb->dev->last_rx = jiffies;
-
         stats = &skb->dev->stats;
         stats->rx_packets++;
         stats->rx_bytes += skb->len;
@@ -526,6 +524,7 @@ out:
 static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
         struct ifreq ifrr;
         int err = -EOPNOTSUPP;
 
@@ -536,8 +535,8 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCGMIIPHY:
         case SIOCGMIIREG:
         case SIOCSMIIREG:
-                if (real_dev->do_ioctl && netif_device_present(real_dev))
-                        err = real_dev->do_ioctl(real_dev, &ifrr, cmd);
+                if (netif_device_present(real_dev) && ops->ndo_do_ioctl)
+                        err = ops->ndo_do_ioctl(real_dev, &ifrr, cmd);
                 break;
         }
 
@@ -648,6 +647,26 @@ static void vlan_dev_uninit(struct net_device *dev)
         }
 }
 
+static int vlan_ethtool_get_settings(struct net_device *dev,
+                                     struct ethtool_cmd *cmd)
+{
+        const struct vlan_dev_info *vlan = vlan_dev_info(dev);
+        struct net_device *real_dev = vlan->real_dev;
+
+        if (!real_dev->ethtool_ops->get_settings)
+                return -EOPNOTSUPP;
+
+        return real_dev->ethtool_ops->get_settings(real_dev, cmd);
+}
+
+static void vlan_ethtool_get_drvinfo(struct net_device *dev,
+                                     struct ethtool_drvinfo *info)
+{
+        strcpy(info->driver, vlan_fullname);
+        strcpy(info->version, vlan_version);
+        strcpy(info->fw_version, "N/A");
+}
+
 static u32 vlan_ethtool_get_rx_csum(struct net_device *dev)
 {
         const struct vlan_dev_info *vlan = vlan_dev_info(dev);
@@ -672,11 +691,27 @@ static u32 vlan_ethtool_get_flags(struct net_device *dev)
 }
 
 static const struct ethtool_ops vlan_ethtool_ops = {
+        .get_settings           = vlan_ethtool_get_settings,
+        .get_drvinfo            = vlan_ethtool_get_drvinfo,
         .get_link               = ethtool_op_get_link,
         .get_rx_csum            = vlan_ethtool_get_rx_csum,
         .get_flags              = vlan_ethtool_get_flags,
 };
 
+static const struct net_device_ops vlan_netdev_ops = {
+        .ndo_change_mtu         = vlan_dev_change_mtu,
+        .ndo_init               = vlan_dev_init,
+        .ndo_uninit             = vlan_dev_uninit,
+        .ndo_open               = vlan_dev_open,
+        .ndo_stop               = vlan_dev_stop,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = vlan_dev_set_mac_address,
+        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
+        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
+        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
+        .ndo_do_ioctl           = vlan_dev_ioctl,
+};
+
 void vlan_setup(struct net_device *dev)
 {
         ether_setup(dev);
@@ -684,16 +719,7 @@ void vlan_setup(struct net_device *dev)
         dev->priv_flags         |= IFF_802_1Q_VLAN;
         dev->tx_queue_len       = 0;
 
-        dev->change_mtu         = vlan_dev_change_mtu;
-        dev->init               = vlan_dev_init;
-        dev->uninit             = vlan_dev_uninit;
-        dev->open               = vlan_dev_open;
-        dev->stop               = vlan_dev_stop;
-        dev->set_mac_address    = vlan_dev_set_mac_address;
-        dev->set_rx_mode        = vlan_dev_set_rx_mode;
-        dev->set_multicast_list = vlan_dev_set_rx_mode;
-        dev->change_rx_flags    = vlan_dev_change_rx_flags;
-        dev->do_ioctl           = vlan_dev_ioctl;
+        dev->netdev_ops         = &vlan_netdev_ops;
         dev->destructor         = free_netdev;
         dev->ethtool_ops        = &vlan_ethtool_ops;
 
diff --git a/net/Kconfig b/net/Kconfig
index d789d79551ae..4e2e40ba8ba6 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -27,11 +27,14 @@ menu "Networking options"
 config NET_NS
         bool "Network namespace support"
         default n
-        depends on EXPERIMENTAL && !SYSFS && NAMESPACES
+        depends on EXPERIMENTAL && NAMESPACES
         help
           Allow user space to create what appear to be multiple instances
           of the network stack.
 
+config COMPAT_NET_DEV_OPS
+       def_bool y
+
 source "net/packet/Kconfig"
 source "net/unix/Kconfig"
 source "net/xfrm/Kconfig"
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index b25c1e909d14..b03ff58e9308 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -995,7 +995,6 @@ static int aarp_seq_show(struct seq_file *seq, void *v)
         struct aarp_iter_state *iter = seq->private;
         struct aarp_entry *entry = v;
         unsigned long now = jiffies;
-        DECLARE_MAC_BUF(mac);
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1006,7 +1005,7 @@ static int aarp_seq_show(struct seq_file *seq, void *v)
                            ntohs(entry->target_addr.s_net),
                            (unsigned int) entry->target_addr.s_node,
                            entry->dev ? entry->dev->name : "????");
-                seq_printf(seq, "%s", print_mac(mac, entry->hwaddr));
+                seq_printf(seq, "%pM", entry->hwaddr);
                 seq_printf(seq, " %8s",
                            dt2str((long)entry->expires_at - (long)now));
                 if (iter->table == unresolved)
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index d3134e7e6ee8..c3f002717378 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1284,7 +1284,7 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
         skb->dev   = dev;
         skb_reset_transport_header(skb);
 
-        stats = dev->priv;
+        stats = netdev_priv(dev);
         stats->rx_packets++;
         stats->rx_bytes += skb->len + 13;
         netif_rx(skb);  /* Send the SKB up to a higher place. */
diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c
index 621805dfa2f4..8d237b15183b 100644
--- a/net/appletalk/sysctl_net_atalk.c
+++ b/net/appletalk/sysctl_net_atalk.c
@@ -17,8 +17,8 @@ static struct ctl_table atalk_table[] = {
                 .data           = &sysctl_aarp_expiry_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_ATALK_AARP_TICK_TIME,
@@ -26,8 +26,8 @@ static struct ctl_table atalk_table[] = {
                 .data           = &sysctl_aarp_tick_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_ATALK_AARP_RETRANSMIT_LIMIT,
@@ -35,7 +35,7 @@ static struct ctl_table atalk_table[] = {
                 .data           = &sysctl_aarp_retransmit_limit,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_ATALK_AARP_RESOLVE_TIME,
@@ -43,8 +43,8 @@ static struct ctl_table atalk_table[] = {
                 .data           = &sysctl_aarp_resolve_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         { 0 },
 };
diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index 1b88311f2130..b5674dc2083d 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -149,7 +149,7 @@ int atm_register_sysfs(struct atm_dev *adev)
         cdev->class = &atm_class;
         dev_set_drvdata(cdev, adev);
 
-        snprintf(cdev->bus_id, BUS_ID_SIZE, "%s%d", adev->type, adev->number);
+        dev_set_name(cdev, "%s%d", adev->type, adev->number);
         err = device_register(cdev);
         if (err < 0)
                 return err;
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 280de481edc7..ea9438fc6855 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -101,7 +101,7 @@ static LIST_HEAD(br2684_devs);
 
 static inline struct br2684_dev *BRPRIV(const struct net_device *net_dev)
 {
-        return (struct br2684_dev *)net_dev->priv;
+        return (struct br2684_dev *)netdev_priv(net_dev);
 }
 
 static inline struct net_device *list_entry_brdev(const struct list_head *le)
@@ -698,12 +698,11 @@ static int br2684_seq_show(struct seq_file *seq, void *v)
                                                     br2684_devs);
         const struct net_device *net_dev = brdev->net_dev;
         const struct br2684_vcc *brvcc;
-        DECLARE_MAC_BUF(mac);
 
-        seq_printf(seq, "dev %.16s: num=%d, mac=%s (%s)\n",
+        seq_printf(seq, "dev %.16s: num=%d, mac=%pM (%s)\n",
                    net_dev->name,
                    brdev->number,
-                   print_mac(mac, net_dev->dev_addr),
+                   net_dev->dev_addr,
                    brdev->mac_was_set ? "set" : "auto");
 
         list_for_each_entry(brvcc, &brdev->brvccs, brvccs) {
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 5b5b96344ce6..2d33a83be799 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -822,8 +822,8 @@ static void atmarp_info(struct seq_file *seq, struct net_device *dev,
         seq_printf(seq, "%-6s%-4s%-4s%5ld ",
                    dev->name, svc ? "SVC" : "PVC", llc ? "LLC" : "NULL", exp);
 
-        off = scnprintf(buf, sizeof(buf) - 1, "%d.%d.%d.%d",
-                        NIPQUAD(entry->ip));
+        off = scnprintf(buf, sizeof(buf) - 1, "%pI4",
+                        &entry->ip);
         while (off < 16)
                 buf[off++] = ' ';
         buf[off] = '\0';
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 8f701cde5945..e5e301550e8a 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -152,7 +152,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
                 buff += 4;
                 mesg->content.normal.flag = *buff & 0x01;       /* 0x01 is topology change */
 
-                priv = (struct lec_priv *)dev->priv;
+                priv = netdev_priv(dev);
                 atm_force_charge(priv->lecd, skb2->truesize);
                 sk = sk_atm(priv->lecd);
                 skb_queue_tail(&sk->sk_receive_queue, skb2);
@@ -218,7 +218,7 @@ static unsigned char *get_tr_dst(unsigned char *packet, unsigned char *rdesc)
 
 static int lec_open(struct net_device *dev)
 {
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
 
         netif_start_queue(dev);
         memset(&priv->stats, 0, sizeof(struct net_device_stats));
@@ -252,7 +252,7 @@ static void lec_tx_timeout(struct net_device *dev)
 static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct sk_buff *skb2;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
         struct lecdatahdr_8023 *lec_h;
         struct atm_vcc *vcc;
         struct lec_arp_table *entry;
@@ -373,19 +373,13 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
                         pr_debug("%s:lec_start_xmit: queuing packet, ",
                                 dev->name);
-                        pr_debug("MAC address " MAC_FMT "\n",
-                                 lec_h->h_dest[0], lec_h->h_dest[1],
-                                 lec_h->h_dest[2], lec_h->h_dest[3],
-                                 lec_h->h_dest[4], lec_h->h_dest[5]);
+                        pr_debug("MAC address %pM\n", lec_h->h_dest);
                         skb_queue_tail(&entry->tx_wait, skb);
                 } else {
                         pr_debug
                             ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
                              dev->name);
-                        pr_debug("MAC address " MAC_FMT "\n",
-                                 lec_h->h_dest[0], lec_h->h_dest[1],
-                                 lec_h->h_dest[2], lec_h->h_dest[3],
-                                 lec_h->h_dest[4], lec_h->h_dest[5]);
+                        pr_debug("MAC address %pM\n", lec_h->h_dest);
                         priv->stats.tx_dropped++;
                         dev_kfree_skb(skb);
                 }
@@ -397,10 +391,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
                 pr_debug("lec.c: emptying tx queue, ");
-                pr_debug("MAC address " MAC_FMT "\n",
-                         lec_h->h_dest[0], lec_h->h_dest[1],
-                         lec_h->h_dest[2], lec_h->h_dest[3],
-                         lec_h->h_dest[4], lec_h->h_dest[5]);
+                pr_debug("MAC address %pM\n", lec_h->h_dest);
                 lec_send(vcc, skb2, priv);
         }
 
@@ -442,14 +433,14 @@ static int lec_close(struct net_device *dev)
  */
 static struct net_device_stats *lec_get_stats(struct net_device *dev)
 {
-        return &((struct lec_priv *)dev->priv)->stats;
+        return &((struct lec_priv *)netdev_priv(dev))->stats;
 }
 
 static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         unsigned long flags;
         struct net_device *dev = (struct net_device *)vcc->proto_data;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
         struct atmlec_msg *mesg;
         struct lec_arp_table *entry;
         int i;
@@ -539,15 +530,8 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                 {
                         struct net_bridge_fdb_entry *f;
 
-                        pr_debug
-                            ("%s: bridge zeppelin asks about " MAC_FMT "\n",
-                             dev->name,
-                             mesg->content.proxy.mac_addr[0],
-                             mesg->content.proxy.mac_addr[1],
-                             mesg->content.proxy.mac_addr[2],
-                             mesg->content.proxy.mac_addr[3],
-                             mesg->content.proxy.mac_addr[4],
-                             mesg->content.proxy.mac_addr[5]);
+                        pr_debug("%s: bridge zeppelin asks about %pM\n",
+                                 dev->name, mesg->content.proxy.mac_addr);
 
                         if (br_fdb_get_hook == NULL || dev->br_port == NULL)
                                 break;
@@ -596,7 +580,7 @@ static void lec_atm_close(struct atm_vcc *vcc)
 {
         struct sk_buff *skb;
         struct net_device *dev = (struct net_device *)vcc->proto_data;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
 
         priv->lecd = NULL;
         /* Do something needful? */
@@ -727,7 +711,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         unsigned long flags;
         struct net_device *dev = (struct net_device *)vcc->proto_data;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
 
 #if DUMP_PACKETS >0
         int i = 0;
@@ -874,7 +858,7 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
         vpriv->old_pop = vcc->pop;
         vcc->user_back = vpriv;
         vcc->pop = lec_pop;
-        lec_vcc_added(dev_lec[ioc_data.dev_num]->priv,
+        lec_vcc_added(netdev_priv(dev_lec[ioc_data.dev_num]),
                       &ioc_data, vcc, vcc->push);
         vcc->proto_data = dev_lec[ioc_data.dev_num];
         vcc->push = lec_push;
@@ -886,7 +870,8 @@ static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
         if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
                 return -EINVAL;
         vcc->proto_data = dev_lec[arg];
-        return (lec_mcast_make((struct lec_priv *)dev_lec[arg]->priv, vcc));
+        return lec_mcast_make((struct lec_priv *)netdev_priv(dev_lec[arg]),
+                                vcc);
 }
 
 /* Initialize device. */
@@ -928,11 +913,11 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                         return -EINVAL;
                 }
 
-                priv = dev_lec[i]->priv;
+                priv = netdev_priv(dev_lec[i]);
                 priv->is_trdev = is_trdev;
                 lec_init(dev_lec[i]);
         } else {
-                priv = dev_lec[i]->priv;
+                priv = netdev_priv(dev_lec[i]);
                 if (priv->lecd)
                         return -EADDRINUSE;
         }
@@ -1093,7 +1078,8 @@ static void *lec_itf_walk(struct lec_state *state, loff_t *l)
         void *v;
 
         dev = state->dev ? state->dev : dev_lec[state->itf];
-        v = (dev && dev->priv) ? lec_priv_walk(state, l, dev->priv) : NULL;
+        v = (dev && netdev_priv(dev)) ?
+                lec_priv_walk(state, l, netdev_priv(dev)) : NULL;
         if (!v && dev) {
                 dev_put(dev);
                 /* Partial state reset for the next time we get called */
@@ -1255,7 +1241,7 @@ static void __exit lane_module_cleanup(void)
 
         for (i = 0; i < MAX_LEC_ITF; i++) {
                 if (dev_lec[i] != NULL) {
-                        priv = (struct lec_priv *)dev_lec[i]->priv;
+                        priv = netdev_priv(dev_lec[i]);
                         unregister_netdev(dev_lec[i]);
                         free_netdev(dev_lec[i]);
                         dev_lec[i] = NULL;
@@ -1279,7 +1265,7 @@ static int lane2_resolve(struct net_device *dev, const u8 *dst_mac, int force,
                          u8 **tlvs, u32 *sizeoftlvs)
 {
         unsigned long flags;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
         struct lec_arp_table *table;
         struct sk_buff *skb;
         int retval;
@@ -1326,7 +1312,7 @@ static int lane2_associate_req(struct net_device *dev, const u8 *lan_dst,
 {
         int retval;
         struct sk_buff *skb;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
 
         if (compare_ether_addr(lan_dst, dev->dev_addr))
                 return (0);     /* not our mac address */
@@ -1363,7 +1349,7 @@ static void lane2_associate_ind(struct net_device *dev, const u8 *mac_addr,
 #if 0
         int i = 0;
 #endif
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_priv *priv = netdev_priv(dev);
 #if 0                           /*
                                  * Why have the TLVs in LE_ARP entries
                                  * since we do not use them? When you
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 11b16d16661c..12e9ea371db1 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -232,8 +232,8 @@ void atm_mpoa_disp_qos(struct seq_file *m)
         seq_printf(m, "IP address\n  TX:max_pcr pcr     min_pcr max_cdv max_sdu\n  RX:max_pcr pcr     min_pcr max_cdv max_sdu\n");
 
         while (qos != NULL) {
-                seq_printf(m, "%u.%u.%u.%u\n     %-7d %-7d %-7d %-7d %-7d\n     %-7d %-7d %-7d %-7d %-7d\n",
-                                NIPQUAD(qos->ipaddr),
+                seq_printf(m, "%pI4\n     %-7d %-7d %-7d %-7d %-7d\n     %-7d %-7d %-7d %-7d %-7d\n",
+                                &qos->ipaddr,
                                 qos->qos.txtp.max_pcr, qos->qos.txtp.pcr, qos->qos.txtp.min_pcr, qos->qos.txtp.max_cdv, qos->qos.txtp.max_sdu,
                                 qos->qos.rxtp.max_pcr, qos->qos.rxtp.pcr, qos->qos.rxtp.min_pcr, qos->qos.rxtp.max_cdv, qos->qos.rxtp.max_sdu);
                 qos = qos->next;
@@ -595,8 +595,8 @@ static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
                         if (in_entry != NULL) mpc->in_ops->put(in_entry);
                         return -EINVAL;
                 }
-                printk("mpoa: (%s) mpc_vcc_attach: attaching ingress SVC, entry = %u.%u.%u.%u\n",
-                       mpc->dev->name, NIPQUAD(in_entry->ctrl_info.in_dst_ip));
+                printk("mpoa: (%s) mpc_vcc_attach: attaching ingress SVC, entry = %pI4\n",
+                       mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
                 in_entry->shortcut = vcc;
                 mpc->in_ops->put(in_entry);
         } else {
@@ -627,8 +627,8 @@ static void mpc_vcc_close(struct atm_vcc *vcc, struct net_device *dev)
         dprintk("mpoa: (%s) mpc_vcc_close:\n", dev->name);
         in_entry = mpc->in_ops->get_by_vcc(vcc, mpc);
         if (in_entry) {
-                dprintk("mpoa: (%s) mpc_vcc_close: ingress SVC closed ip = %u.%u.%u.%u\n",
-                       mpc->dev->name, NIPQUAD(in_entry->ctrl_info.in_dst_ip));
+                dprintk("mpoa: (%s) mpc_vcc_close: ingress SVC closed ip = %pI4\n",
+                       mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
                 in_entry->shortcut = NULL;
                 mpc->in_ops->put(in_entry);
         }
@@ -785,7 +785,7 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
         }
 
         if (mpc->dev) { /* check if the lec is LANE2 capable */
-                priv = (struct lec_priv *)mpc->dev->priv;
+                priv = netdev_priv(mpc->dev);
                 if (priv->lane_version < 2) {
                         dev_put(mpc->dev);
                         mpc->dev = NULL;
@@ -845,7 +845,7 @@ static void mpoad_close(struct atm_vcc *vcc)
 
         mpc->mpoad_vcc = NULL;
         if (mpc->dev) {
-                struct lec_priv *priv = (struct lec_priv *)mpc->dev->priv;
+                struct lec_priv *priv = netdev_priv(mpc->dev);
                 priv->lane2_ops->associate_indicator = NULL;
                 stop_mpc(mpc);
                 dev_put(mpc->dev);
@@ -976,7 +976,7 @@ static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned lo
 
         switch (event) {
         case NETDEV_REGISTER:       /* a new lec device was allocated */
-                priv = (struct lec_priv *)dev->priv;
+                priv = netdev_priv(dev);
                 if (priv->lane_version < 2)
                         break;
                 priv->lane2_ops->associate_indicator = lane2_assoc_ind;
@@ -1098,7 +1098,8 @@ static void check_qos_and_open_shortcut(struct k_message *msg, struct mpoa_clien
                                     entry->shortcut = eg_entry->shortcut;
                 }
                 if(entry->shortcut){
-                        dprintk("mpoa: (%s) using egress SVC to reach %u.%u.%u.%u\n",client->dev->name, NIPQUAD(dst_ip));
+                        dprintk("mpoa: (%s) using egress SVC to reach %pI4\n",
+                                client->dev->name, &dst_ip);
                         client->eg_ops->put(eg_entry);
                         return;
                 }
@@ -1123,7 +1124,8 @@ static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         __be32 dst_ip = msg->content.in_info.in_dst_ip;
         in_cache_entry *entry = mpc->in_ops->get(dst_ip, mpc);
 
-        dprintk("mpoa: (%s) MPOA_res_reply_rcvd: ip %u.%u.%u.%u\n", mpc->dev->name, NIPQUAD(dst_ip));
+        dprintk("mpoa: (%s) MPOA_res_reply_rcvd: ip %pI4\n",
+                mpc->dev->name, &dst_ip);
         ddprintk("mpoa: (%s) MPOA_res_reply_rcvd() entry = %p", mpc->dev->name, entry);
         if(entry == NULL){
                 printk("\nmpoa: (%s) ARGH, received res. reply for an entry that doesn't exist.\n", mpc->dev->name);
@@ -1171,14 +1173,14 @@ static void ingress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         in_cache_entry *entry = mpc->in_ops->get_with_mask(dst_ip, mpc, mask);
 
         if(entry == NULL){
-                printk("mpoa: (%s) ingress_purge_rcvd: purge for a non-existing entry, ", mpc->dev->name);
-                printk("ip = %u.%u.%u.%u\n", NIPQUAD(dst_ip));
+                printk("mpoa: (%s) ingress_purge_rcvd: purge for a non-existing entry, ip = %pI4\n",
+                       mpc->dev->name, &dst_ip);
                 return;
         }
 
         do {
-                dprintk("mpoa: (%s) ingress_purge_rcvd: removing an ingress entry, ip = %u.%u.%u.%u\n" ,
-                        mpc->dev->name, NIPQUAD(dst_ip));
+                dprintk("mpoa: (%s) ingress_purge_rcvd: removing an ingress entry, ip = %pI4\n",
+                        mpc->dev->name, &dst_ip);
                 write_lock_bh(&mpc->ingress_lock);
                 mpc->in_ops->remove_entry(entry, mpc);
                 write_unlock_bh(&mpc->ingress_lock);
@@ -1322,7 +1324,7 @@ static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *m
         dprintk("\n");
 
         if (mpc->dev) {
-                priv = (struct lec_priv *)mpc->dev->priv;
+                priv = netdev_priv(mpc->dev);
                 retval = priv->lane2_ops->associate_req(mpc->dev, mpc->dev->dev_addr, tlv, sizeof(tlv));
                 if (retval == 0)
                         printk("mpoa: (%s) MPOA device type TLV association failed\n", mpc->dev->name);
@@ -1472,7 +1474,7 @@ static void __exit atm_mpoa_cleanup(void)
                 tmp = mpc->next;
                 if (mpc->dev != NULL) {
                         stop_mpc(mpc);
-                        priv = (struct lec_priv *)mpc->dev->priv;
+                        priv = netdev_priv(mpc->dev);
                         if (priv->lane2_ops != NULL)
                                 priv->lane2_ops->associate_indicator = NULL;
                 }
diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
index 24799e3e78f7..4504a4b339bb 100644
--- a/net/atm/mpoa_caches.c
+++ b/net/atm/mpoa_caches.c
@@ -94,7 +94,7 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip,
                 return NULL;
         }
 
-        dprintk("mpoa: mpoa_caches.c: adding an ingress entry, ip = %u.%u.%u.%u\n", NIPQUAD(dst_ip));
+        dprintk("mpoa: mpoa_caches.c: adding an ingress entry, ip = %pI4\n", &dst_ip);
 
         atomic_set(&entry->use, 1);
         dprintk("mpoa: mpoa_caches.c: new_in_cache_entry: about to lock\n");
@@ -150,7 +150,8 @@ static int cache_hit(in_cache_entry *entry, struct mpoa_client *mpc)
 
         if( entry->count > mpc->parameters.mpc_p1 &&
             entry->entry_state == INGRESS_INVALID){
-                dprintk("mpoa: (%s) mpoa_caches.c: threshold exceeded for ip %u.%u.%u.%u, sending MPOA res req\n", mpc->dev->name, NIPQUAD(entry->ctrl_info.in_dst_ip));
+                dprintk("mpoa: (%s) mpoa_caches.c: threshold exceeded for ip %pI4, sending MPOA res req\n",
+                        mpc->dev->name, &entry->ctrl_info.in_dst_ip);
                 entry->entry_state = INGRESS_RESOLVING;
                 msg.type =  SND_MPOA_RES_RQST;
                 memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN );
@@ -184,7 +185,8 @@ static void in_cache_remove_entry(in_cache_entry *entry,
         struct k_message msg;
 
         vcc = entry->shortcut;
-        dprintk("mpoa: mpoa_caches.c: removing an ingress entry, ip = %u.%u.%u.%u\n",NIPQUAD(entry->ctrl_info.in_dst_ip));
+        dprintk("mpoa: mpoa_caches.c: removing an ingress entry, ip = %pI4\n",
+                &entry->ctrl_info.in_dst_ip);
 
         if (entry->prev != NULL)
                 entry->prev->next = entry->next;
@@ -228,7 +230,8 @@ static void clear_count_and_expired(struct mpoa_client *client)
                 next_entry = entry->next;
                 if((now.tv_sec - entry->tv.tv_sec)
                    > entry->ctrl_info.holding_time){
-                        dprintk("mpoa: mpoa_caches.c: holding time expired, ip = %u.%u.%u.%u\n", NIPQUAD(entry->ctrl_info.in_dst_ip));
+                        dprintk("mpoa: mpoa_caches.c: holding time expired, ip = %pI4\n",
+                                &entry->ctrl_info.in_dst_ip);
                         client->in_ops->remove_entry(entry, client);
                 }
                 entry = next_entry;
@@ -453,7 +456,8 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_cli
                 return NULL;
         }
 
-        dprintk("mpoa: mpoa_caches.c: adding an egress entry, ip = %u.%u.%u.%u, this should be our IP\n", NIPQUAD(msg->content.eg_info.eg_dst_ip));
+        dprintk("mpoa: mpoa_caches.c: adding an egress entry, ip = %pI4, this should be our IP\n",
+                &msg->content.eg_info.eg_dst_ip);
 
         atomic_set(&entry->use, 1);
         dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry: about to lock\n");
@@ -469,8 +473,8 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_cli
         do_gettimeofday(&(entry->tv));
         entry->entry_state = EGRESS_RESOLVED;
         dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry cache_id %lu\n", ntohl(entry->ctrl_info.cache_id));
-        dprintk("mpoa: mpoa_caches.c: mps_ip = %u.%u.%u.%u\n",
-                NIPQUAD(entry->ctrl_info.mps_ip));
+        dprintk("mpoa: mpoa_caches.c: mps_ip = %pI4\n",
+                &entry->ctrl_info.mps_ip);
         atomic_inc(&entry->use);
 
         write_unlock_irq(&client->egress_lock);
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index f288fc4aef9b..c1d877bb5dff 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -43,8 +43,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "ip_default_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_ipdefmode,
                 .extra2         = &max_ipdefmode
         },
@@ -53,8 +53,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "ax25_default_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_axdefmode,
                 .extra2         = &max_axdefmode
         },
@@ -63,8 +63,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "backoff_type",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_backoff,
                 .extra2         = &max_backoff
         },
@@ -73,8 +73,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "connect_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_conmode,
                 .extra2         = &max_conmode
         },
@@ -83,8 +83,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "standard_window_size",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_window,
                 .extra2         = &max_window
         },
@@ -93,8 +93,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "extended_window_size",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_ewindow,
                 .extra2         = &max_ewindow
         },
@@ -103,8 +103,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "t1_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_t1,
                 .extra2         = &max_t1
         },
@@ -113,8 +113,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "t2_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_t2,
                 .extra2         = &max_t2
         },
@@ -123,8 +123,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "t3_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_t3,
                 .extra2         = &max_t3
         },
@@ -133,8 +133,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "idle_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_idle,
                 .extra2         = &max_idle
         },
@@ -143,8 +143,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "maximum_retry_count",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_n2,
                 .extra2         = &max_n2
         },
@@ -153,8 +153,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "maximum_packet_length",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_paclen,
                 .extra2         = &max_paclen
         },
@@ -163,8 +163,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "protocol",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_proto,
                 .extra2         = &max_proto
         },
@@ -174,8 +174,8 @@ static const ctl_table ax25_param_table[] = {
                 .procname       = "dama_slave_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_ds_timeout,
                 .extra2         = &max_ds_timeout
         },
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 80ba30cf4b68..f8efaf35293c 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -311,7 +311,6 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
         struct sk_buff *nskb;
         u8 type;
 
-        dev->last_rx = jiffies;
         s->stats.rx_bytes += skb->len;
 
         type = *(u8 *) skb->data; skb_pull(skb, 1);
@@ -566,7 +565,7 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
                 goto failed;
         }
 
-        s = dev->priv;
+        s = netdev_priv(dev);
 
         /* This is rx header therefore addresses are swapped.
          * ie eh.h_dest is our local address. */
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index d9fa0ab2c87f..47e179f62e82 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -62,14 +62,14 @@ static int bnep_net_close(struct net_device *dev)
 
 static struct net_device_stats *bnep_net_get_stats(struct net_device *dev)
 {
-        struct bnep_session *s = dev->priv;
+        struct bnep_session *s = netdev_priv(dev);
         return &s->stats;
 }
 
 static void bnep_net_set_mc_list(struct net_device *dev)
 {
 #ifdef CONFIG_BT_BNEP_MC_FILTER
-        struct bnep_session *s = dev->priv;
+        struct bnep_session *s = netdev_priv(dev);
         struct sock *sk = s->sock->sk;
         struct bnep_set_filter_req *r;
         struct sk_buff *skb;
@@ -183,7 +183,7 @@ static inline int bnep_net_proto_filter(struct sk_buff *skb, struct bnep_session
 
 static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct bnep_session *s = dev->priv;
+        struct bnep_session *s = netdev_priv(dev);
         struct sock *sk = s->sock->sk;
 
         BT_DBG("skb %p, dev %p", skb, dev);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index f4f6615cad9f..f2bbb2f65434 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -113,8 +113,7 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
         conn->dev.class = bt_class;
         conn->dev.parent = &hdev->dev;
 
-        snprintf(conn->dev.bus_id, BUS_ID_SIZE, "%s:%d",
-                                        hdev->name, conn->handle);
+        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
         dev_set_drvdata(&conn->dev, conn);
 
@@ -132,7 +131,7 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
  */
 static int __match_tty(struct device *dev, void *data)
 {
-        return !strncmp(dev->bus_id, "rfcomm", 6);
+        return !strncmp(dev_name(dev), "rfcomm", 6);
 }
 
 static void del_conn(struct work_struct *work)
@@ -421,7 +420,7 @@ int hci_register_sysfs(struct hci_dev *hdev)
         dev->class = bt_class;
         dev->parent = hdev->parent;
 
-        strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE);
+        dev_set_name(dev, hdev->name);
 
         dev_set_drvdata(dev, hdev);
 
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 6c023f0f8252..920ce3348398 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -147,7 +147,7 @@ static int br_set_tx_csum(struct net_device *dev, u32 data)
         return 0;
 }
 
-static struct ethtool_ops br_ethtool_ops = {
+static const struct ethtool_ops br_ethtool_ops = {
         .get_drvinfo    = br_getinfo,
         .get_link       = ethtool_op_get_link,
         .get_tx_csum    = ethtool_op_get_tx_csum,
@@ -160,21 +160,25 @@ static struct ethtool_ops br_ethtool_ops = {
         .get_flags      = ethtool_op_get_flags,
 };
 
+static const struct net_device_ops br_netdev_ops = {
+        .ndo_open                = br_dev_open,
+        .ndo_stop                = br_dev_stop,
+        .ndo_set_mac_address = br_set_mac_address,
+        .ndo_set_multicast_list = br_dev_set_multicast_list,
+        .ndo_change_mtu  = br_change_mtu,
+        .ndo_do_ioctl   = br_dev_ioctl,
+};
+
 void br_dev_setup(struct net_device *dev)
 {
         random_ether_addr(dev->dev_addr);
         ether_setup(dev);
 
-        dev->do_ioctl = br_dev_ioctl;
+        dev->netdev_ops = &br_netdev_ops;
         dev->hard_start_xmit = br_dev_xmit;
-        dev->open = br_dev_open;
-        dev->set_multicast_list = br_dev_set_multicast_list;
-        dev->change_mtu = br_change_mtu;
         dev->destructor = free_netdev;
         SET_ETHTOOL_OPS(dev, &br_ethtool_ops);
-        dev->stop = br_dev_stop;
         dev->tx_queue_len = 0;
-        dev->set_mac_address = br_set_mac_address;
         dev->priv_flags = IFF_EBRIDGE;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 0a09ccf68c1c..ee3a8dd13f55 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -460,7 +460,7 @@ void br_net_exit(struct net *net)
 restart:
         for_each_netdev(net, dev) {
                 if (dev->priv_flags & IFF_EBRIDGE) {
-                        del_br(dev->priv);
+                        del_br(netdev_priv(dev));
                         goto restart;
                 }
         }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa5cda4e552a..db6176d96e71 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -938,35 +938,35 @@ static ctl_table brnf_table[] = {
                 .data           = &brnf_call_arptables,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &brnf_sysctl_call_tables,
+                .proc_handler   = brnf_sysctl_call_tables,
         },
         {
                 .procname       = "bridge-nf-call-iptables",
                 .data           = &brnf_call_iptables,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &brnf_sysctl_call_tables,
+                .proc_handler   = brnf_sysctl_call_tables,
         },
         {
                 .procname       = "bridge-nf-call-ip6tables",
                 .data           = &brnf_call_ip6tables,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &brnf_sysctl_call_tables,
+                .proc_handler   = brnf_sysctl_call_tables,
         },
         {
                 .procname       = "bridge-nf-filter-vlan-tagged",
                 .data           = &brnf_filter_vlan_tagged,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &brnf_sysctl_call_tables,
+                .proc_handler   = brnf_sysctl_call_tables,
         },
         {
                 .procname       = "bridge-nf-filter-pppoe-tagged",
                 .data           = &brnf_filter_pppoe_tagged,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &brnf_sysctl_call_tables,
+                .proc_handler   = brnf_sysctl_call_tables,
         },
         { .ctl_name = 0 }
 };
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 158dee8b4965..603d89248e71 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -22,7 +22,7 @@
 #include "br_private.h"
 
 #define to_dev(obj)     container_of(obj, struct device, kobj)
-#define to_bridge(cd)   ((struct net_bridge *)(to_net_dev(cd)->priv))
+#define to_bridge(cd)   ((struct net_bridge *)netdev_priv(to_net_dev(cd)))
 
 /*
  * Common code for storing bridge parameters.
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 3d33c608906a..d44cbf8c374a 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -79,7 +79,6 @@ print_ports(const struct sk_buff *skb, uint8_t protocol, int offset)
         }
 }
 
-#define myNIPQUAD(a) a[0], a[1], a[2], a[3]
 static void
 ebt_log_packet(u_int8_t pf, unsigned int hooknum,
    const struct sk_buff *skb, const struct net_device *in,
@@ -113,9 +112,8 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum,
                         printk(" INCOMPLETE IP header");
                         goto out;
                 }
-                printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u, IP "
-                       "tos=0x%02X, IP proto=%d", NIPQUAD(ih->saddr),
-                       NIPQUAD(ih->daddr), ih->tos, ih->protocol);
+                printk(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d",
+                       &ih->saddr, &ih->daddr, ih->tos, ih->protocol);
                 print_ports(skb, ih->protocol, ih->ihl*4);
                 goto out;
         }
@@ -133,10 +131,8 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum,
                         printk(" INCOMPLETE IPv6 header");
                         goto out;
                 }
-                printk(" IPv6 SRC=%x:%x:%x:%x:%x:%x:%x:%x "
-                       "IPv6 DST=%x:%x:%x:%x:%x:%x:%x:%x, IPv6 "
-                       "priority=0x%01X, Next Header=%d", NIP6(ih->saddr),
-                       NIP6(ih->daddr), ih->priority, ih->nexthdr);
+                printk(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d",
+                       &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr);
                 nexthdr = ih->nexthdr;
                 offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr);
                 if (offset_ph == -1)
@@ -177,12 +173,10 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum,
                         }
                         printk(" ARP MAC SRC=");
                         print_MAC(ap->mac_src);
-                        printk(" ARP IP SRC=%u.%u.%u.%u",
-                               myNIPQUAD(ap->ip_src));
+                        printk(" ARP IP SRC=%pI4", ap->ip_src);
                         printk(" ARP MAC DST=");
                         print_MAC(ap->mac_dst);
-                        printk(" ARP IP DST=%u.%u.%u.%u",
-                               myNIPQUAD(ap->ip_dst));
+                        printk(" ARP IP DST=%pI4", ap->ip_dst);
                 }
         }
 out:
diff --git a/net/core/datagram.c b/net/core/datagram.c
index ee631843c2f5..5e2ac0c4b07c 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -209,7 +209,7 @@ struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
 void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
 {
         kfree_skb(skb);
-        sk_mem_reclaim(sk);
+        sk_mem_reclaim_partial(sk);
 }
 
 /**
@@ -248,8 +248,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
                 spin_unlock_bh(&sk->sk_receive_queue.lock);
         }
 
-        kfree_skb(skb);
-        sk_mem_reclaim(sk);
+        skb_free_datagram(sk, skb);
         return err;
 }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 9174c77d3112..8843f4e3f5e1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -108,7 +108,6 @@
 #include <linux/init.h>
 #include <linux/kmod.h>
 #include <linux/module.h>
-#include <linux/kallsyms.h>
 #include <linux/netpoll.h>
 #include <linux/rcupdate.h>
 #include <linux/delay.h>
@@ -924,10 +923,15 @@ int dev_change_name(struct net_device *dev, const char *newname)
                 strlcpy(dev->name, newname, IFNAMSIZ);
 
 rollback:
-        ret = device_rename(&dev->dev, dev->name);
-        if (ret) {
-                memcpy(dev->name, oldname, IFNAMSIZ);
-                return ret;
+        /* For now only devices in the initial network namespace
+         * are in sysfs.
+         */
+        if (net == &init_net) {
+                ret = device_rename(&dev->dev, dev->name);
+                if (ret) {
+                        memcpy(dev->name, oldname, IFNAMSIZ);
+                        return ret;
+                }
         }
 
         write_lock_bh(&dev_base_lock);
@@ -1055,6 +1059,7 @@ void dev_load(struct net *net, const char *name)
  */
 int dev_open(struct net_device *dev)
 {
+        const struct net_device_ops *ops = dev->netdev_ops;
         int ret = 0;
 
         ASSERT_RTNL();
@@ -1077,11 +1082,11 @@ int dev_open(struct net_device *dev)
          */
         set_bit(__LINK_STATE_START, &dev->state);
 
-        if (dev->validate_addr)
-                ret = dev->validate_addr(dev);
+        if (ops->ndo_validate_addr)
+                ret = ops->ndo_validate_addr(dev);
 
-        if (!ret && dev->open)
-                ret = dev->open(dev);
+        if (!ret && ops->ndo_open)
+                ret = ops->ndo_open(dev);
 
         /*
          *      If it went open OK then:
@@ -1125,6 +1130,7 @@ int dev_open(struct net_device *dev)
  */
 int dev_close(struct net_device *dev)
 {
+        const struct net_device_ops *ops = dev->netdev_ops;
         ASSERT_RTNL();
 
         might_sleep();
@@ -1157,8 +1163,8 @@ int dev_close(struct net_device *dev)
          *      We allow it to be called even after a DETACH hot-plug
          *      event.
          */
-        if (dev->stop)
-                dev->stop(dev);
+        if (ops->ndo_stop)
+                ops->ndo_stop(dev);
 
         /*
          *      Device is now down.
@@ -2251,8 +2257,10 @@ int netif_receive_skb(struct sk_buff *skb)
         rcu_read_lock();
 
         /* Don't receive packets in an exiting network namespace */
-        if (!net_alive(dev_net(skb->dev)))
+        if (!net_alive(dev_net(skb->dev))) {
+                kfree_skb(skb);
                 goto out;
+        }
 
 #ifdef CONFIG_NET_CLS_ACT
         if (skb->tc_verd & TC_NCLS) {
@@ -2371,7 +2379,7 @@ EXPORT_SYMBOL(__napi_schedule);
 static void net_rx_action(struct softirq_action *h)
 {
         struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
-        unsigned long start_time = jiffies;
+        unsigned long time_limit = jiffies + 2;
         int budget = netdev_budget;
         void *have;
 
@@ -2382,13 +2390,10 @@ static void net_rx_action(struct softirq_action *h)
                 int work, weight;
 
                 /* If softirq window is exhuasted then punt.
-                 *
-                 * Note that this is a slight policy change from the
-                 * previous NAPI code, which would allow up to 2
-                 * jiffies to pass before breaking out.  The test
-                 * used to be "jiffies - start_time > 1".
+                 * Allow this to run for 2 jiffies since which will allow
+                 * an average latency of 1.5/HZ.
                  */
-                if (unlikely(budget <= 0 || jiffies != start_time))
+                if (unlikely(budget <= 0 || time_after(jiffies, time_limit)))
                         goto softnet_break;
 
                 local_irq_enable();
@@ -2615,7 +2620,7 @@ void dev_seq_stop(struct seq_file *seq, void *v)
 
 static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev)
 {
-        struct net_device_stats *stats = dev->get_stats(dev);
+        const struct net_device_stats *stats = dev_get_stats(dev);
 
         seq_printf(seq, "%6s:%8lu %7lu %4lu %4lu %4lu %5lu %10lu %9lu "
                    "%8lu %7lu %4lu %4lu %4lu %5lu %7lu %10lu\n",
@@ -2797,31 +2802,6 @@ static void ptype_seq_stop(struct seq_file *seq, void *v)
         rcu_read_unlock();
 }
 
-static void ptype_seq_decode(struct seq_file *seq, void *sym)
-{
-#ifdef CONFIG_KALLSYMS
-        unsigned long offset = 0, symsize;
-        const char *symname;
-        char *modname;
-        char namebuf[128];
-
-        symname = kallsyms_lookup((unsigned long)sym, &symsize, &offset,
-                                  &modname, namebuf);
-
-        if (symname) {
-                char *delim = ":";
-
-                if (!modname)
-                        modname = delim = "";
-                seq_printf(seq, "%s%s%s%s+0x%lx", delim, modname, delim,
-                           symname, offset);
-                return;
-        }
-#endif
-
-        seq_printf(seq, "[%p]", sym);
-}
-
 static int ptype_seq_show(struct seq_file *seq, void *v)
 {
         struct packet_type *pt = v;
@@ -2834,10 +2814,8 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
                 else
                         seq_printf(seq, "%04x", ntohs(pt->type));
 
-                seq_printf(seq, " %-8s ",
-                           pt->dev ? pt->dev->name : "");
-                ptype_seq_decode(seq,  pt->func);
-                seq_putc(seq, '\n');
+                seq_printf(seq, " %-8s %pF\n",
+                           pt->dev ? pt->dev->name : "", pt->func);
         }
 
         return 0;
@@ -2954,8 +2932,10 @@ int netdev_set_master(struct net_device *slave, struct net_device *master)
 
 static void dev_change_rx_flags(struct net_device *dev, int flags)
 {
-        if (dev->flags & IFF_UP && dev->change_rx_flags)
-                dev->change_rx_flags(dev, flags);
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        if ((dev->flags & IFF_UP) && ops->ndo_change_rx_flags)
+                ops->ndo_change_rx_flags(dev, flags);
 }
 
 static int __dev_set_promiscuity(struct net_device *dev, int inc)
@@ -3075,6 +3055,8 @@ int dev_set_allmulti(struct net_device *dev, int inc)
  */
 void __dev_set_rx_mode(struct net_device *dev)
 {
+        const struct net_device_ops *ops = dev->netdev_ops;
+
         /* dev_open will call this function so the list will stay sane. */
         if (!(dev->flags&IFF_UP))
                 return;
@@ -3082,8 +3064,8 @@ void __dev_set_rx_mode(struct net_device *dev)
         if (!netif_device_present(dev))
                 return;
 
-        if (dev->set_rx_mode)
-                dev->set_rx_mode(dev);
+        if (ops->ndo_set_rx_mode)
+                ops->ndo_set_rx_mode(dev);
         else {
                 /* Unicast addresses changes may only happen under the rtnl,
                  * therefore calling __dev_set_promiscuity here is safe.
@@ -3096,8 +3078,8 @@ void __dev_set_rx_mode(struct net_device *dev)
                         dev->uc_promisc = 0;
                 }
 
-                if (dev->set_multicast_list)
-                        dev->set_multicast_list(dev);
+                if (ops->ndo_set_multicast_list)
+                        ops->ndo_set_multicast_list(dev);
         }
 }
 
@@ -3456,6 +3438,7 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
  */
 int dev_set_mtu(struct net_device *dev, int new_mtu)
 {
+        const struct net_device_ops *ops = dev->netdev_ops;
         int err;
 
         if (new_mtu == dev->mtu)
@@ -3469,10 +3452,11 @@ int dev_set_mtu(struct net_device *dev, int new_mtu)
                 return -ENODEV;
 
         err = 0;
-        if (dev->change_mtu)
-                err = dev->change_mtu(dev, new_mtu);
+        if (ops->ndo_change_mtu)
+                err = ops->ndo_change_mtu(dev, new_mtu);
         else
                 dev->mtu = new_mtu;
+
         if (!err && dev->flags & IFF_UP)
                 call_netdevice_notifiers(NETDEV_CHANGEMTU, dev);
         return err;
@@ -3487,15 +3471,16 @@ int dev_set_mtu(struct net_device *dev, int new_mtu)
  */
 int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
 {
+        const struct net_device_ops *ops = dev->netdev_ops;
         int err;
 
-        if (!dev->set_mac_address)
+        if (!ops->ndo_set_mac_address)
                 return -EOPNOTSUPP;
         if (sa->sa_family != dev->type)
                 return -EINVAL;
         if (!netif_device_present(dev))
                 return -ENODEV;
-        err = dev->set_mac_address(dev, sa);
+        err = ops->ndo_set_mac_address(dev, sa);
         if (!err)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
         return err;
@@ -3575,6 +3560,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
 {
         int err;
         struct net_device *dev = __dev_get_by_name(net, ifr->ifr_name);
+        const struct net_device_ops *ops = dev->netdev_ops;
 
         if (!dev)
                 return -ENODEV;
@@ -3602,15 +3588,15 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                         return 0;
 
                 case SIOCSIFMAP:
-                        if (dev->set_config) {
+                        if (ops->ndo_set_config) {
                                 if (!netif_device_present(dev))
                                         return -ENODEV;
-                                return dev->set_config(dev, &ifr->ifr_map);
+                                return ops->ndo_set_config(dev, &ifr->ifr_map);
                         }
                         return -EOPNOTSUPP;
 
                 case SIOCADDMULTI:
-                        if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
+                        if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
                             ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                                 return -EINVAL;
                         if (!netif_device_present(dev))
@@ -3619,7 +3605,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                                           dev->addr_len, 1);
 
                 case SIOCDELMULTI:
-                        if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
+                        if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
                             ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                                 return -EINVAL;
                         if (!netif_device_present(dev))
@@ -3657,10 +3643,9 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                             cmd == SIOCBRDELIF ||
                             cmd == SIOCWANDEV) {
                                 err = -EOPNOTSUPP;
-                                if (dev->do_ioctl) {
+                                if (ops->ndo_do_ioctl) {
                                         if (netif_device_present(dev))
-                                                err = dev->do_ioctl(dev, ifr,
-                                                                    cmd);
+                                                err = ops->ndo_do_ioctl(dev, ifr, cmd);
                                         else
                                                 err = -ENODEV;
                                 }
@@ -3921,8 +3906,8 @@ static void rollback_registered(struct net_device *dev)
          */
         dev_addr_discard(dev);
 
-        if (dev->uninit)
-                dev->uninit(dev);
+        if (dev->netdev_ops->ndo_uninit)
+                dev->netdev_ops->ndo_uninit(dev);
 
         /* Notifier chain MUST detach us from master device. */
         WARN_ON(dev->master);
@@ -4012,7 +3997,7 @@ int register_netdevice(struct net_device *dev)
         struct hlist_head *head;
         struct hlist_node *p;
         int ret;
-        struct net *net;
+        struct net *net = dev_net(dev);
 
         BUG_ON(dev_boot_phase);
         ASSERT_RTNL();
@@ -4021,8 +4006,7 @@ int register_netdevice(struct net_device *dev)
 
         /* When net_device's are persistent, this will be fatal. */
         BUG_ON(dev->reg_state != NETREG_UNINITIALIZED);
-        BUG_ON(!dev_net(dev));
-        net = dev_net(dev);
+        BUG_ON(!net);
 
         spin_lock_init(&dev->addr_list_lock);
         netdev_set_addr_lockdep_class(dev);
@@ -4030,9 +4014,46 @@ int register_netdevice(struct net_device *dev)
 
         dev->iflink = -1;
 
+#ifdef CONFIG_COMPAT_NET_DEV_OPS
+        /* Netdevice_ops API compatiability support.
+         * This is temporary until all network devices are converted.
+         */
+        if (dev->netdev_ops) {
+                const struct net_device_ops *ops = dev->netdev_ops;
+
+                dev->init = ops->ndo_init;
+                dev->uninit = ops->ndo_uninit;
+                dev->open = ops->ndo_open;
+                dev->change_rx_flags = ops->ndo_change_rx_flags;
+                dev->set_rx_mode = ops->ndo_set_rx_mode;
+                dev->set_multicast_list = ops->ndo_set_multicast_list;
+                dev->set_mac_address = ops->ndo_set_mac_address;
+                dev->validate_addr = ops->ndo_validate_addr;
+                dev->do_ioctl = ops->ndo_do_ioctl;
+                dev->set_config = ops->ndo_set_config;
+                dev->change_mtu = ops->ndo_change_mtu;
+                dev->tx_timeout = ops->ndo_tx_timeout;
+                dev->get_stats = ops->ndo_get_stats;
+                dev->vlan_rx_register = ops->ndo_vlan_rx_register;
+                dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
+                dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+                dev->poll_controller = ops->ndo_poll_controller;
+#endif
+        } else {
+                char drivername[64];
+                pr_info("%s (%s): not using net_device_ops yet\n",
+                        dev->name, netdev_drivername(dev, drivername, 64));
+
+                /* This works only because net_device_ops and the
+                   compatiablity structure are the same. */
+                dev->netdev_ops = (void *) &(dev->init);
+        }
+#endif
+
         /* Init, if this function is available */
-        if (dev->init) {
-                ret = dev->init(dev);
+        if (dev->netdev_ops->ndo_init) {
+                ret = dev->netdev_ops->ndo_init(dev);
                 if (ret) {
                         if (ret > 0)
                                 ret = -EIO;
@@ -4110,8 +4131,8 @@ out:
         return ret;
 
 err_uninit:
-        if (dev->uninit)
-                dev->uninit(dev);
+        if (dev->netdev_ops->ndo_uninit)
+                dev->netdev_ops->ndo_uninit(dev);
         goto out;
 }
 
@@ -4267,10 +4288,24 @@ void netdev_run_todo(void)
         }
 }
 
-static struct net_device_stats *internal_stats(struct net_device *dev)
-{
-        return &dev->stats;
+/**
+ *      dev_get_stats   - get network device statistics
+ *      @dev: device to get statistics from
+ *
+ *      Get network statistics from device. The device driver may provide
+ *      its own method by setting dev->netdev_ops->get_stats; otherwise
+ *      the internal statistics structure is used.
+ */
+const struct net_device_stats *dev_get_stats(struct net_device *dev)
+ {
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        if (ops->ndo_get_stats)
+                return ops->ndo_get_stats(dev);
+        else
+                return &dev->stats;
 }
+EXPORT_SYMBOL(dev_get_stats);
 
 static void netdev_init_one_queue(struct net_device *dev,
                                   struct netdev_queue *queue,
@@ -4349,7 +4384,6 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
 
         netdev_init_queues(dev);
 
-        dev->get_stats = internal_stats;
         netpoll_netdev_init(dev);
         setup(dev);
         strcpy(dev->name, name);
@@ -4463,6 +4497,15 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         if (dev->features & NETIF_F_NETNS_LOCAL)
                 goto out;
 
+#ifdef CONFIG_SYSFS
+        /* Don't allow real devices to be moved when sysfs
+         * is enabled.
+         */
+        err = -EINVAL;
+        if (dev->dev.parent)
+                goto out;
+#endif
+
         /* Ensure the device has been registrered */
         err = -EINVAL;
         if (dev->reg_state != NETREG_REGISTERED)
@@ -4520,6 +4563,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
          */
         dev_addr_discard(dev);
 
+        netdev_unregister_kobject(dev);
+
         /* Actually switch the network namespace */
         dev_net_set(dev, net);
 
@@ -4536,7 +4581,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         }
 
         /* Fixup kobjects */
-        netdev_unregister_kobject(dev);
         err = netdev_register_kobject(dev);
         WARN_ON(err);
 
@@ -4843,6 +4887,12 @@ static void __net_exit default_device_exit(struct net *net)
                 if (dev->features & NETIF_F_NETNS_LOCAL)
                         continue;
 
+                /* Delete virtual devices */
+                if (dev->rtnl_link_ops && dev->rtnl_link_ops->dellink) {
+                        dev->rtnl_link_ops->dellink(dev);
+                        continue;
+                }
+
                 /* Push remaing network devices to init_net */
                 snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
                 err = dev_change_net_namespace(dev, &init_net, fb_name);
@@ -4889,9 +4939,6 @@ static int __init net_dev_init(void)
         if (register_pernet_subsys(&netdev_net_ops))
                 goto out;
 
-        if (register_pernet_device(&default_device_ops))
-                goto out;
-
         /*
          *      Initialise the packet receive queues.
          */
@@ -4908,10 +4955,25 @@ static int __init net_dev_init(void)
                 queue->backlog.weight = weight_p;
         }
 
-        netdev_dma_register();
-
         dev_boot_phase = 0;
 
+        /* The loopback device is special if any other network devices
+         * is present in a network namespace the loopback device must
+         * be present. Since we now dynamically allocate and free the
+         * loopback device ensure this invariant is maintained by
+         * keeping the loopback device as the first device on the
+         * list of network devices.  Ensuring the loopback devices
+         * is the first device that appears and the last network device
+         * that disappears.
+         */
+        if (register_pernet_device(&loopback_net_ops))
+                goto out;
+
+        if (register_pernet_device(&default_device_ops))
+                goto out;
+
+        netdev_dma_register();
+
         open_softirq(NET_TX_SOFTIRQ, net_tx_action);
         open_softirq(NET_RX_SOFTIRQ, net_rx_action);
 
diff --git a/net/core/dst.c b/net/core/dst.c
index 09c1530f4681..57bc4d5b8d08 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -263,9 +263,11 @@ again:
 void dst_release(struct dst_entry *dst)
 {
         if (dst) {
-                WARN_ON(atomic_read(&dst->__refcnt) < 1);
+               int newrefcnt;
+
                 smp_mb__before_atomic_dec();
-                atomic_dec(&dst->__refcnt);
+               newrefcnt = atomic_dec_return(&dst->__refcnt);
+               WARN_ON(newrefcnt < 0);
         }
 }
 EXPORT_SYMBOL(dst_release);
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 79de3b14a8d1..32b3a0152d7a 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -664,17 +664,18 @@ static int __init fib_rules_init(void)
         rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL);
         rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule);
 
-        err = register_netdevice_notifier(&fib_rules_notifier);
+        err = register_pernet_subsys(&fib_rules_net_ops);
         if (err < 0)
                 goto fail;
 
-        err = register_pernet_subsys(&fib_rules_net_ops);
+        err = register_netdevice_notifier(&fib_rules_notifier);
         if (err < 0)
                 goto fail_unregister;
+
         return 0;
 
 fail_unregister:
-        unregister_netdevice_notifier(&fib_rules_notifier);
+        unregister_pernet_subsys(&fib_rules_net_ops);
 fail:
         rtnl_unregister(PF_UNSPEC, RTM_NEWRULE);
         rtnl_unregister(PF_UNSPEC, RTM_DELRULE);
diff --git a/net/core/filter.c b/net/core/filter.c
index df3744355839..d1d779ca096d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -319,6 +319,25 @@ load_b:
                                 A = 0;
                         continue;
                 }
+                case SKF_AD_NLATTR_NEST: {
+                        struct nlattr *nla;
+
+                        if (skb_is_nonlinear(skb))
+                                return 0;
+                        if (A > skb->len - sizeof(struct nlattr))
+                                return 0;
+
+                        nla = (struct nlattr *)&skb->data[A];
+                        if (nla->nla_len > A - skb->len)
+                                return 0;
+
+                        nla = nla_find_nested(nla, X);
+                        if (nla)
+                                A = (void *)nla - (void *)skb->data;
+                        else
+                                A = 0;
+                        continue;
+                }
                 default:
                         return 0;
                 }
diff --git a/net/core/flow.c b/net/core/flow.c
index 5cf81052d044..d323388dd1ba 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -307,7 +307,7 @@ void flow_cache_flush(void)
         put_online_cpus();
 }
 
-static void __devinit flow_cache_cpu_prepare(int cpu)
+static void __init flow_cache_cpu_prepare(int cpu)
 {
         struct tasklet_struct *tasklet;
         unsigned long order;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 1dc728b38589..cca6a55909eb 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -531,9 +531,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
         if (!n)
                 goto out;
 
-#ifdef CONFIG_NET_NS
-        n->net = hold_net(net);
-#endif
+        write_pnet(&n->net, hold_net(net));
         memcpy(n->key, pkey, key_len);
         n->dev = dev;
         if (dev)
@@ -1340,7 +1338,6 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
         if (p) {
                 p->tbl            = tbl;
                 atomic_set(&p->refcnt, 1);
-                INIT_RCU_HEAD(&p->rcu_head);
                 p->reachable_time =
                                 neigh_rand_reach_time(p->base_reachable_time);
 
@@ -1351,9 +1348,7 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
 
                 dev_hold(dev);
                 p->dev = dev;
-#ifdef CONFIG_NET_NS
-                p->net = hold_net(net);
-#endif
+                write_pnet(&p->net, hold_net(net));
                 p->sysctl_table = NULL;
                 write_lock_bh(&tbl->lock);
                 p->next         = tbl->parms.next;
@@ -1408,11 +1403,8 @@ void neigh_table_init_no_netlink(struct neigh_table *tbl)
         unsigned long now = jiffies;
         unsigned long phsize;
 
-#ifdef CONFIG_NET_NS
-        tbl->parms.net = &init_net;
-#endif
+        write_pnet(&tbl->parms.net, &init_net);
         atomic_set(&tbl->parms.refcnt, 1);
-        INIT_RCU_HEAD(&tbl->parms.rcu_head);
         tbl->parms.reachable_time =
                           neigh_rand_reach_time(tbl->parms.base_reachable_time);
 
@@ -1426,9 +1418,8 @@ void neigh_table_init_no_netlink(struct neigh_table *tbl)
                 panic("cannot create neighbour cache statistics");
 
 #ifdef CONFIG_PROC_FS
-        tbl->pde = proc_create_data(tbl->id, 0, init_net.proc_net_stat,
-                                    &neigh_stat_seq_fops, tbl);
-        if (!tbl->pde)
+        if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
+                              &neigh_stat_seq_fops, tbl))
                 panic("cannot create neighbour proc dir entry");
 #endif
 
@@ -2568,128 +2559,128 @@ static struct neigh_sysctl_table {
                         .procname       = "mcast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {
                         .ctl_name       = NET_NEIGH_UCAST_SOLICIT,
                         .procname       = "ucast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {
                         .ctl_name       = NET_NEIGH_APP_SOLICIT,
                         .procname       = "app_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {
                         .procname       = "retrans_time",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_userhz_jiffies,
+                        .proc_handler   = proc_dointvec_userhz_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_REACHABLE_TIME,
                         .procname       = "base_reachable_time",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_jiffies,
-                        .strategy       = &sysctl_jiffies,
+                        .proc_handler   = proc_dointvec_jiffies,
+                        .strategy       = sysctl_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_DELAY_PROBE_TIME,
                         .procname       = "delay_first_probe_time",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_jiffies,
-                        .strategy       = &sysctl_jiffies,
+                        .proc_handler   = proc_dointvec_jiffies,
+                        .strategy       = sysctl_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_GC_STALE_TIME,
                         .procname       = "gc_stale_time",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_jiffies,
-                        .strategy       = &sysctl_jiffies,
+                        .proc_handler   = proc_dointvec_jiffies,
+                        .strategy       = sysctl_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_UNRES_QLEN,
                         .procname       = "unres_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {
                         .ctl_name       = NET_NEIGH_PROXY_QLEN,
                         .procname       = "proxy_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {
                         .procname       = "anycast_delay",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_userhz_jiffies,
+                        .proc_handler   = proc_dointvec_userhz_jiffies,
                 },
                 {
                         .procname       = "proxy_delay",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_userhz_jiffies,
+                        .proc_handler   = proc_dointvec_userhz_jiffies,
                 },
                 {
                         .procname       = "locktime",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_userhz_jiffies,
+                        .proc_handler   = proc_dointvec_userhz_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_RETRANS_TIME_MS,
                         .procname       = "retrans_time_ms",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_ms_jiffies,
-                        .strategy       = &sysctl_ms_jiffies,
+                        .proc_handler   = proc_dointvec_ms_jiffies,
+                        .strategy       = sysctl_ms_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_REACHABLE_TIME_MS,
                         .procname       = "base_reachable_time_ms",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_ms_jiffies,
-                        .strategy       = &sysctl_ms_jiffies,
+                        .proc_handler   = proc_dointvec_ms_jiffies,
+                        .strategy       = sysctl_ms_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_GC_INTERVAL,
                         .procname       = "gc_interval",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec_jiffies,
-                        .strategy       = &sysctl_jiffies,
+                        .proc_handler   = proc_dointvec_jiffies,
+                        .strategy       = sysctl_jiffies,
                 },
                 {
                         .ctl_name       = NET_NEIGH_GC_THRESH1,
                         .procname       = "gc_thresh1",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {
                         .ctl_name       = NET_NEIGH_GC_THRESH2,
                         .procname       = "gc_thresh2",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {
                         .ctl_name       = NET_NEIGH_GC_THRESH3,
                         .procname       = "gc_thresh3",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
+                        .proc_handler   = proc_dointvec,
                 },
                 {},
         },
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 92d6b9467314..afd42d717320 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -270,7 +270,6 @@ static ssize_t netstat_show(const struct device *d,
                             unsigned long offset)
 {
         struct net_device *dev = to_net_dev(d);
-        struct net_device_stats *stats;
         ssize_t ret = -EINVAL;
 
         WARN_ON(offset > sizeof(struct net_device_stats) ||
@@ -278,7 +277,7 @@ static ssize_t netstat_show(const struct device *d,
 
         read_lock(&dev_base_lock);
         if (dev_isalive(dev)) {
-                stats = dev->get_stats(dev);
+                const struct net_device_stats *stats = dev_get_stats(dev);
                 ret = sprintf(buf, fmt_ulong,
                               *(unsigned long *)(((u8 *) stats) + offset));
         }
@@ -476,6 +475,10 @@ void netdev_unregister_kobject(struct net_device * net)
         struct device *dev = &(net->dev);
 
         kobject_get(&dev->kobj);
+
+        if (dev_net(net) != &init_net)
+                return;
+
         device_del(dev);
 }
 
@@ -490,7 +493,7 @@ int netdev_register_kobject(struct net_device *net)
         dev->groups = groups;
 
         BUILD_BUG_ON(BUS_ID_SIZE < IFNAMSIZ);
-        strlcpy(dev->bus_id, net->name, BUS_ID_SIZE);
+        dev_set_name(dev, net->name);
 
 #ifdef CONFIG_SYSFS
         *groups++ = &netstat_group;
@@ -501,6 +504,9 @@ int netdev_register_kobject(struct net_device *net)
 #endif
 #endif /* CONFIG_SYSFS */
 
+        if (dev_net(net) != &init_net)
+                return 0;
+
         return device_add(dev);
 }
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1895a4ca9c4f..55cffad2f328 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -47,7 +47,6 @@ static __net_init int setup_net(struct net *net)
                 goto out;
 
         ng->len = INITIAL_NET_GEN_PTRS;
-        INIT_RCU_HEAD(&ng->rcu);
         rcu_assign_pointer(net->gen, ng);
 
         error = 0;
@@ -478,7 +477,6 @@ int net_assign_generic(struct net *net, int id, void *data)
          */
 
         ng->len = id;
-        INIT_RCU_HEAD(&ng->rcu);
         memcpy(&ng->ptr, &old_ng->ptr, old_ng->len);
 
         rcu_assign_pointer(net->gen, ng);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 6c7af390be0a..630df6034444 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -172,12 +172,13 @@ static void service_arp_queue(struct netpoll_info *npi)
 void netpoll_poll(struct netpoll *np)
 {
         struct net_device *dev = np->dev;
+        const struct net_device_ops *ops = dev->netdev_ops;
 
-        if (!dev || !netif_running(dev) || !dev->poll_controller)
+        if (!dev || !netif_running(dev) || !ops->ndo_poll_controller)
                 return;
 
         /* Process pending work on NIC */
-        dev->poll_controller(dev);
+        ops->ndo_poll_controller(dev);
 
         poll_napi(dev);
 
@@ -343,7 +344,7 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         udph->check = csum_tcpudp_magic(htonl(np->local_ip),
                                         htonl(np->remote_ip),
                                         udp_len, IPPROTO_UDP,
-                                        csum_partial((unsigned char *)udph, udp_len, 0));
+                                        csum_partial(udph, udp_len, 0));
         if (udph->check == 0)
                 udph->check = CSUM_MANGLED_0;
 
@@ -553,7 +554,6 @@ out:
 
 void netpoll_print_options(struct netpoll *np)
 {
-        DECLARE_MAC_BUF(mac);
         printk(KERN_INFO "%s: local port %d\n",
                          np->name, np->local_port);
         printk(KERN_INFO "%s: local IP %d.%d.%d.%d\n",
@@ -564,8 +564,8 @@ void netpoll_print_options(struct netpoll *np)
                          np->name, np->remote_port);
         printk(KERN_INFO "%s: remote IP %d.%d.%d.%d\n",
                          np->name, HIPQUAD(np->remote_ip));
-        printk(KERN_INFO "%s: remote ethernet address %s\n",
-                         np->name, print_mac(mac, np->remote_mac));
+        printk(KERN_INFO "%s: remote ethernet address %pM\n",
+                         np->name, np->remote_mac);
 }
 
 int netpoll_parse_options(struct netpoll *np, char *opt)
@@ -695,7 +695,7 @@ int netpoll_setup(struct netpoll *np)
                 atomic_inc(&npinfo->refcnt);
         }
 
-        if (!ndev->poll_controller) {
+        if (!ndev->netdev_ops->ndo_poll_controller) {
                 printk(KERN_ERR "%s: %s doesn't support polling, aborting.\n",
                        np->name, np->dev_name);
                 err = -ENOTSUPP;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 8997e912aaaf..4e77914c4d42 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -422,6 +422,7 @@ static struct pktgen_dev *pktgen_find_dev(struct pktgen_thread *t,
                                           const char *ifname);
 static int pktgen_device_event(struct notifier_block *, unsigned long, void *);
 static void pktgen_run_all_threads(void);
+static void pktgen_reset_all_threads(void);
 static void pktgen_stop_all_threads_ifs(void);
 static int pktgen_stop_device(struct pktgen_dev *pkt_dev);
 static void pktgen_stop(struct pktgen_thread *t);
@@ -480,6 +481,9 @@ static ssize_t pgctrl_write(struct file *file, const char __user * buf,
         else if (!strcmp(data, "start"))
                 pktgen_run_all_threads();
 
+        else if (!strcmp(data, "reset"))
+                pktgen_reset_all_threads();
+
         else
                 printk(KERN_WARNING "pktgen: Unknown command: %s\n", data);
 
@@ -509,7 +513,6 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
         __u64 sa;
         __u64 stopped;
         __u64 now = getCurUs();
-        DECLARE_MAC_BUF(mac);
 
         seq_printf(seq,
                    "Params: count %llu  min_pkt_size: %u  max_pkt_size: %u\n",
@@ -554,12 +557,12 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
 
         seq_puts(seq, "     src_mac: ");
 
-        seq_printf(seq, "%s ",
-                   print_mac(mac, is_zero_ether_addr(pkt_dev->src_mac) ?
-                             pkt_dev->odev->dev_addr : pkt_dev->src_mac));
+        seq_printf(seq, "%pM ",
+                   is_zero_ether_addr(pkt_dev->src_mac) ?
+                             pkt_dev->odev->dev_addr : pkt_dev->src_mac);
 
         seq_printf(seq, "dst_mac: ");
-        seq_printf(seq, "%s\n", print_mac(mac, pkt_dev->dst_mac));
+        seq_printf(seq, "%pM\n", pkt_dev->dst_mac);
 
         seq_printf(seq,
                    "     udp_src_min: %d  udp_src_max: %d  udp_dst_min: %d  udp_dst_max: %d\n",
@@ -3169,6 +3172,24 @@ static void pktgen_run_all_threads(void)
         pktgen_wait_all_threads_run();
 }
 
+static void pktgen_reset_all_threads(void)
+{
+        struct pktgen_thread *t;
+
+        pr_debug("pktgen: entering pktgen_reset_all_threads.\n");
+
+        mutex_lock(&pktgen_thread_lock);
+
+        list_for_each_entry(t, &pktgen_threads, th_list)
+                t->control |= (T_REMDEVALL);
+
+        mutex_unlock(&pktgen_thread_lock);
+
+        schedule_timeout_interruptible(msecs_to_jiffies(125));  /* Propagate thread->control  */
+
+        pktgen_wait_all_threads_run();
+}
+
 static void show_results(struct pktgen_dev *pkt_dev, int nr_frags)
 {
         __u64 total_us, bps, mbps, pps, idle;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 4dfb6b4d4559..790dd205bb5d 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -551,7 +551,7 @@ static void set_operstate(struct net_device *dev, unsigned char transition)
 }
 
 static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
-                                 struct net_device_stats *b)
+                                 const struct net_device_stats *b)
 {
         a->rx_packets = b->rx_packets;
         a->tx_packets = b->tx_packets;
@@ -609,7 +609,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         struct netdev_queue *txq;
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
-        struct net_device_stats *stats;
+        const struct net_device_stats *stats;
         struct nlattr *attr;
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ifm), flags);
@@ -666,7 +666,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         if (attr == NULL)
                 goto nla_put_failure;
 
-        stats = dev->get_stats(dev);
+        stats = dev_get_stats(dev);
         copy_rtnl_link_stats(nla_data(attr), stats);
 
         if (dev->rtnl_link_ops) {
@@ -762,6 +762,7 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
 static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                       struct nlattr **tb, char *ifname, int modified)
 {
+        const struct net_device_ops *ops = dev->netdev_ops;
         int send_addr_notify = 0;
         int err;
 
@@ -783,7 +784,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 struct rtnl_link_ifmap *u_map;
                 struct ifmap k_map;
 
-                if (!dev->set_config) {
+                if (!ops->ndo_set_config) {
                         err = -EOPNOTSUPP;
                         goto errout;
                 }
@@ -801,7 +802,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 k_map.dma = (unsigned char) u_map->dma;
                 k_map.port = (unsigned char) u_map->port;
 
-                err = dev->set_config(dev, &k_map);
+                err = ops->ndo_set_config(dev, &k_map);
                 if (err < 0)
                         goto errout;
 
@@ -812,7 +813,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 struct sockaddr *sa;
                 int len;
 
-                if (!dev->set_mac_address) {
+                if (!ops->ndo_set_mac_address) {
                         err = -EOPNOTSUPP;
                         goto errout;
                 }
@@ -831,7 +832,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 sa->sa_family = dev->type;
                 memcpy(sa->sa_data, nla_data(tb[IFLA_ADDRESS]),
                        dev->addr_len);
-                err = dev->set_mac_address(dev, sa);
+                err = ops->ndo_set_mac_address(dev, sa);
                 kfree(sa);
                 if (err)
                         goto errout;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d49ef8301b5b..267185a848f6 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -501,7 +501,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->network_header     = old->network_header;
         new->mac_header         = old->mac_header;
         new->dst                = dst_clone(old->dst);
-#ifdef CONFIG_INET
+#ifdef CONFIG_XFRM
         new->sp                 = secpath_get(old->sp);
 #endif
         memcpy(new->cb, old->cb, sizeof(old->cb));
@@ -556,6 +556,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         C(truesize);
 #if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
         C(do_not_encrypt);
+        C(requeue);
 #endif
         atomic_set(&n->users, 1);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 341e39456952..a4e840e5a053 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2040,7 +2040,8 @@ int proto_register(struct proto *prot, int alloc_slab)
 
         if (alloc_slab) {
                 prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
-                                               SLAB_HWCACHE_ALIGN, NULL);
+                                        SLAB_HWCACHE_ALIGN | prot->slab_flags,
+                                        NULL);
 
                 if (prot->slab == NULL) {
                         printk(KERN_CRIT "%s: Can't create sock SLAB cache!\n",
@@ -2079,7 +2080,9 @@ int proto_register(struct proto *prot, int alloc_slab)
                         prot->twsk_prot->twsk_slab =
                                 kmem_cache_create(timewait_sock_slab_name,
                                                   prot->twsk_prot->twsk_obj_size,
-                                                  0, SLAB_HWCACHE_ALIGN,
+                                                  0,
+                                                  SLAB_HWCACHE_ALIGN |
+                                                        prot->slab_flags,
                                                   NULL);
                         if (prot->twsk_prot->twsk_slab == NULL)
                                 goto out_free_timewait_sock_slab_name;
@@ -2171,7 +2174,7 @@ static void proto_seq_printf(struct seq_file *seq, struct proto *proto)
                         "%2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c\n",
                    proto->name,
                    proto->obj_size,
-                   proto->sockets_allocated != NULL ? atomic_read(proto->sockets_allocated) : -1,
+                   sock_prot_inuse_get(seq_file_net(seq), proto),
                    proto->memory_allocated != NULL ? atomic_read(proto->memory_allocated) : -1,
                    proto->memory_pressure != NULL ? *proto->memory_pressure ? "yes" : "no" : "NI",
                    proto->max_header,
@@ -2225,7 +2228,8 @@ static const struct seq_operations proto_seq_ops = {
 
 static int proto_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open(file, &proto_seq_ops);
+        return seq_open_net(inode, file, &proto_seq_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations proto_seq_fops = {
@@ -2233,13 +2237,31 @@ static const struct file_operations proto_seq_fops = {
         .open           = proto_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = seq_release,
+        .release        = seq_release_net,
+};
+
+static __net_init int proto_init_net(struct net *net)
+{
+        if (!proc_net_fops_create(net, "protocols", S_IRUGO, &proto_seq_fops))
+                return -ENOMEM;
+
+        return 0;
+}
+
+static __net_exit void proto_exit_net(struct net *net)
+{
+        proc_net_remove(net, "protocols");
+}
+
+
+static __net_initdata struct pernet_operations proto_net_ops = {
+        .init = proto_init_net,
+        .exit = proto_exit_net,
 };
 
 static int __init proto_init(void)
 {
-        /* register /proc/net/protocols */
-        return proc_net_fops_create(&init_net, "protocols", S_IRUGO, &proto_seq_fops) == NULL ? -ENOBUFS : 0;
+        return register_pernet_subsys(&proto_net_ops);
 }
 
 subsys_initcall(proto_init);
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index f686467ff12b..2bc0384b0448 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -22,7 +22,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_wmem_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_RMEM_MAX,
@@ -30,7 +30,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_rmem_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_WMEM_DEFAULT,
@@ -38,7 +38,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_wmem_default,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_RMEM_DEFAULT,
@@ -46,7 +46,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_rmem_default,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_DEV_WEIGHT,
@@ -54,7 +54,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &weight_p,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_MAX_BACKLOG,
@@ -62,7 +62,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &netdev_max_backlog,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_MSG_COST,
@@ -70,8 +70,8 @@ static struct ctl_table net_core_table[] = {
                 .data           = &net_ratelimit_state.interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_CORE_MSG_BURST,
@@ -79,7 +79,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &net_ratelimit_state.burst,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_CORE_OPTMEM_MAX,
@@ -87,7 +87,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_optmem_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #ifdef CONFIG_XFRM
         {
@@ -96,7 +96,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_xfrm_aevent_etime,
                 .maxlen         = sizeof(u32),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_AEVENT_RSEQTH,
@@ -104,7 +104,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_xfrm_aevent_rseqth,
                 .maxlen         = sizeof(u32),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -112,7 +112,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_xfrm_larval_drop,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -120,7 +120,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_xfrm_acq_expires,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #endif /* CONFIG_XFRM */
 #endif /* CONFIG_NET */
@@ -130,7 +130,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &netdev_budget,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_CORE_WARNINGS,
@@ -138,7 +138,7 @@ static struct ctl_table net_core_table[] = {
                 .data           = &net_msg_warn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         { .ctl_name = 0 }
 };
@@ -150,7 +150,7 @@ static struct ctl_table netns_core_table[] = {
                 .data           = &init_net.core.sysctl_somaxconn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         { .ctl_name = 0 }
 };
diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index 8fe931a3d7a1..647cb0614f84 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -13,6 +13,13 @@
 
 #include "ccid.h"
 
+static u8 builtin_ccids[] = {
+        DCCPC_CCID2,            /* CCID2 is supported by default */
+#if defined(CONFIG_IP_DCCP_CCID3) || defined(CONFIG_IP_DCCP_CCID3_MODULE)
+        DCCPC_CCID3,
+#endif
+};
+
 static struct ccid_operations *ccids[CCID_MAX];
 #if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
 static atomic_t ccids_lockct = ATOMIC_INIT(0);
@@ -86,6 +93,47 @@ static void ccid_kmem_cache_destroy(struct kmem_cache *slab)
         }
 }
 
+/* check that up to @array_len members in @ccid_array are supported */
+bool ccid_support_check(u8 const *ccid_array, u8 array_len)
+{
+        u8 i, j, found;
+
+        for (i = 0, found = 0; i < array_len; i++, found = 0) {
+                for (j = 0; !found && j < ARRAY_SIZE(builtin_ccids); j++)
+                        found = (ccid_array[i] == builtin_ccids[j]);
+                if (!found)
+                        return false;
+        }
+        return true;
+}
+
+/**
+ * ccid_get_builtin_ccids  -  Provide copy of `builtin' CCID array
+ * @ccid_array: pointer to copy into
+ * @array_len: value to return length into
+ * This function allocates memory - caller must see that it is freed after use.
+ */
+int ccid_get_builtin_ccids(u8 **ccid_array, u8 *array_len)
+{
+        *ccid_array = kmemdup(builtin_ccids, sizeof(builtin_ccids), gfp_any());
+        if (*ccid_array == NULL)
+                return -ENOBUFS;
+        *array_len = ARRAY_SIZE(builtin_ccids);
+        return 0;
+}
+
+int ccid_getsockopt_builtin_ccids(struct sock *sk, int len,
+                                    char __user *optval, int __user *optlen)
+{
+        if (len < sizeof(builtin_ccids))
+                return -EINVAL;
+
+        if (put_user(sizeof(builtin_ccids), optlen) ||
+            copy_to_user(optval, builtin_ccids, sizeof(builtin_ccids)))
+                return -EFAULT;
+        return 0;
+}
+
 int ccid_register(struct ccid_operations *ccid_ops)
 {
         int err = -ENOBUFS;
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index fdeae7b57319..259f5469d7d0 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -103,6 +103,11 @@ static inline void *ccid_priv(const struct ccid *ccid)
         return (void *)ccid->ccid_priv;
 }
 
+extern bool ccid_support_check(u8 const *ccid_array, u8 array_len);
+extern int  ccid_get_builtin_ccids(u8 **ccid_array, u8 *array_len);
+extern int  ccid_getsockopt_builtin_ccids(struct sock *sk, int len,
+                                          char __user *, int __user *);
+
 extern struct ccid *ccid_new(unsigned char id, struct sock *sk, int rx,
                              gfp_t gfp);
 
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 9a430734530c..c9ea19a4d85e 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -25,7 +25,7 @@
 /*
  * This implementation should follow RFC 4341
  */
-
+#include "../feat.h"
 #include "../ccid.h"
 #include "../dccp.h"
 #include "ccid2.h"
@@ -147,8 +147,8 @@ static void ccid2_change_l_ack_ratio(struct sock *sk, u32 val)
                 DCCP_WARN("Limiting Ack Ratio (%u) to %u\n", val, max_ratio);
                 val = max_ratio;
         }
-        if (val > 0xFFFF)               /* RFC 4340, 11.3 */
-                val = 0xFFFF;
+        if (val > DCCPF_ACK_RATIO_MAX)
+                val = DCCPF_ACK_RATIO_MAX;
 
         if (val == dp->dccps_l_ack_ratio)
                 return;
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index b4bc6e095a0e..031ce350d3c1 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -98,7 +98,6 @@ extern int  sysctl_dccp_retries2;
 extern int  sysctl_dccp_feat_sequence_window;
 extern int  sysctl_dccp_feat_rx_ccid;
 extern int  sysctl_dccp_feat_tx_ccid;
-extern int  sysctl_dccp_feat_ack_ratio;
 extern int  sysctl_dccp_feat_send_ack_vector;
 extern int  sysctl_dccp_feat_send_ndp_count;
 extern int  sysctl_dccp_tx_qlen;
@@ -252,7 +251,8 @@ extern const char *dccp_state_name(const int state);
 extern void dccp_set_state(struct sock *sk, const int state);
 extern void dccp_done(struct sock *sk);
 
-extern void dccp_reqsk_init(struct request_sock *req, struct sk_buff *skb);
+extern int  dccp_reqsk_init(struct request_sock *rq, struct dccp_sock const *dp,
+                            struct sk_buff const *skb);
 
 extern int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 
@@ -441,6 +441,10 @@ static inline int dccp_ack_pending(const struct sock *sk)
                inet_csk_ack_scheduled(sk);
 }
 
+extern int  dccp_feat_finalise_settings(struct dccp_sock *dp);
+extern int  dccp_feat_server_ccid_dependencies(struct dccp_request_sock *dreq);
+extern void dccp_feat_list_purge(struct list_head *fn_list);
+
 extern int dccp_insert_options(struct sock *sk, struct sk_buff *skb);
 extern int dccp_insert_options_rsk(struct dccp_request_sock*, struct sk_buff*);
 extern int dccp_insert_option_elapsed_time(struct sock *sk,
diff --git a/net/dccp/diag.c b/net/dccp/diag.c
index d8a3509b26f6..d1e100395efb 100644
--- a/net/dccp/diag.c
+++ b/net/dccp/diag.c
@@ -45,7 +45,7 @@ static void dccp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                 dccp_get_info(sk, _info);
 }
 
-static struct inet_diag_handler dccp_diag_handler = {
+static const struct inet_diag_handler dccp_diag_handler = {
         .idiag_hashinfo  = &dccp_hashinfo,
         .idiag_get_info  = dccp_diag_get_info,
         .idiag_type      = DCCPDIAG_GETSOCK,
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index 933a0ecf8d46..2c2216f64b1b 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -6,6 +6,8 @@
  *
  *  ASSUMPTIONS
  *  -----------
+ *  o Feature negotiation is coordinated with connection setup (as in TCP), wild
+ *    changes of parameters of an established connection are not supported.
  *  o All currently known SP features have 1-byte quantities. If in the future
  *    extensions of RFCs 4340..42 define features with item lengths larger than
  *    one byte, a feature-specific extension of the code will be required.
@@ -23,53 +25,560 @@
 
 #define DCCP_FEAT_SP_NOAGREE (-123)
 
-int dccp_feat_change(struct dccp_minisock *dmsk, u8 type, u8 feature,
-                     u8 *val, u8 len, gfp_t gfp)
+static const struct {
+        u8                      feat_num;               /* DCCPF_xxx */
+        enum dccp_feat_type     rxtx;                   /* RX or TX  */
+        enum dccp_feat_type     reconciliation;         /* SP or NN  */
+        u8                      default_value;          /* as in 6.4 */
+/*
+ *    Lookup table for location and type of features (from RFC 4340/4342)
+ *  +--------------------------+----+-----+----+----+---------+-----------+
+ *  | Feature                  | Location | Reconc. | Initial |  Section  |
+ *  |                          | RX | TX  | SP | NN |  Value  | Reference |
+ *  +--------------------------+----+-----+----+----+---------+-----------+
+ *  | DCCPF_CCID               |    |  X  | X  |    |   2     | 10        |
+ *  | DCCPF_SHORT_SEQNOS       |    |  X  | X  |    |   0     |  7.6.1    |
+ *  | DCCPF_SEQUENCE_WINDOW    |    |  X  |    | X  | 100     |  7.5.2    |
+ *  | DCCPF_ECN_INCAPABLE      | X  |     | X  |    |   0     | 12.1      |
+ *  | DCCPF_ACK_RATIO          |    |  X  |    | X  |   2     | 11.3      |
+ *  | DCCPF_SEND_ACK_VECTOR    | X  |     | X  |    |   0     | 11.5      |
+ *  | DCCPF_SEND_NDP_COUNT     |    |  X  | X  |    |   0     |  7.7.2    |
+ *  | DCCPF_MIN_CSUM_COVER     | X  |     | X  |    |   0     |  9.2.1    |
+ *  | DCCPF_DATA_CHECKSUM      | X  |     | X  |    |   0     |  9.3.1    |
+ *  | DCCPF_SEND_LEV_RATE      | X  |     | X  |    |   0     | 4342/8.4  |
+ *  +--------------------------+----+-----+----+----+---------+-----------+
+ */
+} dccp_feat_table[] = {
+        { DCCPF_CCID,            FEAT_AT_TX, FEAT_SP, 2 },
+        { DCCPF_SHORT_SEQNOS,    FEAT_AT_TX, FEAT_SP, 0 },
+        { DCCPF_SEQUENCE_WINDOW, FEAT_AT_TX, FEAT_NN, 100 },
+        { DCCPF_ECN_INCAPABLE,   FEAT_AT_RX, FEAT_SP, 0 },
+        { DCCPF_ACK_RATIO,       FEAT_AT_TX, FEAT_NN, 2 },
+        { DCCPF_SEND_ACK_VECTOR, FEAT_AT_RX, FEAT_SP, 0 },
+        { DCCPF_SEND_NDP_COUNT,  FEAT_AT_TX, FEAT_SP, 0 },
+        { DCCPF_MIN_CSUM_COVER,  FEAT_AT_RX, FEAT_SP, 0 },
+        { DCCPF_DATA_CHECKSUM,   FEAT_AT_RX, FEAT_SP, 0 },
+        { DCCPF_SEND_LEV_RATE,   FEAT_AT_RX, FEAT_SP, 0 },
+};
+#define DCCP_FEAT_SUPPORTED_MAX         ARRAY_SIZE(dccp_feat_table)
+
+/**
+ * dccp_feat_index  -  Hash function to map feature number into array position
+ * Returns consecutive array index or -1 if the feature is not understood.
+ */
+static int dccp_feat_index(u8 feat_num)
 {
-        struct dccp_opt_pend *opt;
+        /* The first 9 entries are occupied by the types from RFC 4340, 6.4 */
+        if (feat_num > DCCPF_RESERVED && feat_num <= DCCPF_DATA_CHECKSUM)
+                return feat_num - 1;
 
-        dccp_feat_debug(type, feature, *val);
+        /*
+         * Other features: add cases for new feature types here after adding
+         * them to the above table.
+         */
+        switch (feat_num) {
+        case DCCPF_SEND_LEV_RATE:
+                        return DCCP_FEAT_SUPPORTED_MAX - 1;
+        }
+        return -1;
+}
 
-        if (len > 3) {
-                DCCP_WARN("invalid length %d\n", len);
-                return -EINVAL;
+static u8 dccp_feat_type(u8 feat_num)
+{
+        int idx = dccp_feat_index(feat_num);
+
+        if (idx < 0)
+                return FEAT_UNKNOWN;
+        return dccp_feat_table[idx].reconciliation;
+}
+
+static int dccp_feat_default_value(u8 feat_num)
+{
+        int idx = dccp_feat_index(feat_num);
+        /*
+         * There are no default values for unknown features, so encountering a
+         * negative index here indicates a serious problem somewhere else.
+         */
+        DCCP_BUG_ON(idx < 0);
+
+        return idx < 0 ? 0 : dccp_feat_table[idx].default_value;
+}
+
+/* copy constructor, fval must not already contain allocated memory */
+static int dccp_feat_clone_sp_val(dccp_feat_val *fval, u8 const *val, u8 len)
+{
+        fval->sp.len = len;
+        if (fval->sp.len > 0) {
+                fval->sp.vec = kmemdup(val, len, gfp_any());
+                if (fval->sp.vec == NULL) {
+                        fval->sp.len = 0;
+                        return -ENOBUFS;
+                }
         }
-        /* XXX add further sanity checks */
+        return 0;
+}
 
-        /* check if that feature is already being negotiated */
-        list_for_each_entry(opt, &dmsk->dccpms_pending, dccpop_node) {
-                /* ok we found a negotiation for this option already */
-                if (opt->dccpop_feat == feature && opt->dccpop_type == type) {
-                        dccp_pr_debug("Replacing old\n");
-                        /* replace */
-                        BUG_ON(opt->dccpop_val == NULL);
-                        kfree(opt->dccpop_val);
-                        opt->dccpop_val  = val;
-                        opt->dccpop_len  = len;
-                        opt->dccpop_conf = 0;
-                        return 0;
+static void dccp_feat_val_destructor(u8 feat_num, dccp_feat_val *val)
+{
+        if (unlikely(val == NULL))
+                return;
+        if (dccp_feat_type(feat_num) == FEAT_SP)
+                kfree(val->sp.vec);
+        memset(val, 0, sizeof(*val));
+}
+
+static struct dccp_feat_entry *
+              dccp_feat_clone_entry(struct dccp_feat_entry const *original)
+{
+        struct dccp_feat_entry *new;
+        u8 type = dccp_feat_type(original->feat_num);
+
+        if (type == FEAT_UNKNOWN)
+                return NULL;
+
+        new = kmemdup(original, sizeof(struct dccp_feat_entry), gfp_any());
+        if (new == NULL)
+                return NULL;
+
+        if (type == FEAT_SP && dccp_feat_clone_sp_val(&new->val,
+                                                      original->val.sp.vec,
+                                                      original->val.sp.len)) {
+                kfree(new);
+                return NULL;
+        }
+        return new;
+}
+
+static void dccp_feat_entry_destructor(struct dccp_feat_entry *entry)
+{
+        if (entry != NULL) {
+                dccp_feat_val_destructor(entry->feat_num, &entry->val);
+                kfree(entry);
+        }
+}
+
+/*
+ * List management functions
+ *
+ * Feature negotiation lists rely on and maintain the following invariants:
+ * - each feat_num in the list is known, i.e. we know its type and default value
+ * - each feat_num/is_local combination is unique (old entries are overwritten)
+ * - SP values are always freshly allocated
+ * - list is sorted in increasing order of feature number (faster lookup)
+ */
+static struct dccp_feat_entry *dccp_feat_list_lookup(struct list_head *fn_list,
+                                                     u8 feat_num, bool is_local)
+{
+        struct dccp_feat_entry *entry;
+
+        list_for_each_entry(entry, fn_list, node) {
+                if (entry->feat_num == feat_num && entry->is_local == is_local)
+                        return entry;
+                else if (entry->feat_num > feat_num)
+                        break;
+        }
+        return NULL;
+}
+
+/**
+ * dccp_feat_entry_new  -  Central list update routine (called by all others)
+ * @head:  list to add to
+ * @feat:  feature number
+ * @local: whether the local (1) or remote feature with number @feat is meant
+ * This is the only constructor and serves to ensure the above invariants.
+ */
+static struct dccp_feat_entry *
+              dccp_feat_entry_new(struct list_head *head, u8 feat, bool local)
+{
+        struct dccp_feat_entry *entry;
+
+        list_for_each_entry(entry, head, node)
+                if (entry->feat_num == feat && entry->is_local == local) {
+                        dccp_feat_val_destructor(entry->feat_num, &entry->val);
+                        return entry;
+                } else if (entry->feat_num > feat) {
+                        head = &entry->node;
+                        break;
                 }
+
+        entry = kmalloc(sizeof(*entry), gfp_any());
+        if (entry != NULL) {
+                entry->feat_num = feat;
+                entry->is_local = local;
+                list_add_tail(&entry->node, head);
         }
+        return entry;
+}
 
-        /* negotiation for a new feature */
-        opt = kmalloc(sizeof(*opt), gfp);
-        if (opt == NULL)
+/**
+ * dccp_feat_push_change  -  Add/overwrite a Change option in the list
+ * @fn_list: feature-negotiation list to update
+ * @feat: one of %dccp_feature_numbers
+ * @local: whether local (1) or remote (0) @feat_num is meant
+ * @needs_mandatory: whether to use Mandatory feature negotiation options
+ * @fval: pointer to NN/SP value to be inserted (will be copied)
+ */
+static int dccp_feat_push_change(struct list_head *fn_list, u8 feat, u8 local,
+                                 u8 mandatory, dccp_feat_val *fval)
+{
+        struct dccp_feat_entry *new = dccp_feat_entry_new(fn_list, feat, local);
+
+        if (new == NULL)
                 return -ENOMEM;
 
-        opt->dccpop_type = type;
-        opt->dccpop_feat = feature;
-        opt->dccpop_len  = len;
-        opt->dccpop_val  = val;
-        opt->dccpop_conf = 0;
-        opt->dccpop_sc   = NULL;
+        new->feat_num        = feat;
+        new->is_local        = local;
+        new->state           = FEAT_INITIALISING;
+        new->needs_confirm   = 0;
+        new->empty_confirm   = 0;
+        new->val             = *fval;
+        new->needs_mandatory = mandatory;
+
+        return 0;
+}
+
+static inline void dccp_feat_list_pop(struct dccp_feat_entry *entry)
+{
+        list_del(&entry->node);
+        dccp_feat_entry_destructor(entry);
+}
+
+void dccp_feat_list_purge(struct list_head *fn_list)
+{
+        struct dccp_feat_entry *entry, *next;
+
+        list_for_each_entry_safe(entry, next, fn_list, node)
+                dccp_feat_entry_destructor(entry);
+        INIT_LIST_HEAD(fn_list);
+}
+EXPORT_SYMBOL_GPL(dccp_feat_list_purge);
+
+/* generate @to as full clone of @from - @to must not contain any nodes */
+int dccp_feat_clone_list(struct list_head const *from, struct list_head *to)
+{
+        struct dccp_feat_entry *entry, *new;
+
+        INIT_LIST_HEAD(to);
+        list_for_each_entry(entry, from, node) {
+                new = dccp_feat_clone_entry(entry);
+                if (new == NULL)
+                        goto cloning_failed;
+                list_add_tail(&new->node, to);
+        }
+        return 0;
+
+cloning_failed:
+        dccp_feat_list_purge(to);
+        return -ENOMEM;
+}
+
+static u8 dccp_feat_is_valid_nn_val(u8 feat_num, u64 val)
+{
+        switch (feat_num) {
+        case DCCPF_ACK_RATIO:
+                return val <= DCCPF_ACK_RATIO_MAX;
+        case DCCPF_SEQUENCE_WINDOW:
+                return val >= DCCPF_SEQ_WMIN && val <= DCCPF_SEQ_WMAX;
+        }
+        return 0;       /* feature unknown - so we can't tell */
+}
+
+/* check that SP values are within the ranges defined in RFC 4340 */
+static u8 dccp_feat_is_valid_sp_val(u8 feat_num, u8 val)
+{
+        switch (feat_num) {
+        case DCCPF_CCID:
+                return val == DCCPC_CCID2 || val == DCCPC_CCID3;
+        /* Type-check Boolean feature values: */
+        case DCCPF_SHORT_SEQNOS:
+        case DCCPF_ECN_INCAPABLE:
+        case DCCPF_SEND_ACK_VECTOR:
+        case DCCPF_SEND_NDP_COUNT:
+        case DCCPF_DATA_CHECKSUM:
+        case DCCPF_SEND_LEV_RATE:
+                return val < 2;
+        case DCCPF_MIN_CSUM_COVER:
+                return val < 16;
+        }
+        return 0;                       /* feature unknown */
+}
+
+static u8 dccp_feat_sp_list_ok(u8 feat_num, u8 const *sp_list, u8 sp_len)
+{
+        if (sp_list == NULL || sp_len < 1)
+                return 0;
+        while (sp_len--)
+                if (!dccp_feat_is_valid_sp_val(feat_num, *sp_list++))
+                        return 0;
+        return 1;
+}
+
+/**
+ * __feat_register_nn  -  Register new NN value on socket
+ * @fn: feature-negotiation list to register with
+ * @feat: an NN feature from %dccp_feature_numbers
+ * @mandatory: use Mandatory option if 1
+ * @nn_val: value to register (restricted to 4 bytes)
+ * Note that NN features are local by definition (RFC 4340, 6.3.2).
+ */
+static int __feat_register_nn(struct list_head *fn, u8 feat,
+                              u8 mandatory, u64 nn_val)
+{
+        dccp_feat_val fval = { .nn = nn_val };
+
+        if (dccp_feat_type(feat) != FEAT_NN ||
+            !dccp_feat_is_valid_nn_val(feat, nn_val))
+                return -EINVAL;
+
+        /* Don't bother with default values, they will be activated anyway. */
+        if (nn_val - (u64)dccp_feat_default_value(feat) == 0)
+                return 0;
+
+        return dccp_feat_push_change(fn, feat, 1, mandatory, &fval);
+}
+
+/**
+ * __feat_register_sp  -  Register new SP value/list on socket
+ * @fn: feature-negotiation list to register with
+ * @feat: an SP feature from %dccp_feature_numbers
+ * @is_local: whether the local (1) or the remote (0) @feat is meant
+ * @mandatory: use Mandatory option if 1
+ * @sp_val: SP value followed by optional preference list
+ * @sp_len: length of @sp_val in bytes
+ */
+static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
+                              u8 mandatory, u8 const *sp_val, u8 sp_len)
+{
+        dccp_feat_val fval;
+
+        if (dccp_feat_type(feat) != FEAT_SP ||
+            !dccp_feat_sp_list_ok(feat, sp_val, sp_len))
+                return -EINVAL;
+
+        /* Avoid negotiating alien CCIDs by only advertising supported ones */
+        if (feat == DCCPF_CCID && !ccid_support_check(sp_val, sp_len))
+                return -EOPNOTSUPP;
 
-        BUG_ON(opt->dccpop_val == NULL);
+        if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
+                return -ENOMEM;
 
-        list_add_tail(&opt->dccpop_node, &dmsk->dccpms_pending);
+        return dccp_feat_push_change(fn, feat, is_local, mandatory, &fval);
+}
+
+/**
+ * dccp_feat_register_sp  -  Register requests to change SP feature values
+ * @sk: client or listening socket
+ * @feat: one of %dccp_feature_numbers
+ * @is_local: whether the local (1) or remote (0) @feat is meant
+ * @list: array of preferred values, in descending order of preference
+ * @len: length of @list in bytes
+ */
+int dccp_feat_register_sp(struct sock *sk, u8 feat, u8 is_local,
+                          u8 const *list, u8 len)
+{        /* any changes must be registered before establishing the connection */
+        if (sk->sk_state != DCCP_CLOSED)
+                return -EISCONN;
+        if (dccp_feat_type(feat) != FEAT_SP)
+                return -EINVAL;
+        return __feat_register_sp(&dccp_sk(sk)->dccps_featneg, feat, is_local,
+                                  0, list, len);
+}
+
+/* Analogous to dccp_feat_register_sp(), but for non-negotiable values */
+int dccp_feat_register_nn(struct sock *sk, u8 feat, u64 val)
+{
+        /* any changes must be registered before establishing the connection */
+        if (sk->sk_state != DCCP_CLOSED)
+                return -EISCONN;
+        if (dccp_feat_type(feat) != FEAT_NN)
+                return -EINVAL;
+        return __feat_register_nn(&dccp_sk(sk)->dccps_featneg, feat, 0, val);
+}
+
+/*
+ *      Tracking features whose value depend on the choice of CCID
+ *
+ * This is designed with an extension in mind so that a list walk could be done
+ * before activating any features. However, the existing framework was found to
+ * work satisfactorily up until now, the automatic verification is left open.
+ * When adding new CCIDs, add a corresponding dependency table here.
+ */
+static const struct ccid_dependency *dccp_feat_ccid_deps(u8 ccid, bool is_local)
+{
+        static const struct ccid_dependency ccid2_dependencies[2][2] = {
+                /*
+                 * CCID2 mandates Ack Vectors (RFC 4341, 4.): as CCID is a TX
+                 * feature and Send Ack Vector is an RX feature, `is_local'
+                 * needs to be reversed.
+                 */
+                {       /* Dependencies of the receiver-side (remote) CCID2 */
+                        {
+                                .dependent_feat = DCCPF_SEND_ACK_VECTOR,
+                                .is_local       = true,
+                                .is_mandatory   = true,
+                                .val            = 1
+                        },
+                        { 0, 0, 0, 0 }
+                },
+                {       /* Dependencies of the sender-side (local) CCID2 */
+                        {
+                                .dependent_feat = DCCPF_SEND_ACK_VECTOR,
+                                .is_local       = false,
+                                .is_mandatory   = true,
+                                .val            = 1
+                        },
+                        { 0, 0, 0, 0 }
+                }
+        };
+        static const struct ccid_dependency ccid3_dependencies[2][5] = {
+                {       /*
+                         * Dependencies of the receiver-side CCID3
+                         */
+                        {       /* locally disable Ack Vectors */
+                                .dependent_feat = DCCPF_SEND_ACK_VECTOR,
+                                .is_local       = true,
+                                .is_mandatory   = false,
+                                .val            = 0
+                        },
+                        {       /* see below why Send Loss Event Rate is on */
+                                .dependent_feat = DCCPF_SEND_LEV_RATE,
+                                .is_local       = true,
+                                .is_mandatory   = true,
+                                .val            = 1
+                        },
+                        {       /* NDP Count is needed as per RFC 4342, 6.1.1 */
+                                .dependent_feat = DCCPF_SEND_NDP_COUNT,
+                                .is_local       = false,
+                                .is_mandatory   = true,
+                                .val            = 1
+                        },
+                        { 0, 0, 0, 0 },
+                },
+                {       /*
+                         * CCID3 at the TX side: we request that the HC-receiver
+                         * will not send Ack Vectors (they will be ignored, so
+                         * Mandatory is not set); we enable Send Loss Event Rate
+                         * (Mandatory since the implementation does not support
+                         * the Loss Intervals option of RFC 4342, 8.6).
+                         * The last two options are for peer's information only.
+                        */
+                        {
+                                .dependent_feat = DCCPF_SEND_ACK_VECTOR,
+                                .is_local       = false,
+                                .is_mandatory   = false,
+                                .val            = 0
+                        },
+                        {
+                                .dependent_feat = DCCPF_SEND_LEV_RATE,
+                                .is_local       = false,
+                                .is_mandatory   = true,
+                                .val            = 1
+                        },
+                        {       /* this CCID does not support Ack Ratio */
+                                .dependent_feat = DCCPF_ACK_RATIO,
+                                .is_local       = true,
+                                .is_mandatory   = false,
+                                .val            = 0
+                        },
+                        {       /* tell receiver we are sending NDP counts */
+                                .dependent_feat = DCCPF_SEND_NDP_COUNT,
+                                .is_local       = true,
+                                .is_mandatory   = false,
+                                .val            = 1
+                        },
+                        { 0, 0, 0, 0 }
+                }
+        };
+        switch (ccid) {
+        case DCCPC_CCID2:
+                return ccid2_dependencies[is_local];
+        case DCCPC_CCID3:
+                return ccid3_dependencies[is_local];
+        default:
+                return NULL;
+        }
+}
+
+/**
+ * dccp_feat_propagate_ccid - Resolve dependencies of features on choice of CCID
+ * @fn: feature-negotiation list to update
+ * @id: CCID number to track
+ * @is_local: whether TX CCID (1) or RX CCID (0) is meant
+ * This function needs to be called after registering all other features.
+ */
+static int dccp_feat_propagate_ccid(struct list_head *fn, u8 id, bool is_local)
+{
+        const struct ccid_dependency *table = dccp_feat_ccid_deps(id, is_local);
+        int i, rc = (table == NULL);
+
+        for (i = 0; rc == 0 && table[i].dependent_feat != DCCPF_RESERVED; i++)
+                if (dccp_feat_type(table[i].dependent_feat) == FEAT_SP)
+                        rc = __feat_register_sp(fn, table[i].dependent_feat,
+                                                    table[i].is_local,
+                                                    table[i].is_mandatory,
+                                                    &table[i].val, 1);
+                else
+                        rc = __feat_register_nn(fn, table[i].dependent_feat,
+                                                    table[i].is_mandatory,
+                                                    table[i].val);
+        return rc;
+}
+
+/**
+ * dccp_feat_finalise_settings  -  Finalise settings before starting negotiation
+ * @dp: client or listening socket (settings will be inherited)
+ * This is called after all registrations (socket initialisation, sysctls, and
+ * sockopt calls), and before sending the first packet containing Change options
+ * (ie. client-Request or server-Response), to ensure internal consistency.
+ */
+int dccp_feat_finalise_settings(struct dccp_sock *dp)
+{
+        struct list_head *fn = &dp->dccps_featneg;
+        struct dccp_feat_entry *entry;
+        int i = 2, ccids[2] = { -1, -1 };
+
+        /*
+         * Propagating CCIDs:
+         * 1) not useful to propagate CCID settings if this host advertises more
+         *    than one CCID: the choice of CCID  may still change - if this is
+         *    the client, or if this is the server and the client sends
+         *    singleton CCID values.
+         * 2) since is that propagate_ccid changes the list, we defer changing
+         *    the sorted list until after the traversal.
+         */
+        list_for_each_entry(entry, fn, node)
+                if (entry->feat_num == DCCPF_CCID && entry->val.sp.len == 1)
+                        ccids[entry->is_local] = entry->val.sp.vec[0];
+        while (i--)
+                if (ccids[i] > 0 && dccp_feat_propagate_ccid(fn, ccids[i], i))
+                        return -1;
         return 0;
 }
 
-EXPORT_SYMBOL_GPL(dccp_feat_change);
+/**
+ * dccp_feat_server_ccid_dependencies  -  Resolve CCID-dependent features
+ * It is the server which resolves the dependencies once the CCID has been
+ * fully negotiated. If no CCID has been negotiated, it uses the default CCID.
+ */
+int dccp_feat_server_ccid_dependencies(struct dccp_request_sock *dreq)
+{
+        struct list_head *fn = &dreq->dreq_featneg;
+        struct dccp_feat_entry *entry;
+        u8 is_local, ccid;
+
+        for (is_local = 0; is_local <= 1; is_local++) {
+                entry = dccp_feat_list_lookup(fn, DCCPF_CCID, is_local);
+
+                if (entry != NULL && !entry->empty_confirm)
+                        ccid = entry->val.sp.vec[0];
+                else
+                        ccid = dccp_feat_default_value(DCCPF_CCID);
+
+                if (dccp_feat_propagate_ccid(fn, ccid, is_local))
+                        return -1;
+        }
+        return 0;
+}
 
 static int dccp_feat_update_ccid(struct sock *sk, u8 type, u8 new_ccid_nr)
 {
@@ -377,6 +886,9 @@ int dccp_feat_change_recv(struct sock *sk, u8 type, u8 feature, u8 *val, u8 len)
 {
         int rc;
 
+        /* Ignore Change requests other than during connection setup */
+        if (sk->sk_state != DCCP_LISTEN && sk->sk_state != DCCP_REQUESTING)
+                return 0;
         dccp_feat_debug(type, feature, *val);
 
         /* figure out if it's SP or NN feature */
@@ -426,6 +938,9 @@ int dccp_feat_confirm_recv(struct sock *sk, u8 type, u8 feature,
         int found = 0;
         int all_confirmed = 1;
 
+        /* Ignore Confirm options other than during connection setup */
+        if (sk->sk_state != DCCP_LISTEN && sk->sk_state != DCCP_REQUESTING)
+                return 0;
         dccp_feat_debug(type, feature, *val);
 
         /* locate our change request */
@@ -460,17 +975,6 @@ int dccp_feat_confirm_recv(struct sock *sk, u8 type, u8 feature,
                         all_confirmed = 0;
         }
 
-        /* fix re-transmit timer */
-        /* XXX gotta make sure that no option negotiation occurs during
-         * connection shutdown.  Consider that the CLOSEREQ is sent and timer is
-         * on.  if all options are confirmed it might kill timer which should
-         * remain alive until close is received.
-         */
-        if (all_confirmed) {
-                dccp_pr_debug("clear feat negotiation timer %p\n", sk);
-                inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
-        }
-
         if (!found)
                 dccp_pr_debug("%s(%d, ...) never requested\n",
                               dccp_feat_typename(type), feature);
@@ -564,42 +1068,30 @@ out_clean:
 
 EXPORT_SYMBOL_GPL(dccp_feat_clone);
 
-static int __dccp_feat_init(struct dccp_minisock *dmsk, u8 type, u8 feat,
-                            u8 *val, u8 len)
-{
-        int rc = -ENOMEM;
-        u8 *copy = kmemdup(val, len, GFP_KERNEL);
-
-        if (copy != NULL) {
-                rc = dccp_feat_change(dmsk, type, feat, copy, len, GFP_KERNEL);
-                if (rc)
-                        kfree(copy);
-        }
-        return rc;
-}
-
-int dccp_feat_init(struct dccp_minisock *dmsk)
+int dccp_feat_init(struct sock *sk)
 {
+        struct dccp_sock *dp = dccp_sk(sk);
+        struct dccp_minisock *dmsk = dccp_msk(sk);
         int rc;
 
-        INIT_LIST_HEAD(&dmsk->dccpms_pending);
-        INIT_LIST_HEAD(&dmsk->dccpms_conf);
+        INIT_LIST_HEAD(&dmsk->dccpms_pending);  /* XXX no longer used */
+        INIT_LIST_HEAD(&dmsk->dccpms_conf);     /* XXX no longer used */
 
         /* CCID L */
-        rc = __dccp_feat_init(dmsk, DCCPO_CHANGE_L, DCCPF_CCID,
-                              &dmsk->dccpms_tx_ccid, 1);
+        rc = __feat_register_sp(&dp->dccps_featneg, DCCPF_CCID, 1, 0,
+                                &dmsk->dccpms_tx_ccid, 1);
         if (rc)
                 goto out;
 
         /* CCID R */
-        rc = __dccp_feat_init(dmsk, DCCPO_CHANGE_R, DCCPF_CCID,
-                              &dmsk->dccpms_rx_ccid, 1);
+        rc = __feat_register_sp(&dp->dccps_featneg, DCCPF_CCID, 0, 0,
+                                &dmsk->dccpms_rx_ccid, 1);
         if (rc)
                 goto out;
 
         /* Ack ratio */
-        rc = __dccp_feat_init(dmsk, DCCPO_CHANGE_L, DCCPF_ACK_RATIO,
-                              &dmsk->dccpms_ack_ratio, 1);
+        rc = __feat_register_nn(&dp->dccps_featneg, DCCPF_ACK_RATIO, 0,
+                                dp->dccps_l_ack_ratio);
 out:
         return rc;
 }
@@ -639,6 +1131,8 @@ const char *dccp_feat_name(const u8 feat)
         if (feat > DCCPF_DATA_CHECKSUM && feat < DCCPF_MIN_CCID_SPECIFIC)
                 return feature_names[DCCPF_RESERVED];
 
+        if (feat ==  DCCPF_SEND_LEV_RATE)
+                return "Send Loss Event Rate";
         if (feat >= DCCPF_MIN_CCID_SPECIFIC)
                 return "CCID-specific";
 
diff --git a/net/dccp/feat.h b/net/dccp/feat.h
index e272222c7ace..4d172822df17 100644
--- a/net/dccp/feat.h
+++ b/net/dccp/feat.h
@@ -14,6 +14,90 @@
 #include <linux/types.h>
 #include "dccp.h"
 
+/*
+ * Known limit values
+ */
+/* Ack Ratio takes 2-byte integer values (11.3) */
+#define DCCPF_ACK_RATIO_MAX     0xFFFF
+/* Wmin=32 and Wmax=2^46-1 from 7.5.2 */
+#define DCCPF_SEQ_WMIN          32
+#define DCCPF_SEQ_WMAX          0x3FFFFFFFFFFFull
+
+enum dccp_feat_type {
+        FEAT_AT_RX   = 1,       /* located at RX side of half-connection  */
+        FEAT_AT_TX   = 2,       /* located at TX side of half-connection  */
+        FEAT_SP      = 4,       /* server-priority reconciliation (6.3.1) */
+        FEAT_NN      = 8,       /* non-negotiable reconciliation (6.3.2)  */
+        FEAT_UNKNOWN = 0xFF     /* not understood or invalid feature      */
+};
+
+enum dccp_feat_state {
+        FEAT_DEFAULT = 0,       /* using default values from 6.4 */
+        FEAT_INITIALISING,      /* feature is being initialised  */
+        FEAT_CHANGING,          /* Change sent but not confirmed yet */
+        FEAT_UNSTABLE,          /* local modification in state CHANGING */
+        FEAT_STABLE             /* both ends (think they) agree */
+};
+
+/**
+ * dccp_feat_val  -  Container for SP or NN feature values
+ * @nn:     single NN value
+ * @sp.vec: single SP value plus optional preference list
+ * @sp.len: length of @sp.vec in bytes
+ */
+typedef union {
+        u64 nn;
+        struct {
+                u8      *vec;
+                u8      len;
+        }   sp;
+} dccp_feat_val;
+
+/**
+ * struct feat_entry  -  Data structure to perform feature negotiation
+ * @val: feature's current value (SP features may have preference list)
+ * @state: feature's current state
+ * @feat_num: one of %dccp_feature_numbers
+ * @needs_mandatory: whether Mandatory options should be sent
+ * @needs_confirm: whether to send a Confirm instead of a Change
+ * @empty_confirm: whether to send an empty Confirm (depends on @needs_confirm)
+ * @is_local: feature location (1) or feature-remote (0)
+ * @node: list pointers, entries arranged in FIFO order
+ */
+struct dccp_feat_entry {
+        dccp_feat_val           val;
+        enum dccp_feat_state    state:8;
+        u8                      feat_num;
+
+        bool                    needs_mandatory,
+                                needs_confirm,
+                                empty_confirm,
+                                is_local;
+
+        struct list_head        node;
+};
+
+static inline u8 dccp_feat_genopt(struct dccp_feat_entry *entry)
+{
+        if (entry->needs_confirm)
+                return entry->is_local ? DCCPO_CONFIRM_L : DCCPO_CONFIRM_R;
+        return entry->is_local ? DCCPO_CHANGE_L : DCCPO_CHANGE_R;
+}
+
+/**
+ * struct ccid_dependency  -  Track changes resulting from choosing a CCID
+ * @dependent_feat: one of %dccp_feature_numbers
+ * @is_local: local (1) or remote (0) @dependent_feat
+ * @is_mandatory: whether presence of @dependent_feat is mission-critical or not
+ * @val: corresponding default value for @dependent_feat (u8 is sufficient here)
+ */
+struct ccid_dependency {
+        u8      dependent_feat;
+        bool    is_local:1,
+                is_mandatory:1;
+        u8      val;
+};
+
 #ifdef CONFIG_IP_DCCP_DEBUG
 extern const char *dccp_feat_typename(const u8 type);
 extern const char *dccp_feat_name(const u8 feat);
@@ -27,14 +111,16 @@ static inline void dccp_feat_debug(const u8 type, const u8 feat, const u8 val)
 #define dccp_feat_debug(type, feat, val)
 #endif /* CONFIG_IP_DCCP_DEBUG */
 
-extern int  dccp_feat_change(struct dccp_minisock *dmsk, u8 type, u8 feature,
-                             u8 *val, u8 len, gfp_t gfp);
+extern int  dccp_feat_register_sp(struct sock *sk, u8 feat, u8 is_local,
+                                  u8 const *list, u8 len);
+extern int  dccp_feat_register_nn(struct sock *sk, u8 feat, u64 val);
 extern int  dccp_feat_change_recv(struct sock *sk, u8 type, u8 feature,
                                   u8 *val, u8 len);
 extern int  dccp_feat_confirm_recv(struct sock *sk, u8 type, u8 feature,
                                    u8 *val, u8 len);
 extern void dccp_feat_clean(struct dccp_minisock *dmsk);
 extern int  dccp_feat_clone(struct sock *oldsk, struct sock *newsk);
-extern int  dccp_feat_init(struct dccp_minisock *dmsk);
+extern int  dccp_feat_clone_list(struct list_head const *, struct list_head *);
+extern int  dccp_feat_init(struct sock *sk);
 
 #endif /* _DCCP_FEAT_H */
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 779d0ed9ae94..3070015edc75 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -590,8 +590,6 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
                                                                     skb) < 0)
                                 return 1;
-
-                        /* FIXME: do congestion control initialization */
                         goto discard;
                 }
                 if (dh->dccph_type == DCCP_PKT_RESET)
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index e3dfddab21cc..d1dd95289b89 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -545,6 +545,7 @@ out:
 
 static void dccp_v4_reqsk_destructor(struct request_sock *req)
 {
+        dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
         kfree(inet_rsk(req)->opt);
 }
 
@@ -595,7 +596,8 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (req == NULL)
                 goto drop;
 
-        dccp_reqsk_init(req, skb);
+        if (dccp_reqsk_init(req, dccp_sk(sk), skb))
+                goto drop_and_free;
 
         dreq = dccp_rsk(req);
         if (dccp_parse_options(sk, dreq, skb))
@@ -792,12 +794,10 @@ static int dccp_v4_rcv(struct sk_buff *skb)
         DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(dh);
         DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
 
-        dccp_pr_debug("%8.8s "
-                      "src=%u.%u.%u.%u@%-5d "
-                      "dst=%u.%u.%u.%u@%-5d seq=%llu",
+        dccp_pr_debug("%8.8s src=%pI4@%-5d dst=%pI4@%-5d seq=%llu",
                       dccp_packet_name(dh->dccph_type),
-                      NIPQUAD(iph->saddr), ntohs(dh->dccph_sport),
-                      NIPQUAD(iph->daddr), ntohs(dh->dccph_dport),
+                      &iph->saddr, ntohs(dh->dccph_sport),
+                      &iph->daddr, ntohs(dh->dccph_dport),
                       (unsigned long long) DCCP_SKB_CB(skb)->dccpd_seq);
 
         if (dccp_packet_without_ack(skb)) {
@@ -938,6 +938,7 @@ static struct proto dccp_v4_prot = {
         .orphan_count           = &dccp_orphan_count,
         .max_header             = MAX_DCCP_HEADER,
         .obj_size               = sizeof(struct dccp_sock),
+        .slab_flags             = SLAB_DESTROY_BY_RCU,
         .rsk_prot               = &dccp_request_sock_ops,
         .twsk_prot              = &dccp_timewait_sock_ops,
         .h.hashinfo             = &dccp_hashinfo,
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index d4ce1224e008..f033e845bb07 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -304,6 +304,7 @@ done:
 
 static void dccp_v6_reqsk_destructor(struct request_sock *req)
 {
+        dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
         if (inet6_rsk(req)->pktopts != NULL)
                 kfree_skb(inet6_rsk(req)->pktopts);
 }
@@ -426,7 +427,8 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (req == NULL)
                 goto drop;
 
-        dccp_reqsk_init(req, skb);
+        if (dccp_reqsk_init(req, dccp_sk(sk), skb))
+                goto drop_and_free;
 
         dreq = dccp_rsk(req);
         if (dccp_parse_options(sk, dreq, skb))
@@ -1138,6 +1140,7 @@ static struct proto dccp_v6_prot = {
         .orphan_count      = &dccp_orphan_count,
         .max_header        = MAX_DCCP_HEADER,
         .obj_size          = sizeof(struct dccp6_sock),
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .rsk_prot          = &dccp6_request_sock_ops,
         .twsk_prot         = &dccp6_timewait_sock_ops,
         .h.hashinfo        = &dccp_hashinfo,
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index e6bf99e3e41a..ed61bc58e41e 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -47,7 +47,6 @@ void dccp_minisock_init(struct dccp_minisock *dmsk)
         dmsk->dccpms_sequence_window = sysctl_dccp_feat_sequence_window;
         dmsk->dccpms_rx_ccid         = sysctl_dccp_feat_rx_ccid;
         dmsk->dccpms_tx_ccid         = sysctl_dccp_feat_tx_ccid;
-        dmsk->dccpms_ack_ratio       = sysctl_dccp_feat_ack_ratio;
         dmsk->dccpms_send_ack_vector = sysctl_dccp_feat_send_ack_vector;
         dmsk->dccpms_send_ndp_count  = sysctl_dccp_feat_send_ndp_count;
 }
@@ -125,6 +124,7 @@ struct sock *dccp_create_openreq_child(struct sock *sk,
                 newdp->dccps_timestamp_time = dreq->dreq_timestamp_time;
                 newicsk->icsk_rto           = DCCP_TIMEOUT_INIT;
 
+                INIT_LIST_HEAD(&newdp->dccps_featneg);
                 if (dccp_feat_clone(sk, newsk))
                         goto out_free;
 
@@ -304,7 +304,8 @@ void dccp_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 
 EXPORT_SYMBOL_GPL(dccp_reqsk_send_ack);
 
-void dccp_reqsk_init(struct request_sock *req, struct sk_buff *skb)
+int dccp_reqsk_init(struct request_sock *req,
+                    struct dccp_sock const *dp, struct sk_buff const *skb)
 {
         struct dccp_request_sock *dreq = dccp_rsk(req);
 
@@ -313,6 +314,9 @@ void dccp_reqsk_init(struct request_sock *req, struct sk_buff *skb)
         inet_rsk(req)->acked      = 0;
         req->rcv_wnd              = sysctl_dccp_feat_sequence_window;
         dreq->dreq_timestamp_echo = 0;
+
+        /* inherit feature negotiation options from listening socket */
+        return dccp_feat_clone_list(&dp->dccps_featneg, &dreq->dreq_featneg);
 }
 
 EXPORT_SYMBOL_GPL(dccp_reqsk_init);
diff --git a/net/dccp/options.c b/net/dccp/options.c
index 0809b63cb055..515ad45013ad 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -26,7 +26,6 @@
 int sysctl_dccp_feat_sequence_window = DCCPF_INITIAL_SEQUENCE_WINDOW;
 int sysctl_dccp_feat_rx_ccid          = DCCPF_INITIAL_CCID;
 int sysctl_dccp_feat_tx_ccid          = DCCPF_INITIAL_CCID;
-int sysctl_dccp_feat_ack_ratio        = DCCPF_INITIAL_ACK_RATIO;
 int sysctl_dccp_feat_send_ack_vector = DCCPF_INITIAL_SEND_ACK_VECTOR;
 int sysctl_dccp_feat_send_ndp_count  = DCCPF_INITIAL_SEND_NDP_COUNT;
 
@@ -489,7 +488,6 @@ static int dccp_insert_feat_opt(struct sk_buff *skb, u8 type, u8 feat,
 
 static int dccp_insert_options_feat(struct sock *sk, struct sk_buff *skb)
 {
-        struct dccp_sock *dp = dccp_sk(sk);
         struct dccp_minisock *dmsk = dccp_msk(sk);
         struct dccp_opt_pend *opt, *next;
         int change = 0;
@@ -530,23 +528,6 @@ static int dccp_insert_options_feat(struct sock *sk, struct sk_buff *skb)
                 }
         }
 
-        /* Retransmit timer.
-         * If this is the master listening sock, we don't set a timer on it.  It
-         * should be fine because if the dude doesn't receive our RESPONSE
-         * [which will contain the CHANGE] he will send another REQUEST which
-         * will "retrnasmit" the change.
-         */
-        if (change && dp->dccps_role != DCCP_ROLE_LISTEN) {
-                dccp_pr_debug("reset feat negotiation timer %p\n", sk);
-
-                /* XXX don't reset the timer on re-transmissions.  I.e. reset it
-                 * only when sending new stuff i guess.  Currently the timer
-                 * never backs off because on re-transmission it just resets it!
-                 */
-                inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-                                          inet_csk(sk)->icsk_rto, DCCP_RTO_MAX);
-        }
-
         return 0;
 }
 
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 809d803d5006..fea30cdc0bee 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -339,10 +339,12 @@ struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
         DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_RESPONSE;
         DCCP_SKB_CB(skb)->dccpd_seq  = dreq->dreq_iss;
 
-        if (dccp_insert_options_rsk(dreq, skb)) {
-                kfree_skb(skb);
-                return NULL;
-        }
+        /* Resolve feature dependencies resulting from choice of CCID */
+        if (dccp_feat_server_ccid_dependencies(dreq))
+                goto response_failed;
+
+        if (dccp_insert_options_rsk(dreq, skb))
+                goto response_failed;
 
         /* Build and checksum header */
         dh = dccp_zeroed_hdr(skb, dccp_header_size);
@@ -363,6 +365,9 @@ struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
         inet_rsk(req)->acked = 1;
         DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
         return skb;
+response_failed:
+        kfree_skb(skb);
+        return NULL;
 }
 
 EXPORT_SYMBOL_GPL(dccp_make_response);
@@ -469,6 +474,10 @@ int dccp_connect(struct sock *sk)
         struct sk_buff *skb;
         struct inet_connection_sock *icsk = inet_csk(sk);
 
+        /* do not connect if feature negotiation setup fails */
+        if (dccp_feat_finalise_settings(dccp_sk(sk)))
+                return -EPROTO;
+
         dccp_connect_init(sk);
 
         skb = alloc_skb(sk->sk_prot->max_header, sk->sk_allocation);
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 81368a7f5379..49ba8d5ec4b5 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -86,18 +86,18 @@ static int jdccp_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (port == 0 || ntohs(inet->dport) == port ||
             ntohs(inet->sport) == port) {
                 if (hctx)
-                        printl("%d.%d.%d.%d:%u %d.%d.%d.%d:%u %d %d %d %d %u "
+                        printl("%pI4:%u %pI4:%u %d %d %d %d %u "
                                "%llu %llu %d\n",
-                               NIPQUAD(inet->saddr), ntohs(inet->sport),
-                               NIPQUAD(inet->daddr), ntohs(inet->dport), size,
+                               &inet->saddr, ntohs(inet->sport),
+                               &inet->daddr, ntohs(inet->dport), size,
                                hctx->ccid3hctx_s, hctx->ccid3hctx_rtt,
                                hctx->ccid3hctx_p, hctx->ccid3hctx_x_calc,
                                hctx->ccid3hctx_x_recv >> 6,
                                hctx->ccid3hctx_x >> 6, hctx->ccid3hctx_t_ipi);
                 else
-                        printl("%d.%d.%d.%d:%u %d.%d.%d.%d:%u %d\n",
-                               NIPQUAD(inet->saddr), ntohs(inet->sport),
-                               NIPQUAD(inet->daddr), ntohs(inet->dport), size);
+                        printl("%pI4:%u %pI4:%u %d\n",
+                               &inet->saddr, ntohs(inet->sport),
+                               &inet->daddr, ntohs(inet->dport), size);
         }
 
         jprobe_return();
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index d0bd34819761..8b63394ec24c 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -44,12 +44,7 @@ atomic_t dccp_orphan_count = ATOMIC_INIT(0);
 
 EXPORT_SYMBOL_GPL(dccp_orphan_count);
 
-struct inet_hashinfo __cacheline_aligned dccp_hashinfo = {
-        .lhash_lock     = RW_LOCK_UNLOCKED,
-        .lhash_users    = ATOMIC_INIT(0),
-        .lhash_wait = __WAIT_QUEUE_HEAD_INITIALIZER(dccp_hashinfo.lhash_wait),
-};
-
+struct inet_hashinfo dccp_hashinfo;
 EXPORT_SYMBOL_GPL(dccp_hashinfo);
 
 /* the maximum queue length for tx in packets. 0 is no limit */
@@ -193,6 +188,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 
         dccp_init_xmit_timers(sk);
 
+        INIT_LIST_HEAD(&dp->dccps_featneg);
         /*
          * FIXME: We're hardcoding the CCID, and doing this at this point makes
          * the listening (master) sock get CCID control blocks, which is not
@@ -201,7 +197,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
          * setsockopt(CCIDs-I-want/accept). -acme
          */
         if (likely(ctl_sock_initialized)) {
-                int rc = dccp_feat_init(dmsk);
+                int rc = dccp_feat_init(sk);
 
                 if (rc)
                         return rc;
@@ -267,7 +263,7 @@ void dccp_destroy_sock(struct sock *sk)
         dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
 
         /* clean up feature negotiation state */
-        dccp_feat_clean(dmsk);
+        dccp_feat_list_purge(&dp->dccps_featneg);
 }
 
 EXPORT_SYMBOL_GPL(dccp_destroy_sock);
@@ -277,6 +273,9 @@ static inline int dccp_listen_start(struct sock *sk, int backlog)
         struct dccp_sock *dp = dccp_sk(sk);
 
         dp->dccps_role = DCCP_ROLE_LISTEN;
+        /* do not start to listen if feature negotiation setup fails */
+        if (dccp_feat_finalise_settings(dp))
+                return -EPROTO;
         return inet_csk_listen_start(sk, backlog);
 }
 
@@ -466,42 +465,40 @@ static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
         return 0;
 }
 
-/* byte 1 is feature.  the rest is the preference list */
-static int dccp_setsockopt_change(struct sock *sk, int type,
-                                  struct dccp_so_feat __user *optval)
+static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
 {
-        struct dccp_so_feat opt;
-        u8 *val;
-        int rc;
+        u8 *list, len;
+        int i, rc;
 
-        if (copy_from_user(&opt, optval, sizeof(opt)))
-                return -EFAULT;
+        if (cscov < 0 || cscov > 15)
+                return -EINVAL;
         /*
-         * rfc4340: 6.1. Change Options
+         * Populate a list of permissible values, in the range cscov...15. This
+         * is necessary since feature negotiation of single values only works if
+         * both sides incidentally choose the same value. Since the list starts
+         * lowest-value first, negotiation will pick the smallest shared value.
          */
-        if (opt.dccpsf_len < 1)
-                return -EINVAL;
+        if (cscov == 0)
+                return 0;
+        len = 16 - cscov;
 
-        val = kmalloc(opt.dccpsf_len, GFP_KERNEL);
-        if (!val)
-                return -ENOMEM;
+        list = kmalloc(len, GFP_KERNEL);
+        if (list == NULL)
+                return -ENOBUFS;
 
-        if (copy_from_user(val, opt.dccpsf_val, opt.dccpsf_len)) {
-                rc = -EFAULT;
-                goto out_free_val;
-        }
+        for (i = 0; i < len; i++)
+                list[i] = cscov++;
 
-        rc = dccp_feat_change(dccp_msk(sk), type, opt.dccpsf_feat,
-                              val, opt.dccpsf_len, GFP_KERNEL);
-        if (rc)
-                goto out_free_val;
+        rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
 
-out:
+        if (rc == 0) {
+                if (rx)
+                        dccp_sk(sk)->dccps_pcrlen = cscov;
+                else
+                        dccp_sk(sk)->dccps_pcslen = cscov;
+        }
+        kfree(list);
         return rc;
-
-out_free_val:
-        kfree(val);
-        goto out;
 }
 
 static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
@@ -510,7 +507,17 @@ static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
         struct dccp_sock *dp = dccp_sk(sk);
         int val, err = 0;
 
-        if (optlen < sizeof(int))
+        switch (optname) {
+        case DCCP_SOCKOPT_PACKET_SIZE:
+                DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
+                return 0;
+        case DCCP_SOCKOPT_CHANGE_L:
+        case DCCP_SOCKOPT_CHANGE_R:
+                DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
+                return 0;
+        }
+
+        if (optlen < (int)sizeof(int))
                 return -EINVAL;
 
         if (get_user(val, (int __user *)optval))
@@ -521,53 +528,24 @@ static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
 
         lock_sock(sk);
         switch (optname) {
-        case DCCP_SOCKOPT_PACKET_SIZE:
-                DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
-                err = 0;
-                break;
-        case DCCP_SOCKOPT_CHANGE_L:
-                if (optlen != sizeof(struct dccp_so_feat))
-                        err = -EINVAL;
-                else
-                        err = dccp_setsockopt_change(sk, DCCPO_CHANGE_L,
-                                                     (struct dccp_so_feat __user *)
-                                                     optval);
-                break;
-        case DCCP_SOCKOPT_CHANGE_R:
-                if (optlen != sizeof(struct dccp_so_feat))
-                        err = -EINVAL;
-                else
-                        err = dccp_setsockopt_change(sk, DCCPO_CHANGE_R,
-                                                     (struct dccp_so_feat __user *)
-                                                     optval);
-                break;
         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
                 if (dp->dccps_role != DCCP_ROLE_SERVER)
                         err = -EOPNOTSUPP;
                 else
                         dp->dccps_server_timewait = (val != 0);
                 break;
-        case DCCP_SOCKOPT_SEND_CSCOV:   /* sender side, RFC 4340, sec. 9.2 */
-                if (val < 0 || val > 15)
-                        err = -EINVAL;
-                else
-                        dp->dccps_pcslen = val;
+        case DCCP_SOCKOPT_SEND_CSCOV:
+                err = dccp_setsockopt_cscov(sk, val, false);
                 break;
-        case DCCP_SOCKOPT_RECV_CSCOV:   /* receiver side, RFC 4340 sec. 9.2.1 */
-                if (val < 0 || val > 15)
-                        err = -EINVAL;
-                else {
-                        dp->dccps_pcrlen = val;
-                        /* FIXME: add feature negotiation,
-                         * ChangeL(MinimumChecksumCoverage, val) */
-                }
+        case DCCP_SOCKOPT_RECV_CSCOV:
+                err = dccp_setsockopt_cscov(sk, val, true);
                 break;
         default:
                 err = -ENOPROTOOPT;
                 break;
         }
-
         release_sock(sk);
+
         return err;
 }
 
@@ -648,6 +626,8 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
         case DCCP_SOCKOPT_GET_CUR_MPS:
                 val = dp->dccps_mss_cache;
                 break;
+        case DCCP_SOCKOPT_AVAILABLE_CCIDS:
+                return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
                 val = dp->dccps_server_timewait;
                 break;
@@ -1045,6 +1025,7 @@ static int __init dccp_init(void)
         BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
                      FIELD_SIZEOF(struct sk_buff, cb));
 
+        inet_hashinfo_init(&dccp_hashinfo);
         dccp_hashinfo.bind_bucket_cachep =
                 kmem_cache_create("dccp_bind_bucket",
                                   sizeof(struct inet_bind_bucket), 0,
@@ -1084,8 +1065,8 @@ static int __init dccp_init(void)
         }
 
         for (i = 0; i < dccp_hashinfo.ehash_size; i++) {
-                INIT_HLIST_HEAD(&dccp_hashinfo.ehash[i].chain);
-                INIT_HLIST_HEAD(&dccp_hashinfo.ehash[i].twchain);
+                INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
+                INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].twchain, i);
         }
 
         if (inet_ehash_locks_alloc(&dccp_hashinfo))
diff --git a/net/dccp/sysctl.c b/net/dccp/sysctl.c
index 21295993fdb8..f6e54f433e29 100644
--- a/net/dccp/sysctl.c
+++ b/net/dccp/sysctl.c
@@ -41,13 +41,6 @@ static struct ctl_table dccp_default_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .procname       = "ack_ratio",
-                .data           = &sysctl_dccp_feat_ack_ratio,
-                .maxlen         = sizeof(sysctl_dccp_feat_ack_ratio),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
                 .procname       = "send_ackvec",
                 .data           = &sysctl_dccp_feat_send_ack_vector,
                 .maxlen         = sizeof(sysctl_dccp_feat_send_ack_vector),
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 54b3c7e9e016..162d1e683c39 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -87,17 +87,6 @@ static void dccp_retransmit_timer(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
 
-        /* retransmit timer is used for feature negotiation throughout
-         * connection.  In this case, no packet is re-transmitted, but rather an
-         * ack is generated and pending changes are placed into its options.
-         */
-        if (sk->sk_send_head == NULL) {
-                dccp_pr_debug("feat negotiation retransmit timeout %p\n", sk);
-                if (sk->sk_state == DCCP_OPEN)
-                        dccp_send_ack(sk);
-                goto backoff;
-        }
-
         /*
          * More than than 4MSL (8 minutes) has passed, a RESET(aborted) was
          * sent, no need to retransmit, this sock is dead.
@@ -126,7 +115,6 @@ static void dccp_retransmit_timer(struct sock *sk)
                 return;
         }
 
-backoff:
         icsk->icsk_backoff++;
 
         icsk->icsk_rto = min(icsk->icsk_rto << 1, DCCP_RTO_MAX);
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 821bd1cdec04..768df000523b 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -131,7 +131,6 @@ static struct dst_ops dn_dst_ops = {
         .negative_advice =      dn_dst_negative_advice,
         .link_failure =         dn_dst_link_failure,
         .update_pmtu =          dn_dst_update_pmtu,
-        .entry_size =           sizeof(struct dn_route),
         .entries =              ATOMIC_INIT(0),
 };
 
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 36400b266896..2f360a1e5e49 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -354,8 +354,8 @@ static ctl_table dn_table[] = {
                 .data = node_name,
                 .maxlen = 7,
                 .mode = 0644,
-                .proc_handler = &proc_dostring,
-                .strategy = &sysctl_string,
+                .proc_handler = proc_dostring,
+                .strategy = sysctl_string,
         },
         {
                 .ctl_name = NET_DECNET_DEFAULT_DEVICE,
@@ -371,8 +371,8 @@ static ctl_table dn_table[] = {
                 .data = &decnet_time_wait,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy = sysctl_intvec,
                 .extra1 = &min_decnet_time_wait,
                 .extra2 = &max_decnet_time_wait
         },
@@ -382,8 +382,8 @@ static ctl_table dn_table[] = {
                 .data = &decnet_dn_count,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy = sysctl_intvec,
                 .extra1 = &min_state_count,
                 .extra2 = &max_state_count
         },
@@ -393,8 +393,8 @@ static ctl_table dn_table[] = {
                 .data = &decnet_di_count,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy = sysctl_intvec,
                 .extra1 = &min_state_count,
                 .extra2 = &max_state_count
         },
@@ -404,8 +404,8 @@ static ctl_table dn_table[] = {
                 .data = &decnet_dr_count,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy = sysctl_intvec,
                 .extra1 = &min_state_count,
                 .extra2 = &max_state_count
         },
@@ -415,8 +415,8 @@ static ctl_table dn_table[] = {
                 .data = &decnet_dst_gc_interval,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy = sysctl_intvec,
                 .extra1 = &min_decnet_dst_gc_interval,
                 .extra2 = &max_decnet_dst_gc_interval
         },
@@ -426,8 +426,8 @@ static ctl_table dn_table[] = {
                 .data = &decnet_no_fc_max_cwnd,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy = sysctl_intvec,
                 .extra1 = &min_decnet_no_fc_max_cwnd,
                 .extra2 = &max_decnet_no_fc_max_cwnd
         },
@@ -437,8 +437,8 @@ static ctl_table dn_table[] = {
                 .data = &sysctl_decnet_mem,
                 .maxlen = sizeof(sysctl_decnet_mem),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec,
+                .strategy = sysctl_intvec,
         },
         {
                 .ctl_name = NET_DECNET_RMEM,
@@ -446,8 +446,8 @@ static ctl_table dn_table[] = {
                 .data = &sysctl_decnet_rmem,
                 .maxlen = sizeof(sysctl_decnet_rmem),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec,
+                .strategy = sysctl_intvec,
         },
         {
                 .ctl_name = NET_DECNET_WMEM,
@@ -455,8 +455,8 @@ static ctl_table dn_table[] = {
                 .data = &sysctl_decnet_wmem,
                 .maxlen = sizeof(sysctl_decnet_wmem),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec,
+                .strategy = sysctl_intvec,
         },
         {
                 .ctl_name = NET_DECNET_DEBUG_LEVEL,
@@ -464,8 +464,8 @@ static ctl_table dn_table[] = {
                 .data = &decnet_debug_level,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec,
-                .strategy = &sysctl_intvec,
+                .proc_handler = proc_dointvec,
+                .strategy = sysctl_intvec,
         },
         {0}
 };
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 1af5a79309e9..a3a410d20da0 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -352,7 +352,7 @@ dsa_slave_create(struct dsa_switch *ds, struct device *parent,
         netif_carrier_off(slave_dev);
 
         if (p->phy != NULL) {
-                phy_attach(slave_dev, p->phy->dev.bus_id,
+                phy_attach(slave_dev, dev_name(&p->phy->dev),
                            0, PHY_INTERFACE_MODE_GMII);
 
                 p->phy->autoneg = AUTONEG_ENABLE;
diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c
index 31866543332e..f99a019b939e 100644
--- a/net/dsa/tag_dsa.c
+++ b/net/dsa/tag_dsa.c
@@ -162,7 +162,6 @@ static int dsa_rcv(struct sk_buff *skb, struct net_device *dev,
         skb->pkt_type = PACKET_HOST;
         skb->protocol = eth_type_trans(skb, skb->dev);
 
-        skb->dev->last_rx = jiffies;
         skb->dev->stats.rx_packets++;
         skb->dev->stats.rx_bytes += skb->len;
 
diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c
index 9f4ce55eae59..328ec957f786 100644
--- a/net/dsa/tag_edsa.c
+++ b/net/dsa/tag_edsa.c
@@ -181,7 +181,6 @@ static int edsa_rcv(struct sk_buff *skb, struct net_device *dev,
         skb->pkt_type = PACKET_HOST;
         skb->protocol = eth_type_trans(skb, skb->dev);
 
-        skb->dev->last_rx = jiffies;
         skb->dev->stats.rx_packets++;
         skb->dev->stats.rx_bytes += skb->len;
 
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index efd26697e716..b59132878ad1 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -98,7 +98,6 @@ static int trailer_rcv(struct sk_buff *skb, struct net_device *dev,
         skb->pkt_type = PACKET_HOST;
         skb->protocol = eth_type_trans(skb, skb->dev);
 
-        skb->dev->last_rx = jiffies;
         skb->dev->stats.rx_packets++;
         skb->dev->stats.rx_bytes += skb->len;
 
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index b9d85af2dd31..a87a171d9914 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -282,7 +282,7 @@ EXPORT_SYMBOL(eth_header_cache_update);
  * This doesn't change hardware matching, so needs to be overridden
  * for most real devices.
  */
-static int eth_mac_addr(struct net_device *dev, void *p)
+int eth_mac_addr(struct net_device *dev, void *p)
 {
         struct sockaddr *addr = p;
 
@@ -293,6 +293,7 @@ static int eth_mac_addr(struct net_device *dev, void *p)
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
         return 0;
 }
+EXPORT_SYMBOL(eth_mac_addr);
 
 /**
  * eth_change_mtu - set new MTU size
@@ -302,21 +303,23 @@ static int eth_mac_addr(struct net_device *dev, void *p)
  * Allow changing MTU size. Needs to be overridden for devices
  * supporting jumbo frames.
  */
-static int eth_change_mtu(struct net_device *dev, int new_mtu)
+int eth_change_mtu(struct net_device *dev, int new_mtu)
 {
         if (new_mtu < 68 || new_mtu > ETH_DATA_LEN)
                 return -EINVAL;
         dev->mtu = new_mtu;
         return 0;
 }
+EXPORT_SYMBOL(eth_change_mtu);
 
-static int eth_validate_addr(struct net_device *dev)
+int eth_validate_addr(struct net_device *dev)
 {
         if (!is_valid_ether_addr(dev->dev_addr))
                 return -EADDRNOTAVAIL;
 
         return 0;
 }
+EXPORT_SYMBOL(eth_validate_addr);
 
 const struct header_ops eth_header_ops ____cacheline_aligned = {
         .create         = eth_header,
@@ -334,11 +337,11 @@ const struct header_ops eth_header_ops ____cacheline_aligned = {
 void ether_setup(struct net_device *dev)
 {
         dev->header_ops         = &eth_header_ops;
-
+#ifdef CONFIG_COMPAT_NET_DEV_OPS
         dev->change_mtu         = eth_change_mtu;
         dev->set_mac_address    = eth_mac_addr;
         dev->validate_addr      = eth_validate_addr;
-
+#endif
         dev->type               = ARPHRD_ETHER;
         dev->hard_header_len    = ETH_HLEN;
         dev->mtu                = ETH_DATA_LEN;
diff --git a/net/ieee80211/Kconfig b/net/ieee80211/Kconfig
index 94ed7d3cd9da..d2282bb2e4f1 100644
--- a/net/ieee80211/Kconfig
+++ b/net/ieee80211/Kconfig
@@ -1,12 +1,24 @@
 config IEEE80211
-        tristate "Generic IEEE 802.11 Networking Stack (DEPRECATED)"
+        tristate
+        select WIRELESS_EXT
+        select CRYPTO
+        select CRYPTO_ARC4
+        select CRYPTO_ECB
+        select CRYPTO_AES
+        select CRYPTO_MICHAEL_MIC
+        select CRYPTO_ECB
+        select CRC32
+        select IEEE80211_CRYPT_WEP
+        select IEEE80211_CRYPT_TKIP
+        select IEEE80211_CRYPT_CCMP
+        select LIB80211
         ---help---
         This option enables the hardware independent IEEE 802.11
         networking stack.  This component is deprecated in favor of the
         mac80211 component.
 
 config IEEE80211_DEBUG
-        bool "Enable full debugging output"
+        bool "Full debugging output for the old IEEE80211 stack"
         depends on IEEE80211
         ---help---
           This option will enable debug tracing output for the
@@ -29,45 +41,10 @@ config IEEE80211_DEBUG
           subsystem, you most likely want to say N here.
 
 config IEEE80211_CRYPT_WEP
-        tristate "IEEE 802.11 WEP encryption (802.1x)"
-        depends on IEEE80211
-        select CRYPTO
-        select CRYPTO_ARC4
-        select CRYPTO_ECB
-        select CRC32
-        ---help---
-        Include software based cipher suites in support of IEEE
-        802.11's WEP.  This is needed for WEP as well as 802.1x.
-
-        This can be compiled as a module and it will be called
-        "ieee80211_crypt_wep".
+        tristate
 
 config IEEE80211_CRYPT_CCMP
-        tristate "IEEE 802.11i CCMP support"
-        depends on IEEE80211
-        select CRYPTO
-        select CRYPTO_AES
-        ---help---
-        Include software based cipher suites in support of IEEE 802.11i
-        (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with CCMP enabled
-        networks.
-
-        This can be compiled as a module and it will be called
-        "ieee80211_crypt_ccmp".
+        tristate
 
 config IEEE80211_CRYPT_TKIP
-        tristate "IEEE 802.11i TKIP encryption"
-        depends on IEEE80211
-        select WIRELESS_EXT
-        select CRYPTO
-        select CRYPTO_MICHAEL_MIC
-        select CRYPTO_ECB
-        select CRC32
-        ---help---
-        Include software based cipher suites in support of IEEE 802.11i
-        (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
-        networks.
-
-        This can be compiled as a module and it will be called
-        "ieee80211_crypt_tkip".
-
+        tristate
diff --git a/net/ieee80211/ieee80211_crypt_ccmp.c b/net/ieee80211/ieee80211_crypt_ccmp.c
index 208bf35b5546..bea04af0b482 100644
--- a/net/ieee80211/ieee80211_crypt_ccmp.c
+++ b/net/ieee80211/ieee80211_crypt_ccmp.c
@@ -296,7 +296,6 @@ static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         int i, blocks, last, len;
         size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN - CCMP_MIC_LEN;
         u8 *mic = skb->data + skb->len - CCMP_MIC_LEN;
-        DECLARE_MAC_BUF(mac);
 
         if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) {
                 key->dot11RSNAStatsCCMPFormatErrors++;
@@ -309,7 +308,7 @@ static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         if (!(keyidx & (1 << 5))) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "CCMP: received packet without ExtIV"
-                               " flag from %s\n", print_mac(mac, hdr->addr2));
+                               " flag from %pM\n", hdr->addr2);
                 }
                 key->dot11RSNAStatsCCMPFormatErrors++;
                 return -2;
@@ -322,9 +321,9 @@ static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         }
         if (!key->key_set) {
                 if (net_ratelimit()) {
-                        printk(KERN_DEBUG "CCMP: received packet from %s"
+                        printk(KERN_DEBUG "CCMP: received packet from %pM"
                                " with keyid=%d that does not have a configured"
-                               " key\n", print_mac(mac, hdr->addr2), keyidx);
+                               " key\n", hdr->addr2, keyidx);
                 }
                 return -3;
         }
@@ -339,10 +338,10 @@ static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 
         if (ccmp_replay_check(pn, key->rx_pn)) {
                 if (ieee80211_ratelimit_debug(IEEE80211_DL_DROP)) {
-                        IEEE80211_DEBUG_DROP("CCMP: replay detected: STA=%s "
+                        IEEE80211_DEBUG_DROP("CCMP: replay detected: STA=%pM "
                                  "previous PN %02x%02x%02x%02x%02x%02x "
                                  "received PN %02x%02x%02x%02x%02x%02x\n",
-                                 print_mac(mac, hdr->addr2),
+                                 hdr->addr2,
                                  key->rx_pn[0], key->rx_pn[1], key->rx_pn[2],
                                  key->rx_pn[3], key->rx_pn[4], key->rx_pn[5],
                                  pn[0], pn[1], pn[2], pn[3], pn[4], pn[5]);
@@ -373,7 +372,7 @@ static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         if (memcmp(mic, a, CCMP_MIC_LEN) != 0) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "CCMP: decrypt failed: STA="
-                               "%s\n", print_mac(mac, hdr->addr2));
+                               "%pM\n", hdr->addr2);
                 }
                 key->dot11RSNAStatsCCMPDecryptErrors++;
                 return -5;
diff --git a/net/ieee80211/ieee80211_crypt_tkip.c b/net/ieee80211/ieee80211_crypt_tkip.c
index bba0152e2d71..d12da1da6328 100644
--- a/net/ieee80211/ieee80211_crypt_tkip.c
+++ b/net/ieee80211/ieee80211_crypt_tkip.c
@@ -359,15 +359,13 @@ static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         u8 rc4key[16], *pos, *icv;
         u32 crc;
         struct scatterlist sg;
-        DECLARE_MAC_BUF(mac);
 
         if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
                 if (net_ratelimit()) {
                         struct ieee80211_hdr_4addr *hdr =
                             (struct ieee80211_hdr_4addr *)skb->data;
                         printk(KERN_DEBUG ": TKIP countermeasures: dropped "
-                               "TX packet to %s\n",
-                               print_mac(mac, hdr->addr1));
+                               "TX packet to %pM\n", hdr->addr1);
                 }
                 return -1;
         }
@@ -420,15 +418,13 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         u32 crc;
         struct scatterlist sg;
         int plen;
-        DECLARE_MAC_BUF(mac);
 
         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 
         if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG ": TKIP countermeasures: dropped "
-                               "received packet from %s\n",
-                               print_mac(mac, hdr->addr2));
+                               "received packet from %pM\n", hdr->addr2);
                 }
                 return -1;
         }
@@ -441,7 +437,7 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         if (!(keyidx & (1 << 5))) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "TKIP: received packet without ExtIV"
-                               " flag from %s\n", print_mac(mac, hdr->addr2));
+                               " flag from %pM\n", hdr->addr2);
                 }
                 return -2;
         }
@@ -453,9 +449,9 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         }
         if (!tkey->key_set) {
                 if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: received packet from %s"
+                        printk(KERN_DEBUG "TKIP: received packet from %pM"
                                " with keyid=%d that does not have a configured"
-                               " key\n", print_mac(mac, hdr->addr2), keyidx);
+                               " key\n", hdr->addr2, keyidx);
                 }
                 return -3;
         }
@@ -465,9 +461,9 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 
         if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) {
                 if (ieee80211_ratelimit_debug(IEEE80211_DL_DROP)) {
-                        IEEE80211_DEBUG_DROP("TKIP: replay detected: STA=%s"
+                        IEEE80211_DEBUG_DROP("TKIP: replay detected: STA=%pM"
                                " previous TSC %08x%04x received TSC "
-                               "%08x%04x\n", print_mac(mac, hdr->addr2),
+                               "%08x%04x\n", hdr->addr2,
                                tkey->rx_iv32, tkey->rx_iv16, iv32, iv16);
                 }
                 tkey->dot11RSNAStatsTKIPReplays++;
@@ -487,8 +483,8 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4)) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG ": TKIP: failed to decrypt "
-                               "received packet from %s\n",
-                               print_mac(mac, hdr->addr2));
+                               "received packet from %pM\n",
+                               hdr->addr2);
                 }
                 return -7;
         }
@@ -506,7 +502,7 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 }
                 if (ieee80211_ratelimit_debug(IEEE80211_DL_DROP)) {
                         IEEE80211_DEBUG_DROP("TKIP: ICV error detected: STA="
-                               "%s\n", print_mac(mac, hdr->addr2));
+                               "%pM\n", hdr->addr2);
                 }
                 tkey->dot11RSNAStatsTKIPICVErrors++;
                 return -5;
@@ -633,7 +629,6 @@ static int ieee80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
 {
         struct ieee80211_tkip_data *tkey = priv;
         u8 mic[8];
-        DECLARE_MAC_BUF(mac);
 
         if (!tkey->key_set)
                 return -1;
@@ -646,8 +641,8 @@ static int ieee80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
                 struct ieee80211_hdr_4addr *hdr;
                 hdr = (struct ieee80211_hdr_4addr *)skb->data;
                 printk(KERN_DEBUG "%s: Michael MIC verification failed for "
-                       "MSDU from %s keyidx=%d\n",
-                       skb->dev ? skb->dev->name : "N/A", print_mac(mac, hdr->addr2),
+                       "MSDU from %pM keyidx=%d\n",
+                       skb->dev ? skb->dev->name : "N/A", hdr->addr2,
                        keyidx);
                 if (skb->dev)
                         ieee80211_michael_mic_failure(skb->dev, hdr, keyidx);
diff --git a/net/ieee80211/ieee80211_module.c b/net/ieee80211/ieee80211_module.c
index 949772a5a7dc..d34d4e79b6f7 100644
--- a/net/ieee80211/ieee80211_module.c
+++ b/net/ieee80211/ieee80211_module.c
@@ -308,31 +308,5 @@ MODULE_PARM_DESC(debug, "debug output mask");
 module_exit(ieee80211_exit);
 module_init(ieee80211_init);
 
-const char *escape_essid(const char *essid, u8 essid_len)
-{
-        static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-        const char *s = essid;
-        char *d = escaped;
-
-        if (ieee80211_is_empty_essid(essid, essid_len)) {
-                memcpy(escaped, "<hidden>", sizeof("<hidden>"));
-                return escaped;
-        }
-
-        essid_len = min(essid_len, (u8) IW_ESSID_MAX_SIZE);
-        while (essid_len--) {
-                if (*s == '\0') {
-                        *d++ = '\\';
-                        *d++ = '0';
-                        s++;
-                } else {
-                        *d++ = *s++;
-                }
-        }
-        *d = '\0';
-        return escaped;
-}
-
 EXPORT_SYMBOL(alloc_ieee80211);
 EXPORT_SYMBOL(free_ieee80211);
-EXPORT_SYMBOL(escape_essid);
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 69dbc342a464..3dd58b594f6a 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -32,6 +32,7 @@
 #include <asm/uaccess.h>
 #include <linux/ctype.h>
 
+#include <net/lib80211.h>
 #include <net/ieee80211.h>
 
 static void ieee80211_monitor_rx(struct ieee80211_device *ieee,
@@ -39,7 +40,7 @@ static void ieee80211_monitor_rx(struct ieee80211_device *ieee,
                                         struct ieee80211_rx_stats *rx_stats)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        u16 fc = le16_to_cpu(hdr->frame_ctl);
+        u16 fc = le16_to_cpu(hdr->frame_control);
 
         skb->dev = ieee->dev;
         skb_reset_mac_header(skb);
@@ -282,12 +283,8 @@ ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
         res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
         atomic_dec(&crypt->refcnt);
         if (res < 0) {
-                IEEE80211_DEBUG_DROP("decryption failed (SA=" MAC_FMT
-                                     ") res=%d\n",
-                                     hdr->addr2[0], hdr->addr2[1],
-                                     hdr->addr2[2], hdr->addr2[3],
-                                     hdr->addr2[4], hdr->addr2[5],
-                                     res);
+                IEEE80211_DEBUG_DROP("decryption failed (SA=%pM) res=%d\n",
+                                     hdr->addr2, res);
                 if (res == -2)
                         IEEE80211_DEBUG_DROP("Decryption failed ICV "
                                              "mismatch (key %d)\n",
@@ -319,11 +316,7 @@ ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
         atomic_dec(&crypt->refcnt);
         if (res < 0) {
                 printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
-                       " (SA=" MAC_FMT " keyidx=%d)\n",
-                       ieee->dev->name,
-                       hdr->addr2[0], hdr->addr2[1],
-                       hdr->addr2[2], hdr->addr2[3],
-                       hdr->addr2[4], hdr->addr2[5],
+                       " (SA=%pM keyidx=%d)\n", ieee->dev->name, hdr->addr2,
                        keyidx);
                 return -1;
         }
@@ -358,7 +351,6 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
         struct ieee80211_crypt_data *crypt = NULL;
         int keyidx = 0;
         int can_be_decrypted = 0;
-        DECLARE_MAC_BUF(mac);
 
         hdr = (struct ieee80211_hdr_4addr *)skb->data;
         stats = &ieee->stats;
@@ -468,10 +460,7 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                          * frames silently instead of filling system log with
                          * these reports. */
                         IEEE80211_DEBUG_DROP("Decryption failed (not set)"
-                                             " (SA=" MAC_FMT ")\n",
-                                             hdr->addr2[0], hdr->addr2[1],
-                                             hdr->addr2[2], hdr->addr2[3],
-                                             hdr->addr2[4], hdr->addr2[5]);
+                                             " (SA=%pM)\n", hdr->addr2);
                         ieee->ieee_stats.rx_discards_undecryptable++;
                         goto rx_dropped;
                 }
@@ -482,10 +471,7 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                     fc & IEEE80211_FCTL_PROTECTED && ieee->host_decrypt &&
                     (keyidx = hostap_rx_frame_decrypt(ieee, skb, crypt)) < 0) {
                         printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth "
-                               "from " MAC_FMT "\n", dev->name,
-                               hdr->addr2[0], hdr->addr2[1],
-                               hdr->addr2[2], hdr->addr2[3],
-                               hdr->addr2[4], hdr->addr2[5]);
+                               "from %pM\n", dev->name, hdr->addr2);
                         /* TODO: could inform hostapd about this so that it
                          * could send auth failure report */
                         goto rx_dropped;
@@ -547,8 +533,6 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
         }
 #endif
 
-        dev->last_rx = jiffies;
-
 #ifdef NOT_YET
         if ((ieee->iw_mode == IW_MODE_MASTER ||
              ieee->iw_mode == IW_MODE_REPEAT) && !from_assoc_ap) {
@@ -663,11 +647,8 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                          * configured */
                 } else {
                         IEEE80211_DEBUG_DROP("encryption configured, but RX "
-                                             "frame not encrypted (SA="
-                                             MAC_FMT ")\n",
-                                             hdr->addr2[0], hdr->addr2[1],
-                                             hdr->addr2[2], hdr->addr2[3],
-                                             hdr->addr2[4], hdr->addr2[5]);
+                                             "frame not encrypted (SA=%pM)\n",
+                                             hdr->addr2);
                         goto rx_dropped;
                 }
         }
@@ -675,11 +656,8 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
         if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !ieee->open_wep &&
             !ieee80211_is_eapol_frame(ieee, skb)) {
                 IEEE80211_DEBUG_DROP("dropped unencrypted RX data "
-                                     "frame from " MAC_FMT
-                                     " (drop_unencrypted=1)\n",
-                                     hdr->addr2[0], hdr->addr2[1],
-                                     hdr->addr2[2], hdr->addr2[3],
-                                     hdr->addr2[4], hdr->addr2[5]);
+                                     "frame from %pM (drop_unencrypted=1)\n",
+                                     hdr->addr2);
                 goto rx_dropped;
         }
 
@@ -1144,6 +1122,7 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
                                       *info_element, u16 length,
                                       struct ieee80211_network *network)
 {
+        DECLARE_SSID_BUF(ssid);
         u8 i;
 #ifdef CONFIG_IEEE80211_DEBUG
         char rates_str[64];
@@ -1166,12 +1145,6 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
 
                 switch (info_element->id) {
                 case MFIE_TYPE_SSID:
-                        if (ieee80211_is_empty_essid(info_element->data,
-                                                     info_element->len)) {
-                                network->flags |= NETWORK_EMPTY_ESSID;
-                                break;
-                        }
-
                         network->ssid_len = min(info_element->len,
                                                 (u8) IW_ESSID_MAX_SIZE);
                         memcpy(network->ssid, info_element->data,
@@ -1181,7 +1154,9 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
                                        IW_ESSID_MAX_SIZE - network->ssid_len);
 
                         IEEE80211_DEBUG_MGMT("MFIE_TYPE_SSID: '%s' len=%d.\n",
-                                             network->ssid, network->ssid_len);
+                                             print_ssid(ssid, network->ssid,
+                                                        network->ssid_len),
+                                             network->ssid_len);
                         break;
 
                 case MFIE_TYPE_RATES:
@@ -1411,9 +1386,6 @@ static int ieee80211_handle_assoc_resp(struct ieee80211_device *ieee, struct iee
                         network->mode |= IEEE_B;
         }
 
-        if (ieee80211_is_empty_essid(network->ssid, network->ssid_len))
-                network->flags |= NETWORK_EMPTY_ESSID;
-
         memcpy(&network->stats, stats, sizeof(network->stats));
 
         if (ieee->handle_assoc_response != NULL)
@@ -1429,7 +1401,7 @@ static int ieee80211_network_init(struct ieee80211_device *ieee, struct ieee8021
                                          struct ieee80211_network *network,
                                          struct ieee80211_rx_stats *stats)
 {
-        DECLARE_MAC_BUF(mac);
+        DECLARE_SSID_BUF(ssid);
 
         network->qos_data.active = 0;
         network->qos_data.supported = 0;
@@ -1477,17 +1449,14 @@ static int ieee80211_network_init(struct ieee80211_device *ieee, struct ieee8021
         }
 
         if (network->mode == 0) {
-                IEEE80211_DEBUG_SCAN("Filtered out '%s (%s)' "
+                IEEE80211_DEBUG_SCAN("Filtered out '%s (%pM)' "
                                      "network.\n",
-                                     escape_essid(network->ssid,
-                                                  network->ssid_len),
-                                     print_mac(mac, network->bssid));
+                                     print_ssid(ssid, network->ssid,
+                                                 network->ssid_len),
+                                     network->bssid);
                 return 1;
         }
 
-        if (ieee80211_is_empty_essid(network->ssid, network->ssid_len))
-                network->flags |= NETWORK_EMPTY_ESSID;
-
         memcpy(&network->stats, stats, sizeof(network->stats));
 
         return 0;
@@ -1510,7 +1479,6 @@ static void update_network(struct ieee80211_network *dst,
 {
         int qos_active;
         u8 old_param;
-        DECLARE_MAC_BUF(mac);
 
         ieee80211_network_reset(dst);
         dst->ibss_dfs = src->ibss_dfs;
@@ -1524,8 +1492,8 @@ static void update_network(struct ieee80211_network *dst,
                 memcpy(&dst->stats, &src->stats,
                        sizeof(struct ieee80211_rx_stats));
         else
-                IEEE80211_DEBUG_SCAN("Network %s info received "
-                        "off channel (%d vs. %d)\n", print_mac(mac, src->bssid),
+                IEEE80211_DEBUG_SCAN("Network %pM info received "
+                        "off channel (%d vs. %d)\n", src->bssid,
                         dst->channel, src->stats.received_channel);
 
         dst->capability = src->capability;
@@ -1597,12 +1565,12 @@ static void ieee80211_process_probe_response(struct ieee80211_device
         struct ieee80211_info_element *info_element = beacon->info_element;
 #endif
         unsigned long flags;
-        DECLARE_MAC_BUF(mac);
+        DECLARE_SSID_BUF(ssid);
 
-        IEEE80211_DEBUG_SCAN("'%s' (%s"
+        IEEE80211_DEBUG_SCAN("'%s' (%pM"
                      "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
-                     escape_essid(info_element->data, info_element->len),
-                     print_mac(mac, beacon->header.addr3),
+                     print_ssid(ssid, info_element->data, info_element->len),
+                     beacon->header.addr3,
                      (beacon->capability & cpu_to_le16(1 << 0xf)) ? '1' : '0',
                      (beacon->capability & cpu_to_le16(1 << 0xe)) ? '1' : '0',
                      (beacon->capability & cpu_to_le16(1 << 0xd)) ? '1' : '0',
@@ -1621,10 +1589,10 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                      (beacon->capability & cpu_to_le16(1 << 0x0)) ? '1' : '0');
 
         if (ieee80211_network_init(ieee, beacon, &network, stats)) {
-                IEEE80211_DEBUG_SCAN("Dropped '%s' (%s) via %s.\n",
-                                     escape_essid(info_element->data,
-                                                  info_element->len),
-                                     print_mac(mac, beacon->header.addr3),
+                IEEE80211_DEBUG_SCAN("Dropped '%s' (%pM) via %s.\n",
+                                     print_ssid(ssid, info_element->data,
+                                                 info_element->len),
+                                     beacon->header.addr3,
                                      is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
                 return;
@@ -1658,11 +1626,11 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                         /* If there are no more slots, expire the oldest */
                         list_del(&oldest->list);
                         target = oldest;
-                        IEEE80211_DEBUG_SCAN("Expired '%s' (%s) from "
+                        IEEE80211_DEBUG_SCAN("Expired '%s' (%pM) from "
                                              "network list.\n",
-                                             escape_essid(target->ssid,
-                                                          target->ssid_len),
-                                             print_mac(mac, target->bssid));
+                                             print_ssid(ssid, target->ssid,
+                                                         target->ssid_len),
+                                             target->bssid);
                         ieee80211_network_reset(target);
                 } else {
                         /* Otherwise just pull from the free list */
@@ -1672,10 +1640,10 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                 }
 
 #ifdef CONFIG_IEEE80211_DEBUG
-                IEEE80211_DEBUG_SCAN("Adding '%s' (%s) via %s.\n",
-                                     escape_essid(network.ssid,
-                                                  network.ssid_len),
-                                     print_mac(mac, network.bssid),
+                IEEE80211_DEBUG_SCAN("Adding '%s' (%pM) via %s.\n",
+                                     print_ssid(ssid, network.ssid,
+                                                 network.ssid_len),
+                                     network.bssid,
                                      is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
 #endif
@@ -1683,10 +1651,10 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                 network.ibss_dfs = NULL;
                 list_add_tail(&target->list, &ieee->network_list);
         } else {
-                IEEE80211_DEBUG_SCAN("Updating '%s' (%s) via %s.\n",
-                                     escape_essid(target->ssid,
-                                                  target->ssid_len),
-                                     print_mac(mac, target->bssid),
+                IEEE80211_DEBUG_SCAN("Updating '%s' (%pM) via %s.\n",
+                                     print_ssid(ssid, target->ssid,
+                                                 target->ssid_len),
+                                     target->bssid,
                                      is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
                 update_network(target, &network);
diff --git a/net/ieee80211/ieee80211_wx.c b/net/ieee80211/ieee80211_wx.c
index 973832dd7faf..7cc4e5ee3660 100644
--- a/net/ieee80211/ieee80211_wx.c
+++ b/net/ieee80211/ieee80211_wx.c
@@ -34,6 +34,7 @@
 #include <linux/module.h>
 #include <linux/jiffies.h>
 
+#include <net/lib80211.h>
 #include <net/ieee80211.h>
 #include <linux/wireless.h>
 
@@ -65,15 +66,9 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         /* Add the ESSID */
         iwe.cmd = SIOCGIWESSID;
         iwe.u.data.flags = 1;
-        if (network->flags & NETWORK_EMPTY_ESSID) {
-                iwe.u.data.length = sizeof("<hidden>");
-                start = iwe_stream_add_point(info, start, stop,
-                                             &iwe, "<hidden>");
-        } else {
-                iwe.u.data.length = min(network->ssid_len, (u8) 32);
-                start = iwe_stream_add_point(info, start, stop,
-                                             &iwe, network->ssid);
-        }
+        iwe.u.data.length = min(network->ssid_len, (u8) 32);
+        start = iwe_stream_add_point(info, start, stop,
+                                     &iwe, network->ssid);
 
         /* Add the protocol name */
         iwe.cmd = SIOCGIWNAME;
@@ -264,7 +259,7 @@ int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
         char *ev = extra;
         char *stop = ev + wrqu->data.length;
         int i = 0;
-        DECLARE_MAC_BUF(mac);
+        DECLARE_SSID_BUF(ssid);
 
         IEEE80211_DEBUG_WX("Getting scan\n");
 
@@ -283,10 +278,10 @@ int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
                                                       info);
                 else
                         IEEE80211_DEBUG_SCAN("Not showing network '%s ("
-                                             "%s)' due to age (%dms).\n",
-                                             escape_essid(network->ssid,
-                                                          network->ssid_len),
-                                             print_mac(mac, network->bssid),
+                                             "%pM)' due to age (%dms).\n",
+                                             print_ssid(ssid, network->ssid,
+                                                         network->ssid_len),
+                                             network->bssid,
                                              jiffies_to_msecs(jiffies -
                                                               network->
                                                               last_scanned));
@@ -314,6 +309,7 @@ int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
         int i, key, key_provided, len;
         struct ieee80211_crypt_data **crypt;
         int host_crypto = ieee->host_encrypt || ieee->host_decrypt || ieee->host_build_iv;
+        DECLARE_SSID_BUF(ssid);
 
         IEEE80211_DEBUG_WX("SET_ENCODE\n");
 
@@ -403,13 +399,17 @@ int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
 
         /* If a new key was provided, set it up */
         if (erq->length > 0) {
+#ifdef CONFIG_IEEE80211_DEBUG
+                DECLARE_SSID_BUF(ssid);
+#endif
+
                 len = erq->length <= 5 ? 5 : 13;
                 memcpy(sec.keys[key], keybuf, erq->length);
                 if (len > erq->length)
                         memset(sec.keys[key] + erq->length, 0,
                                len - erq->length);
                 IEEE80211_DEBUG_WX("Setting key %d to '%s' (%d:%d bytes)\n",
-                                   key, escape_essid(sec.keys[key], len),
+                                   key, print_ssid(ssid, sec.keys[key], len),
                                    erq->length, len);
                 sec.key_sizes[key] = len;
                 if (*crypt)
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1aa2dc9e380e..b1462e8c64cf 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1070,11 +1070,8 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                 return 0;
 
         if (sysctl_ip_dynaddr > 1) {
-                printk(KERN_INFO "%s(): shifting inet->"
-                                 "saddr from " NIPQUAD_FMT " to " NIPQUAD_FMT "\n",
-                       __func__,
-                       NIPQUAD(old_saddr),
-                       NIPQUAD(new_saddr));
+                printk(KERN_INFO "%s(): shifting inet->saddr from %pI4 to %pI4\n",
+                       __func__, &old_saddr, &new_saddr);
         }
 
         inet->saddr = inet->rcv_saddr = new_saddr;
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 8219b7e0968d..3f205181712d 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -201,8 +201,8 @@ out:
 
 static void ah4_err(struct sk_buff *skb, u32 info)
 {
-        struct iphdr *iph = (struct iphdr*)skb->data;
-        struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+(iph->ihl<<2));
+        struct iphdr *iph = (struct iphdr *)skb->data;
+        struct ip_auth_hdr *ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
         struct xfrm_state *x;
 
         if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH ||
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 1a9dd66511fc..29a74c01d8de 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -506,7 +506,7 @@ int arp_bind_neighbour(struct dst_entry *dst)
         if (dev == NULL)
                 return -EINVAL;
         if (n == NULL) {
-                __be32 nexthop = ((struct rtable*)dst)->rt_gateway;
+                __be32 nexthop = ((struct rtable *)dst)->rt_gateway;
                 if (dev->flags&(IFF_LOOPBACK|IFF_POINTOPOINT))
                         nexthop = 0;
                 n = __neigh_lookup_errno(
@@ -640,14 +640,14 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
         arp_ptr=(unsigned char *)(arp+1);
 
         memcpy(arp_ptr, src_hw, dev->addr_len);
-        arp_ptr+=dev->addr_len;
-        memcpy(arp_ptr, &src_ip,4);
-        arp_ptr+=4;
+        arp_ptr += dev->addr_len;
+        memcpy(arp_ptr, &src_ip, 4);
+        arp_ptr += 4;
         if (target_hw != NULL)
                 memcpy(arp_ptr, target_hw, dev->addr_len);
         else
                 memset(arp_ptr, 0, dev->addr_len);
-        arp_ptr+=dev->addr_len;
+        arp_ptr += dev->addr_len;
         memcpy(arp_ptr, &dest_ip, 4);
 
         return skb;
@@ -818,18 +818,18 @@ static int arp_process(struct sk_buff *skb)
                 addr_type = rt->rt_type;
 
                 if (addr_type == RTN_LOCAL) {
-                        n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
-                        if (n) {
-                                int dont_send = 0;
-
-                                if (!dont_send)
-                                        dont_send |= arp_ignore(in_dev,sip,tip);
-                                if (!dont_send && IN_DEV_ARPFILTER(in_dev))
-                                        dont_send |= arp_filter(sip,tip,dev);
-                                if (!dont_send)
-                                        arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
+                        int dont_send = 0;
 
-                                neigh_release(n);
+                        if (!dont_send)
+                                dont_send |= arp_ignore(in_dev,sip,tip);
+                        if (!dont_send && IN_DEV_ARPFILTER(in_dev))
+                                dont_send |= arp_filter(sip,tip,dev);
+                        if (!dont_send) {
+                                n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
+                                if (n) {
+                                        arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
+                                        neigh_release(n);
+                                }
                         }
                         goto out;
                 } else if (IN_DEV_FORWARD(in_dev)) {
@@ -1308,7 +1308,7 @@ static void arp_format_neigh_entry(struct seq_file *seq,
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
         }
 #endif
-        sprintf(tbuf, NIPQUAD_FMT, NIPQUAD(*(u32*)n->primary_key));
+        sprintf(tbuf, "%pI4", n->primary_key);
         seq_printf(seq, "%-16s 0x%-10x0x%-10x%s     *        %s\n",
                    tbuf, hatype, arp_state_to_flags(n), hbuffer, dev->name);
         read_unlock(&n->lock);
@@ -1321,7 +1321,7 @@ static void arp_format_pneigh_entry(struct seq_file *seq,
         int hatype = dev ? dev->type : 0;
         char tbuf[16];
 
-        sprintf(tbuf, NIPQUAD_FMT, NIPQUAD(*(u32*)n->key));
+        sprintf(tbuf, "%pI4", n->key);
         seq_printf(seq, "%-16s 0x%-10x0x%-10x%s     *        %s\n",
                    tbuf, hatype, ATF_PUBL | ATF_PERM, "00:00:00:00:00:00",
                    dev ? dev->name : "*");
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 2e78f6bd9775..e52799047a5f 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -490,7 +490,6 @@ int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
         }
 
         atomic_set(&doi_def->refcount, 1);
-        INIT_RCU_HEAD(&doi_def->rcu);
 
         spin_lock(&cipso_v4_doi_list_lock);
         if (cipso_v4_doi_search(doi_def->doi) != NULL)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 56fce3ab6c55..309997edc8a5 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -112,13 +112,7 @@ static inline void devinet_sysctl_unregister(struct in_device *idev)
 
 static struct in_ifaddr *inet_alloc_ifa(void)
 {
-        struct in_ifaddr *ifa = kzalloc(sizeof(*ifa), GFP_KERNEL);
-
-        if (ifa) {
-                INIT_RCU_HEAD(&ifa->rcu_head);
-        }
-
-        return ifa;
+        return kzalloc(sizeof(struct in_ifaddr), GFP_KERNEL);
 }
 
 static void inet_rcu_free_ifa(struct rcu_head *head)
@@ -161,7 +155,6 @@ static struct in_device *inetdev_init(struct net_device *dev)
         in_dev = kzalloc(sizeof(*in_dev), GFP_KERNEL);
         if (!in_dev)
                 goto out;
-        INIT_RCU_HEAD(&in_dev->rcu_head);
         memcpy(&in_dev->cnf, dev_net(dev)->ipv4.devconf_dflt,
                         sizeof(in_dev->cnf));
         in_dev->cnf.sysctl = NULL;
@@ -1108,7 +1101,7 @@ out:
 }
 
 static struct notifier_block ip_netdev_notifier = {
-        .notifier_call =inetdev_event,
+        .notifier_call = inetdev_event,
 };
 
 static inline size_t inet_nlmsg_size(void)
@@ -1195,7 +1188,7 @@ done:
         return skb->len;
 }
 
-static void rtmsg_ifa(int event, struct in_ifaddr* ifa, struct nlmsghdr *nlh,
+static void rtmsg_ifa(int event, struct in_ifaddr *ifa, struct nlmsghdr *nlh,
                       u32 pid)
 {
         struct sk_buff *skb;
@@ -1262,7 +1255,7 @@ static void inet_forward_change(struct net *net)
 }
 
 static int devinet_conf_proc(ctl_table *ctl, int write,
-                             struct file* filp, void __user *buffer,
+                             struct file *filp, void __user *buffer,
                              size_t *lenp, loff_t *ppos)
 {
         int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
@@ -1334,7 +1327,7 @@ static int devinet_conf_sysctl(ctl_table *table,
 }
 
 static int devinet_sysctl_forward(ctl_table *ctl, int write,
-                                  struct file* filp, void __user *buffer,
+                                  struct file *filp, void __user *buffer,
                                   size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
@@ -1363,7 +1356,7 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
 }
 
 int ipv4_doint_and_flush(ctl_table *ctl, int write,
-                         struct file* filp, void __user *buffer,
+                         struct file *filp, void __user *buffer,
                          size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 21515d4c49eb..95a9c65003f8 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -413,8 +413,8 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
 
 static void esp4_err(struct sk_buff *skb, u32 info)
 {
-        struct iphdr *iph = (struct iphdr*)skb->data;
-        struct ip_esp_hdr *esph = (struct ip_esp_hdr*)(skb->data+(iph->ihl<<2));
+        struct iphdr *iph = (struct iphdr *)skb->data;
+        struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
         struct xfrm_state *x;
 
         if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH ||
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 65c1503f8cc8..741e4fa3e474 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -578,7 +578,7 @@ errout:
         return err;
 }
 
-static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
+static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
         struct net *net = sock_net(skb->sk);
         struct fib_config cfg;
@@ -600,7 +600,7 @@ errout:
         return err;
 }
 
-static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
+static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
         struct net *net = sock_net(skb->sk);
         struct fib_config cfg;
@@ -903,7 +903,7 @@ static void fib_disable_ip(struct net_device *dev, int force)
 
 static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct in_ifaddr *ifa = (struct in_ifaddr*)ptr;
+        struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
         struct net_device *dev = ifa->ifa_dev->dev;
 
         switch (event) {
@@ -964,11 +964,11 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
 }
 
 static struct notifier_block fib_inetaddr_notifier = {
-        .notifier_call =fib_inetaddr_event,
+        .notifier_call = fib_inetaddr_event,
 };
 
 static struct notifier_block fib_netdev_notifier = {
-        .notifier_call =fib_netdev_event,
+        .notifier_call = fib_netdev_event,
 };
 
 static int __net_init ip_fib_net_init(struct net *net)
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index c8cac6c7f881..ded8c44fb848 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -247,7 +247,7 @@ fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 {
         int err;
         struct fn_zone *fz;
-        struct fn_hash *t = (struct fn_hash*)tb->tb_data;
+        struct fn_hash *t = (struct fn_hash *)tb->tb_data;
 
         read_lock(&fib_hash_lock);
         for (fz = t->fn_zone_list; fz; fz = fz->fz_next) {
@@ -283,7 +283,7 @@ fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
         struct fib_node *f;
         struct fib_info *fi = NULL;
         struct fib_info *last_resort;
-        struct fn_hash *t = (struct fn_hash*)tb->tb_data;
+        struct fn_hash *t = (struct fn_hash *)tb->tb_data;
         struct fn_zone *fz = t->fn_zones[0];
 
         if (fz == NULL)
@@ -548,7 +548,7 @@ out:
 
 static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
 {
-        struct fn_hash *table = (struct fn_hash*)tb->tb_data;
+        struct fn_hash *table = (struct fn_hash *)tb->tb_data;
         struct fib_node *f;
         struct fib_alias *fa, *fa_to_delete;
         struct fn_zone *fz;
@@ -748,7 +748,7 @@ static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlin
 {
         int m, s_m;
         struct fn_zone *fz;
-        struct fn_hash *table = (struct fn_hash*)tb->tb_data;
+        struct fn_hash *table = (struct fn_hash *)tb->tb_data;
 
         s_m = cb->args[2];
         read_lock(&fib_hash_lock);
@@ -845,10 +845,10 @@ static struct fib_alias *fib_get_first(struct seq_file *seq)
                         struct hlist_node *node;
                         struct fib_node *fn;
 
-                        hlist_for_each_entry(fn,node,iter->hash_head,fn_hash) {
+                        hlist_for_each_entry(fn, node, iter->hash_head, fn_hash) {
                                 struct fib_alias *fa;
 
-                                list_for_each_entry(fa,&fn->fn_alias,fa_list) {
+                                list_for_each_entry(fa, &fn->fn_alias, fa_list) {
                                         iter->fn = fn;
                                         iter->fa = fa;
                                         goto out;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index ded2ae34eab1..4817dea3bc73 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -63,16 +63,16 @@ static DEFINE_SPINLOCK(fib_multipath_lock);
 for (nhsel=0, nh = (fi)->fib_nh; nhsel < (fi)->fib_nhs; nh++, nhsel++)
 
 #define change_nexthops(fi) { int nhsel; struct fib_nh * nh; \
-for (nhsel=0, nh = (struct fib_nh*)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++, nhsel++)
+for (nhsel=0, nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++, nhsel++)
 
 #else /* CONFIG_IP_ROUTE_MULTIPATH */
 
 /* Hope, that gcc will optimize it to get rid of dummy loop */
 
-#define for_nexthops(fi) { int nhsel=0; const struct fib_nh * nh = (fi)->fib_nh; \
+#define for_nexthops(fi) { int nhsel = 0; const struct fib_nh * nh = (fi)->fib_nh; \
 for (nhsel=0; nhsel < 1; nhsel++)
 
-#define change_nexthops(fi) { int nhsel=0; struct fib_nh * nh = (struct fib_nh*)((fi)->fib_nh); \
+#define change_nexthops(fi) { int nhsel = 0; struct fib_nh * nh = (struct fib_nh *)((fi)->fib_nh); \
 for (nhsel=0; nhsel < 1; nhsel++)
 
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
@@ -358,7 +358,7 @@ int fib_detect_death(struct fib_info *fi, int order,
                 state = n->nud_state;
                 neigh_release(n);
         }
-        if (state==NUD_REACHABLE)
+        if (state == NUD_REACHABLE)
                 return 0;
         if ((state&NUD_VALID) && order != dflt)
                 return 0;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 5cb72786a8af..ec0ae490f0b6 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2399,8 +2399,8 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
                 __be32 prf = htonl(mask_pfx(tn->key, tn->pos));
 
                 seq_indent(seq, iter->depth-1);
-                seq_printf(seq, "  +-- " NIPQUAD_FMT "/%d %d %d %d\n",
-                           NIPQUAD(prf), tn->pos, tn->bits, tn->full_children,
+                seq_printf(seq, "  +-- %pI4/%d %d %d %d\n",
+                           &prf, tn->pos, tn->bits, tn->full_children,
                            tn->empty_children);
 
         } else {
@@ -2410,7 +2410,7 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
                 __be32 val = htonl(l->key);
 
                 seq_indent(seq, iter->depth);
-                seq_printf(seq, "  |-- " NIPQUAD_FMT "\n", NIPQUAD(val));
+                seq_printf(seq, "  |-- %pI4\n", &val);
 
                 hlist_for_each_entry_rcu(li, node, &l->list, hlist) {
                         struct fib_alias *fa;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 72b2de76f1cd..21e497efbd7f 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -683,10 +683,8 @@ static void icmp_unreach(struct sk_buff *skb)
                         break;
                 case ICMP_FRAG_NEEDED:
                         if (ipv4_config.no_pmtu_disc) {
-                                LIMIT_NETDEBUG(KERN_INFO "ICMP: " NIPQUAD_FMT ": "
-                                                         "fragmentation needed "
-                                                         "and DF set.\n",
-                                               NIPQUAD(iph->daddr));
+                                LIMIT_NETDEBUG(KERN_INFO "ICMP: %pI4: fragmentation needed and DF set.\n",
+                                               &iph->daddr);
                         } else {
                                 info = ip_rt_frag_needed(net, iph,
                                                          ntohs(icmph->un.frag.mtu),
@@ -696,9 +694,8 @@ static void icmp_unreach(struct sk_buff *skb)
                         }
                         break;
                 case ICMP_SR_FAILED:
-                        LIMIT_NETDEBUG(KERN_INFO "ICMP: " NIPQUAD_FMT ": Source "
-                                                 "Route Failed.\n",
-                                       NIPQUAD(iph->daddr));
+                        LIMIT_NETDEBUG(KERN_INFO "ICMP: %pI4: Source Route Failed.\n",
+                                       &iph->daddr);
                         break;
                 default:
                         break;
@@ -729,12 +726,12 @@ static void icmp_unreach(struct sk_buff *skb)
         if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses &&
             inet_addr_type(net, iph->daddr) == RTN_BROADCAST) {
                 if (net_ratelimit())
-                        printk(KERN_WARNING NIPQUAD_FMT " sent an invalid ICMP "
+                        printk(KERN_WARNING "%pI4 sent an invalid ICMP "
                                             "type %u, code %u "
-                                            "error to a broadcast: " NIPQUAD_FMT " on %s\n",
-                               NIPQUAD(ip_hdr(skb)->saddr),
+                                            "error to a broadcast: %pI4 on %s\n",
+                               &ip_hdr(skb)->saddr,
                                icmph->type, icmph->code,
-                               NIPQUAD(iph->daddr),
+                               &iph->daddr,
                                skb->dev->name);
                 goto out;
         }
@@ -952,9 +949,8 @@ static void icmp_address_reply(struct sk_buff *skb)
                                 break;
                 }
                 if (!ifa && net_ratelimit()) {
-                        printk(KERN_INFO "Wrong address mask " NIPQUAD_FMT " from "
-                                         "%s/" NIPQUAD_FMT "\n",
-                               NIPQUAD(*mp), dev->name, NIPQUAD(rt->rt_src));
+                        printk(KERN_INFO "Wrong address mask %pI4 from %s/%pI4\n",
+                               mp, dev->name, &rt->rt_src);
                 }
         }
         rcu_read_unlock();
@@ -976,9 +972,10 @@ int icmp_rcv(struct sk_buff *skb)
         struct net *net = dev_net(rt->u.dst.dev);
 
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+                struct sec_path *sp = skb_sec_path(skb);
                 int nh;
 
-                if (!(skb->sp && skb->sp->xvec[skb->sp->len - 1]->props.flags &
+                if (!(sp && sp->xvec[sp->len - 1]->props.flags &
                                  XFRM_STATE_ICMP))
                         goto drop;
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index a0d86455c53e..f92733e15c9f 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -167,7 +167,7 @@ static __inline__ void igmp_stop_timer(struct ip_mc_list *im)
         spin_lock_bh(&im->lock);
         if (del_timer(&im->timer))
                 atomic_dec(&im->refcnt);
-        im->tm_running=0;
+        im->tm_running = 0;
         im->reporter = 0;
         im->unsolicit_count = 0;
         spin_unlock_bh(&im->lock);
@@ -176,9 +176,9 @@ static __inline__ void igmp_stop_timer(struct ip_mc_list *im)
 /* It must be called with locked im->lock */
 static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
 {
-        int tv=net_random() % max_delay;
+        int tv = net_random() % max_delay;
 
-        im->tm_running=1;
+        im->tm_running = 1;
         if (!mod_timer(&im->timer, jiffies+tv+2))
                 atomic_inc(&im->refcnt);
 }
@@ -207,7 +207,7 @@ static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)
         if (del_timer(&im->timer)) {
                 if ((long)(im->timer.expires-jiffies) < max_delay) {
                         add_timer(&im->timer);
-                        im->tm_running=1;
+                        im->tm_running = 1;
                         spin_unlock_bh(&im->lock);
                         return;
                 }
@@ -358,7 +358,7 @@ static int igmpv3_sendpack(struct sk_buff *skb)
 
 static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)
 {
-        return sizeof(struct igmpv3_grec) + 4*igmp_scount(pmc,type,gdel,sdel);
+        return sizeof(struct igmpv3_grec) + 4*igmp_scount(pmc, type, gdel, sdel);
 }
 
 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
@@ -653,7 +653,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
                 return -1;
         }
 
-        skb=alloc_skb(IGMP_SIZE+LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
+        skb = alloc_skb(IGMP_SIZE+LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
         if (skb == NULL) {
                 ip_rt_put(rt);
                 return -1;
@@ -682,11 +682,11 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         ((u8*)&iph[1])[3] = 0;
 
         ih = (struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
-        ih->type=type;
-        ih->code=0;
-        ih->csum=0;
-        ih->group=group;
-        ih->csum=ip_compute_csum((void *)ih, sizeof(struct igmphdr));
+        ih->type = type;
+        ih->code = 0;
+        ih->csum = 0;
+        ih->group = group;
+        ih->csum = ip_compute_csum((void *)ih, sizeof(struct igmphdr));
 
         return ip_local_out(skb);
 }
@@ -728,7 +728,7 @@ static void igmp_timer_expire(unsigned long data)
         struct in_device *in_dev = im->interface;
 
         spin_lock(&im->lock);
-        im->tm_running=0;
+        im->tm_running = 0;
 
         if (im->unsolicit_count) {
                 im->unsolicit_count--;
@@ -997,7 +997,7 @@ static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
            --ANK
            */
         if (arp_mc_map(addr, buf, dev, 0) == 0)
-                dev_mc_add(dev,buf,dev->addr_len,0);
+                dev_mc_add(dev, buf, dev->addr_len, 0);
 }
 
 /*
@@ -1010,7 +1010,7 @@ static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
         struct net_device *dev = in_dev->dev;
 
         if (arp_mc_map(addr, buf, dev, 0) == 0)
-                dev_mc_delete(dev,buf,dev->addr_len,0);
+                dev_mc_delete(dev, buf, dev->addr_len, 0);
 }
 
 #ifdef CONFIG_IP_MULTICAST
@@ -1210,10 +1210,10 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         if (!im)
                 goto out;
 
-        im->users=1;
-        im->interface=in_dev;
+        im->users = 1;
+        im->interface = in_dev;
         in_dev_hold(in_dev);
-        im->multiaddr=addr;
+        im->multiaddr = addr;
         /* initial mode is (EX, empty) */
         im->sfmode = MCAST_EXCLUDE;
         im->sfcount[MCAST_INCLUDE] = 0;
@@ -1224,7 +1224,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         atomic_set(&im->refcnt, 1);
         spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
-        im->tm_running=0;
+        im->tm_running = 0;
         setup_timer(&im->timer, &igmp_timer_expire, (unsigned long)im);
         im->unsolicit_count = IGMP_Unsolicited_Report_Count;
         im->reporter = 0;
@@ -1232,8 +1232,8 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 #endif
         im->loaded = 0;
         write_lock_bh(&in_dev->mc_list_lock);
-        im->next=in_dev->mc_list;
-        in_dev->mc_list=im;
+        im->next = in_dev->mc_list;
+        in_dev->mc_list = im;
         in_dev->mc_count++;
         write_unlock_bh(&in_dev->mc_list_lock);
 #ifdef CONFIG_IP_MULTICAST
@@ -1279,7 +1279,7 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
         ASSERT_RTNL();
 
         for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
-                if (i->multiaddr==addr) {
+                if (i->multiaddr == addr) {
                         if (--i->users == 0) {
                                 write_lock_bh(&in_dev->mc_list_lock);
                                 *ip = i->next;
@@ -1738,7 +1738,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
 {
         int err;
         __be32 addr = imr->imr_multiaddr.s_addr;
-        struct ip_mc_socklist *iml=NULL, *i;
+        struct ip_mc_socklist *iml = NULL, *i;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
         struct net *net = sock_net(sk);
@@ -1769,7 +1769,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
         err = -ENOBUFS;
         if (count >= sysctl_igmp_max_memberships)
                 goto done;
-        iml = sock_kmalloc(sk,sizeof(*iml),GFP_KERNEL);
+        iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
         if (iml == NULL)
                 goto done;
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index bd1278a2d828..05af807ca9b9 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -109,7 +109,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
-                                if (tb->ib_net == net && tb->port == rover)
+                                if (ib_net(tb) == net && tb->port == rover)
                                         goto next;
                         break;
                 next:
@@ -137,7 +137,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
                                 hashinfo->bhash_size)];
                 spin_lock(&head->lock);
                 inet_bind_bucket_for_each(tb, node, &head->chain)
-                        if (tb->ib_net == net && tb->port == snum)
+                        if (ib_net(tb) == net && tb->port == snum)
                                 goto tb_found;
         }
         tb = NULL;
@@ -323,7 +323,7 @@ void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long len)
 
 EXPORT_SYMBOL(inet_csk_reset_keepalive_timer);
 
-struct dst_entry* inet_csk_route_req(struct sock *sk,
+struct dst_entry *inet_csk_route_req(struct sock *sk,
                                      const struct request_sock *req)
 {
         struct rtable *rt;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 564230dabcb8..1cb154ed75ad 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -718,13 +718,15 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                 if (!(r->idiag_states & (TCPF_LISTEN | TCPF_SYN_RECV)))
                         goto skip_listen_ht;
 
-                inet_listen_lock(hashinfo);
                 for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
                         struct sock *sk;
                         struct hlist_node *node;
+                        struct inet_listen_hashbucket *ilb;
 
                         num = 0;
-                        sk_for_each(sk, node, &hashinfo->listening_hash[i]) {
+                        ilb = &hashinfo->listening_hash[i];
+                        spin_lock_bh(&ilb->lock);
+                        sk_for_each(sk, node, &ilb->head) {
                                 struct inet_sock *inet = inet_sk(sk);
 
                                 if (num < s_num) {
@@ -742,7 +744,7 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                         goto syn_recv;
 
                                 if (inet_csk_diag_dump(sk, skb, cb) < 0) {
-                                        inet_listen_unlock(hashinfo);
+                                        spin_unlock_bh(&ilb->lock);
                                         goto done;
                                 }
 
@@ -751,7 +753,7 @@ syn_recv:
                                         goto next_listen;
 
                                 if (inet_diag_dump_reqs(skb, sk, cb) < 0) {
-                                        inet_listen_unlock(hashinfo);
+                                        spin_unlock_bh(&ilb->lock);
                                         goto done;
                                 }
 
@@ -760,12 +762,12 @@ next_listen:
                                 cb->args[4] = 0;
                                 ++num;
                         }
+                        spin_unlock_bh(&ilb->lock);
 
                         s_num = 0;
                         cb->args[3] = 0;
                         cb->args[4] = 0;
                 }
-                inet_listen_unlock(hashinfo);
 skip_listen_ht:
                 cb->args[0] = 1;
                 s_i = num = s_num = 0;
@@ -778,18 +780,19 @@ skip_listen_ht:
                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
                 rwlock_t *lock = inet_ehash_lockp(hashinfo, i);
                 struct sock *sk;
-                struct hlist_node *node;
+                struct hlist_nulls_node *node;
 
                 num = 0;
 
-                if (hlist_empty(&head->chain) && hlist_empty(&head->twchain))
+                if (hlist_nulls_empty(&head->chain) &&
+                        hlist_nulls_empty(&head->twchain))
                         continue;
 
                 if (i > s_i)
                         s_num = 0;
 
                 read_lock_bh(lock);
-                sk_for_each(sk, node, &head->chain) {
+                sk_nulls_for_each(sk, node, &head->chain) {
                         struct inet_sock *inet = inet_sk(sk);
 
                         if (num < s_num)
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 44981906fb91..377d004e5723 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -35,7 +35,7 @@ struct inet_bind_bucket *inet_bind_bucket_create(struct kmem_cache *cachep,
         struct inet_bind_bucket *tb = kmem_cache_alloc(cachep, GFP_ATOMIC);
 
         if (tb != NULL) {
-                tb->ib_net       = hold_net(net);
+                write_pnet(&tb->ib_net, hold_net(net));
                 tb->port      = snum;
                 tb->fastreuse = 0;
                 INIT_HLIST_HEAD(&tb->owners);
@@ -51,7 +51,7 @@ void inet_bind_bucket_destroy(struct kmem_cache *cachep, struct inet_bind_bucket
 {
         if (hlist_empty(&tb->owners)) {
                 __hlist_del(&tb->node);
-                release_net(tb->ib_net);
+                release_net(ib_net(tb));
                 kmem_cache_free(cachep, tb);
         }
 }
@@ -111,35 +111,6 @@ void __inet_inherit_port(struct sock *sk, struct sock *child)
 EXPORT_SYMBOL_GPL(__inet_inherit_port);
 
 /*
- * This lock without WQ_FLAG_EXCLUSIVE is good on UP and it can be very bad on SMP.
- * Look, when several writers sleep and reader wakes them up, all but one
- * immediately hit write lock and grab all the cpus. Exclusive sleep solves
- * this, _but_ remember, it adds useless work on UP machines (wake up each
- * exclusive lock release). It should be ifdefed really.
- */
-void inet_listen_wlock(struct inet_hashinfo *hashinfo)
-        __acquires(hashinfo->lhash_lock)
-{
-        write_lock(&hashinfo->lhash_lock);
-
-        if (atomic_read(&hashinfo->lhash_users)) {
-                DEFINE_WAIT(wait);
-
-                for (;;) {
-                        prepare_to_wait_exclusive(&hashinfo->lhash_wait,
-                                                  &wait, TASK_UNINTERRUPTIBLE);
-                        if (!atomic_read(&hashinfo->lhash_users))
-                                break;
-                        write_unlock_bh(&hashinfo->lhash_lock);
-                        schedule();
-                        write_lock_bh(&hashinfo->lhash_lock);
-                }
-
-                finish_wait(&hashinfo->lhash_wait, &wait);
-        }
-}
-
-/*
  * Don't inline this cruft. Here are some nice properties to exploit here. The
  * BSD API does not allow a listening sock to specify the remote port nor the
  * remote address for the connection. So always assume those are both
@@ -191,25 +162,25 @@ struct sock *__inet_lookup_listener(struct net *net,
                                     const int dif)
 {
         struct sock *sk = NULL;
-        const struct hlist_head *head;
+        struct inet_listen_hashbucket *ilb;
 
-        read_lock(&hashinfo->lhash_lock);
-        head = &hashinfo->listening_hash[inet_lhashfn(net, hnum)];
-        if (!hlist_empty(head)) {
-                const struct inet_sock *inet = inet_sk((sk = __sk_head(head)));
+        ilb = &hashinfo->listening_hash[inet_lhashfn(net, hnum)];
+        spin_lock(&ilb->lock);
+        if (!hlist_empty(&ilb->head)) {
+                const struct inet_sock *inet = inet_sk((sk = __sk_head(&ilb->head)));
 
                 if (inet->num == hnum && !sk->sk_node.next &&
                     (!inet->rcv_saddr || inet->rcv_saddr == daddr) &&
                     (sk->sk_family == PF_INET || !ipv6_only_sock(sk)) &&
                     !sk->sk_bound_dev_if && net_eq(sock_net(sk), net))
                         goto sherry_cache;
-                sk = inet_lookup_listener_slow(net, head, daddr, hnum, dif);
+                sk = inet_lookup_listener_slow(net, &ilb->head, daddr, hnum, dif);
         }
         if (sk) {
 sherry_cache:
                 sock_hold(sk);
         }
-        read_unlock(&hashinfo->lhash_lock);
+        spin_unlock(&ilb->lock);
         return sk;
 }
 EXPORT_SYMBOL_GPL(__inet_lookup_listener);
@@ -223,35 +194,65 @@ struct sock * __inet_lookup_established(struct net *net,
         INET_ADDR_COOKIE(acookie, saddr, daddr)
         const __portpair ports = INET_COMBINED_PORTS(sport, hnum);
         struct sock *sk;
-        const struct hlist_node *node;
+        const struct hlist_nulls_node *node;
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
         unsigned int hash = inet_ehashfn(net, daddr, hnum, saddr, sport);
-        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
-        rwlock_t *lock = inet_ehash_lockp(hashinfo, hash);
+        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
-        prefetch(head->chain.first);
-        read_lock(lock);
-        sk_for_each(sk, node, &head->chain) {
+        rcu_read_lock();
+begin:
+        sk_nulls_for_each_rcu(sk, node, &head->chain) {
                 if (INET_MATCH(sk, net, hash, acookie,
-                                        saddr, daddr, ports, dif))
-                        goto hit; /* You sunk my battleship! */
+                                        saddr, daddr, ports, dif)) {
+                        if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt)))
+                                goto begintw;
+                        if (unlikely(!INET_MATCH(sk, net, hash, acookie,
+                                saddr, daddr, ports, dif))) {
+                                sock_put(sk);
+                                goto begin;
+                        }
+                        goto out;
+                }
         }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot)
+                goto begin;
 
+begintw:
         /* Must check for a TIME_WAIT'er before going to listener hash. */
-        sk_for_each(sk, node, &head->twchain) {
+        sk_nulls_for_each_rcu(sk, node, &head->twchain) {
                 if (INET_TW_MATCH(sk, net, hash, acookie,
-                                        saddr, daddr, ports, dif))
-                        goto hit;
+                                        saddr, daddr, ports, dif)) {
+                        if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt))) {
+                                sk = NULL;
+                                goto out;
+                        }
+                        if (unlikely(!INET_TW_MATCH(sk, net, hash, acookie,
+                                 saddr, daddr, ports, dif))) {
+                                sock_put(sk);
+                                goto begintw;
+                        }
+                        goto out;
+                }
         }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot)
+                goto begintw;
         sk = NULL;
 out:
-        read_unlock(lock);
+        rcu_read_unlock();
         return sk;
-hit:
-        sock_hold(sk);
-        goto out;
 }
 EXPORT_SYMBOL_GPL(__inet_lookup_established);
 
@@ -272,14 +273,14 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         rwlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
-        const struct hlist_node *node;
+        const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
 
         prefetch(head->chain.first);
         write_lock(lock);
 
         /* Check TIME-WAIT sockets first. */
-        sk_for_each(sk2, node, &head->twchain) {
+        sk_nulls_for_each(sk2, node, &head->twchain) {
                 tw = inet_twsk(sk2);
 
                 if (INET_TW_MATCH(sk2, net, hash, acookie,
@@ -293,7 +294,7 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
         tw = NULL;
 
         /* And established part... */
-        sk_for_each(sk2, node, &head->chain) {
+        sk_nulls_for_each(sk2, node, &head->chain) {
                 if (INET_MATCH(sk2, net, hash, acookie,
                                         saddr, daddr, ports, dif))
                         goto not_unique;
@@ -306,7 +307,7 @@ unique:
         inet->sport = htons(lport);
         sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
-        __sk_add_node(sk, &head->chain);
+        __sk_nulls_add_node_rcu(sk, &head->chain);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         write_unlock(lock);
 
@@ -338,7 +339,7 @@ static inline u32 inet_sk_port_offset(const struct sock *sk)
 void __inet_hash_nolisten(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        struct hlist_head *list;
+        struct hlist_nulls_head *list;
         rwlock_t *lock;
         struct inet_ehash_bucket *head;
 
@@ -350,7 +351,7 @@ void __inet_hash_nolisten(struct sock *sk)
         lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
 
         write_lock(lock);
-        __sk_add_node(sk, list);
+        __sk_nulls_add_node_rcu(sk, list);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         write_unlock(lock);
 }
@@ -359,8 +360,7 @@ EXPORT_SYMBOL_GPL(__inet_hash_nolisten);
 static void __inet_hash(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        struct hlist_head *list;
-        rwlock_t *lock;
+        struct inet_listen_hashbucket *ilb;
 
         if (sk->sk_state != TCP_LISTEN) {
                 __inet_hash_nolisten(sk);
@@ -368,14 +368,12 @@ static void __inet_hash(struct sock *sk)
         }
 
         WARN_ON(!sk_unhashed(sk));
-        list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
-        lock = &hashinfo->lhash_lock;
+        ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
 
-        inet_listen_wlock(hashinfo);
-        __sk_add_node(sk, list);
+        spin_lock(&ilb->lock);
+        __sk_add_node(sk, &ilb->head);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-        write_unlock(lock);
-        wake_up(&hashinfo->lhash_wait);
+        spin_unlock(&ilb->lock);
 }
 
 void inet_hash(struct sock *sk)
@@ -390,27 +388,27 @@ EXPORT_SYMBOL_GPL(inet_hash);
 
 void inet_unhash(struct sock *sk)
 {
-        rwlock_t *lock;
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
 
         if (sk_unhashed(sk))
-                goto out;
+                return;
 
         if (sk->sk_state == TCP_LISTEN) {
-                local_bh_disable();
-                inet_listen_wlock(hashinfo);
-                lock = &hashinfo->lhash_lock;
+                struct inet_listen_hashbucket *ilb;
+
+                ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
+                spin_lock_bh(&ilb->lock);
+                if (__sk_del_node_init(sk))
+                        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+                spin_unlock_bh(&ilb->lock);
         } else {
-                lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
+                rwlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
+
                 write_lock_bh(lock);
+                if (__sk_nulls_del_node_init_rcu(sk))
+                        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+                write_unlock_bh(lock);
         }
-
-        if (__sk_del_node_init(sk))
-                sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
-        write_unlock_bh(lock);
-out:
-        if (sk->sk_state == TCP_LISTEN)
-                wake_up(&hashinfo->lhash_wait);
 }
 EXPORT_SYMBOL_GPL(inet_unhash);
 
@@ -449,7 +447,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          * unique enough.
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
-                                if (tb->ib_net == net && tb->port == port) {
+                                if (ib_net(tb) == net && tb->port == port) {
                                         WARN_ON(hlist_empty(&tb->owners));
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
@@ -524,3 +522,13 @@ int inet_hash_connect(struct inet_timewait_death_row *death_row,
 }
 
 EXPORT_SYMBOL_GPL(inet_hash_connect);
+
+void inet_hashinfo_init(struct inet_hashinfo *h)
+{
+        int i;
+
+        for (i = 0; i < INET_LHTABLE_SIZE; i++)
+                spin_lock_init(&h->listening_hash[i].lock);
+}
+
+EXPORT_SYMBOL_GPL(inet_hashinfo_init);
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index cfd034a2b96e..6a667dae315e 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -120,7 +120,7 @@ static void lro_update_tcp_ip_header(struct net_lro_desc *lro_desc)
         iph->check = ip_fast_csum((u8 *)lro_desc->iph, iph->ihl);
 
         tcph->check = 0;
-        tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), 0);
+        tcp_hdr_csum = csum_partial(tcph, TCP_HDR_LEN(tcph), 0);
         lro_desc->data_csum = csum_add(lro_desc->data_csum, tcp_hdr_csum);
         tcph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
                                         lro_desc->ip_tot_len -
@@ -135,7 +135,7 @@ static __wsum lro_tcp_data_csum(struct iphdr *iph, struct tcphdr *tcph, int len)
         __wsum tcp_ps_hdr_csum;
 
         tcp_csum = ~csum_unfold(tcph->check);
-        tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), tcp_csum);
+        tcp_hdr_csum = csum_partial(tcph, TCP_HDR_LEN(tcph), tcp_csum);
 
         tcp_ps_hdr_csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
                                              len + TCP_HDR_LEN(tcph),
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 1c5fd38f8824..60689951ecdb 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -23,12 +23,12 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
         rwlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
 
         write_lock(lock);
-        if (hlist_unhashed(&tw->tw_node)) {
+        if (hlist_nulls_unhashed(&tw->tw_node)) {
                 write_unlock(lock);
                 return;
         }
-        __hlist_del(&tw->tw_node);
-        sk_node_init(&tw->tw_node);
+        hlist_nulls_del_rcu(&tw->tw_node);
+        sk_nulls_node_init(&tw->tw_node);
         write_unlock(lock);
 
         /* Disassociate with bind bucket. */
@@ -92,13 +92,17 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
 
         write_lock(lock);
 
-        /* Step 2: Remove SK from established hash. */
-        if (__sk_del_node_init(sk))
-                sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
-
-        /* Step 3: Hash TW into TIMEWAIT chain. */
-        inet_twsk_add_node(tw, &ehead->twchain);
+        /*
+         * Step 2: Hash TW into TIMEWAIT chain.
+         * Should be done before removing sk from established chain
+         * because readers are lockless and search established first.
+         */
         atomic_inc(&tw->tw_refcnt);
+        inet_twsk_add_node_rcu(tw, &ehead->twchain);
+
+        /* Step 3: Remove SK from established hash. */
+        if (__sk_nulls_del_node_init_rcu(sk))
+                sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 
         write_unlock(lock);
 }
@@ -416,7 +420,7 @@ void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
 {
         struct inet_timewait_sock *tw;
         struct sock *sk;
-        struct hlist_node *node;
+        struct hlist_nulls_node *node;
         int h;
 
         local_bh_disable();
@@ -426,7 +430,7 @@ void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
                 rwlock_t *lock = inet_ehash_lockp(hashinfo, h);
 restart:
                 write_lock(lock);
-                sk_for_each(sk, node, &head->twchain) {
+                sk_nulls_for_each(sk, node, &head->twchain) {
 
                         tw = inet_twsk(sk);
                         if (!net_eq(twsk_net(tw), net) ||
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index a456ceeac3f2..b1fbe18feb5a 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -144,7 +144,7 @@ static void unlink_from_unused(struct inet_peer *p)
  * _stack is known to be NULL or not at compile time,
  * so compiler will optimize the if (_stack) tests.
  */
-#define lookup(_daddr,_stack)                                   \
+#define lookup(_daddr, _stack)                                  \
 ({                                                              \
         struct inet_peer *u, **v;                               \
         if (_stack != NULL) {                                   \
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 450016b89a18..df3fe50bbf0d 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -106,7 +106,7 @@ int ip_forward(struct sk_buff *skb)
          *      We now generate an ICMP HOST REDIRECT giving the route
          *      we calculated.
          */
-        if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb->sp)
+        if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
                 ip_rt_send_redirect(skb);
 
         skb->priority = rt_tos2priority(iph->tos);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index e4f81f54befe..6659ac000eeb 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -56,7 +56,7 @@ struct ipfrag_skb_cb
         int                     offset;
 };
 
-#define FRAG_CB(skb)    ((struct ipfrag_skb_cb*)((skb)->cb))
+#define FRAG_CB(skb)    ((struct ipfrag_skb_cb *)((skb)->cb))
 
 /* Describe an entry in the "incomplete datagrams" queue. */
 struct ipq {
@@ -559,9 +559,8 @@ out_nomem:
         goto out_fail;
 out_oversize:
         if (net_ratelimit())
-                printk(KERN_INFO
-                        "Oversized IP packet from " NIPQUAD_FMT ".\n",
-                        NIPQUAD(qp->saddr));
+                printk(KERN_INFO "Oversized IP packet from %pI4.\n",
+                        &qp->saddr);
 out_fail:
         IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
         return err;
@@ -608,7 +607,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .data           = &init_net.ipv4.frags.high_thresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_IPFRAG_LOW_THRESH,
@@ -616,7 +615,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .data           = &init_net.ipv4.frags.low_thresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_IPFRAG_TIME,
@@ -624,8 +623,8 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .data           = &init_net.ipv4.frags.timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         { }
 };
@@ -637,15 +636,15 @@ static struct ctl_table ip4_frags_ctl_table[] = {
                 .data           = &ip4_frags.secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         {
                 .procname       = "ipfrag_max_dist",
                 .data           = &sysctl_ipfrag_max_dist,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
+                .proc_handler   = proc_dointvec_minmax,
                 .extra1         = &zero
         },
         { }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 85c487b8572b..191ef7588134 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -371,7 +371,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
    by themself???
  */
 
-        struct iphdr *iph = (struct iphdr*)skb->data;
+        struct iphdr *iph = (struct iphdr *)skb->data;
         __be16       *p = (__be16*)(skb->data+(iph->ihl<<2));
         int grehlen = (iph->ihl<<2) + 4;
         const int type = icmp_hdr(skb)->type;
@@ -632,7 +632,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
                 gre_hlen = 0;
-                tiph = (struct iphdr*)skb->data;
+                tiph = (struct iphdr *)skb->data;
         } else {
                 gre_hlen = tunnel->hlen;
                 tiph = &tunnel->parms.iph;
@@ -660,7 +660,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         if (neigh == NULL)
                                 goto tx_error;
 
-                        addr6 = (struct in6_addr*)&neigh->primary_key;
+                        addr6 = (struct in6_addr *)&neigh->primary_key;
                         addr_type = ipv6_addr_type(addr6);
 
                         if (addr_type == IPV6_ADDR_ANY) {
@@ -726,7 +726,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 #ifdef CONFIG_IPV6
         else if (skb->protocol == htons(ETH_P_IPV6)) {
-                struct rt6_info *rt6 = (struct rt6_info*)skb->dst;
+                struct rt6_info *rt6 = (struct rt6_info *)skb->dst;
 
                 if (rt6 && mtu < dst_mtu(skb->dst) && mtu >= IPV6_MIN_MTU) {
                         if ((tunnel->parms.iph.daddr &&
@@ -800,7 +800,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         iph->ttl = old_iph->ttl;
 #ifdef CONFIG_IPV6
                 else if (skb->protocol == htons(ETH_P_IPV6))
-                        iph->ttl = ((struct ipv6hdr*)old_iph)->hop_limit;
+                        iph->ttl = ((struct ipv6hdr *)old_iph)->hop_limit;
 #endif
                 else
                         iph->ttl = dst_metric(&rt->u.dst, RTAX_HOPLIMIT);
@@ -962,7 +962,7 @@ ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                         break;
                                 }
                         } else {
-                                unsigned nflags=0;
+                                unsigned nflags = 0;
 
                                 t = netdev_priv(dev);
 
@@ -1104,7 +1104,7 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
 
 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
 {
-        struct iphdr *iph = (struct iphdr*) skb_mac_header(skb);
+        struct iphdr *iph = (struct iphdr *) skb_mac_header(skb);
         memcpy(haddr, &iph->saddr, 4);
         return 4;
 }
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index cfb38ac9d698..1a58a6fa1dc0 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -302,10 +302,8 @@ static inline int ip_rcv_options(struct sk_buff *skb)
                         if (!IN_DEV_SOURCE_ROUTE(in_dev)) {
                                 if (IN_DEV_LOG_MARTIANS(in_dev) &&
                                     net_ratelimit())
-                                        printk(KERN_INFO "source route option "
-                                               NIPQUAD_FMT " -> " NIPQUAD_FMT "\n",
-                                               NIPQUAD(iph->saddr),
-                                               NIPQUAD(iph->daddr));
+                                        printk(KERN_INFO "source route option %pI4 -> %pI4\n",
+                                               &iph->saddr, &iph->daddr);
                                 in_dev_put(in_dev);
                                 goto drop;
                         }
@@ -350,9 +348,9 @@ static int ip_rcv_finish(struct sk_buff *skb)
                 struct ip_rt_acct *st = per_cpu_ptr(ip_rt_acct, smp_processor_id());
                 u32 idx = skb->dst->tclassid;
                 st[idx&0xFF].o_packets++;
-                st[idx&0xFF].o_bytes+=skb->len;
+                st[idx&0xFF].o_bytes += skb->len;
                 st[(idx>>16)&0xFF].i_packets++;
-                st[(idx>>16)&0xFF].i_bytes+=skb->len;
+                st[(idx>>16)&0xFF].i_bytes += skb->len;
         }
 #endif
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d2a8f8bb78a6..46d7be233eac 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -430,7 +430,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
  *      single device frame, and queue such a frame for sending.
  */
 
-int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
+int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct iphdr *iph;
         int raw = 0;
@@ -720,7 +720,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                         int getfrag(void *from, char *to, int offset, int len,
                                int odd, struct sk_buff *skb),
                         void *from, int length, int hh_len, int fragheaderlen,
-                        int transhdrlen, int mtu,unsigned int flags)
+                        int transhdrlen, int mtu, unsigned int flags)
 {
         struct sk_buff *skb;
         int err;
@@ -741,7 +741,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                 skb_reserve(skb, hh_len);
 
                 /* create space for UDP/IP header */
-                skb_put(skb,fragheaderlen + transhdrlen);
+                skb_put(skb, fragheaderlen + transhdrlen);
 
                 /* initialize network header pointer */
                 skb_reset_network_header(skb);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 465abf0a9869..43c05854d752 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -48,6 +48,7 @@
 #define IP_CMSG_RECVOPTS        8
 #define IP_CMSG_RETOPTS         16
 #define IP_CMSG_PASSSEC         32
+#define IP_CMSG_ORIGDSTADDR     64
 
 /*
  *      SOL_IP control messages.
@@ -94,7 +95,7 @@ static void ip_cmsg_recv_opts(struct msghdr *msg, struct sk_buff *skb)
 static void ip_cmsg_recv_retopts(struct msghdr *msg, struct sk_buff *skb)
 {
         unsigned char optbuf[sizeof(struct ip_options) + 40];
-        struct ip_options * opt = (struct ip_options*)optbuf;
+        struct ip_options * opt = (struct ip_options *)optbuf;
 
         if (IPCB(skb)->opt.optlen == 0)
                 return;
@@ -126,6 +127,27 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
         security_release_secctx(secdata, seclen);
 }
 
+static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
+{
+        struct sockaddr_in sin;
+        struct iphdr *iph = ip_hdr(skb);
+        __be16 *ports = (__be16 *)skb_transport_header(skb);
+
+        if (skb_transport_offset(skb) + 4 > skb->len)
+                return;
+
+        /* All current transport protocols have the port numbers in the
+         * first four bytes of the transport header and this function is
+         * written with this assumption in mind.
+         */
+
+        sin.sin_family = AF_INET;
+        sin.sin_addr.s_addr = iph->daddr;
+        sin.sin_port = ports[1];
+        memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
+
+        put_cmsg(msg, SOL_IP, IP_ORIGDSTADDR, sizeof(sin), &sin);
+}
 
 void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
 {
@@ -160,6 +182,12 @@ void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
 
         if (flags & 1)
                 ip_cmsg_recv_security(msg, skb);
+
+        if ((flags>>=1) == 0)
+                return;
+        if (flags & 1)
+                ip_cmsg_recv_dstaddr(msg, skb);
+
 }
 
 int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
@@ -411,7 +439,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                             int optname, char __user *optval, int optlen)
 {
         struct inet_sock *inet = inet_sk(sk);
-        int val=0,err;
+        int val = 0, err;
 
         if (((1<<optname) & ((1<<IP_PKTINFO) | (1<<IP_RECVTTL) |
                              (1<<IP_RECVOPTS) | (1<<IP_RECVTOS) |
@@ -421,7 +449,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                              (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
                              (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT))) ||
             optname == IP_MULTICAST_TTL ||
-            optname == IP_MULTICAST_LOOP) {
+            optname == IP_MULTICAST_LOOP ||
+            optname == IP_RECVORIGDSTADDR) {
                 if (optlen >= sizeof(int)) {
                         if (get_user(val, (int __user *) optval))
                                 return -EFAULT;
@@ -437,7 +466,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         /* If optlen==0, it is equivalent to val == 0 */
 
         if (ip_mroute_opt(optname))
-                return ip_mroute_setsockopt(sk,optname,optval,optlen);
+                return ip_mroute_setsockopt(sk, optname, optval, optlen);
 
         err = 0;
         lock_sock(sk);
@@ -509,6 +538,12 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 else
                         inet->cmsg_flags &= ~IP_CMSG_PASSSEC;
                 break;
+        case IP_RECVORIGDSTADDR:
+                if (val)
+                        inet->cmsg_flags |= IP_CMSG_ORIGDSTADDR;
+                else
+                        inet->cmsg_flags &= ~IP_CMSG_ORIGDSTADDR;
+                break;
         case IP_TOS:    /* This sets both TOS and Precedence */
                 if (sk->sk_type == SOCK_STREAM) {
                         val &= ~3;
@@ -549,7 +584,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         goto e_inval;
                 if (optlen<1)
                         goto e_inval;
-                if (val==-1)
+                if (val == -1)
                         val = 1;
                 if (val < 0 || val > 255)
                         goto e_inval;
@@ -573,12 +608,12 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 
                 err = -EFAULT;
                 if (optlen >= sizeof(struct ip_mreqn)) {
-                        if (copy_from_user(&mreq,optval,sizeof(mreq)))
+                        if (copy_from_user(&mreq, optval, sizeof(mreq)))
                                 break;
                 } else {
                         memset(&mreq, 0, sizeof(mreq));
                         if (optlen >= sizeof(struct in_addr) &&
-                            copy_from_user(&mreq.imr_address,optval,sizeof(struct in_addr)))
+                            copy_from_user(&mreq.imr_address, optval, sizeof(struct in_addr)))
                                 break;
                 }
 
@@ -626,11 +661,11 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         goto e_inval;
                 err = -EFAULT;
                 if (optlen >= sizeof(struct ip_mreqn)) {
-                        if (copy_from_user(&mreq,optval,sizeof(mreq)))
+                        if (copy_from_user(&mreq, optval, sizeof(mreq)))
                                 break;
                 } else {
                         memset(&mreq, 0, sizeof(mreq));
-                        if (copy_from_user(&mreq,optval,sizeof(struct ip_mreq)))
+                        if (copy_from_user(&mreq, optval, sizeof(struct ip_mreq)))
                                 break;
                 }
 
@@ -808,7 +843,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         err = -ENOBUFS;
                         break;
                 }
-                gsf = kmalloc(optlen,GFP_KERNEL);
+                gsf = kmalloc(optlen, GFP_KERNEL);
                 if (!gsf) {
                         err = -ENOBUFS;
                         break;
@@ -828,7 +863,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         goto mc_msf_out;
                 }
                 msize = IP_MSFILTER_SIZE(gsf->gf_numsrc);
-                msf = kmalloc(msize,GFP_KERNEL);
+                msf = kmalloc(msize, GFP_KERNEL);
                 if (!msf) {
                         err = -ENOBUFS;
                         goto mc_msf_out;
@@ -971,9 +1006,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                 return -EOPNOTSUPP;
 
         if (ip_mroute_opt(optname))
-                return ip_mroute_getsockopt(sk,optname,optval,optlen);
+                return ip_mroute_getsockopt(sk, optname, optval, optlen);
 
-        if (get_user(len,optlen))
+        if (get_user(len, optlen))
                 return -EFAULT;
         if (len < 0)
                 return -EINVAL;
@@ -984,7 +1019,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_OPTIONS:
         {
                 unsigned char optbuf[sizeof(struct ip_options)+40];
-                struct ip_options * opt = (struct ip_options*)optbuf;
+                struct ip_options * opt = (struct ip_options *)optbuf;
                 opt->optlen = 0;
                 if (inet->opt)
                         memcpy(optbuf, inet->opt,
@@ -1022,6 +1057,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_PASSSEC:
                 val = (inet->cmsg_flags & IP_CMSG_PASSSEC) != 0;
                 break;
+        case IP_RECVORIGDSTADDR:
+                val = (inet->cmsg_flags & IP_CMSG_ORIGDSTADDR) != 0;
+                break;
         case IP_TOS:
                 val = inet->tos;
                 break;
@@ -1154,13 +1192,13 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                 len = 1;
                 if (put_user(len, optlen))
                         return -EFAULT;
-                if (copy_to_user(optval,&ucval,1))
+                if (copy_to_user(optval, &ucval, 1))
                         return -EFAULT;
         } else {
                 len = min_t(unsigned int, sizeof(int), len);
                 if (put_user(len, optlen))
                         return -EFAULT;
-                if (copy_to_user(optval,&val,len))
+                if (copy_to_user(optval, &val, len))
                         return -EFAULT;
         }
         return 0;
@@ -1178,7 +1216,7 @@ int ip_getsockopt(struct sock *sk, int level,
                         !ip_mroute_opt(optname)) {
                 int len;
 
-                if (get_user(len,optlen))
+                if (get_user(len, optlen))
                         return -EFAULT;
 
                 lock_sock(sk);
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 38ccb6dfb02e..ec8264ae45c2 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -39,8 +39,8 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
                 return;
-        NETDEBUG(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/" NIPQUAD_FMT "\n",
-                 spi, NIPQUAD(iph->daddr));
+        NETDEBUG(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%pI4\n",
+                 spi, &iph->daddr);
         xfrm_state_put(x);
 }
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 42065fff46c4..42a0f3dd3fd6 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -374,7 +374,7 @@ static int __init ic_defaults(void)
          */
 
         if (!ic_host_name_set)
-                sprintf(init_utsname()->nodename, NIPQUAD_FMT, NIPQUAD(ic_myaddr));
+                sprintf(init_utsname()->nodename, "%pI4", &ic_myaddr);
 
         if (root_server_addr == NONE)
                 root_server_addr = ic_servaddr;
@@ -387,11 +387,11 @@ static int __init ic_defaults(void)
                 else if (IN_CLASSC(ntohl(ic_myaddr)))
                         ic_netmask = htonl(IN_CLASSC_NET);
                 else {
-                        printk(KERN_ERR "IP-Config: Unable to guess netmask for address " NIPQUAD_FMT "\n",
-                                NIPQUAD(ic_myaddr));
+                        printk(KERN_ERR "IP-Config: Unable to guess netmask for address %pI4\n",
+                                &ic_myaddr);
                         return -1;
                 }
-                printk("IP-Config: Guessing netmask " NIPQUAD_FMT "\n", NIPQUAD(ic_netmask));
+                printk("IP-Config: Guessing netmask %pI4\n", &ic_netmask);
         }
 
         return 0;
@@ -979,10 +979,8 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
                                 ic_myaddr = b->your_ip;
                                 ic_servaddr = server_id;
 #ifdef IPCONFIG_DEBUG
-                                printk("DHCP: Offered address " NIPQUAD_FMT,
-                                       NIPQUAD(ic_myaddr));
-                                printk(" by server " NIPQUAD_FMT "\n",
-                                       NIPQUAD(ic_servaddr));
+                                printk("DHCP: Offered address %pI4 by server %pI4\n",
+                                       &ic_myaddr, &ic_servaddr);
 #endif
                                 /* The DHCP indicated server address takes
                                  * precedence over the bootp header one if
@@ -1177,11 +1175,11 @@ static int __init ic_dynamic(void)
                 return -1;
         }
 
-        printk("IP-Config: Got %s answer from " NIPQUAD_FMT ", ",
+        printk("IP-Config: Got %s answer from %pI4, ",
                 ((ic_got_reply & IC_RARP) ? "RARP"
                  : (ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP"),
-                NIPQUAD(ic_servaddr));
-        printk("my address is " NIPQUAD_FMT "\n", NIPQUAD(ic_myaddr));
+                &ic_servaddr);
+        printk("my address is %pI4\n", &ic_myaddr);
 
         return 0;
 }
@@ -1206,14 +1204,12 @@ static int pnp_seq_show(struct seq_file *seq, void *v)
                            "domain %s\n", ic_domain);
         for (i = 0; i < CONF_NAMESERVERS_MAX; i++) {
                 if (ic_nameservers[i] != NONE)
-                        seq_printf(seq,
-                                   "nameserver " NIPQUAD_FMT "\n",
-                                   NIPQUAD(ic_nameservers[i]));
+                        seq_printf(seq, "nameserver %pI4\n",
+                                   &ic_nameservers[i]);
         }
         if (ic_servaddr != NONE)
-                seq_printf(seq,
-                           "bootserver " NIPQUAD_FMT "\n",
-                           NIPQUAD(ic_servaddr));
+                seq_printf(seq, "bootserver %pI4\n",
+                           &ic_servaddr);
         return 0;
 }
 
@@ -1387,13 +1383,13 @@ static int __init ip_auto_config(void)
          */
         printk("IP-Config: Complete:");
         printk("\n     device=%s", ic_dev->name);
-        printk(", addr=" NIPQUAD_FMT, NIPQUAD(ic_myaddr));
-        printk(", mask=" NIPQUAD_FMT, NIPQUAD(ic_netmask));
-        printk(", gw=" NIPQUAD_FMT, NIPQUAD(ic_gateway));
+        printk(", addr=%pI4", &ic_myaddr);
+        printk(", mask=%pI4", &ic_netmask);
+        printk(", gw=%pI4", &ic_gateway);
         printk(",\n     host=%s, domain=%s, nis-domain=%s",
                utsname()->nodename, ic_domain, utsname()->domainname);
-        printk(",\n     bootserver=" NIPQUAD_FMT, NIPQUAD(ic_servaddr));
-        printk(", rootserver=" NIPQUAD_FMT, NIPQUAD(root_server_addr));
+        printk(",\n     bootserver=%pI4", &ic_servaddr);
+        printk(", rootserver=%pI4", &root_server_addr);
         printk(", rootpath=%s", root_server_path);
         printk("\n");
 #endif /* !SILENT */
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 29609d29df76..b3c3d7b0d116 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -281,7 +281,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
    8 bytes of packet payload. It means, that precise relaying of
    ICMP in the real Internet is absolutely infeasible.
  */
-        struct iphdr *iph = (struct iphdr*)skb->data;
+        struct iphdr *iph = (struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct ip_tunnel *t;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 25924b1eb2ef..ee58bcbc99a5 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -124,8 +124,8 @@ static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
 
         dev = __dev_get_by_name(&init_net, "tunl0");
         if (dev) {
+                const struct net_device_ops *ops = dev->netdev_ops;
                 struct ifreq ifr;
-                mm_segment_t    oldfs;
                 struct ip_tunnel_parm p;
 
                 memset(&p, 0, sizeof(p));
@@ -137,9 +137,13 @@ static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
                 sprintf(p.name, "dvmrp%d", v->vifc_vifi);
                 ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
 
-                oldfs = get_fs(); set_fs(KERNEL_DS);
-                dev->do_ioctl(dev, &ifr, SIOCDELTUNNEL);
-                set_fs(oldfs);
+                if (ops->ndo_do_ioctl) {
+                        mm_segment_t oldfs = get_fs();
+
+                        set_fs(KERNEL_DS);
+                        ops->ndo_do_ioctl(dev, &ifr, SIOCDELTUNNEL);
+                        set_fs(oldfs);
+                }
         }
 }
 
@@ -151,9 +155,9 @@ struct net_device *ipmr_new_tunnel(struct vifctl *v)
         dev = __dev_get_by_name(&init_net, "tunl0");
 
         if (dev) {
+                const struct net_device_ops *ops = dev->netdev_ops;
                 int err;
                 struct ifreq ifr;
-                mm_segment_t    oldfs;
                 struct ip_tunnel_parm p;
                 struct in_device  *in_dev;
 
@@ -166,9 +170,14 @@ struct net_device *ipmr_new_tunnel(struct vifctl *v)
                 sprintf(p.name, "dvmrp%d", v->vifc_vifi);
                 ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
 
-                oldfs = get_fs(); set_fs(KERNEL_DS);
-                err = dev->do_ioctl(dev, &ifr, SIOCADDTUNNEL);
-                set_fs(oldfs);
+                if (ops->ndo_do_ioctl) {
+                        mm_segment_t oldfs = get_fs();
+
+                        set_fs(KERNEL_DS);
+                        err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
+                        set_fs(oldfs);
+                } else
+                        err = -EOPNOTSUPP;
 
                 dev = NULL;
 
@@ -331,7 +340,7 @@ static void ipmr_destroy_unres(struct mfc_cache *c)
 
         atomic_dec(&cache_resolve_queue_len);
 
-        while ((skb=skb_dequeue(&c->mfc_un.unres.unresolved))) {
+        while ((skb = skb_dequeue(&c->mfc_un.unres.unresolved))) {
                 if (ip_hdr(skb)->version == 0) {
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct iphdr));
                         nlh->nlmsg_type = NLMSG_ERROR;
@@ -477,13 +486,13 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
         /*
          *      Fill in the VIF structures
          */
-        v->rate_limit=vifc->vifc_rate_limit;
-        v->local=vifc->vifc_lcl_addr.s_addr;
-        v->remote=vifc->vifc_rmt_addr.s_addr;
-        v->flags=vifc->vifc_flags;
+        v->rate_limit = vifc->vifc_rate_limit;
+        v->local = vifc->vifc_lcl_addr.s_addr;
+        v->remote = vifc->vifc_rmt_addr.s_addr;
+        v->flags = vifc->vifc_flags;
         if (!mrtsock)
                 v->flags |= VIFF_STATIC;
-        v->threshold=vifc->vifc_threshold;
+        v->threshold = vifc->vifc_threshold;
         v->bytes_in = 0;
         v->bytes_out = 0;
         v->pkt_in = 0;
@@ -494,7 +503,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
 
         /* And finish update writing critical data */
         write_lock_bh(&mrt_lock);
-        v->dev=dev;
+        v->dev = dev;
 #ifdef CONFIG_IP_PIMSM
         if (v->flags&VIFF_REGISTER)
                 reg_vif_num = vifi;
@@ -507,7 +516,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
 
 static struct mfc_cache *ipmr_cache_find(__be32 origin, __be32 mcastgrp)
 {
-        int line=MFC_HASH(mcastgrp,origin);
+        int line = MFC_HASH(mcastgrp, origin);
         struct mfc_cache *c;
 
         for (c=mfc_cache_array[line]; c; c = c->next) {
@@ -522,8 +531,8 @@ static struct mfc_cache *ipmr_cache_find(__be32 origin, __be32 mcastgrp)
  */
 static struct mfc_cache *ipmr_cache_alloc(void)
 {
-        struct mfc_cache *c=kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
-        if (c==NULL)
+        struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
+        if (c == NULL)
                 return NULL;
         c->mfc_un.res.minvif = MAXVIFS;
         return c;
@@ -531,8 +540,8 @@ static struct mfc_cache *ipmr_cache_alloc(void)
 
 static struct mfc_cache *ipmr_cache_alloc_unres(void)
 {
-        struct mfc_cache *c=kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
-        if (c==NULL)
+        struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
+        if (c == NULL)
                 return NULL;
         skb_queue_head_init(&c->mfc_un.unres.unresolved);
         c->mfc_un.unres.expires = jiffies + 10*HZ;
@@ -552,7 +561,7 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
          *      Play the pending entries through our router
          */
 
-        while ((skb=__skb_dequeue(&uc->mfc_un.unres.unresolved))) {
+        while ((skb = __skb_dequeue(&uc->mfc_un.unres.unresolved))) {
                 if (ip_hdr(skb)->version == 0) {
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct iphdr));
 
@@ -637,7 +646,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
          *      Add our header
          */
 
-        igmp=(struct igmphdr *)skb_put(skb,sizeof(struct igmphdr));
+        igmp=(struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
         igmp->type      =
         msg->im_msgtype = assert;
         igmp->code      =       0;
@@ -653,7 +662,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
         /*
          *      Deliver to mrouted
          */
-        if ((ret=sock_queue_rcv_skb(mroute_socket,skb))<0) {
+        if ((ret = sock_queue_rcv_skb(mroute_socket, skb))<0) {
                 if (net_ratelimit())
                         printk(KERN_WARNING "mroute: pending queue full, dropping entries.\n");
                 kfree_skb(skb);
@@ -685,7 +694,7 @@ ipmr_cache_unresolved(vifi_t vifi, struct sk_buff *skb)
                  *      Create a new entry if allowable
                  */
 
-                if (atomic_read(&cache_resolve_queue_len)>=10 ||
+                if (atomic_read(&cache_resolve_queue_len) >= 10 ||
                     (c=ipmr_cache_alloc_unres())==NULL) {
                         spin_unlock_bh(&mfc_unres_lock);
 
@@ -728,7 +737,7 @@ ipmr_cache_unresolved(vifi_t vifi, struct sk_buff *skb)
                 kfree_skb(skb);
                 err = -ENOBUFS;
         } else {
-                skb_queue_tail(&c->mfc_un.unres.unresolved,skb);
+                skb_queue_tail(&c->mfc_un.unres.unresolved, skb);
                 err = 0;
         }
 
@@ -745,7 +754,7 @@ static int ipmr_mfc_delete(struct mfcctl *mfc)
         int line;
         struct mfc_cache *c, **cp;
 
-        line=MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
+        line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
         for (cp=&mfc_cache_array[line]; (c=*cp) != NULL; cp = &c->next) {
                 if (c->mfc_origin == mfc->mfcc_origin.s_addr &&
@@ -766,7 +775,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         int line;
         struct mfc_cache *uc, *c, **cp;
 
-        line=MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
+        line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
         for (cp=&mfc_cache_array[line]; (c=*cp) != NULL; cp = &c->next) {
                 if (c->mfc_origin == mfc->mfcc_origin.s_addr &&
@@ -787,13 +796,13 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         if (!ipv4_is_multicast(mfc->mfcc_mcastgrp.s_addr))
                 return -EINVAL;
 
-        c=ipmr_cache_alloc();
-        if (c==NULL)
+        c = ipmr_cache_alloc();
+        if (c == NULL)
                 return -ENOMEM;
 
-        c->mfc_origin=mfc->mfcc_origin.s_addr;
-        c->mfc_mcastgrp=mfc->mfcc_mcastgrp.s_addr;
-        c->mfc_parent=mfc->mfcc_parent;
+        c->mfc_origin = mfc->mfcc_origin.s_addr;
+        c->mfc_mcastgrp = mfc->mfcc_mcastgrp.s_addr;
+        c->mfc_parent = mfc->mfcc_parent;
         ipmr_update_thresholds(c, mfc->mfcc_ttls);
         if (!mrtsock)
                 c->mfc_flags |= MFC_STATIC;
@@ -846,7 +855,7 @@ static void mroute_clean_tables(struct sock *sk)
         /*
          *      Wipe the cache
          */
-        for (i=0;i<MFC_LINES;i++) {
+        for (i=0; i<MFC_LINES; i++) {
                 struct mfc_cache *c, **cp;
 
                 cp = &mfc_cache_array[i];
@@ -887,7 +896,7 @@ static void mrtsock_destruct(struct sock *sk)
                 IPV4_DEVCONF_ALL(sock_net(sk), MC_FORWARDING)--;
 
                 write_lock_bh(&mrt_lock);
-                mroute_socket=NULL;
+                mroute_socket = NULL;
                 write_unlock_bh(&mrt_lock);
 
                 mroute_clean_tables(sk);
@@ -902,7 +911,7 @@ static void mrtsock_destruct(struct sock *sk)
  *      MOSPF/PIM router set up we can clean this up.
  */
 
-int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int optlen)
+int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int optlen)
 {
         int ret;
         struct vifctl vif;
@@ -918,7 +927,7 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int opt
                 if (sk->sk_type != SOCK_RAW ||
                     inet_sk(sk)->num != IPPROTO_IGMP)
                         return -EOPNOTSUPP;
-                if (optlen!=sizeof(int))
+                if (optlen != sizeof(int))
                         return -ENOPROTOOPT;
 
                 rtnl_lock();
@@ -930,7 +939,7 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int opt
                 ret = ip_ra_control(sk, 1, mrtsock_destruct);
                 if (ret == 0) {
                         write_lock_bh(&mrt_lock);
-                        mroute_socket=sk;
+                        mroute_socket = sk;
                         write_unlock_bh(&mrt_lock);
 
                         IPV4_DEVCONF_ALL(sock_net(sk), MC_FORWARDING)++;
@@ -938,19 +947,19 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int opt
                 rtnl_unlock();
                 return ret;
         case MRT_DONE:
-                if (sk!=mroute_socket)
+                if (sk != mroute_socket)
                         return -EACCES;
                 return ip_ra_control(sk, 0, NULL);
         case MRT_ADD_VIF:
         case MRT_DEL_VIF:
-                if (optlen!=sizeof(vif))
+                if (optlen != sizeof(vif))
                         return -EINVAL;
-                if (copy_from_user(&vif,optval,sizeof(vif)))
+                if (copy_from_user(&vif, optval, sizeof(vif)))
                         return -EFAULT;
                 if (vif.vifc_vifi >= MAXVIFS)
                         return -ENFILE;
                 rtnl_lock();
-                if (optname==MRT_ADD_VIF) {
+                if (optname == MRT_ADD_VIF) {
                         ret = vif_add(&vif, sk==mroute_socket);
                 } else {
                         ret = vif_delete(vif.vifc_vifi, 0);
@@ -964,12 +973,12 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int opt
                  */
         case MRT_ADD_MFC:
         case MRT_DEL_MFC:
-                if (optlen!=sizeof(mfc))
+                if (optlen != sizeof(mfc))
                         return -EINVAL;
-                if (copy_from_user(&mfc,optval, sizeof(mfc)))
+                if (copy_from_user(&mfc, optval, sizeof(mfc)))
                         return -EFAULT;
                 rtnl_lock();
-                if (optname==MRT_DEL_MFC)
+                if (optname == MRT_DEL_MFC)
                         ret = ipmr_mfc_delete(&mfc);
                 else
                         ret = ipmr_mfc_add(&mfc, sk==mroute_socket);
@@ -1028,12 +1037,12 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int opt
  *      Getsock opt support for the multicast routing system.
  */
 
-int ip_mroute_getsockopt(struct sock *sk,int optname,char __user *optval,int __user *optlen)
+int ip_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, int __user *optlen)
 {
         int olr;
         int val;
 
-        if (optname!=MRT_VERSION &&
+        if (optname != MRT_VERSION &&
 #ifdef CONFIG_IP_PIMSM
            optname!=MRT_PIM &&
 #endif
@@ -1047,17 +1056,17 @@ int ip_mroute_getsockopt(struct sock *sk,int optname,char __user *optval,int __u
         if (olr < 0)
                 return -EINVAL;
 
-        if (put_user(olr,optlen))
+        if (put_user(olr, optlen))
                 return -EFAULT;
-        if (optname==MRT_VERSION)
-                val=0x0305;
+        if (optname == MRT_VERSION)
+                val = 0x0305;
 #ifdef CONFIG_IP_PIMSM
-        else if (optname==MRT_PIM)
-                val=mroute_do_pim;
+        else if (optname == MRT_PIM)
+                val = mroute_do_pim;
 #endif
         else
-                val=mroute_do_assert;
-        if (copy_to_user(optval,&val,olr))
+                val = mroute_do_assert;
+        if (copy_to_user(optval, &val, olr))
                 return -EFAULT;
         return 0;
 }
@@ -1075,27 +1084,27 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
 
         switch (cmd) {
         case SIOCGETVIFCNT:
-                if (copy_from_user(&vr,arg,sizeof(vr)))
+                if (copy_from_user(&vr, arg, sizeof(vr)))
                         return -EFAULT;
-                if (vr.vifi>=maxvif)
+                if (vr.vifi >= maxvif)
                         return -EINVAL;
                 read_lock(&mrt_lock);
                 vif=&vif_table[vr.vifi];
                 if (VIF_EXISTS(vr.vifi))        {
-                        vr.icount=vif->pkt_in;
-                        vr.ocount=vif->pkt_out;
-                        vr.ibytes=vif->bytes_in;
-                        vr.obytes=vif->bytes_out;
+                        vr.icount = vif->pkt_in;
+                        vr.ocount = vif->pkt_out;
+                        vr.ibytes = vif->bytes_in;
+                        vr.obytes = vif->bytes_out;
                         read_unlock(&mrt_lock);
 
-                        if (copy_to_user(arg,&vr,sizeof(vr)))
+                        if (copy_to_user(arg, &vr, sizeof(vr)))
                                 return -EFAULT;
                         return 0;
                 }
                 read_unlock(&mrt_lock);
                 return -EADDRNOTAVAIL;
         case SIOCGETSGCNT:
-                if (copy_from_user(&sr,arg,sizeof(sr)))
+                if (copy_from_user(&sr, arg, sizeof(sr)))
                         return -EFAULT;
 
                 read_lock(&mrt_lock);
@@ -1106,7 +1115,7 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
                         sr.wrong_if = c->mfc_un.res.wrong_if;
                         read_unlock(&mrt_lock);
 
-                        if (copy_to_user(arg,&sr,sizeof(sr)))
+                        if (copy_to_user(arg, &sr, sizeof(sr)))
                                 return -EFAULT;
                         return 0;
                 }
@@ -1130,15 +1139,15 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
         v=&vif_table[0];
-        for (ct=0;ct<maxvif;ct++,v++) {
-                if (v->dev==dev)
+        for (ct=0; ct<maxvif; ct++,v++) {
+                if (v->dev == dev)
                         vif_delete(ct, 1);
         }
         return NOTIFY_DONE;
 }
 
 
-static struct notifier_block ip_mr_notifier={
+static struct notifier_block ip_mr_notifier = {
         .notifier_call = ipmr_device_event,
 };
 
@@ -1204,7 +1213,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
 #ifdef CONFIG_IP_PIMSM
         if (vif->flags & VIFF_REGISTER) {
                 vif->pkt_out++;
-                vif->bytes_out+=skb->len;
+                vif->bytes_out += skb->len;
                 vif->dev->stats.tx_bytes += skb->len;
                 vif->dev->stats.tx_packets++;
                 ipmr_cache_report(skb, vifi, IGMPMSG_WHOLEPKT);
@@ -1254,7 +1263,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
         }
 
         vif->pkt_out++;
-        vif->bytes_out+=skb->len;
+        vif->bytes_out += skb->len;
 
         dst_release(skb->dst);
         skb->dst = &rt->u.dst;
@@ -1352,7 +1361,7 @@ static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local
         }
 
         vif_table[vif].pkt_in++;
-        vif_table[vif].bytes_in+=skb->len;
+        vif_table[vif].bytes_in += skb->len;
 
         /*
          *      Forward the frame
@@ -1364,7 +1373,7 @@ static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local
                                 if (skb2)
                                         ipmr_queue_xmit(skb2, cache, psend);
                         }
-                        psend=ct;
+                        psend = ct;
                 }
         }
         if (psend != -1) {
@@ -1428,7 +1437,7 @@ int ip_mr_input(struct sk_buff *skb)
         /*
          *      No usable cache entry
          */
-        if (cache==NULL) {
+        if (cache == NULL) {
                 int vif;
 
                 if (local) {
@@ -1602,13 +1611,13 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
         if (dev)
                 RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
 
-        mp_head = (struct rtattr*)skb_put(skb, RTA_LENGTH(0));
+        mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
                 if (c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
-                        nhp = (struct rtnexthop*)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
+                        nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
                         nhp->rtnh_flags = 0;
                         nhp->rtnh_hops = c->mfc_un.res.ttls[ct];
                         nhp->rtnh_ifindex = vif_table[ct].dev->ifindex;
@@ -1634,7 +1643,7 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
         read_lock(&mrt_lock);
         cache = ipmr_cache_find(rt->rt_src, rt->rt_dst);
 
-        if (cache==NULL) {
+        if (cache == NULL) {
                 struct sk_buff *skb2;
                 struct iphdr *iph;
                 struct net_device *dev;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 8d70d29f1ccf..7ea88b61cb0d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -142,15 +142,15 @@ static inline int arp_packet_match(const struct arphdr *arphdr,
                   ARPT_INV_TGTIP)) {
                 dprintf("Source or target IP address mismatch.\n");
 
-                dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
-                        NIPQUAD(src_ipaddr),
-                        NIPQUAD(arpinfo->smsk.s_addr),
-                        NIPQUAD(arpinfo->src.s_addr),
+                dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
+                        &src_ipaddr,
+                        &arpinfo->smsk.s_addr,
+                        &arpinfo->src.s_addr,
                         arpinfo->invflags & ARPT_INV_SRCIP ? " (INV)" : "");
-                dprintf("TGT: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
-                        NIPQUAD(tgt_ipaddr),
-                        NIPQUAD(arpinfo->tmsk.s_addr),
-                        NIPQUAD(arpinfo->tgt.s_addr),
+                dprintf("TGT: %pI4 Mask: %pI4 Target: %pI4.%s\n",
+                        &tgt_ipaddr,
+                        &arpinfo->tmsk.s_addr,
+                        &arpinfo->tgt.s_addr,
                         arpinfo->invflags & ARPT_INV_TGTIP ? " (INV)" : "");
                 return 0;
         }
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 213fb27debc1..ef8b6ca068b2 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -94,15 +94,11 @@ ip_packet_match(const struct iphdr *ip,
                      IPT_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
 
-                dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
-                        NIPQUAD(ip->saddr),
-                        NIPQUAD(ipinfo->smsk.s_addr),
-                        NIPQUAD(ipinfo->src.s_addr),
+                dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
+                        &ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
                         ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
-                dprintf("DST: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
-                        NIPQUAD(ip->daddr),
-                        NIPQUAD(ipinfo->dmsk.s_addr),
-                        NIPQUAD(ipinfo->dst.s_addr),
+                dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
+                        &ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
                         ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
                 return false;
         }
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 7ac1677419a9..2e4f98b85524 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -168,7 +168,7 @@ clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
                 char buffer[16];
 
                 /* create proc dir entry */
-                sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(ip));
+                sprintf(buffer, "%pI4", &ip);
                 c->pde = proc_create_data(buffer, S_IWUSR|S_IRUSR,
                                           clusterip_procdir,
                                           &clusterip_proc_fops, c);
@@ -373,7 +373,7 @@ static bool clusterip_tg_check(const struct xt_tgchk_param *par)
         config = clusterip_config_find_get(e->ip.dst.s_addr, 1);
         if (!config) {
                 if (!(cipinfo->flags & CLUSTERIP_FLAG_NEW)) {
-                        printk(KERN_WARNING "CLUSTERIP: no config found for %u.%u.%u.%u, need 'new'\n", NIPQUAD(e->ip.dst.s_addr));
+                        printk(KERN_WARNING "CLUSTERIP: no config found for %pI4, need 'new'\n", &e->ip.dst.s_addr);
                         return false;
                 } else {
                         struct net_device *dev;
@@ -478,9 +478,8 @@ static void arp_print(struct arp_payload *payload)
         }
         hbuffer[--k]='\0';
 
-        printk("src %u.%u.%u.%u@%s, dst %u.%u.%u.%u\n",
-                NIPQUAD(payload->src_ip), hbuffer,
-                NIPQUAD(payload->dst_ip));
+        printk("src %pI4@%s, dst %pI4\n",
+                &payload->src_ip, hbuffer, &payload->dst_ip);
 }
 #endif
 
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index fc6ce04a3e35..4614a696f1b0 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -54,8 +54,8 @@ static void dump_packet(const struct nf_loginfo *info,
         /* Important fields:
          * TOS, len, DF/MF, fragment offset, TTL, src, dst, options. */
         /* Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 " */
-        printk("SRC=%u.%u.%u.%u DST=%u.%u.%u.%u ",
-               NIPQUAD(ih->saddr), NIPQUAD(ih->daddr));
+        printk("SRC=%pI4 DST=%pI4 ",
+               &ih->saddr, &ih->daddr);
 
         /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */
         printk("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
@@ -262,8 +262,7 @@ static void dump_packet(const struct nf_loginfo *info,
                         break;
                 case ICMP_REDIRECT:
                         /* Max length: 24 "GATEWAY=255.255.255.255 " */
-                        printk("GATEWAY=%u.%u.%u.%u ",
-                               NIPQUAD(ich->un.gateway));
+                        printk("GATEWAY=%pI4 ", &ich->un.gateway);
                         /* Fall through */
                 case ICMP_DEST_UNREACH:
                 case ICMP_SOURCE_QUENCH:
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 4a7c35275396..b2141e11575e 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -60,9 +60,8 @@ static bool ipv4_invert_tuple(struct nf_conntrack_tuple *tuple,
 static int ipv4_print_tuple(struct seq_file *s,
                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "src=%u.%u.%u.%u dst=%u.%u.%u.%u ",
-                          NIPQUAD(tuple->src.u3.ip),
-                          NIPQUAD(tuple->dst.u3.ip));
+        return seq_printf(s, "src=%pI4 dst=%pI4 ",
+                          &tuple->src.u3.ip, &tuple->dst.u3.ip);
 }
 
 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
@@ -198,7 +197,7 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .data           = &nf_conntrack_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_COUNT,
@@ -206,7 +205,7 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .data           = &init_net.ct.count,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_BUCKETS,
@@ -214,7 +213,7 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .data           = &nf_conntrack_htable_size,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_CHECKSUM,
@@ -222,7 +221,7 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .data           = &init_net.ct.sysctl_checksum,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_LOG_INVALID,
@@ -230,8 +229,8 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .data           = &init_net.ct.sysctl_log_invalid,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &log_invalid_proto_min,
                 .extra2         = &log_invalid_proto_max,
         },
@@ -284,17 +283,17 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                         .tuple.dst.u3.ip;
                 memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
 
-                pr_debug("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
-                         NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
+                pr_debug("SO_ORIGINAL_DST: %pI4 %u\n",
+                         &sin.sin_addr.s_addr, ntohs(sin.sin_port));
                 nf_ct_put(ct);
                 if (copy_to_user(user, &sin, sizeof(sin)) != 0)
                         return -EFAULT;
                 else
                         return 0;
         }
-        pr_debug("SO_ORIGINAL_DST: Can't find %u.%u.%u.%u/%u-%u.%u.%u.%u/%u.\n",
-                 NIPQUAD(tuple.src.u3.ip), ntohs(tuple.src.u.tcp.port),
-                 NIPQUAD(tuple.dst.u3.ip), ntohs(tuple.dst.u.tcp.port));
+        pr_debug("SO_ORIGINAL_DST: Can't find %pI4/%u-%pI4/%u.\n",
+                 &tuple.src.u3.ip, ntohs(tuple.src.u.tcp.port),
+                 &tuple.dst.u3.ip, ntohs(tuple.dst.u.tcp.port));
         return -ENOENT;
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 4e8879220222..1fd3ef7718b6 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -272,7 +272,7 @@ static struct ctl_table icmp_sysctl_table[] = {
                 .data           = &nf_ct_icmp_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name = 0
@@ -285,7 +285,7 @@ static struct ctl_table icmp_compat_sysctl_table[] = {
                 .data           = &nf_ct_icmp_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name = 0
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index ee47bf28c825..7e8e6fc75413 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -119,10 +119,9 @@ static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
                                     (ntohl(addr.ip) & 0xff000000) == 0x7f000000)
                                         i = 0;
 
-                                pr_debug("nf_nat_ras: set signal address "
-                                         "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                                         NIPQUAD(addr.ip), port,
-                                         NIPQUAD(ct->tuplehash[!dir].tuple.dst.u3.ip),
+                                pr_debug("nf_nat_ras: set signal address %pI4:%hu->%pI4:%hu\n",
+                                         &addr.ip, port,
+                                         &ct->tuplehash[!dir].tuple.dst.u3.ip,
                                          info->sig_port[!dir]);
                                 return set_h225_addr(skb, data, 0, &taddr[i],
                                                      &ct->tuplehash[!dir].
@@ -131,10 +130,9 @@ static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
                         } else if (addr.ip == ct->tuplehash[dir].tuple.dst.u3.ip &&
                                    port == info->sig_port[dir]) {
                                 /* GK->GW */
-                                pr_debug("nf_nat_ras: set signal address "
-                                         "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                                         NIPQUAD(addr.ip), port,
-                                         NIPQUAD(ct->tuplehash[!dir].tuple.src.u3.ip),
+                                pr_debug("nf_nat_ras: set signal address %pI4:%hu->%pI4:%hu\n",
+                                         &addr.ip, port,
+                                         &ct->tuplehash[!dir].tuple.src.u3.ip,
                                          info->sig_port[!dir]);
                                 return set_h225_addr(skb, data, 0, &taddr[i],
                                                      &ct->tuplehash[!dir].
@@ -162,10 +160,9 @@ static int set_ras_addr(struct sk_buff *skb, struct nf_conn *ct,
                 if (get_h225_addr(ct, *data, &taddr[i], &addr, &port) &&
                     addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
                     port == ct->tuplehash[dir].tuple.src.u.udp.port) {
-                        pr_debug("nf_nat_ras: set rasAddress "
-                                 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                                 NIPQUAD(addr.ip), ntohs(port),
-                                 NIPQUAD(ct->tuplehash[!dir].tuple.dst.u3.ip),
+                        pr_debug("nf_nat_ras: set rasAddress %pI4:%hu->%pI4:%hu\n",
+                                 &addr.ip, ntohs(port),
+                                 &ct->tuplehash[!dir].tuple.dst.u3.ip,
                                  ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port));
                         return set_h225_addr(skb, data, 0, &taddr[i],
                                              &ct->tuplehash[!dir].tuple.dst.u3,
@@ -257,15 +254,15 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Success */
-        pr_debug("nf_nat_h323: expect RTP %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                 NIPQUAD(rtp_exp->tuple.src.u3.ip),
+        pr_debug("nf_nat_h323: expect RTP %pI4:%hu->%pI4:%hu\n",
+                 &rtp_exp->tuple.src.u3.ip,
                  ntohs(rtp_exp->tuple.src.u.udp.port),
-                 NIPQUAD(rtp_exp->tuple.dst.u3.ip),
+                 &rtp_exp->tuple.dst.u3.ip,
                  ntohs(rtp_exp->tuple.dst.u.udp.port));
-        pr_debug("nf_nat_h323: expect RTCP %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                 NIPQUAD(rtcp_exp->tuple.src.u3.ip),
+        pr_debug("nf_nat_h323: expect RTCP %pI4:%hu->%pI4:%hu\n",
+                 &rtcp_exp->tuple.src.u3.ip,
                  ntohs(rtcp_exp->tuple.src.u.udp.port),
-                 NIPQUAD(rtcp_exp->tuple.dst.u3.ip),
+                 &rtcp_exp->tuple.dst.u3.ip,
                  ntohs(rtcp_exp->tuple.dst.u.udp.port));
 
         return 0;
@@ -307,10 +304,10 @@ static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
                 return -1;
         }
 
-        pr_debug("nf_nat_h323: expect T.120 %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                 NIPQUAD(exp->tuple.src.u3.ip),
+        pr_debug("nf_nat_h323: expect T.120 %pI4:%hu->%pI4:%hu\n",
+                 &exp->tuple.src.u3.ip,
                  ntohs(exp->tuple.src.u.tcp.port),
-                 NIPQUAD(exp->tuple.dst.u3.ip),
+                 &exp->tuple.dst.u3.ip,
                  ntohs(exp->tuple.dst.u.tcp.port));
 
         return 0;
@@ -361,10 +358,10 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
                 return -1;
         }
 
-        pr_debug("nf_nat_q931: expect H.245 %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                 NIPQUAD(exp->tuple.src.u3.ip),
+        pr_debug("nf_nat_q931: expect H.245 %pI4:%hu->%pI4:%hu\n",
+                 &exp->tuple.src.u3.ip,
                  ntohs(exp->tuple.src.u.tcp.port),
-                 NIPQUAD(exp->tuple.dst.u3.ip),
+                 &exp->tuple.dst.u3.ip,
                  ntohs(exp->tuple.dst.u.tcp.port));
 
         return 0;
@@ -455,10 +452,10 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Success */
-        pr_debug("nf_nat_ras: expect Q.931 %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                 NIPQUAD(exp->tuple.src.u3.ip),
+        pr_debug("nf_nat_ras: expect Q.931 %pI4:%hu->%pI4:%hu\n",
+                 &exp->tuple.src.u3.ip,
                  ntohs(exp->tuple.src.u.tcp.port),
-                 NIPQUAD(exp->tuple.dst.u3.ip),
+                 &exp->tuple.dst.u3.ip,
                  ntohs(exp->tuple.dst.u.tcp.port));
 
         return 0;
@@ -524,11 +521,10 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Success */
-        pr_debug("nf_nat_q931: expect Call Forwarding "
-                 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
-                 NIPQUAD(exp->tuple.src.u3.ip),
+        pr_debug("nf_nat_q931: expect Call Forwarding %pI4:%hu->%pI4:%hu\n",
+                 &exp->tuple.src.u3.ip,
                  ntohs(exp->tuple.src.u.tcp.port),
-                 NIPQUAD(exp->tuple.dst.u3.ip),
+                 &exp->tuple.dst.u3.ip,
                  ntohs(exp->tuple.dst.u.tcp.port));
 
         return 0;
diff --git a/net/ipv4/netfilter/nf_nat_irc.c b/net/ipv4/netfilter/nf_nat_irc.c
index fe6f9cef6c85..ea83a886b03e 100644
--- a/net/ipv4/netfilter/nf_nat_irc.c
+++ b/net/ipv4/netfilter/nf_nat_irc.c
@@ -55,8 +55,8 @@ static unsigned int help(struct sk_buff *skb,
 
         ip = ntohl(exp->master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip);
         sprintf(buffer, "%u %u", ip, port);
-        pr_debug("nf_nat_irc: inserting '%s' == %u.%u.%u.%u, port %u\n",
-                 buffer, NIPQUAD(ip), port);
+        pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n",
+                 buffer, &ip, port);
 
         ret = nf_nat_mangle_tcp_packet(skb, exp->master, ctinfo,
                                        matchoff, matchlen, buffer,
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index bea54a685109..a4f1c3479e23 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -98,8 +98,7 @@ static void warn_if_extra_mangle(struct net *net, __be32 dstip, __be32 srcip)
 
         if (rt->rt_src != srcip && !warned) {
                 printk("NAT: no longer support implicit source local NAT\n");
-                printk("NAT: packet src %u.%u.%u.%u -> dst %u.%u.%u.%u\n",
-                       NIPQUAD(srcip), NIPQUAD(dstip));
+                printk("NAT: packet src %pI4 -> dst %pI4\n", &srcip, &dstip);
                 warned = 1;
         }
         ip_rt_put(rt);
@@ -166,8 +165,7 @@ alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
         struct nf_nat_range range
                 = { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } };
 
-        pr_debug("Allocating NULL binding for %p (%u.%u.%u.%u)\n",
-                 ct, NIPQUAD(ip));
+        pr_debug("Allocating NULL binding for %p (%pI4)\n", ct, &ip);
         return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 14544320c545..07d61a57613c 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -74,8 +74,7 @@ static int map_addr(struct sk_buff *skb,
         if (newaddr == addr->ip && newport == port)
                 return 1;
 
-        buflen = sprintf(buffer, "%u.%u.%u.%u:%u",
-                         NIPQUAD(newaddr), ntohs(newport));
+        buflen = sprintf(buffer, "%pI4:%u", &newaddr, ntohs(newport));
 
         return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
                              buffer, buflen);
@@ -152,8 +151,8 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                                                &addr) > 0 &&
                     addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
                     addr.ip != ct->tuplehash[!dir].tuple.dst.u3.ip) {
-                        __be32 ip = ct->tuplehash[!dir].tuple.dst.u3.ip;
-                        buflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(ip));
+                        buflen = sprintf(buffer, "%pI4",
+                                        &ct->tuplehash[!dir].tuple.dst.u3.ip);
                         if (!mangle_packet(skb, dptr, datalen, poff, plen,
                                            buffer, buflen))
                                 return NF_DROP;
@@ -166,8 +165,8 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                                                &addr) > 0 &&
                     addr.ip == ct->tuplehash[dir].tuple.dst.u3.ip &&
                     addr.ip != ct->tuplehash[!dir].tuple.src.u3.ip) {
-                        __be32 ip = ct->tuplehash[!dir].tuple.src.u3.ip;
-                        buflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(ip));
+                        buflen = sprintf(buffer, "%pI4",
+                                        &ct->tuplehash[!dir].tuple.src.u3.ip);
                         if (!mangle_packet(skb, dptr, datalen, poff, plen,
                                            buffer, buflen))
                                 return NF_DROP;
@@ -279,8 +278,7 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb,
 
         if (exp->tuple.dst.u3.ip != exp->saved_ip ||
             exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
-                buflen = sprintf(buffer, "%u.%u.%u.%u:%u",
-                                 NIPQUAD(newip), port);
+                buflen = sprintf(buffer, "%pI4:%u", &newip, port);
                 if (!mangle_packet(skb, dptr, datalen, matchoff, matchlen,
                                    buffer, buflen))
                         goto err;
@@ -345,7 +343,7 @@ static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, const char **dptr,
         char buffer[sizeof("nnn.nnn.nnn.nnn")];
         unsigned int buflen;
 
-        buflen = sprintf(buffer, NIPQUAD_FMT, NIPQUAD(addr->ip));
+        buflen = sprintf(buffer, "%pI4", &addr->ip);
         if (mangle_sdp_packet(skb, dptr, dataoff, datalen, type, term,
                               buffer, buflen))
                 return 0;
@@ -380,7 +378,7 @@ static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
         unsigned int buflen;
 
         /* Mangle session description owner and contact addresses */
-        buflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(addr->ip));
+        buflen = sprintf(buffer, "%pI4", &addr->ip);
         if (mangle_sdp_packet(skb, dptr, dataoff, datalen,
                                SDP_HDR_OWNER_IP4, SDP_HDR_MEDIA,
                                buffer, buflen))
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 8303e4b406c0..182f845de92f 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -930,8 +930,8 @@ static inline void mangle_address(unsigned char *begin,
                 }
 
                 if (debug)
-                        printk(KERN_DEBUG "bsalg: mapped %u.%u.%u.%u to "
-                               "%u.%u.%u.%u\n", NIPQUAD(old), NIPQUAD(*addr));
+                        printk(KERN_DEBUG "bsalg: mapped %pI4 to %pI4\n",
+                               &old, addr);
         }
 }
 
@@ -1267,9 +1267,8 @@ static int help(struct sk_buff *skb, unsigned int protoff,
          */
         if (ntohs(udph->len) != skb->len - (iph->ihl << 2)) {
                  if (net_ratelimit())
-                         printk(KERN_WARNING "SNMP: dropping malformed packet "
-                                "src=%u.%u.%u.%u dst=%u.%u.%u.%u\n",
-                                NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
+                         printk(KERN_WARNING "SNMP: dropping malformed packet src=%pI4 dst=%pI4\n",
+                                &iph->saddr, &iph->daddr);
                  return NF_DROP;
         }
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index cd975743bcd2..998fcffc9e15 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -247,7 +247,7 @@ static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info)
         }
 
         if (inet->recverr) {
-                struct iphdr *iph = (struct iphdr*)skb->data;
+                struct iphdr *iph = (struct iphdr *)skb->data;
                 u8 *payload = skb->data + (iph->ihl << 2);
 
                 if (inet->hdrincl)
@@ -465,7 +465,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          */
 
         if (msg->msg_namelen) {
-                struct sockaddr_in *usin = (struct sockaddr_in*)msg->msg_name;
+                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
                 err = -EINVAL;
                 if (msg->msg_namelen < sizeof(*usin))
                         goto out;
@@ -851,7 +851,7 @@ struct proto raw_prot = {
 static struct sock *raw_get_first(struct seq_file *seq)
 {
         struct sock *sk;
-        struct raw_iter_state* state = raw_seq_private(seq);
+        struct raw_iter_state *state = raw_seq_private(seq);
 
         for (state->bucket = 0; state->bucket < RAW_HTABLE_SIZE;
                         ++state->bucket) {
@@ -868,7 +868,7 @@ found:
 
 static struct sock *raw_get_next(struct seq_file *seq, struct sock *sk)
 {
-        struct raw_iter_state* state = raw_seq_private(seq);
+        struct raw_iter_state *state = raw_seq_private(seq);
 
         do {
                 sk = sk_next(sk);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2ea6dcc3e2cc..4e6959c29819 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -129,6 +129,7 @@ static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 static int ip_rt_secret_interval __read_mostly  = 10 * 60 * HZ;
+static int rt_chain_length_max __read_mostly    = 20;
 
 static void rt_worker_func(struct work_struct *work);
 static DECLARE_DELAYED_WORK(expires_work, rt_worker_func);
@@ -145,6 +146,7 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
 static void              ipv4_link_failure(struct sk_buff *skb);
 static void              ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 static int rt_garbage_collect(struct dst_ops *ops);
+static void rt_emergency_hash_rebuild(struct net *net);
 
 
 static struct dst_ops ipv4_dst_ops = {
@@ -158,7 +160,6 @@ static struct dst_ops ipv4_dst_ops = {
         .link_failure =         ipv4_link_failure,
         .update_pmtu =          ip_rt_update_pmtu,
         .local_out =            __ip_local_out,
-        .entry_size =           sizeof(struct rtable),
         .entries =              ATOMIC_INIT(0),
 };
 
@@ -201,6 +202,7 @@ const __u8 ip_tos2prio[16] = {
 struct rt_hash_bucket {
         struct rtable   *chain;
 };
+
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK) || \
         defined(CONFIG_PROVE_LOCKING)
 /*
@@ -674,6 +676,20 @@ static inline u32 rt_score(struct rtable *rt)
         return score;
 }
 
+static inline bool rt_caching(const struct net *net)
+{
+        return net->ipv4.current_rt_cache_rebuild_count <=
+                net->ipv4.sysctl_rt_cache_rebuild_count;
+}
+
+static inline bool compare_hash_inputs(const struct flowi *fl1,
+                                        const struct flowi *fl2)
+{
+        return (__force u32)(((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
+                (fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr) |
+                (fl1->iif ^ fl2->iif)) == 0);
+}
+
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
         return ((__force u32)((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
@@ -753,11 +769,24 @@ static void rt_do_flush(int process_context)
         }
 }
 
+/*
+ * While freeing expired entries, we compute average chain length
+ * and standard deviation, using fixed-point arithmetic.
+ * This to have an estimation of rt_chain_length_max
+ *  rt_chain_length_max = max(elasticity, AVG + 4*SD)
+ * We use 3 bits for frational part, and 29 (or 61) for magnitude.
+ */
+
+#define FRACT_BITS 3
+#define ONE (1UL << FRACT_BITS)
+
 static void rt_check_expire(void)
 {
         static unsigned int rover;
         unsigned int i = rover, goal;
         struct rtable *rth, **rthp;
+        unsigned long length = 0, samples = 0;
+        unsigned long sum = 0, sum2 = 0;
         u64 mult;
 
         mult = ((u64)ip_rt_gc_interval) << rt_hash_log;
@@ -766,6 +795,7 @@ static void rt_check_expire(void)
         goal = (unsigned int)mult;
         if (goal > rt_hash_mask)
                 goal = rt_hash_mask + 1;
+        length = 0;
         for (; goal > 0; goal--) {
                 unsigned long tmo = ip_rt_gc_timeout;
 
@@ -775,6 +805,8 @@ static void rt_check_expire(void)
                 if (need_resched())
                         cond_resched();
 
+                samples++;
+
                 if (*rthp == NULL)
                         continue;
                 spin_lock_bh(rt_hash_lock_addr(i));
@@ -789,11 +821,29 @@ static void rt_check_expire(void)
                                 if (time_before_eq(jiffies, rth->u.dst.expires)) {
                                         tmo >>= 1;
                                         rthp = &rth->u.dst.rt_next;
+                                        /*
+                                         * Only bump our length if the hash
+                                         * inputs on entries n and n+1 are not
+                                         * the same, we only count entries on
+                                         * a chain with equal hash inputs once
+                                         * so that entries for different QOS
+                                         * levels, and other non-hash input
+                                         * attributes don't unfairly skew
+                                         * the length computation
+                                         */
+                                        if ((*rthp == NULL) ||
+                                            !compare_hash_inputs(&(*rthp)->fl,
+                                                                 &rth->fl))
+                                                length += ONE;
                                         continue;
                                 }
                         } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout)) {
                                 tmo >>= 1;
                                 rthp = &rth->u.dst.rt_next;
+                                if ((*rthp == NULL) ||
+                                    !compare_hash_inputs(&(*rthp)->fl,
+                                                         &rth->fl))
+                                        length += ONE;
                                 continue;
                         }
 
@@ -802,6 +852,15 @@ static void rt_check_expire(void)
                         rt_free(rth);
                 }
                 spin_unlock_bh(rt_hash_lock_addr(i));
+                sum += length;
+                sum2 += length*length;
+        }
+        if (samples) {
+                unsigned long avg = sum / samples;
+                unsigned long sd = int_sqrt(sum2 / samples - avg*avg);
+                rt_chain_length_max = max_t(unsigned long,
+                                        ip_rt_gc_elasticity,
+                                        (avg + 4*sd) >> FRACT_BITS);
         }
         rover = i;
 }
@@ -851,6 +910,26 @@ static void rt_secret_rebuild(unsigned long __net)
         mod_timer(&net->ipv4.rt_secret_timer, jiffies + ip_rt_secret_interval);
 }
 
+static void rt_secret_rebuild_oneshot(struct net *net)
+{
+        del_timer_sync(&net->ipv4.rt_secret_timer);
+        rt_cache_invalidate(net);
+        if (ip_rt_secret_interval) {
+                net->ipv4.rt_secret_timer.expires += ip_rt_secret_interval;
+                add_timer(&net->ipv4.rt_secret_timer);
+        }
+}
+
+static void rt_emergency_hash_rebuild(struct net *net)
+{
+        if (net_ratelimit()) {
+                printk(KERN_WARNING "Route hash chain too long!\n");
+                printk(KERN_WARNING "Adjust your secret_interval!\n");
+        }
+
+        rt_secret_rebuild_oneshot(net);
+}
+
 /*
    Short description of GC goals.
 
@@ -989,6 +1068,7 @@ out:	return 0;
 static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 {
         struct rtable   *rth, **rthp;
+        struct rtable   *rthi;
         unsigned long   now;
         struct rtable *cand, **candp;
         u32             min_score;
@@ -1002,7 +1082,13 @@ restart:
         candp = NULL;
         now = jiffies;
 
+        if (!rt_caching(dev_net(rt->u.dst.dev))) {
+                rt_drop(rt);
+                return 0;
+        }
+
         rthp = &rt_hash_table[hash].chain;
+        rthi = NULL;
 
         spin_lock_bh(rt_hash_lock_addr(hash));
         while ((rth = *rthp) != NULL) {
@@ -1048,6 +1134,17 @@ restart:
                 chain_length++;
 
                 rthp = &rth->u.dst.rt_next;
+
+                /*
+                 * check to see if the next entry in the chain
+                 * contains the same hash input values as rt.  If it does
+                 * This is where we will insert into the list, instead of
+                 * at the head.  This groups entries that differ by aspects not
+                 * relvant to the hash function together, which we use to adjust
+                 * our chain length
+                 */
+                if (*rthp && compare_hash_inputs(&(*rthp)->fl, &rt->fl))
+                        rthi = rth;
         }
 
         if (cand) {
@@ -1061,6 +1158,16 @@ restart:
                         *candp = cand->u.dst.rt_next;
                         rt_free(cand);
                 }
+        } else {
+                if (chain_length > rt_chain_length_max) {
+                        struct net *net = dev_net(rt->u.dst.dev);
+                        int num = ++net->ipv4.current_rt_cache_rebuild_count;
+                        if (!rt_caching(dev_net(rt->u.dst.dev))) {
+                                printk(KERN_WARNING "%s: %d rebuilds is over limit, route caching disabled\n",
+                                        rt->u.dst.dev->name, num);
+                        }
+                        rt_emergency_hash_rebuild(dev_net(rt->u.dst.dev));
+                }
         }
 
         /* Try to bind route to arp only if it is output
@@ -1098,14 +1205,17 @@ restart:
                 }
         }
 
-        rt->u.dst.rt_next = rt_hash_table[hash].chain;
+        if (rthi)
+                rt->u.dst.rt_next = rthi->u.dst.rt_next;
+        else
+                rt->u.dst.rt_next = rt_hash_table[hash].chain;
+
 #if RT_CACHE_DEBUG >= 2
         if (rt->u.dst.rt_next) {
                 struct rtable *trt;
-                printk(KERN_DEBUG "rt_cache @%02x: " NIPQUAD_FMT, hash,
-                       NIPQUAD(rt->rt_dst));
+                printk(KERN_DEBUG "rt_cache @%02x: %pI4", hash, &rt->rt_dst);
                 for (trt = rt->u.dst.rt_next; trt; trt = trt->u.dst.rt_next)
-                        printk(" . " NIPQUAD_FMT, NIPQUAD(trt->rt_dst));
+                        printk(" . %pI4", &trt->rt_dst);
                 printk("\n");
         }
 #endif
@@ -1114,7 +1224,11 @@ restart:
          * previous writes to rt are comitted to memory
          * before making rt visible to other CPUS.
          */
-        rcu_assign_pointer(rt_hash_table[hash].chain, rt);
+        if (rthi)
+                rcu_assign_pointer(rthi->u.dst.rt_next, rt);
+        else
+                rcu_assign_pointer(rt_hash_table[hash].chain, rt);
+
         spin_unlock_bh(rt_hash_lock_addr(hash));
         *rp = rt;
         return 0;
@@ -1217,6 +1331,9 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
             || ipv4_is_zeronet(new_gw))
                 goto reject_redirect;
 
+        if (!rt_caching(net))
+                goto reject_redirect;
+
         if (!IN_DEV_SHARED_MEDIA(in_dev)) {
                 if (!inet_addr_onlink(in_dev, new_gw, old_gw))
                         goto reject_redirect;
@@ -1267,7 +1384,6 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
 
                                 /* Copy all the information. */
                                 *rt = *rth;
-                                INIT_RCU_HEAD(&rt->u.dst.rcu_head);
                                 rt->u.dst.__use         = 1;
                                 atomic_set(&rt->u.dst.__refcnt, 1);
                                 rt->u.dst.child         = NULL;
@@ -1280,7 +1396,9 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                 rt->u.dst.path          = &rt->u.dst;
                                 rt->u.dst.neighbour     = NULL;
                                 rt->u.dst.hh            = NULL;
+#ifdef CONFIG_XFRM
                                 rt->u.dst.xfrm          = NULL;
+#endif
                                 rt->rt_genid            = rt_genid(net);
                                 rt->rt_flags            |= RTCF_REDIRECTED;
 
@@ -1324,11 +1442,10 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
 reject_redirect:
 #ifdef CONFIG_IP_ROUTE_VERBOSE
         if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit())
-                printk(KERN_INFO "Redirect from " NIPQUAD_FMT " on %s about "
-                        NIPQUAD_FMT " ignored.\n"
-                        "  Advised path = " NIPQUAD_FMT " -> " NIPQUAD_FMT "\n",
-                       NIPQUAD(old_gw), dev->name, NIPQUAD(new_gw),
-                       NIPQUAD(saddr), NIPQUAD(daddr));
+                printk(KERN_INFO "Redirect from %pI4 on %s about %pI4 ignored.\n"
+                        "  Advised path = %pI4 -> %pI4\n",
+                       &old_gw, dev->name, &new_gw,
+                       &saddr, &daddr);
 #endif
         in_dev_put(in_dev);
 }
@@ -1348,9 +1465,8 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
                                                 rt->fl.oif,
                                                 rt_genid(dev_net(dst->dev)));
 #if RT_CACHE_DEBUG >= 1
-                        printk(KERN_DEBUG "ipv4_negative_advice: redirect to "
-                                          NIPQUAD_FMT "/%02x dropped\n",
-                                NIPQUAD(rt->rt_dst), rt->fl.fl4_tos);
+                        printk(KERN_DEBUG "ipv4_negative_advice: redirect to %pI4/%02x dropped\n",
+                                &rt->rt_dst, rt->fl.fl4_tos);
 #endif
                         rt_del(hash, rt);
                         ret = NULL;
@@ -1414,10 +1530,9 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                 if (IN_DEV_LOG_MARTIANS(in_dev) &&
                     rt->u.dst.rate_tokens == ip_rt_redirect_number &&
                     net_ratelimit())
-                        printk(KERN_WARNING "host " NIPQUAD_FMT "/if%d ignores "
-                                "redirects for " NIPQUAD_FMT " to " NIPQUAD_FMT ".\n",
-                                NIPQUAD(rt->rt_src), rt->rt_iif,
-                                NIPQUAD(rt->rt_dst), NIPQUAD(rt->rt_gateway));
+                        printk(KERN_WARNING "host %pI4/if%d ignores redirects for %pI4 to %pI4.\n",
+                                &rt->rt_src, rt->rt_iif,
+                                &rt->rt_dst, &rt->rt_gateway);
 #endif
         }
 out:
@@ -1610,8 +1725,8 @@ static void ipv4_link_failure(struct sk_buff *skb)
 
 static int ip_rt_bug(struct sk_buff *skb)
 {
-        printk(KERN_DEBUG "ip_rt_bug: " NIPQUAD_FMT " -> " NIPQUAD_FMT ", %s\n",
-                NIPQUAD(ip_hdr(skb)->saddr), NIPQUAD(ip_hdr(skb)->daddr),
+        printk(KERN_DEBUG "ip_rt_bug: %pI4 -> %pI4, %s\n",
+                &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
                 skb->dev ? skb->dev->name : "?");
         kfree_skb(skb);
         return 0;
@@ -1788,9 +1903,8 @@ static void ip_handle_martian_source(struct net_device *dev,
                  *      RFC1812 recommendation, if source is martian,
                  *      the only hint is MAC header.
                  */
-                printk(KERN_WARNING "martian source " NIPQUAD_FMT " from "
-                        NIPQUAD_FMT", on dev %s\n",
-                        NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
+                printk(KERN_WARNING "martian source %pI4 from %pI4, on dev %s\n",
+                        &daddr, &saddr, dev->name);
                 if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
                         int i;
                         const unsigned char *p = skb_mac_header(skb);
@@ -2099,9 +2213,8 @@ martian_destination:
         RT_CACHE_STAT_INC(in_martian_dst);
 #ifdef CONFIG_IP_ROUTE_VERBOSE
         if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit())
-                printk(KERN_WARNING "martian destination " NIPQUAD_FMT " from "
-                        NIPQUAD_FMT ", dev %s\n",
-                        NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
+                printk(KERN_WARNING "martian destination %pI4 from %pI4, dev %s\n",
+                        &daddr, &saddr, dev->name);
 #endif
 
 e_hostunreach:
@@ -2130,6 +2243,10 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         struct net *net;
 
         net = dev_net(dev);
+
+        if (!rt_caching(net))
+                goto skip_cache;
+
         tos &= IPTOS_RT_MASK;
         hash = rt_hash(daddr, saddr, iif, rt_genid(net));
 
@@ -2154,6 +2271,7 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         }
         rcu_read_unlock();
 
+skip_cache:
         /* Multicast recognition logic is moved from route cache to here.
            The problem was that too many Ethernet cards have broken/missing
            hardware multicast filters :-( As result the host on multicasting
@@ -2539,6 +2657,9 @@ int __ip_route_output_key(struct net *net, struct rtable **rp,
         unsigned hash;
         struct rtable *rth;
 
+        if (!rt_caching(net))
+                goto slow_output;
+
         hash = rt_hash(flp->fl4_dst, flp->fl4_src, flp->oif, rt_genid(net));
 
         rcu_read_lock_bh();
@@ -2563,6 +2684,7 @@ int __ip_route_output_key(struct net *net, struct rtable **rp,
         }
         rcu_read_unlock_bh();
 
+slow_output:
         return ip_route_output_slow(net, rp, flp);
 }
 
@@ -2578,7 +2700,6 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .destroy                =       ipv4_dst_destroy,
         .check                  =       ipv4_dst_check,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
-        .entry_size             =       sizeof(struct rtable),
         .entries                =       ATOMIC_INIT(0),
 };
 
@@ -2995,7 +3116,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ipv4_dst_ops.gc_thresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_MAX_SIZE,
@@ -3003,7 +3124,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_max_size,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 /*  Deprecated. Use gc_min_interval_ms */
@@ -3013,8 +3134,8 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_gc_min_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_GC_MIN_INTERVAL_MS,
@@ -3022,8 +3143,8 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_gc_min_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_ms_jiffies,
-                .strategy       = &sysctl_ms_jiffies,
+                .proc_handler   = proc_dointvec_ms_jiffies,
+                .strategy       = sysctl_ms_jiffies,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_GC_TIMEOUT,
@@ -3031,8 +3152,8 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_gc_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_GC_INTERVAL,
@@ -3040,8 +3161,8 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_gc_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_REDIRECT_LOAD,
@@ -3049,7 +3170,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_redirect_load,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_REDIRECT_NUMBER,
@@ -3057,7 +3178,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_redirect_number,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_REDIRECT_SILENCE,
@@ -3065,7 +3186,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_redirect_silence,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_ERROR_COST,
@@ -3073,7 +3194,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_error_cost,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_ERROR_BURST,
@@ -3081,7 +3202,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_error_burst,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_GC_ELASTICITY,
@@ -3089,7 +3210,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_gc_elasticity,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_MTU_EXPIRES,
@@ -3097,8 +3218,8 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_mtu_expires,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_MIN_PMTU,
@@ -3106,7 +3227,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_min_pmtu,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_MIN_ADVMSS,
@@ -3114,7 +3235,7 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_min_advmss,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_ROUTE_SECRET_INTERVAL,
@@ -3122,8 +3243,8 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &ipv4_sysctl_rt_secret_interval,
-                .strategy       = &ipv4_sysctl_rt_secret_interval_strategy,
+                .proc_handler   = ipv4_sysctl_rt_secret_interval,
+                .strategy       = ipv4_sysctl_rt_secret_interval_strategy,
         },
         { .ctl_name = 0 }
 };
@@ -3151,8 +3272,8 @@ static struct ctl_table ipv4_route_flush_table[] = {
                 .procname       = "flush",
                 .maxlen         = sizeof(int),
                 .mode           = 0200,
-                .proc_handler   = &ipv4_sysctl_rtcache_flush,
-                .strategy       = &ipv4_sysctl_rtcache_flush_strategy,
+                .proc_handler   = ipv4_sysctl_rtcache_flush,
+                .strategy       = ipv4_sysctl_rtcache_flush_strategy,
         },
         { .ctl_name = 0 },
 };
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 1bb10df8ce7d..4710d219f06a 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -195,7 +195,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_timestamps,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_TCP_WINDOW_SCALING,
@@ -203,7 +203,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_window_scaling,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_TCP_SACK,
@@ -211,7 +211,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_sack,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_TCP_RETRANS_COLLAPSE,
@@ -219,7 +219,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_retrans_collapse,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_DEFAULT_TTL,
@@ -227,8 +227,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_ip_default_ttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &ipv4_doint_and_flush,
-                .strategy       = &ipv4_doint_and_flush_strategy,
+                .proc_handler   = ipv4_doint_and_flush,
+                .strategy       = ipv4_doint_and_flush_strategy,
                 .extra2         = &init_net,
         },
         {
@@ -237,7 +237,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &ipv4_config.no_pmtu_disc,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_NONLOCAL_BIND,
@@ -245,7 +245,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_ip_nonlocal_bind,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_TCP_SYN_RETRIES,
@@ -253,7 +253,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_SYNACK_RETRIES,
@@ -261,7 +261,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_synack_retries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_MAX_ORPHANS,
@@ -269,7 +269,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_max_orphans,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_MAX_TW_BUCKETS,
@@ -277,7 +277,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &tcp_death_row.sysctl_max_tw_buckets,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_DYNADDR,
@@ -285,7 +285,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_ip_dynaddr,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_TCP_KEEPALIVE_TIME,
@@ -293,8 +293,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_keepalive_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         {
                 .ctl_name       = NET_IPV4_TCP_KEEPALIVE_PROBES,
@@ -302,7 +302,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_keepalive_probes,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_TCP_KEEPALIVE_INTVL,
@@ -310,8 +310,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_keepalive_intvl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         {
                 .ctl_name       = NET_IPV4_TCP_RETRIES1,
@@ -319,8 +319,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_retries1,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra2         = &tcp_retr1_max
         },
         {
@@ -329,7 +329,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_retries2,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_TCP_FIN_TIMEOUT,
@@ -337,8 +337,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_fin_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
 #ifdef CONFIG_SYN_COOKIES
         {
@@ -347,7 +347,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_syncookies,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #endif
         {
@@ -356,7 +356,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &tcp_death_row.sysctl_tw_recycle,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_ABORT_ON_OVERFLOW,
@@ -364,7 +364,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_abort_on_overflow,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_STDURG,
@@ -372,7 +372,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_stdurg,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_RFC1337,
@@ -380,7 +380,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_rfc1337,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_MAX_SYN_BACKLOG,
@@ -388,7 +388,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_max_syn_backlog,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_LOCAL_PORT_RANGE,
@@ -396,8 +396,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_local_ports.range,
                 .maxlen         = sizeof(sysctl_local_ports.range),
                 .mode           = 0644,
-                .proc_handler   = &ipv4_local_port_range,
-                .strategy       = &ipv4_sysctl_local_port_range,
+                .proc_handler   = ipv4_local_port_range,
+                .strategy       = ipv4_sysctl_local_port_range,
         },
 #ifdef CONFIG_IP_MULTICAST
         {
@@ -406,7 +406,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_igmp_max_memberships,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 
 #endif
@@ -416,7 +416,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_igmp_max_msf,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_INET_PEER_THRESHOLD,
@@ -424,7 +424,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &inet_peer_threshold,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_INET_PEER_MINTTL,
@@ -432,8 +432,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &inet_peer_minttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         {
                 .ctl_name       = NET_IPV4_INET_PEER_MAXTTL,
@@ -441,8 +441,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &inet_peer_maxttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         {
                 .ctl_name       = NET_IPV4_INET_PEER_GC_MINTIME,
@@ -450,8 +450,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &inet_peer_gc_mintime,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         {
                 .ctl_name       = NET_IPV4_INET_PEER_GC_MAXTIME,
@@ -459,8 +459,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &inet_peer_gc_maxtime,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         {
                 .ctl_name       = NET_TCP_ORPHAN_RETRIES,
@@ -468,7 +468,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_orphan_retries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_FACK,
@@ -476,7 +476,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_fack,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_REORDERING,
@@ -484,7 +484,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_reordering,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_ECN,
@@ -492,7 +492,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_ecn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_DSACK,
@@ -500,7 +500,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_dsack,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_MEM,
@@ -508,7 +508,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_mem,
                 .maxlen         = sizeof(sysctl_tcp_mem),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_WMEM,
@@ -516,7 +516,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_wmem,
                 .maxlen         = sizeof(sysctl_tcp_wmem),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_RMEM,
@@ -524,7 +524,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_rmem,
                 .maxlen         = sizeof(sysctl_tcp_rmem),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_APP_WIN,
@@ -532,7 +532,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_app_win,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_ADV_WIN_SCALE,
@@ -540,7 +540,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_adv_win_scale,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_TW_REUSE,
@@ -548,7 +548,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_tw_reuse,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_FRTO,
@@ -556,7 +556,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_frto,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_FRTO_RESPONSE,
@@ -564,7 +564,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_frto_response,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_LOW_LATENCY,
@@ -572,7 +572,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_low_latency,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_TCP_NO_METRICS_SAVE,
@@ -580,7 +580,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_nometrics_save,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_TCP_MODERATE_RCVBUF,
@@ -588,7 +588,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_moderate_rcvbuf,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_TCP_TSO_WIN_DIVISOR,
@@ -596,15 +596,15 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_tso_win_divisor,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_TCP_CONG_CONTROL,
                 .procname       = "tcp_congestion_control",
                 .mode           = 0644,
                 .maxlen         = TCP_CA_NAME_MAX,
-                .proc_handler   = &proc_tcp_congestion_control,
-                .strategy       = &sysctl_tcp_congestion_control,
+                .proc_handler   = proc_tcp_congestion_control,
+                .strategy       = sysctl_tcp_congestion_control,
         },
         {
                 .ctl_name       = NET_TCP_ABC,
@@ -612,7 +612,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_abc,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_TCP_MTU_PROBING,
@@ -620,7 +620,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_mtu_probing,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_TCP_BASE_MSS,
@@ -628,7 +628,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_base_mss,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_TCP_WORKAROUND_SIGNED_WINDOWS,
@@ -636,7 +636,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_workaround_signed_windows,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #ifdef CONFIG_NET_DMA
         {
@@ -645,7 +645,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_dma_copybreak,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #endif
         {
@@ -654,7 +654,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_slow_start_after_idle,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #ifdef CONFIG_NETLABEL
         {
@@ -663,7 +663,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &cipso_v4_cache_enabled,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_CIPSOV4_CACHE_BUCKET_SIZE,
@@ -671,7 +671,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &cipso_v4_cache_bucketsize,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_CIPSOV4_RBM_OPTFMT,
@@ -679,7 +679,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &cipso_v4_rbm_optfmt,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_CIPSOV4_RBM_STRICTVALID,
@@ -687,22 +687,22 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &cipso_v4_rbm_strictvalid,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
 #endif /* CONFIG_NETLABEL */
         {
                 .procname       = "tcp_available_congestion_control",
                 .maxlen         = TCP_CA_BUF_MAX,
                 .mode           = 0444,
-                .proc_handler   = &proc_tcp_available_congestion_control,
+                .proc_handler   = proc_tcp_available_congestion_control,
         },
         {
                 .ctl_name       = NET_TCP_ALLOWED_CONG_CONTROL,
                 .procname       = "tcp_allowed_congestion_control",
                 .maxlen         = TCP_CA_BUF_MAX,
                 .mode           = 0644,
-                .proc_handler   = &proc_allowed_congestion_control,
-                .strategy       = &strategy_allowed_congestion_control,
+                .proc_handler   = proc_allowed_congestion_control,
+                .strategy       = strategy_allowed_congestion_control,
         },
         {
                 .ctl_name       = NET_TCP_MAX_SSTHRESH,
@@ -710,7 +710,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_max_ssthresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -718,8 +718,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
         {
@@ -728,8 +728,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_udp_rmem_min,
                 .maxlen         = sizeof(sysctl_udp_rmem_min),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
         {
@@ -738,8 +738,8 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_udp_wmem_min,
                 .maxlen         = sizeof(sysctl_udp_wmem_min),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
         { .ctl_name = 0 }
@@ -752,7 +752,7 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_icmp_echo_ignore_all,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_ICMP_ECHO_IGNORE_BROADCASTS,
@@ -760,7 +760,7 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_ICMP_IGNORE_BOGUS_ERROR_RESPONSES,
@@ -768,7 +768,7 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_ICMP_ERRORS_USE_INBOUND_IFADDR,
@@ -776,7 +776,7 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV4_ICMP_RATELIMIT,
@@ -784,8 +784,8 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_icmp_ratelimit,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_ms_jiffies,
-                .strategy       = &sysctl_ms_jiffies
+                .proc_handler   = proc_dointvec_ms_jiffies,
+                .strategy       = sysctl_ms_jiffies
         },
         {
                 .ctl_name       = NET_IPV4_ICMP_RATEMASK,
@@ -793,7 +793,15 @@ static struct ctl_table ipv4_net_table[] = {
                 .data           = &init_net.ipv4.sysctl_icmp_ratemask,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "rt_cache_rebuild_count",
+                .data           = &init_net.ipv4.sysctl_rt_cache_rebuild_count,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
         },
         { }
 };
@@ -827,8 +835,12 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
                         &net->ipv4.sysctl_icmp_ratelimit;
                 table[5].data =
                         &net->ipv4.sysctl_icmp_ratemask;
+                table[6].data =
+                        &net->ipv4.sysctl_rt_cache_rebuild_count;
         }
 
+        net->ipv4.sysctl_rt_cache_rebuild_count = 4;
+
         net->ipv4.ipv4_hdr = register_net_sysctl_table(net,
                         net_ipv4_ctl_path, table);
         if (net->ipv4.ipv4_hdr == NULL)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c5aca0bb116a..044224a341eb 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1680,7 +1680,7 @@ void tcp_set_state(struct sock *sk, int state)
                         inet_put_port(sk);
                 /* fall through */
         default:
-                if (oldstate==TCP_ESTABLISHED)
+                if (oldstate == TCP_ESTABLISHED)
                         TCP_DEC_STATS(sock_net(sk), TCP_MIB_CURRESTAB);
         }
 
@@ -1690,7 +1690,7 @@ void tcp_set_state(struct sock *sk, int state)
         sk->sk_state = state;
 
 #ifdef STATE_TRACE
-        SOCK_DEBUG(sk, "TCP sk=%p, State %s -> %s\n",sk, statename[oldstate],statename[state]);
+        SOCK_DEBUG(sk, "TCP sk=%p, State %s -> %s\n", sk, statename[oldstate], statename[state]);
 #endif
 }
 EXPORT_SYMBOL_GPL(tcp_set_state);
@@ -2650,7 +2650,7 @@ EXPORT_SYMBOL(tcp_md5_hash_key);
 
 void tcp_done(struct sock *sk)
 {
-        if(sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
+        if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
 
         tcp_set_state(sk, TCP_CLOSE);
@@ -2707,8 +2707,8 @@ void __init tcp_init(void)
                                         thash_entries ? 0 : 512 * 1024);
         tcp_hashinfo.ehash_size = 1 << tcp_hashinfo.ehash_size;
         for (i = 0; i < tcp_hashinfo.ehash_size; i++) {
-                INIT_HLIST_HEAD(&tcp_hashinfo.ehash[i].chain);
-                INIT_HLIST_HEAD(&tcp_hashinfo.ehash[i].twchain);
+                INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
+                INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].twchain, i);
         }
         if (inet_ehash_locks_alloc(&tcp_hashinfo))
                 panic("TCP: failed to alloc ehash_locks");
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 4a1221e5e8ee..ee467ec40c4f 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -1,13 +1,23 @@
 /*
- * TCP CUBIC: Binary Increase Congestion control for TCP v2.2
+ * TCP CUBIC: Binary Increase Congestion control for TCP v2.3
  * Home page:
  *      http://netsrv.csc.ncsu.edu/twiki/bin/view/Main/BIC
  * This is from the implementation of CUBIC TCP in
- * Injong Rhee, Lisong Xu.
- *  "CUBIC: A New TCP-Friendly High-Speed TCP Variant
- *  in PFLDnet 2005
+ * Sangtae Ha, Injong Rhee and Lisong Xu,
+ *  "CUBIC: A New TCP-Friendly High-Speed TCP Variant"
+ *  in ACM SIGOPS Operating System Review, July 2008.
  * Available from:
- *  http://netsrv.csc.ncsu.edu/export/cubic-paper.pdf
+ *  http://netsrv.csc.ncsu.edu/export/cubic_a_new_tcp_2008.pdf
+ *
+ * CUBIC integrates a new slow start algorithm, called HyStart.
+ * The details of HyStart are presented in
+ *  Sangtae Ha and Injong Rhee,
+ *  "Taming the Elephants: New TCP Slow Start", NCSU TechReport 2008.
+ * Available from:
+ *  http://netsrv.csc.ncsu.edu/export/hystart_techreport_2008.pdf
+ *
+ * All testing results are available from:
+ * http://netsrv.csc.ncsu.edu/wiki/index.php/TCP_Testing
  *
  * Unless CUBIC is enabled and congestion window is large
  * this behaves the same as the original Reno.
@@ -23,12 +33,26 @@
                                          */
 #define BICTCP_HZ               10      /* BIC HZ 2^10 = 1024 */
 
+/* Two methods of hybrid slow start */
+#define HYSTART_ACK_TRAIN       0x1
+#define HYSTART_DELAY           0x2
+
+/* Number of delay samples for detecting the increase of delay */
+#define HYSTART_MIN_SAMPLES     8
+#define HYSTART_DELAY_MIN       (2U<<3)
+#define HYSTART_DELAY_MAX       (16U<<3)
+#define HYSTART_DELAY_THRESH(x) clamp(x, HYSTART_DELAY_MIN, HYSTART_DELAY_MAX)
+
 static int fast_convergence __read_mostly = 1;
 static int beta __read_mostly = 717;    /* = 717/1024 (BICTCP_BETA_SCALE) */
 static int initial_ssthresh __read_mostly;
 static int bic_scale __read_mostly = 41;
 static int tcp_friendliness __read_mostly = 1;
 
+static int hystart __read_mostly = 1;
+static int hystart_detect __read_mostly = HYSTART_ACK_TRAIN | HYSTART_DELAY;
+static int hystart_low_window __read_mostly = 16;
+
 static u32 cube_rtt_scale __read_mostly;
 static u32 beta_scale __read_mostly;
 static u64 cube_factor __read_mostly;
@@ -44,6 +68,13 @@ module_param(bic_scale, int, 0444);
 MODULE_PARM_DESC(bic_scale, "scale (scaled by 1024) value for bic function (bic_scale/1024)");
 module_param(tcp_friendliness, int, 0644);
 MODULE_PARM_DESC(tcp_friendliness, "turn on/off tcp friendliness");
+module_param(hystart, int, 0644);
+MODULE_PARM_DESC(hystart, "turn on/off hybrid slow start algorithm");
+module_param(hystart_detect, int, 0644);
+MODULE_PARM_DESC(hystart_detect, "hyrbrid slow start detection mechanisms"
+                 " 1: packet-train 2: delay 3: both packet-train and delay");
+module_param(hystart_low_window, int, 0644);
+MODULE_PARM_DESC(hystart_low_window, "lower bound cwnd for hybrid slow start");
 
 /* BIC TCP Parameters */
 struct bictcp {
@@ -59,7 +90,13 @@ struct bictcp {
         u32     ack_cnt;        /* number of acks */
         u32     tcp_cwnd;       /* estimated tcp cwnd */
 #define ACK_RATIO_SHIFT 4
-        u32     delayed_ack;    /* estimate the ratio of Packets/ACKs << 4 */
+        u16     delayed_ack;    /* estimate the ratio of Packets/ACKs << 4 */
+        u8      sample_cnt;     /* number of samples to decide curr_rtt */
+        u8      found;          /* the exit point is found? */
+        u32     round_start;    /* beginning of each round */
+        u32     end_seq;        /* end_seq of the round */
+        u32     last_jiffies;   /* last time when the ACK spacing is close */
+        u32     curr_rtt;       /* the minimum rtt of current round */
 };
 
 static inline void bictcp_reset(struct bictcp *ca)
@@ -76,12 +113,28 @@ static inline void bictcp_reset(struct bictcp *ca)
         ca->delayed_ack = 2 << ACK_RATIO_SHIFT;
         ca->ack_cnt = 0;
         ca->tcp_cwnd = 0;
+        ca->found = 0;
+}
+
+static inline void bictcp_hystart_reset(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct bictcp *ca = inet_csk_ca(sk);
+
+        ca->round_start = ca->last_jiffies = jiffies;
+        ca->end_seq = tp->snd_nxt;
+        ca->curr_rtt = 0;
+        ca->sample_cnt = 0;
 }
 
 static void bictcp_init(struct sock *sk)
 {
         bictcp_reset(inet_csk_ca(sk));
-        if (initial_ssthresh)
+
+        if (hystart)
+                bictcp_hystart_reset(sk);
+
+        if (!hystart && initial_ssthresh)
                 tcp_sk(sk)->snd_ssthresh = initial_ssthresh;
 }
 
@@ -235,9 +288,11 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
         if (!tcp_is_cwnd_limited(sk, in_flight))
                 return;
 
-        if (tp->snd_cwnd <= tp->snd_ssthresh)
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                if (hystart && after(ack, ca->end_seq))
+                        bictcp_hystart_reset(sk);
                 tcp_slow_start(tp);
-        else {
+        } else {
                 bictcp_update(ca, tp->snd_cwnd);
 
                 /* In dangerous area, increase slowly.
@@ -281,8 +336,45 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 
 static void bictcp_state(struct sock *sk, u8 new_state)
 {
-        if (new_state == TCP_CA_Loss)
+        if (new_state == TCP_CA_Loss) {
                 bictcp_reset(inet_csk_ca(sk));
+                bictcp_hystart_reset(sk);
+        }
+}
+
+static void hystart_update(struct sock *sk, u32 delay)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct bictcp *ca = inet_csk_ca(sk);
+
+        if (!(ca->found & hystart_detect)) {
+                u32 curr_jiffies = jiffies;
+
+                /* first detection parameter - ack-train detection */
+                if (curr_jiffies - ca->last_jiffies <= msecs_to_jiffies(2)) {
+                        ca->last_jiffies = curr_jiffies;
+                        if (curr_jiffies - ca->round_start >= ca->delay_min>>4)
+                                ca->found |= HYSTART_ACK_TRAIN;
+                }
+
+                /* obtain the minimum delay of more than sampling packets */
+                if (ca->sample_cnt < HYSTART_MIN_SAMPLES) {
+                        if (ca->curr_rtt == 0 || ca->curr_rtt > delay)
+                                ca->curr_rtt = delay;
+
+                        ca->sample_cnt++;
+                } else {
+                        if (ca->curr_rtt > ca->delay_min +
+                            HYSTART_DELAY_THRESH(ca->delay_min>>4))
+                                ca->found |= HYSTART_DELAY;
+                }
+                /*
+                 * Either one of two conditions are met,
+                 * we exit from slow start immediately.
+                 */
+                if (ca->found & hystart_detect)
+                        tp->snd_ssthresh = tp->snd_cwnd;
+        }
 }
 
 /* Track delayed acknowledgment ratio using sliding window
@@ -291,6 +383,7 @@ static void bictcp_state(struct sock *sk, u8 new_state)
 static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
         struct bictcp *ca = inet_csk_ca(sk);
         u32 delay;
 
@@ -314,6 +407,11 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
         /* first time call or link delay decreases */
         if (ca->delay_min == 0 || ca->delay_min > delay)
                 ca->delay_min = delay;
+
+        /* hystart triggers when cwnd is larger than some threshold */
+        if (hystart && tp->snd_cwnd <= tp->snd_ssthresh &&
+            tp->snd_cwnd >= hystart_low_window)
+                hystart_update(sk, delay);
 }
 
 static struct tcp_congestion_ops cubictcp = {
@@ -372,4 +470,4 @@ module_exit(cubictcp_unregister);
 MODULE_AUTHOR("Sangtae Ha, Stephen Hemminger");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("CUBIC TCP");
-MODULE_VERSION("2.2");
+MODULE_VERSION("2.3");
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 838d491dfda7..fcbcd4ff6c5f 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -34,7 +34,7 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                 tcp_get_info(sk, info);
 }
 
-static struct inet_diag_handler tcp_diag_handler = {
+static const struct inet_diag_handler tcp_diag_handler = {
         .idiag_hashinfo  = &tcp_hashinfo,
         .idiag_get_info  = tcp_diag_get_info,
         .idiag_type      = TCPDIAG_GETSOCK,
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d77c0d29e239..097294b7da3e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2336,9 +2336,9 @@ static void DBGUNDO(struct sock *sk, const char *msg)
         struct inet_sock *inet = inet_sk(sk);
 
         if (sk->sk_family == AF_INET) {
-                printk(KERN_DEBUG "Undo %s " NIPQUAD_FMT "/%u c%u l%u ss%u/%u p%u\n",
+                printk(KERN_DEBUG "Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n",
                        msg,
-                       NIPQUAD(inet->daddr), ntohs(inet->dport),
+                       &inet->daddr, ntohs(inet->dport),
                        tp->snd_cwnd, tcp_left_out(tp),
                        tp->snd_ssthresh, tp->prior_ssthresh,
                        tp->packets_out);
@@ -2346,9 +2346,9 @@ static void DBGUNDO(struct sock *sk, const char *msg)
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         else if (sk->sk_family == AF_INET6) {
                 struct ipv6_pinfo *np = inet6_sk(sk);
-                printk(KERN_DEBUG "Undo %s " NIP6_FMT "/%u c%u l%u ss%u/%u p%u\n",
+                printk(KERN_DEBUG "Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
                        msg,
-                       NIP6(np->daddr), ntohs(inet->dport),
+                       &np->daddr, ntohs(inet->dport),
                        tp->snd_cwnd, tcp_left_out(tp),
                        tp->snd_ssthresh, tp->prior_ssthresh,
                        tp->packets_out);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5c8fa7f1e327..330b08a12274 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -97,11 +97,7 @@ struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, __be32 addr)
 }
 #endif
 
-struct inet_hashinfo __cacheline_aligned tcp_hashinfo = {
-        .lhash_lock  = __RW_LOCK_UNLOCKED(tcp_hashinfo.lhash_lock),
-        .lhash_users = ATOMIC_INIT(0),
-        .lhash_wait  = __WAIT_QUEUE_HEAD_INITIALIZER(tcp_hashinfo.lhash_wait),
-};
+struct inet_hashinfo tcp_hashinfo;
 
 static inline __u32 tcp_v4_init_sequence(struct sk_buff *skb)
 {
@@ -492,7 +488,7 @@ void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb)
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
                 th->check = tcp_v4_check(len, inet->saddr, inet->daddr,
-                                         csum_partial((char *)th,
+                                         csum_partial(th,
                                                       th->doff << 2,
                                                       skb->csum));
         }
@@ -726,7 +722,7 @@ static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
                 th->check = tcp_v4_check(skb->len,
                                          ireq->loc_addr,
                                          ireq->rmt_addr,
-                                         csum_partial((char *)th, skb->len,
+                                         csum_partial(th, skb->len,
                                                       skb->csum));
 
                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
@@ -1139,10 +1135,9 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                 if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash failed for "
-                               "(" NIPQUAD_FMT ", %d)->(" NIPQUAD_FMT ", %d)%s\n",
-                               NIPQUAD(iph->saddr), ntohs(th->source),
-                               NIPQUAD(iph->daddr), ntohs(th->dest),
+                        printk(KERN_INFO "MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s\n",
+                               &iph->saddr, ntohs(th->source),
+                               &iph->daddr, ntohs(th->dest),
                                genhash ? " tcp_v4_calc_md5_hash failed" : "");
                 }
                 return 1;
@@ -1297,10 +1292,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                          * to destinations, already remembered
                          * to the moment of synflood.
                          */
-                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open "
-                                       "request from " NIPQUAD_FMT "/%u\n",
-                                       NIPQUAD(saddr),
-                                       ntohs(tcp_hdr(skb)->source));
+                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI4/%u\n",
+                                       &saddr, ntohs(tcp_hdr(skb)->source));
                         goto drop_and_release;
                 }
 
@@ -1860,16 +1853,16 @@ EXPORT_SYMBOL(tcp_v4_destroy_sock);
 #ifdef CONFIG_PROC_FS
 /* Proc filesystem TCP sock list dumping. */
 
-static inline struct inet_timewait_sock *tw_head(struct hlist_head *head)
+static inline struct inet_timewait_sock *tw_head(struct hlist_nulls_head *head)
 {
-        return hlist_empty(head) ? NULL :
+        return hlist_nulls_empty(head) ? NULL :
                 list_entry(head->first, struct inet_timewait_sock, tw_node);
 }
 
 static inline struct inet_timewait_sock *tw_next(struct inet_timewait_sock *tw)
 {
-        return tw->tw_node.next ?
-                hlist_entry(tw->tw_node.next, typeof(*tw), tw_node) : NULL;
+        return !is_a_nulls(tw->tw_node.next) ?
+                hlist_nulls_entry(tw->tw_node.next, typeof(*tw), tw_node) : NULL;
 }
 
 static void *listening_get_next(struct seq_file *seq, void *cur)
@@ -1877,15 +1870,18 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
         struct inet_connection_sock *icsk;
         struct hlist_node *node;
         struct sock *sk = cur;
-        struct tcp_iter_state* st = seq->private;
+        struct inet_listen_hashbucket *ilb;
+        struct tcp_iter_state *st = seq->private;
         struct net *net = seq_file_net(seq);
 
         if (!sk) {
                 st->bucket = 0;
-                sk = sk_head(&tcp_hashinfo.listening_hash[0]);
+                ilb = &tcp_hashinfo.listening_hash[0];
+                spin_lock_bh(&ilb->lock);
+                sk = sk_head(&ilb->head);
                 goto get_sk;
         }
-
+        ilb = &tcp_hashinfo.listening_hash[st->bucket];
         ++st->num;
 
         if (st->state == TCP_SEQ_STATE_OPENREQ) {
@@ -1935,8 +1931,11 @@ start_req:
                 }
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
         }
+        spin_unlock_bh(&ilb->lock);
         if (++st->bucket < INET_LHTABLE_SIZE) {
-                sk = sk_head(&tcp_hashinfo.listening_hash[st->bucket]);
+                ilb = &tcp_hashinfo.listening_hash[st->bucket];
+                spin_lock_bh(&ilb->lock);
+                sk = sk_head(&ilb->head);
                 goto get_sk;
         }
         cur = NULL;
@@ -1957,19 +1956,19 @@ static void *listening_get_idx(struct seq_file *seq, loff_t *pos)
 
 static inline int empty_bucket(struct tcp_iter_state *st)
 {
-        return hlist_empty(&tcp_hashinfo.ehash[st->bucket].chain) &&
-                hlist_empty(&tcp_hashinfo.ehash[st->bucket].twchain);
+        return hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].chain) &&
+                hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].twchain);
 }
 
 static void *established_get_first(struct seq_file *seq)
 {
-        struct tcp_iter_state* st = seq->private;
+        struct tcp_iter_state *st = seq->private;
         struct net *net = seq_file_net(seq);
         void *rc = NULL;
 
         for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
                 struct sock *sk;
-                struct hlist_node *node;
+                struct hlist_nulls_node *node;
                 struct inet_timewait_sock *tw;
                 rwlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, st->bucket);
 
@@ -1978,7 +1977,7 @@ static void *established_get_first(struct seq_file *seq)
                         continue;
 
                 read_lock_bh(lock);
-                sk_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
+                sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
                         if (sk->sk_family != st->family ||
                             !net_eq(sock_net(sk), net)) {
                                 continue;
@@ -2007,8 +2006,8 @@ static void *established_get_next(struct seq_file *seq, void *cur)
 {
         struct sock *sk = cur;
         struct inet_timewait_sock *tw;
-        struct hlist_node *node;
-        struct tcp_iter_state* st = seq->private;
+        struct hlist_nulls_node *node;
+        struct tcp_iter_state *st = seq->private;
         struct net *net = seq_file_net(seq);
 
         ++st->num;
@@ -2035,11 +2034,11 @@ get_tw:
                         return NULL;
 
                 read_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
-                sk = sk_head(&tcp_hashinfo.ehash[st->bucket].chain);
+                sk = sk_nulls_head(&tcp_hashinfo.ehash[st->bucket].chain);
         } else
-                sk = sk_next(sk);
+                sk = sk_nulls_next(sk);
 
-        sk_for_each_from(sk, node) {
+        sk_nulls_for_each_from(sk, node) {
                 if (sk->sk_family == st->family && net_eq(sock_net(sk), net))
                         goto found;
         }
@@ -2067,14 +2066,12 @@ static void *established_get_idx(struct seq_file *seq, loff_t pos)
 static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
 {
         void *rc;
-        struct tcp_iter_state* st = seq->private;
+        struct tcp_iter_state *st = seq->private;
 
-        inet_listen_lock(&tcp_hashinfo);
         st->state = TCP_SEQ_STATE_LISTENING;
         rc        = listening_get_idx(seq, &pos);
 
         if (!rc) {
-                inet_listen_unlock(&tcp_hashinfo);
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
                 rc        = established_get_idx(seq, pos);
         }
@@ -2084,7 +2081,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
 
 static void *tcp_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct tcp_iter_state* st = seq->private;
+        struct tcp_iter_state *st = seq->private;
         st->state = TCP_SEQ_STATE_LISTENING;
         st->num = 0;
         return *pos ? tcp_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
@@ -2093,7 +2090,7 @@ static void *tcp_seq_start(struct seq_file *seq, loff_t *pos)
 static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         void *rc = NULL;
-        struct tcp_iter_state* st;
+        struct tcp_iter_state *st;
 
         if (v == SEQ_START_TOKEN) {
                 rc = tcp_get_idx(seq, 0);
@@ -2106,7 +2103,6 @@ static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         case TCP_SEQ_STATE_LISTENING:
                 rc = listening_get_next(seq, v);
                 if (!rc) {
-                        inet_listen_unlock(&tcp_hashinfo);
                         st->state = TCP_SEQ_STATE_ESTABLISHED;
                         rc        = established_get_first(seq);
                 }
@@ -2123,7 +2119,7 @@ out:
 
 static void tcp_seq_stop(struct seq_file *seq, void *v)
 {
-        struct tcp_iter_state* st = seq->private;
+        struct tcp_iter_state *st = seq->private;
 
         switch (st->state) {
         case TCP_SEQ_STATE_OPENREQ:
@@ -2133,7 +2129,7 @@ static void tcp_seq_stop(struct seq_file *seq, void *v)
                 }
         case TCP_SEQ_STATE_LISTENING:
                 if (v != SEQ_START_TOKEN)
-                        inet_listen_unlock(&tcp_hashinfo);
+                        spin_unlock_bh(&tcp_hashinfo.listening_hash[st->bucket].lock);
                 break;
         case TCP_SEQ_STATE_TIME_WAIT:
         case TCP_SEQ_STATE_ESTABLISHED:
@@ -2284,7 +2280,7 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
 
 static int tcp4_seq_show(struct seq_file *seq, void *v)
 {
-        struct tcp_iter_state* st;
+        struct tcp_iter_state *st;
         int len;
 
         if (v == SEQ_START_TOKEN) {
@@ -2378,6 +2374,7 @@ struct proto tcp_prot = {
         .sysctl_rmem            = sysctl_tcp_rmem,
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp_sock),
+        .slab_flags             = SLAB_DESTROY_BY_RCU,
         .twsk_prot              = &tcp_timewait_sock_ops,
         .rsk_prot               = &tcp_request_sock_ops,
         .h.hashinfo             = &tcp_hashinfo,
@@ -2407,6 +2404,7 @@ static struct pernet_operations __net_initdata tcp_sk_ops = {
 
 void __init tcp_v4_init(void)
 {
+        inet_hashinfo_init(&tcp_hashinfo);
         if (register_pernet_device(&tcp_sk_ops))
                 panic("Failed to create the TCP control socket.\n");
 }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 779f2e9d0689..f67effbb102b 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -491,7 +491,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
  *      as a request_sock.
  */
 
-struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
+struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                            struct request_sock *req,
                            struct request_sock **prev)
 {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ba85d8831893..a524627923ae 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -42,7 +42,7 @@
 /* People can turn this off for buggy TCP's found in printers etc. */
 int sysctl_tcp_retrans_collapse __read_mostly = 1;
 
-/* People can turn this on to  work with those rare, broken TCPs that
+/* People can turn this on to work with those rare, broken TCPs that
  * interpret the window field as a signed quantity.
  */
 int sysctl_tcp_workaround_signed_windows __read_mostly = 0;
@@ -484,7 +484,7 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         }
         if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
-                if(likely(opts->ws))
+                if (likely(opts->ws))
                         size += TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(sysctl_tcp_sack)) {
@@ -526,7 +526,7 @@ static unsigned tcp_synack_options(struct sock *sk,
 
         if (likely(ireq->wscale_ok)) {
                 opts->ws = ireq->rcv_wscale;
-                if(likely(opts->ws))
+                if (likely(opts->ws))
                         size += TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(doing_ts)) {
@@ -1172,7 +1172,7 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
 
 static inline int tcp_minshall_check(const struct tcp_sock *tp)
 {
-        return after(tp->snd_sml,tp->snd_una) &&
+        return after(tp->snd_sml, tp->snd_una) &&
                 !after(tp->snd_sml, tp->snd_nxt);
 }
 
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 7ddc30f0744f..25524d4e372a 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -153,12 +153,11 @@ static int tcpprobe_sprint(char *tbuf, int n)
                 = ktime_to_timespec(ktime_sub(p->tstamp, tcp_probe.start));
 
         return snprintf(tbuf, n,
-                        "%lu.%09lu " NIPQUAD_FMT ":%u " NIPQUAD_FMT ":%u"
-                        " %d %#x %#x %u %u %u %u\n",
+                        "%lu.%09lu %pI4:%u %pI4:%u %d %#x %#x %u %u %u %u\n",
                         (unsigned long) tv.tv_sec,
                         (unsigned long) tv.tv_nsec,
-                        NIPQUAD(p->saddr), ntohs(p->sport),
-                        NIPQUAD(p->daddr), ntohs(p->dport),
+                        &p->saddr, ntohs(p->sport),
+                        &p->daddr, ntohs(p->dport),
                         p->length, p->snd_nxt, p->snd_una,
                         p->snd_cwnd, p->ssthresh, p->snd_wnd, p->srtt);
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 6b6dff1164b9..3df339e3e363 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -171,7 +171,7 @@ static int tcp_write_timeout(struct sock *sk)
 
 static void tcp_delack_timer(unsigned long data)
 {
-        struct sock *sk = (struct sock*)data;
+        struct sock *sk = (struct sock *)data;
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
 
@@ -299,15 +299,15 @@ static void tcp_retransmit_timer(struct sock *sk)
 #ifdef TCP_DEBUG
                 struct inet_sock *inet = inet_sk(sk);
                 if (sk->sk_family == AF_INET) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Treason uncloaked! Peer " NIPQUAD_FMT ":%u/%u shrinks window %u:%u. Repaired.\n",
-                               NIPQUAD(inet->daddr), ntohs(inet->dport),
+                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Treason uncloaked! Peer %pI4:%u/%u shrinks window %u:%u. Repaired.\n",
+                               &inet->daddr, ntohs(inet->dport),
                                inet->num, tp->snd_una, tp->snd_nxt);
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (sk->sk_family == AF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
-                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Treason uncloaked! Peer " NIP6_FMT ":%u/%u shrinks window %u:%u. Repaired.\n",
-                               NIP6(np->daddr), ntohs(inet->dport),
+                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Treason uncloaked! Peer %pI6:%u/%u shrinks window %u:%u. Repaired.\n",
+                               &np->daddr, ntohs(inet->dport),
                                inet->num, tp->snd_una, tp->snd_nxt);
                 }
 #endif
@@ -396,7 +396,7 @@ out:;
 
 static void tcp_write_timer(unsigned long data)
 {
-        struct sock *sk = (struct sock*)data;
+        struct sock *sk = (struct sock *)data;
         struct inet_connection_sock *icsk = inet_csk(sk);
         int event;
 
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index e03b10183a8b..9ec843a9bbb2 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -83,7 +83,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
         else if (!yeah->doing_reno_now) {
                 /* Scalable */
 
-                tp->snd_cwnd_cnt+=yeah->pkts_acked;
+                tp->snd_cwnd_cnt += yeah->pkts_acked;
                 if (tp->snd_cwnd_cnt > min(tp->snd_cwnd, TCP_SCALABLE_AI_CNT)){
                         if (tp->snd_cwnd < tp->snd_cwnd_clamp)
                                 tp->snd_cwnd++;
@@ -224,7 +224,7 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) {
 
                 reduction = max( reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
         } else
-                reduction = max(tp->snd_cwnd>>1,2U);
+                reduction = max(tp->snd_cwnd>>1, 2U);
 
         yeah->fast_count = 0;
         yeah->reno_count = max(yeah->reno_count>>1, 2U);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 98c1fd09be88..da869ce041d9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -81,6 +81,8 @@
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 #include <linux/bootmem.h>
+#include <linux/highmem.h>
+#include <linux/swap.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/module.h>
@@ -104,12 +106,8 @@
 #include <net/xfrm.h>
 #include "udp_impl.h"
 
-/*
- *      Snmp MIB for the UDP layer
- */
-
-struct hlist_head udp_hash[UDP_HTABLE_SIZE];
-DEFINE_RWLOCK(udp_hash_lock);
+struct udp_table udp_table;
+EXPORT_SYMBOL(udp_table);
 
 int sysctl_udp_mem[3] __read_mostly;
 int sysctl_udp_rmem_min __read_mostly;
@@ -123,15 +121,15 @@ atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
-                               const struct hlist_head udptable[],
+                               const struct udp_hslot *hslot,
                                struct sock *sk,
                                int (*saddr_comp)(const struct sock *sk1,
                                                  const struct sock *sk2))
 {
         struct sock *sk2;
-        struct hlist_node *node;
+        struct hlist_nulls_node *node;
 
-        sk_for_each(sk2, node, &udptable[udp_hashfn(net, num)])
+        sk_nulls_for_each(sk2, node, &hslot->head)
                 if (net_eq(sock_net(sk2), net)                  &&
                     sk2 != sk                                   &&
                     sk2->sk_hash == num                         &&
@@ -154,12 +152,11 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                        int (*saddr_comp)(const struct sock *sk1,
                                          const struct sock *sk2 )    )
 {
-        struct hlist_head *udptable = sk->sk_prot->h.udp_hash;
+        struct udp_hslot *hslot;
+        struct udp_table *udptable = sk->sk_prot->h.udp_table;
         int    error = 1;
         struct net *net = sock_net(sk);
 
-        write_lock_bh(&udp_hash_lock);
-
         if (!snum) {
                 int low, high, remaining;
                 unsigned rand;
@@ -171,26 +168,34 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 rand = net_random();
                 snum = first = rand % remaining + low;
                 rand |= 1;
-                while (udp_lib_lport_inuse(net, snum, udptable, sk,
-                                           saddr_comp)) {
+                for (;;) {
+                        hslot = &udptable->hash[udp_hashfn(net, snum)];
+                        spin_lock_bh(&hslot->lock);
+                        if (!udp_lib_lport_inuse(net, snum, hslot, sk, saddr_comp))
+                                break;
+                        spin_unlock_bh(&hslot->lock);
                         do {
                                 snum = snum + rand;
                         } while (snum < low || snum > high);
                         if (snum == first)
                                 goto fail;
                 }
-        } else if (udp_lib_lport_inuse(net, snum, udptable, sk, saddr_comp))
-                goto fail;
-
+        } else {
+                hslot = &udptable->hash[udp_hashfn(net, snum)];
+                spin_lock_bh(&hslot->lock);
+                if (udp_lib_lport_inuse(net, snum, hslot, sk, saddr_comp))
+                        goto fail_unlock;
+        }
         inet_sk(sk)->num = snum;
         sk->sk_hash = snum;
         if (sk_unhashed(sk)) {
-                sk_add_node(sk, &udptable[udp_hashfn(net, snum)]);
+                sk_nulls_add_node_rcu(sk, &hslot->head);
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         }
         error = 0;
+fail_unlock:
+        spin_unlock_bh(&hslot->lock);
 fail:
-        write_unlock_bh(&udp_hash_lock);
         return error;
 }
 
@@ -208,63 +213,91 @@ int udp_v4_get_port(struct sock *sk, unsigned short snum)
         return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal);
 }
 
+static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
+                         unsigned short hnum,
+                         __be16 sport, __be32 daddr, __be16 dport, int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+                        !ipv6_only_sock(sk)) {
+                struct inet_sock *inet = inet_sk(sk);
+
+                score = (sk->sk_family == PF_INET ? 1 : 0);
+                if (inet->rcv_saddr) {
+                        if (inet->rcv_saddr != daddr)
+                                return -1;
+                        score += 2;
+                }
+                if (inet->daddr) {
+                        if (inet->daddr != saddr)
+                                return -1;
+                        score += 2;
+                }
+                if (inet->dport) {
+                        if (inet->dport != sport)
+                                return -1;
+                        score += 2;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score += 2;
+                }
+        }
+        return score;
+}
+
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
 static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
                 __be16 sport, __be32 daddr, __be16 dport,
-                int dif, struct hlist_head udptable[])
+                int dif, struct udp_table *udptable)
 {
-        struct sock *sk, *result = NULL;
-        struct hlist_node *node;
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        int badness = -1;
-
-        read_lock(&udp_hash_lock);
-        sk_for_each(sk, node, &udptable[udp_hashfn(net, hnum)]) {
-                struct inet_sock *inet = inet_sk(sk);
-
-                if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
-                                !ipv6_only_sock(sk)) {
-                        int score = (sk->sk_family == PF_INET ? 1 : 0);
-                        if (inet->rcv_saddr) {
-                                if (inet->rcv_saddr != daddr)
-                                        continue;
-                                score+=2;
-                        }
-                        if (inet->daddr) {
-                                if (inet->daddr != saddr)
-                                        continue;
-                                score+=2;
-                        }
-                        if (inet->dport) {
-                                if (inet->dport != sport)
-                                        continue;
-                                score+=2;
-                        }
-                        if (sk->sk_bound_dev_if) {
-                                if (sk->sk_bound_dev_if != dif)
-                                        continue;
-                                score+=2;
-                        }
-                        if (score == 9) {
-                                result = sk;
-                                break;
-                        } else if (score > badness) {
-                                result = sk;
-                                badness = score;
-                        }
+        unsigned int hash = udp_hashfn(net, hnum);
+        struct udp_hslot *hslot = &udptable->hash[hash];
+        int score, badness;
+
+        rcu_read_lock();
+begin:
+        result = NULL;
+        badness = -1;
+        sk_nulls_for_each_rcu(sk, node, &hslot->head) {
+                score = compute_score(sk, net, saddr, hnum, sport,
+                                      daddr, dport, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
                 }
         }
-        if (result)
-                sock_hold(result);
-        read_unlock(&udp_hash_lock);
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != hash)
+                goto begin;
+
+        if (result) {
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score(result, net, saddr, hnum, sport,
+                                  daddr, dport, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        rcu_read_unlock();
         return result;
 }
 
 static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
                                                  __be16 sport, __be16 dport,
-                                                 struct hlist_head udptable[])
+                                                 struct udp_table *udptable)
 {
         struct sock *sk;
         const struct iphdr *iph = ip_hdr(skb);
@@ -280,7 +313,7 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
 struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
                              __be32 daddr, __be16 dport, int dif)
 {
-        return __udp4_lib_lookup(net, saddr, sport, daddr, dport, dif, udp_hash);
+        return __udp4_lib_lookup(net, saddr, sport, daddr, dport, dif, &udp_table);
 }
 EXPORT_SYMBOL_GPL(udp4_lib_lookup);
 
@@ -289,11 +322,11 @@ static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
                                              __be16 rmt_port, __be32 rmt_addr,
                                              int dif)
 {
-        struct hlist_node *node;
+        struct hlist_nulls_node *node;
         struct sock *s = sk;
         unsigned short hnum = ntohs(loc_port);
 
-        sk_for_each_from(s, node) {
+        sk_nulls_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
                 if (!net_eq(sock_net(s), net)                           ||
@@ -324,7 +357,7 @@ found:
  * to find the appropriate port.
  */
 
-void __udp4_lib_err(struct sk_buff *skb, u32 info, struct hlist_head udptable[])
+void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
 {
         struct inet_sock *inet;
         struct iphdr *iph = (struct iphdr*)skb->data;
@@ -393,7 +426,7 @@ out:
 
 void udp_err(struct sk_buff *skb, u32 info)
 {
-        __udp4_lib_err(skb, info, udp_hash);
+        __udp4_lib_err(skb, info, &udp_table);
 }
 
 /*
@@ -935,6 +968,21 @@ int udp_disconnect(struct sock *sk, int flags)
         return 0;
 }
 
+void udp_lib_unhash(struct sock *sk)
+{
+        struct udp_table *udptable = sk->sk_prot->h.udp_table;
+        unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
+        struct udp_hslot *hslot = &udptable->hash[hash];
+
+        spin_lock_bh(&hslot->lock);
+        if (sk_nulls_del_node_init_rcu(sk)) {
+                inet_sk(sk)->num = 0;
+                sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+        }
+        spin_unlock_bh(&hslot->lock);
+}
+EXPORT_SYMBOL(udp_lib_unhash);
+
 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int is_udplite = IS_UDPLITE(sk);
@@ -1073,13 +1121,14 @@ drop:
 static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                     struct udphdr  *uh,
                                     __be32 saddr, __be32 daddr,
-                                    struct hlist_head udptable[])
+                                    struct udp_table *udptable)
 {
         struct sock *sk;
+        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
         int dif;
 
-        read_lock(&udp_hash_lock);
-        sk = sk_head(&udptable[udp_hashfn(net, ntohs(uh->dest))]);
+        spin_lock(&hslot->lock);
+        sk = sk_nulls_head(&hslot->head);
         dif = skb->dev->ifindex;
         sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
         if (sk) {
@@ -1088,7 +1137,7 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                 do {
                         struct sk_buff *skb1 = skb;
 
-                        sknext = udp_v4_mcast_next(net, sk_next(sk), uh->dest,
+                        sknext = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
                                                    daddr, uh->source, saddr,
                                                    dif);
                         if (sknext)
@@ -1105,7 +1154,7 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                 } while (sknext);
         } else
                 kfree_skb(skb);
-        read_unlock(&udp_hash_lock);
+        spin_unlock(&hslot->lock);
         return 0;
 }
 
@@ -1151,7 +1200,7 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
  *      All we need to do is get the socket, and then do a checksum.
  */
 
-int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
+int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
         struct sock *sk;
@@ -1219,13 +1268,13 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
         return 0;
 
 short_packet:
-        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From " NIPQUAD_FMT ":%u %d/%d to " NIPQUAD_FMT ":%u\n",
+        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %pI4:%u %d/%d to %pI4:%u\n",
                        proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       NIPQUAD(saddr),
+                       &saddr,
                        ntohs(uh->source),
                        ulen,
                        skb->len,
-                       NIPQUAD(daddr),
+                       &daddr,
                        ntohs(uh->dest));
         goto drop;
 
@@ -1234,11 +1283,11 @@ csum_error:
          * RFC1122: OK.  Discards the bad packet silently (as far as
          * the network is concerned, anyway) as per 4.1.3.4 (MUST).
          */
-        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From " NIPQUAD_FMT ":%u to " NIPQUAD_FMT ":%u ulen %d\n",
+        LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %pI4:%u to %pI4:%u ulen %d\n",
                        proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       NIPQUAD(saddr),
+                       &saddr,
                        ntohs(uh->source),
-                       NIPQUAD(daddr),
+                       &daddr,
                        ntohs(uh->dest),
                        ulen);
 drop:
@@ -1249,7 +1298,7 @@ drop:
 
 int udp_rcv(struct sk_buff *skb)
 {
-        return __udp4_lib_rcv(skb, udp_hash, IPPROTO_UDP);
+        return __udp4_lib_rcv(skb, &udp_table, IPPROTO_UDP);
 }
 
 void udp_destroy_sock(struct sock *sk)
@@ -1491,7 +1540,8 @@ struct proto udp_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp_sock),
-        .h.udp_hash        = udp_hash,
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
+        .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
@@ -1501,20 +1551,23 @@ struct proto udp_prot = {
 /* ------------------------------------------------------------------------ */
 #ifdef CONFIG_PROC_FS
 
-static struct sock *udp_get_first(struct seq_file *seq)
+static struct sock *udp_get_first(struct seq_file *seq, int start)
 {
         struct sock *sk;
         struct udp_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
 
-        for (state->bucket = 0; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
-                struct hlist_node *node;
-                sk_for_each(sk, node, state->hashtable + state->bucket) {
+        for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
+                struct hlist_nulls_node *node;
+                struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
+                spin_lock_bh(&hslot->lock);
+                sk_nulls_for_each(sk, node, &hslot->head) {
                         if (!net_eq(sock_net(sk), net))
                                 continue;
                         if (sk->sk_family == state->family)
                                 goto found;
                 }
+                spin_unlock_bh(&hslot->lock);
         }
         sk = NULL;
 found:
@@ -1527,21 +1580,19 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
         struct net *net = seq_file_net(seq);
 
         do {
-                sk = sk_next(sk);
-try_again:
-                ;
+                sk = sk_nulls_next(sk);
         } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
 
-        if (!sk && ++state->bucket < UDP_HTABLE_SIZE) {
-                sk = sk_head(state->hashtable + state->bucket);
-                goto try_again;
+        if (!sk) {
+                spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
+                return udp_get_first(seq, state->bucket + 1);
         }
         return sk;
 }
 
 static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 {
-        struct sock *sk = udp_get_first(seq);
+        struct sock *sk = udp_get_first(seq, 0);
 
         if (sk)
                 while (pos && (sk = udp_get_next(seq, sk)) != NULL)
@@ -1550,9 +1601,7 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(udp_hash_lock)
 {
-        read_lock(&udp_hash_lock);
         return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
 
@@ -1570,9 +1619,11 @@ static void *udp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void udp_seq_stop(struct seq_file *seq, void *v)
-        __releases(udp_hash_lock)
 {
-        read_unlock(&udp_hash_lock);
+        struct udp_iter_state *state = seq->private;
+
+        if (state->bucket < UDP_HTABLE_SIZE)
+                spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
 }
 
 static int udp_seq_open(struct inode *inode, struct file *file)
@@ -1588,7 +1639,7 @@ static int udp_seq_open(struct inode *inode, struct file *file)
 
         s = ((struct seq_file *)file->private_data)->private;
         s->family               = afinfo->family;
-        s->hashtable            = afinfo->hashtable;
+        s->udp_table            = afinfo->udp_table;
         return err;
 }
 
@@ -1660,7 +1711,7 @@ int udp4_seq_show(struct seq_file *seq, void *v)
 static struct udp_seq_afinfo udp4_seq_afinfo = {
         .name           = "udp",
         .family         = AF_INET,
-        .hashtable      = udp_hash,
+        .udp_table      = &udp_table,
         .seq_fops       = {
                 .owner  =       THIS_MODULE,
         },
@@ -1695,16 +1746,28 @@ void udp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
+void __init udp_table_init(struct udp_table *table)
+{
+        int i;
+
+        for (i = 0; i < UDP_HTABLE_SIZE; i++) {
+                INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
+                spin_lock_init(&table->hash[i].lock);
+        }
+}
+
 void __init udp_init(void)
 {
-        unsigned long limit;
+        unsigned long nr_pages, limit;
 
+        udp_table_init(&udp_table);
         /* Set the pressure threshold up by the same strategy of TCP. It is a
          * fraction of global memory that is up to 1/2 at 256 MB, decreasing
          * toward zero with the amount of memory, with a floor of 128 pages.
          */
-        limit = min(nr_all_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
-        limit = (limit * (nr_all_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        nr_pages = totalram_pages - totalhigh_pages;
+        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
         limit = max(limit, 128UL);
         sysctl_udp_mem[0] = limit / 4 * 3;
         sysctl_udp_mem[1] = limit;
@@ -1715,8 +1778,6 @@ void __init udp_init(void)
 }
 
 EXPORT_SYMBOL(udp_disconnect);
-EXPORT_SYMBOL(udp_hash);
-EXPORT_SYMBOL(udp_hash_lock);
 EXPORT_SYMBOL(udp_ioctl);
 EXPORT_SYMBOL(udp_prot);
 EXPORT_SYMBOL(udp_sendmsg);
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index 2e9bad2fa1bc..9f4a6165f722 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -5,8 +5,8 @@
 #include <net/protocol.h>
 #include <net/inet_common.h>
 
-extern int      __udp4_lib_rcv(struct sk_buff *, struct hlist_head [], int );
-extern void     __udp4_lib_err(struct sk_buff *, u32, struct hlist_head []);
+extern int      __udp4_lib_rcv(struct sk_buff *, struct udp_table *, int );
+extern void     __udp4_lib_err(struct sk_buff *, u32, struct udp_table *);
 
 extern int      udp_v4_get_port(struct sock *sk, unsigned short snum);
 
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 3c807964da96..c784891cb7e5 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -12,16 +12,17 @@
  */
 #include "udp_impl.h"
 
-struct hlist_head       udplite_hash[UDP_HTABLE_SIZE];
+struct udp_table        udplite_table;
+EXPORT_SYMBOL(udplite_table);
 
 static int udplite_rcv(struct sk_buff *skb)
 {
-        return __udp4_lib_rcv(skb, udplite_hash, IPPROTO_UDPLITE);
+        return __udp4_lib_rcv(skb, &udplite_table, IPPROTO_UDPLITE);
 }
 
 static void udplite_err(struct sk_buff *skb, u32 info)
 {
-        __udp4_lib_err(skb, info, udplite_hash);
+        __udp4_lib_err(skb, info, &udplite_table);
 }
 
 static  struct net_protocol udplite_protocol = {
@@ -50,7 +51,8 @@ struct proto 	udplite_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v4_get_port,
         .obj_size          = sizeof(struct udp_sock),
-        .h.udp_hash        = udplite_hash,
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
+        .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
@@ -71,7 +73,7 @@ static struct inet_protosw udplite4_protosw = {
 static struct udp_seq_afinfo udplite4_seq_afinfo = {
         .name           = "udplite",
         .family         = AF_INET,
-        .hashtable      = udplite_hash,
+        .udp_table      = &udplite_table,
         .seq_fops       = {
                 .owner  =       THIS_MODULE,
         },
@@ -108,6 +110,7 @@ static inline int udplite4_proc_init(void)
 
 void __init udplite4_register(void)
 {
+        udp_table_init(&udplite_table);
         if (proto_register(&udplite_prot, 1))
                 goto out_register_err;
 
@@ -126,5 +129,4 @@ out_register_err:
         printk(KERN_CRIT "%s: Cannot add UDP-Lite protocol.\n", __func__);
 }
 
-EXPORT_SYMBOL(udplite_hash);
 EXPORT_SYMBOL(udplite_prot);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index c63de0a72aba..84dbb5a03cc2 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -65,7 +65,7 @@ __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
 
         read_lock_bh(&policy->lock);
         for (dst = policy->bundles; dst; dst = dst->next) {
-                struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
+                struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
                 if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
@@ -246,7 +246,6 @@ static struct dst_ops xfrm4_dst_ops = {
         .ifdown =               xfrm4_dst_ifdown,
         .local_out =            __ip_local_out,
         .gc_thresh =            1024,
-        .entry_size =           sizeof(struct xfrm_dst),
         .entries =              ATOMIC_INIT(0),
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d9da5eb9dcb2..e92ad8455c63 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2031,8 +2031,8 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
 
 #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT) {
+                const struct net_device_ops *ops = dev->netdev_ops;
                 struct ifreq ifr;
-                mm_segment_t    oldfs;
                 struct ip_tunnel_parm p;
 
                 err = -EADDRNOTAVAIL;
@@ -2048,9 +2048,14 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
                 p.iph.ttl = 64;
                 ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
 
-                oldfs = get_fs(); set_fs(KERNEL_DS);
-                err = dev->do_ioctl(dev, &ifr, SIOCADDTUNNEL);
-                set_fs(oldfs);
+                if (ops->ndo_do_ioctl) {
+                        mm_segment_t oldfs = get_fs();
+
+                        set_fs(KERNEL_DS);
+                        err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
+                        set_fs(oldfs);
+                } else
+                        err = -EOPNOTSUPP;
 
                 if (err == 0) {
                         err = -ENOBUFS;
@@ -2988,9 +2993,8 @@ static void if6_seq_stop(struct seq_file *seq, void *v)
 static int if6_seq_show(struct seq_file *seq, void *v)
 {
         struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
-        seq_printf(seq,
-                   NIP6_SEQFMT " %02x %02x %02x %02x %8s\n",
-                   NIP6(ifp->addr),
+        seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
+                   &ifp->addr,
                    ifp->idev->dev->ifindex,
                    ifp->prefix_len,
                    ifp->scope,
@@ -4033,8 +4037,8 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.forwarding,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &addrconf_sysctl_forward,
-                        .strategy       =       &addrconf_sysctl_forward_strategy,
+                        .proc_handler   =       addrconf_sysctl_forward,
+                        .strategy       =       addrconf_sysctl_forward_strategy,
                 },
                 {
                         .ctl_name       =       NET_IPV6_HOP_LIMIT,
@@ -4050,7 +4054,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.mtu6,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_RA,
@@ -4058,7 +4062,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_ra,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_REDIRECTS,
@@ -4066,7 +4070,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_redirects,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_AUTOCONF,
@@ -4074,7 +4078,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.autoconf,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_DAD_TRANSMITS,
@@ -4082,7 +4086,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.dad_transmits,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_RTR_SOLICITS,
@@ -4090,7 +4094,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.rtr_solicits,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_RTR_SOLICIT_INTERVAL,
@@ -4098,8 +4102,8 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.rtr_solicit_interval,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec_jiffies,
-                        .strategy       =       &sysctl_jiffies,
+                        .proc_handler   =       proc_dointvec_jiffies,
+                        .strategy       =       sysctl_jiffies,
                 },
                 {
                         .ctl_name       =       NET_IPV6_RTR_SOLICIT_DELAY,
@@ -4107,8 +4111,8 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.rtr_solicit_delay,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec_jiffies,
-                        .strategy       =       &sysctl_jiffies,
+                        .proc_handler   =       proc_dointvec_jiffies,
+                        .strategy       =       sysctl_jiffies,
                 },
                 {
                         .ctl_name       =       NET_IPV6_FORCE_MLD_VERSION,
@@ -4116,7 +4120,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.force_mld_version,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
 #ifdef CONFIG_IPV6_PRIVACY
                 {
@@ -4125,7 +4129,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.use_tempaddr,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_TEMP_VALID_LFT,
@@ -4133,7 +4137,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.temp_valid_lft,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_TEMP_PREFERED_LFT,
@@ -4141,7 +4145,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.temp_prefered_lft,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_REGEN_MAX_RETRY,
@@ -4149,7 +4153,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.regen_max_retry,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_MAX_DESYNC_FACTOR,
@@ -4157,7 +4161,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.max_desync_factor,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
 #endif
                 {
@@ -4166,7 +4170,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.max_addresses,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_RA_DEFRTR,
@@ -4174,7 +4178,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_ra_defrtr,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_RA_PINFO,
@@ -4182,7 +4186,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_ra_pinfo,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
 #ifdef CONFIG_IPV6_ROUTER_PREF
                 {
@@ -4191,7 +4195,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_ra_rtr_pref,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_RTR_PROBE_INTERVAL,
@@ -4199,8 +4203,8 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.rtr_probe_interval,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec_jiffies,
-                        .strategy       =       &sysctl_jiffies,
+                        .proc_handler   =       proc_dointvec_jiffies,
+                        .strategy       =       sysctl_jiffies,
                 },
 #ifdef CONFIG_IPV6_ROUTE_INFO
                 {
@@ -4209,7 +4213,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_ra_rt_info_max_plen,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
 #endif
 #endif
@@ -4219,7 +4223,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.proxy_ndp,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_SOURCE_ROUTE,
@@ -4227,7 +4231,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_source_route,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
                 {
@@ -4236,7 +4240,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.optimistic_dad,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
 
                 },
 #endif
@@ -4247,7 +4251,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.mc_forwarding,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
 #endif
                 {
@@ -4256,7 +4260,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.disable_ipv6,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       CTL_UNNUMBERED,
@@ -4264,7 +4268,7 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.accept_dad,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       &proc_dointvec,
+                        .proc_handler   =       proc_dointvec,
                 },
                 {
                         .ctl_name       =       0,      /* sentinel */
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 08909039d87b..6ff73c4c126a 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -186,10 +186,8 @@ u32 ipv6_addr_label(struct net *net,
         label = p ? p->label : IPV6_ADDR_LABEL_DEFAULT;
         rcu_read_unlock();
 
-        ADDRLABEL(KERN_DEBUG "%s(addr=" NIP6_FMT ", type=%d, ifindex=%d) => %08x\n",
-                        __func__,
-                        NIP6(*addr), type, ifindex,
-                        label);
+        ADDRLABEL(KERN_DEBUG "%s(addr=%pI6, type=%d, ifindex=%d) => %08x\n",
+                  __func__, addr, type, ifindex, label);
 
         return label;
 }
@@ -203,11 +201,8 @@ static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
         struct ip6addrlbl_entry *newp;
         int addrtype;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex,
-                        (unsigned int)label);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d, label=%u)\n",
+                  __func__, prefix, prefixlen, ifindex, (unsigned int)label);
 
         addrtype = ipv6_addr_type(prefix) & (IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK);
 
@@ -294,12 +289,9 @@ static int ip6addrlbl_add(struct net *net,
         struct ip6addrlbl_entry *newp;
         int ret = 0;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u, replace=%d)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex,
-                        (unsigned int)label,
-                        replace);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d, label=%u, replace=%d)\n",
+                  __func__, prefix, prefixlen, ifindex, (unsigned int)label,
+                  replace);
 
         newp = ip6addrlbl_alloc(net, prefix, prefixlen, ifindex, label);
         if (IS_ERR(newp))
@@ -321,10 +313,8 @@ static int __ip6addrlbl_del(struct net *net,
         struct hlist_node *pos, *n;
         int ret = -ESRCH;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
+                  __func__, prefix, prefixlen, ifindex);
 
         hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
                 if (p->prefixlen == prefixlen &&
@@ -347,10 +337,8 @@ static int ip6addrlbl_del(struct net *net,
         struct in6_addr prefix_buf;
         int ret;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
+                  __func__, prefix, prefixlen, ifindex);
 
         ipv6_addr_prefix(&prefix_buf, prefix, prefixlen);
         spin_lock(&ip6addrlbl_table.lock);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 2ff0c8233e47..7a8a01369e5c 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -419,8 +419,8 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (!x)
                 return;
 
-        NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/" NIP6_FMT "\n",
-                 ntohl(ah->spi), NIP6(iph->daddr));
+        NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/%pI6\n",
+                 ntohl(ah->spi), &iph->daddr);
 
         xfrm_state_put(x);
 }
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 8336cd81cb4f..1ae58bec1de0 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -512,11 +512,9 @@ static int ac6_seq_show(struct seq_file *seq, void *v)
         struct ifacaddr6 *im = (struct ifacaddr6 *)v;
         struct ac6_iter_state *state = ac6_seq_private(seq);
 
-        seq_printf(seq,
-                   "%-4d %-15s " NIP6_SEQFMT " %5d\n",
+        seq_printf(seq, "%-4d %-15s %pi6 %5d\n",
                    state->dev->ifindex, state->dev->name,
-                   NIP6(im->aca_addr),
-                   im->aca_users);
+                   &im->aca_addr, im->aca_users);
         return 0;
 }
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b181b08fb761..c02a6308defe 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -367,8 +367,8 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
-        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/" NIP6_FMT "\n",
-                        ntohl(esph->spi), NIP6(iph->daddr));
+        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
+                        ntohl(esph->spi), &iph->daddr);
         xfrm_state_put(x);
 }
 
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 6bfffec2371c..1c7f400a3cfe 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -219,7 +219,7 @@ static int ipv6_dest_hao(struct sk_buff *skb, int optoff)
 
         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
                 LIMIT_NETDEBUG(
-                        KERN_DEBUG "hao is not an unicast addr: " NIP6_FMT "\n", NIP6(hao->addr));
+                        KERN_DEBUG "hao is not an unicast addr: %pI6\n", &hao->addr);
                 goto discard;
         }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 9b7d19ae5ced..a77b8d103804 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -233,7 +233,7 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
         icmp6h->icmp6_cksum = 0;
 
         if (skb_queue_len(&sk->sk_write_queue) == 1) {
-                skb->csum = csum_partial((char *)icmp6h,
+                skb->csum = csum_partial(icmp6h,
                                         sizeof(struct icmp6hdr), skb->csum);
                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl->fl6_src,
                                                       &fl->fl6_dst,
@@ -246,7 +246,7 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
                         tmp_csum = csum_add(tmp_csum, skb->csum);
                 }
 
-                tmp_csum = csum_partial((char *)icmp6h,
+                tmp_csum = csum_partial(icmp6h,
                                         sizeof(struct icmp6hdr), tmp_csum);
                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl->fl6_src,
                                                       &fl->fl6_dst,
@@ -646,9 +646,10 @@ static int icmpv6_rcv(struct sk_buff *skb)
         int type;
 
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+                struct sec_path *sp = skb_sec_path(skb);
                 int nh;
 
-                if (!(skb->sp && skb->sp->xvec[skb->sp->len - 1]->props.flags &
+                if (!(sp && sp->xvec[sp->len - 1]->props.flags &
                                  XFRM_STATE_ICMP))
                         goto drop_no_count;
 
@@ -680,8 +681,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
                 skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
                                              IPPROTO_ICMPV6, 0));
                 if (__skb_checksum_complete(skb)) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [" NIP6_FMT " > " NIP6_FMT "]\n",
-                                       NIP6(*saddr), NIP6(*daddr));
+                        LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [%pI6 > %pI6]\n",
+                                       saddr, daddr);
                         goto discard_it;
                 }
         }
@@ -955,8 +956,8 @@ ctl_table ipv6_icmp_table_template[] = {
                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_ms_jiffies,
-                .strategy       = &sysctl_ms_jiffies
+                .proc_handler   = proc_dointvec_ms_jiffies,
+                .strategy       = sysctl_ms_jiffies
         },
         { .ctl_name = 0 },
 };
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1646a5658255..21544b9be259 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -25,26 +25,30 @@
 void __inet6_hash(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        struct hlist_head *list;
-        rwlock_t *lock;
 
         WARN_ON(!sk_unhashed(sk));
 
         if (sk->sk_state == TCP_LISTEN) {
-                list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
-                lock = &hashinfo->lhash_lock;
-                inet_listen_wlock(hashinfo);
+                struct inet_listen_hashbucket *ilb;
+
+                ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
+                spin_lock(&ilb->lock);
+                __sk_add_node(sk, &ilb->head);
+                spin_unlock(&ilb->lock);
         } else {
                 unsigned int hash;
+                struct hlist_nulls_head *list;
+                rwlock_t *lock;
+
                 sk->sk_hash = hash = inet6_sk_ehashfn(sk);
                 list = &inet_ehash_bucket(hashinfo, hash)->chain;
                 lock = inet_ehash_lockp(hashinfo, hash);
                 write_lock(lock);
+                __sk_nulls_add_node_rcu(sk, list);
+                write_unlock(lock);
         }
 
-        __sk_add_node(sk, list);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-        write_unlock(lock);
 }
 EXPORT_SYMBOL(__inet6_hash);
 
@@ -63,33 +67,53 @@ struct sock *__inet6_lookup_established(struct net *net,
                                            const int dif)
 {
         struct sock *sk;
-        const struct hlist_node *node;
+        const struct hlist_nulls_node *node;
         const __portpair ports = INET_COMBINED_PORTS(sport, hnum);
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
         unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
-        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
-        rwlock_t *lock = inet_ehash_lockp(hashinfo, hash);
+        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
-        prefetch(head->chain.first);
-        read_lock(lock);
-        sk_for_each(sk, node, &head->chain) {
+
+        rcu_read_lock();
+begin:
+        sk_nulls_for_each_rcu(sk, node, &head->chain) {
                 /* For IPV6 do the cheaper port and family tests first. */
-                if (INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif))
-                        goto hit; /* You sunk my battleship! */
+                if (INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                        if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt)))
+                                goto begintw;
+                        if (!INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                                sock_put(sk);
+                                goto begin;
+                        }
+                goto out;
+                }
         }
+        if (get_nulls_value(node) != slot)
+                goto begin;
+
+begintw:
         /* Must check for a TIME_WAIT'er before going to listener hash. */
-        sk_for_each(sk, node, &head->twchain) {
-                if (INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif))
-                        goto hit;
+        sk_nulls_for_each_rcu(sk, node, &head->twchain) {
+                if (INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                        if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt))) {
+                                sk = NULL;
+                                goto out;
+                        }
+                        if (!INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                                sock_put(sk);
+                                goto begintw;
+                        }
+                        goto out;
+                }
         }
-        read_unlock(lock);
-        return NULL;
-
-hit:
-        sock_hold(sk);
-        read_unlock(lock);
+        if (get_nulls_value(node) != slot)
+                goto begintw;
+        sk = NULL;
+out:
+        rcu_read_unlock();
         return sk;
 }
 EXPORT_SYMBOL(__inet6_lookup_established);
@@ -102,10 +126,11 @@ struct sock *inet6_lookup_listener(struct net *net,
         const struct hlist_node *node;
         struct sock *result = NULL;
         int score, hiscore = 0;
+        struct inet_listen_hashbucket *ilb;
 
-        read_lock(&hashinfo->lhash_lock);
-        sk_for_each(sk, node,
-                        &hashinfo->listening_hash[inet_lhashfn(net, hnum)]) {
+        ilb = &hashinfo->listening_hash[inet_lhashfn(net, hnum)];
+        spin_lock(&ilb->lock);
+        sk_for_each(sk, node, &ilb->head) {
                 if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
                                 sk->sk_family == PF_INET6) {
                         const struct ipv6_pinfo *np = inet6_sk(sk);
@@ -133,7 +158,7 @@ struct sock *inet6_lookup_listener(struct net *net,
         }
         if (result)
                 sock_hold(result);
-        read_unlock(&hashinfo->lhash_lock);
+        spin_unlock(&ilb->lock);
         return result;
 }
 
@@ -172,14 +197,14 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         rwlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
-        const struct hlist_node *node;
+        const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
 
         prefetch(head->chain.first);
         write_lock(lock);
 
         /* Check TIME-WAIT sockets first. */
-        sk_for_each(sk2, node, &head->twchain) {
+        sk_nulls_for_each(sk2, node, &head->twchain) {
                 tw = inet_twsk(sk2);
 
                 if (INET6_TW_MATCH(sk2, net, hash, saddr, daddr, ports, dif)) {
@@ -192,7 +217,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         tw = NULL;
 
         /* And established part... */
-        sk_for_each(sk2, node, &head->chain) {
+        sk_nulls_for_each(sk2, node, &head->chain) {
                 if (INET6_MATCH(sk2, net, hash, saddr, daddr, ports, dif))
                         goto not_unique;
         }
@@ -203,7 +228,7 @@ unique:
         inet->num = lport;
         inet->sport = htons(lport);
         WARN_ON(!sk_unhashed(sk));
-        __sk_add_node(sk, &head->chain);
+        __sk_nulls_add_node_rcu(sk, &head->chain);
         sk->sk_hash = hash;
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         write_unlock(lock);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 37a4e777e347..7927a8498d17 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -696,14 +696,14 @@ static int ip6fl_seq_show(struct seq_file *seq, void *v)
         else {
                 struct ip6_flowlabel *fl = v;
                 seq_printf(seq,
-                           "%05X %-1d %-6d %-6d %-6ld %-8ld " NIP6_SEQFMT " %-4d\n",
+                           "%05X %-1d %-6d %-6d %-6ld %-8ld %pi6 %-4d\n",
                            (unsigned)ntohl(fl->label),
                            fl->share,
                            (unsigned)fl->owner,
                            atomic_read(&fl->users),
                            fl->linger/HZ,
                            (long)(fl->expires - jiffies)/HZ,
-                           NIP6(fl->dst),
+                           &fl->dst,
                            fl->opt ? fl->opt->opt_nflen : 0);
         }
         return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index c77db0b95e26..7d92fd97cfb9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -490,7 +490,7 @@ int ip6_forward(struct sk_buff *skb)
            We don't send redirects to frames decapsulated from IPsec.
          */
         if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
-            !skb->sp) {
+            !skb_sec_path(skb)) {
                 struct in6_addr *target = NULL;
                 struct rt6_info *rt;
                 struct neighbour *n = dst->neighbour;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0524769632e7..363ae258ee1e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -297,9 +297,8 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
                 const struct mfc6_cache *mfc = v;
                 const struct ipmr_mfc_iter *it = seq->private;
 
-                seq_printf(seq,
-                           NIP6_FMT " " NIP6_FMT " %-3d %8ld %8ld %8ld",
-                           NIP6(mfc->mf6c_mcastgrp), NIP6(mfc->mf6c_origin),
+                seq_printf(seq, "%pI6 %pI6 %-3d %8ld %8ld %8ld",
+                           &mfc->mf6c_mcastgrp, &mfc->mf6c_origin,
                            mfc->mf6c_parent,
                            mfc->mfc_un.res.pkt,
                            mfc->mfc_un.res.bytes,
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 4545e4306862..d4576a9c154f 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -67,8 +67,8 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (!x)
                 return;
 
-        printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/" NIP6_FMT "\n",
-                        spi, NIP6(iph->daddr));
+        printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%pI6\n",
+                        spi, &iph->daddr);
         xfrm_state_put(x);
 }
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index d7b3c6d398ae..870a1d64605a 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1817,7 +1817,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 
         hdr->icmp6_cksum = csum_ipv6_magic(saddr, snd_addr, len,
                                            IPPROTO_ICMPV6,
-                                           csum_partial((__u8 *) hdr, len, 0));
+                                           csum_partial(hdr, len, 0));
 
         idev = in6_dev_get(skb->dev);
 
@@ -2430,9 +2430,9 @@ static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
         struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
 
         seq_printf(seq,
-                   "%-4d %-15s " NIP6_SEQFMT " %5d %08X %ld\n",
+                   "%-4d %-15s %pi6 %5d %08X %ld\n",
                    state->dev->ifindex, state->dev->name,
-                   NIP6(im->mca_addr),
+                   &im->mca_addr,
                    im->mca_users, im->mca_flags,
                    (im->mca_flags&MAF_TIMER_RUNNING) ?
                    jiffies_to_clock_t(im->mca_timer.expires-jiffies) : 0);
@@ -2591,10 +2591,10 @@ static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
                            "Source Address", "INC", "EXC");
         } else {
                 seq_printf(seq,
-                           "%3d %6.6s " NIP6_SEQFMT " " NIP6_SEQFMT " %6lu %6lu\n",
+                           "%3d %6.6s %pi6 %pi6 %6lu %6lu\n",
                            state->dev->ifindex, state->dev->name,
-                           NIP6(state->im->mca_addr),
-                           NIP6(psf->sf_addr),
+                           &state->im->mca_addr,
+                           &psf->sf_addr,
                            psf->sf_count[MCAST_INCLUDE],
                            psf->sf_count[MCAST_EXCLUDE]);
         }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 172438320eec..af6705f03b5c 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -437,38 +437,20 @@ static void pndisc_destructor(struct pneigh_entry *n)
         ipv6_dev_mc_dec(dev, &maddr);
 }
 
-/*
- *      Send a Neighbour Advertisement
- */
-static void __ndisc_send(struct net_device *dev,
-                         struct neighbour *neigh,
-                         const struct in6_addr *daddr,
-                         const struct in6_addr *saddr,
-                         struct icmp6hdr *icmp6h, const struct in6_addr *target,
-                         int llinfo)
+struct sk_buff *ndisc_build_skb(struct net_device *dev,
+                                const struct in6_addr *daddr,
+                                const struct in6_addr *saddr,
+                                struct icmp6hdr *icmp6h,
+                                const struct in6_addr *target,
+                                int llinfo)
 {
-        struct flowi fl;
-        struct dst_entry *dst;
         struct net *net = dev_net(dev);
         struct sock *sk = net->ipv6.ndisc_sk;
         struct sk_buff *skb;
         struct icmp6hdr *hdr;
-        struct inet6_dev *idev;
         int len;
         int err;
-        u8 *opt, type;
-
-        type = icmp6h->icmp6_type;
-
-        icmpv6_flow_init(sk, &fl, type, saddr, daddr, dev->ifindex);
-
-        dst = icmp6_dst_alloc(dev, neigh, daddr);
-        if (!dst)
-                return;
-
-        err = xfrm_lookup(&dst, &fl, NULL, 0);
-        if (err < 0)
-                return;
+        u8 *opt;
 
         if (!dev->addr_len)
                 llinfo = 0;
@@ -485,8 +467,7 @@ static void __ndisc_send(struct net_device *dev,
                 ND_PRINTK0(KERN_ERR
                            "ICMPv6 ND: %s() failed to allocate an skb.\n",
                            __func__);
-                dst_release(dst);
-                return;
+                return NULL;
         }
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
@@ -510,9 +491,45 @@ static void __ndisc_send(struct net_device *dev,
 
         hdr->icmp6_cksum = csum_ipv6_magic(saddr, daddr, len,
                                            IPPROTO_ICMPV6,
-                                           csum_partial((__u8 *) hdr,
+                                           csum_partial(hdr,
                                                         len, 0));
 
+        return skb;
+}
+
+EXPORT_SYMBOL(ndisc_build_skb);
+
+void ndisc_send_skb(struct sk_buff *skb,
+                    struct net_device *dev,
+                    struct neighbour *neigh,
+                    const struct in6_addr *daddr,
+                    const struct in6_addr *saddr,
+                    struct icmp6hdr *icmp6h)
+{
+        struct flowi fl;
+        struct dst_entry *dst;
+        struct net *net = dev_net(dev);
+        struct sock *sk = net->ipv6.ndisc_sk;
+        struct inet6_dev *idev;
+        int err;
+        u8 type;
+
+        type = icmp6h->icmp6_type;
+
+        icmpv6_flow_init(sk, &fl, type, saddr, daddr, dev->ifindex);
+
+        dst = icmp6_dst_alloc(dev, neigh, daddr);
+        if (!dst) {
+                kfree_skb(skb);
+                return;
+        }
+
+        err = xfrm_lookup(&dst, &fl, NULL, 0);
+        if (err < 0) {
+                kfree_skb(skb);
+                return;
+        }
+
         skb->dst = dst;
 
         idev = in6_dev_get(dst->dev);
@@ -529,6 +546,27 @@ static void __ndisc_send(struct net_device *dev,
                 in6_dev_put(idev);
 }
 
+EXPORT_SYMBOL(ndisc_send_skb);
+
+/*
+ *      Send a Neighbour Discover packet
+ */
+static void __ndisc_send(struct net_device *dev,
+                         struct neighbour *neigh,
+                         const struct in6_addr *daddr,
+                         const struct in6_addr *saddr,
+                         struct icmp6hdr *icmp6h, const struct in6_addr *target,
+                         int llinfo)
+{
+        struct sk_buff *skb;
+
+        skb = ndisc_build_skb(dev, daddr, saddr, icmp6h, target, llinfo);
+        if (!skb)
+                return;
+
+        ndisc_send_skb(skb, dev, neigh, daddr, saddr, icmp6h);
+}
+
 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                           const struct in6_addr *daddr,
                           const struct in6_addr *solicited_addr,
@@ -647,11 +685,8 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 
         if ((probes -= neigh->parms->ucast_probes) < 0) {
                 if (!(neigh->nud_state & NUD_VALID)) {
-                        ND_PRINTK1(KERN_DEBUG
-                                   "%s(): trying to ucast probe in NUD_INVALID: "
-                                   NIP6_FMT "\n",
-                                   __func__,
-                                   NIP6(*target));
+                        ND_PRINTK1(KERN_DEBUG "%s(): trying to ucast probe in NUD_INVALID: %pI6\n",
+                                   __func__, target);
                 }
                 ndisc_send_ns(dev, neigh, target, target, saddr);
         } else if ((probes -= neigh->parms->app_probes) < 0) {
@@ -1577,7 +1612,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 
         icmph->icmp6_cksum = csum_ipv6_magic(&saddr_buf, &ipv6_hdr(skb)->saddr,
                                              len, IPPROTO_ICMPV6,
-                                             csum_partial((u8 *) icmph, len, 0));
+                                             csum_partial(icmph, len, 0));
 
         buff->dst = dst;
         idev = in6_dev_get(dst->dev);
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index caa441d09567..7c668c63f708 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -61,7 +61,7 @@ static void dump_packet(const struct nf_loginfo *info,
         }
 
         /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000 " */
-        printk("SRC=" NIP6_FMT " DST=" NIP6_FMT " ", NIP6(ih->saddr), NIP6(ih->daddr));
+        printk("SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
 
         /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
         printk("LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
@@ -424,9 +424,8 @@ ip6t_log_packet(u_int8_t pf,
                         if (skb->dev->type == ARPHRD_SIT) {
                                 const struct iphdr *iph =
                                         (struct iphdr *)skb_mac_header(skb);
-                                printk("TUNNEL=%u.%u.%u.%u->%u.%u.%u.%u ",
-                                       NIPQUAD(iph->saddr),
-                                       NIPQUAD(iph->daddr));
+                                printk("TUNNEL=%pI4->%pI4 ",
+                                       &iph->saddr, &iph->daddr);
                         }
                 } else
                         printk(" ");
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index e91db16611d9..727b9530448a 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -56,9 +56,8 @@ static bool ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
 static int ipv6_print_tuple(struct seq_file *s,
                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "src=" NIP6_FMT " dst=" NIP6_FMT " ",
-                          NIP6(*((struct in6_addr *)tuple->src.u3.ip6)),
-                          NIP6(*((struct in6_addr *)tuple->dst.u3.ip6)));
+        return seq_printf(s, "src=%pI6 dst=%pI6 ",
+                          tuple->src.u3.ip6, tuple->dst.u3.ip6);
 }
 
 /*
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 05726177903f..bd52151d31e9 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -253,7 +253,7 @@ static struct ctl_table icmpv6_sysctl_table[] = {
                 .data           = &nf_ct_icmpv6_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = 0
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 9967ac7a01a8..ed4d79a9e4a6 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -80,7 +80,7 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
                 .data           = &nf_init_frags.timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_LOW_THRESH,
@@ -88,7 +88,7 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
                 .data           = &nf_init_frags.low_thresh,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
@@ -96,7 +96,7 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
                 .data           = &nf_init_frags.high_thresh,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         { .ctl_name = 0 }
 };
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index af12de071f4c..3c575118fca5 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -642,7 +642,7 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                 .data           = &init_net.ipv6.frags.high_thresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV6_IP6FRAG_LOW_THRESH,
@@ -650,7 +650,7 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                 .data           = &init_net.ipv6.frags.low_thresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IPV6_IP6FRAG_TIME,
@@ -658,8 +658,8 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                 .data           = &init_net.ipv6.frags.timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         { }
 };
@@ -671,8 +671,8 @@ static struct ctl_table ip6_frags_ctl_table[] = {
                 .data           = &ip6_frags.secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies
         },
         { }
 };
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 89dc69924340..9da1ece466a2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -108,7 +108,6 @@ static struct dst_ops ip6_dst_ops_template = {
         .link_failure           =       ip6_link_failure,
         .update_pmtu            =       ip6_rt_update_pmtu,
         .local_out              =       __ip6_local_out,
-        .entry_size             =       sizeof(struct rt6_info),
         .entries                =       ATOMIC_INIT(0),
 };
 
@@ -122,7 +121,6 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
-        .entry_size             =       sizeof(struct rt6_info),
         .entries                =       ATOMIC_INIT(0),
 };
 
@@ -2408,19 +2406,16 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 {
         struct seq_file *m = p_arg;
 
-        seq_printf(m, NIP6_SEQFMT " %02x ", NIP6(rt->rt6i_dst.addr),
-                   rt->rt6i_dst.plen);
+        seq_printf(m, "%pi6 %02x ", &rt->rt6i_dst.addr, rt->rt6i_dst.plen);
 
 #ifdef CONFIG_IPV6_SUBTREES
-        seq_printf(m, NIP6_SEQFMT " %02x ", NIP6(rt->rt6i_src.addr),
-                   rt->rt6i_src.plen);
+        seq_printf(m, "%pi6 %02x ", &rt->rt6i_src.addr, rt->rt6i_src.plen);
 #else
         seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
 
         if (rt->rt6i_nexthop) {
-                seq_printf(m, NIP6_SEQFMT,
-                           NIP6(*((struct in6_addr *)rt->rt6i_nexthop->primary_key)));
+                seq_printf(m, "%pi6", rt->rt6i_nexthop->primary_key);
         } else {
                 seq_puts(m, "00000000000000000000000000000000");
         }
@@ -2502,7 +2497,7 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.flush_delay,
                 .maxlen         =       sizeof(int),
                 .mode           =       0200,
-                .proc_handler   =       &ipv6_sysctl_rtcache_flush
+                .proc_handler   =       ipv6_sysctl_rtcache_flush
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_THRESH,
@@ -2510,7 +2505,7 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &ip6_dst_ops_template.gc_thresh,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec,
+                .proc_handler   =       proc_dointvec,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_MAX_SIZE,
@@ -2518,7 +2513,7 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_max_size,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec,
+                .proc_handler   =       proc_dointvec,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL,
@@ -2526,8 +2521,8 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
-                .strategy       =       &sysctl_jiffies,
+                .proc_handler   =       proc_dointvec_jiffies,
+                .strategy       =       sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_TIMEOUT,
@@ -2535,8 +2530,8 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_timeout,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
-                .strategy       =       &sysctl_jiffies,
+                .proc_handler   =       proc_dointvec_jiffies,
+                .strategy       =       sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_INTERVAL,
@@ -2544,8 +2539,8 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
-                .strategy       =       &sysctl_jiffies,
+                .proc_handler   =       proc_dointvec_jiffies,
+                .strategy       =       sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_ELASTICITY,
@@ -2553,8 +2548,8 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_elasticity,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
-                .strategy       =       &sysctl_jiffies,
+                .proc_handler   =       proc_dointvec_jiffies,
+                .strategy       =       sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_MTU_EXPIRES,
@@ -2562,8 +2557,8 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_mtu_expires,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
-                .strategy       =       &sysctl_jiffies,
+                .proc_handler   =       proc_dointvec_jiffies,
+                .strategy       =       sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_MIN_ADVMSS,
@@ -2571,8 +2566,8 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_min_advmss,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_jiffies,
-                .strategy       =       &sysctl_jiffies,
+                .proc_handler   =       proc_dointvec_jiffies,
+                .strategy       =       sysctl_jiffies,
         },
         {
                 .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL_MS,
@@ -2580,8 +2575,8 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       &proc_dointvec_ms_jiffies,
-                .strategy       =       &sysctl_ms_jiffies,
+                .proc_handler   =       proc_dointvec_ms_jiffies,
+                .strategy       =       sysctl_ms_jiffies,
         },
         { .ctl_name = 0 }
 };
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 587f8f60c489..9048fe7e7ea7 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -35,7 +35,7 @@ static ctl_table ipv6_table_template[] = {
                 .data           = &init_net.ipv6.sysctl.bindv6only,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         { .ctl_name = 0 }
 };
@@ -47,7 +47,7 @@ static ctl_table ipv6_table[] = {
                 .data           = &sysctl_mld_max_msf,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         { .ctl_name = 0 }
 };
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index b6b356b7912a..a5d750acd793 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -501,7 +501,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
 
                 th->check = tcp_v6_check(th, skb->len,
                                          &treq->loc_addr, &treq->rmt_addr,
-                                         csum_partial((char *)th, skb->len, skb->csum));
+                                         csum_partial(th, skb->len, skb->csum));
 
                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
                 err = ip6_xmit(sk, skb, &fl, opt, 0);
@@ -872,12 +872,10 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                 if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash %s for "
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
+                        printk(KERN_INFO "MD5 Hash %s for (%pI6, %u)->(%pI6, %u)\n",
                                genhash ? "failed" : "mismatch",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
+                               &ip6h->saddr, ntohs(th->source),
+                               &ip6h->daddr, ntohs(th->dest));
                 }
                 return 1;
         }
@@ -917,7 +915,7 @@ static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
-                                            csum_partial((char *)th, th->doff<<2,
+                                            csum_partial(th, th->doff<<2,
                                                          skb->csum));
         }
 }
@@ -999,7 +997,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         }
 #endif
 
-        buff->csum = csum_partial((char *)t1, tot_len, 0);
+        buff->csum = csum_partial(t1, tot_len, 0);
 
         memset(&fl, 0, sizeof(fl));
         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
@@ -2045,6 +2043,7 @@ struct proto tcpv6_prot = {
         .sysctl_rmem            = sysctl_tcp_rmem,
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp6_sock),
+        .slab_flags             = SLAB_DESTROY_BY_RCU,
         .twsk_prot              = &tcp6_timewait_sock_ops,
         .rsk_prot               = &tcp6_request_sock_ops,
         .h.hashinfo             = &tcp_hashinfo,
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 8b48512ebf6a..fd2d9ad4a8a3 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -54,62 +54,91 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
         return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal);
 }
 
+static inline int compute_score(struct sock *sk, struct net *net,
+                                unsigned short hnum,
+                                struct in6_addr *saddr, __be16 sport,
+                                struct in6_addr *daddr, __be16 dport,
+                                int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+                        sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                struct inet_sock *inet = inet_sk(sk);
+
+                score = 0;
+                if (inet->dport) {
+                        if (inet->dport != sport)
+                                return -1;
+                        score++;
+                }
+                if (!ipv6_addr_any(&np->rcv_saddr)) {
+                        if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
+                                return -1;
+                        score++;
+                }
+                if (!ipv6_addr_any(&np->daddr)) {
+                        if (!ipv6_addr_equal(&np->daddr, saddr))
+                                return -1;
+                        score++;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score++;
+                }
+        }
+        return score;
+}
+
 static struct sock *__udp6_lib_lookup(struct net *net,
                                       struct in6_addr *saddr, __be16 sport,
                                       struct in6_addr *daddr, __be16 dport,
-                                      int dif, struct hlist_head udptable[])
+                                      int dif, struct udp_table *udptable)
 {
-        struct sock *sk, *result = NULL;
-        struct hlist_node *node;
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        int badness = -1;
-
-        read_lock(&udp_hash_lock);
-        sk_for_each(sk, node, &udptable[udp_hashfn(net, hnum)]) {
-                struct inet_sock *inet = inet_sk(sk);
-
-                if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
-                                sk->sk_family == PF_INET6) {
-                        struct ipv6_pinfo *np = inet6_sk(sk);
-                        int score = 0;
-                        if (inet->dport) {
-                                if (inet->dport != sport)
-                                        continue;
-                                score++;
-                        }
-                        if (!ipv6_addr_any(&np->rcv_saddr)) {
-                                if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
-                                        continue;
-                                score++;
-                        }
-                        if (!ipv6_addr_any(&np->daddr)) {
-                                if (!ipv6_addr_equal(&np->daddr, saddr))
-                                        continue;
-                                score++;
-                        }
-                        if (sk->sk_bound_dev_if) {
-                                if (sk->sk_bound_dev_if != dif)
-                                        continue;
-                                score++;
-                        }
-                        if (score == 4) {
-                                result = sk;
-                                break;
-                        } else if (score > badness) {
-                                result = sk;
-                                badness = score;
-                        }
+        unsigned int hash = udp_hashfn(net, hnum);
+        struct udp_hslot *hslot = &udptable->hash[hash];
+        int score, badness;
+
+        rcu_read_lock();
+begin:
+        result = NULL;
+        badness = -1;
+        sk_nulls_for_each_rcu(sk, node, &hslot->head) {
+                score = compute_score(sk, net, hnum, saddr, sport, daddr, dport, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != hash)
+                goto begin;
+
+        if (result) {
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score(result, net, hnum, saddr, sport,
+                                        daddr, dport, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
                 }
         }
-        if (result)
-                sock_hold(result);
-        read_unlock(&udp_hash_lock);
+        rcu_read_unlock();
         return result;
 }
 
 static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
                                           __be16 sport, __be16 dport,
-                                          struct hlist_head udptable[])
+                                          struct udp_table *udptable)
 {
         struct sock *sk;
         struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -253,7 +282,7 @@ csum_copy_err:
 
 void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                     int type, int code, int offset, __be32 info,
-                    struct hlist_head udptable[]                    )
+                    struct udp_table *udptable)
 {
         struct ipv6_pinfo *np;
         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
@@ -289,7 +318,7 @@ static __inline__ void udpv6_err(struct sk_buff *skb,
                                  struct inet6_skb_parm *opt, int type,
                                  int code, int offset, __be32 info     )
 {
-        __udp6_lib_err(skb, opt, type, code, offset, info, udp_hash);
+        __udp6_lib_err(skb, opt, type, code, offset, info, &udp_table);
 }
 
 int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
@@ -347,11 +376,11 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
                                       __be16 rmt_port, struct in6_addr *rmt_addr,
                                       int dif)
 {
-        struct hlist_node *node;
+        struct hlist_nulls_node *node;
         struct sock *s = sk;
         unsigned short num = ntohs(loc_port);
 
-        sk_for_each_from(s, node) {
+        sk_nulls_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
                 if (!net_eq(sock_net(s), net))
@@ -388,14 +417,15 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
  */
 static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                 struct in6_addr *saddr, struct in6_addr *daddr,
-                struct hlist_head udptable[])
+                struct udp_table *udptable)
 {
         struct sock *sk, *sk2;
         const struct udphdr *uh = udp_hdr(skb);
+        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
         int dif;
 
-        read_lock(&udp_hash_lock);
-        sk = sk_head(&udptable[udp_hashfn(net, ntohs(uh->dest))]);
+        spin_lock(&hslot->lock);
+        sk = sk_nulls_head(&hslot->head);
         dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
@@ -404,7 +434,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
         }
 
         sk2 = sk;
-        while ((sk2 = udp_v6_mcast_next(net, sk_next(sk2), uh->dest, daddr,
+        while ((sk2 = udp_v6_mcast_next(net, sk_nulls_next(sk2), uh->dest, daddr,
                                         uh->source, saddr, dif))) {
                 struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
                 if (buff) {
@@ -423,7 +453,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                 sk_add_backlog(sk, skb);
         bh_unlock_sock(sk);
 out:
-        read_unlock(&udp_hash_lock);
+        spin_unlock(&hslot->lock);
         return 0;
 }
 
@@ -461,7 +491,7 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh,
         return 0;
 }
 
-int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
+int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
         struct sock *sk;
@@ -558,7 +588,7 @@ discard:
 
 static __inline__ int udpv6_rcv(struct sk_buff *skb)
 {
-        return __udp6_lib_rcv(skb, udp_hash, IPPROTO_UDP);
+        return __udp6_lib_rcv(skb, &udp_table, IPPROTO_UDP);
 }
 
 /*
@@ -1022,7 +1052,7 @@ int udp6_seq_show(struct seq_file *seq, void *v)
 static struct udp_seq_afinfo udp6_seq_afinfo = {
         .name           = "udp6",
         .family         = AF_INET6,
-        .hashtable      = udp_hash,
+        .udp_table      = &udp_table,
         .seq_fops       = {
                 .owner  =       THIS_MODULE,
         },
@@ -1064,7 +1094,8 @@ struct proto udpv6_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp6_sock),
-        .h.udp_hash        = udp_hash,
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
+        .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 92dd7da766d8..23779208c334 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -7,9 +7,9 @@
 #include <net/inet_common.h>
 #include <net/transp_v6.h>
 
-extern int      __udp6_lib_rcv(struct sk_buff *, struct hlist_head [], int );
+extern int      __udp6_lib_rcv(struct sk_buff *, struct udp_table *, int );
 extern void     __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
-                               int , int , int , __be32 , struct hlist_head []);
+                               int , int , int , __be32 , struct udp_table *);
 
 extern int      udp_v6_get_port(struct sock *sk, unsigned short snum);
 
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 3cd1a1ac3d6c..ba162a824585 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -15,14 +15,14 @@
 
 static int udplitev6_rcv(struct sk_buff *skb)
 {
-        return __udp6_lib_rcv(skb, udplite_hash, IPPROTO_UDPLITE);
+        return __udp6_lib_rcv(skb, &udplite_table, IPPROTO_UDPLITE);
 }
 
 static void udplitev6_err(struct sk_buff *skb,
                           struct inet6_skb_parm *opt,
                           int type, int code, int offset, __be32 info)
 {
-        __udp6_lib_err(skb, opt, type, code, offset, info, udplite_hash);
+        __udp6_lib_err(skb, opt, type, code, offset, info, &udplite_table);
 }
 
 static struct inet6_protocol udplitev6_protocol = {
@@ -49,7 +49,8 @@ struct proto udplitev6_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
         .obj_size          = sizeof(struct udp6_sock),
-        .h.udp_hash        = udplite_hash,
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
+        .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
@@ -95,7 +96,7 @@ void udplitev6_exit(void)
 static struct udp_seq_afinfo udplite6_seq_afinfo = {
         .name           = "udplite6",
         .family         = AF_INET6,
-        .hashtable      = udplite_hash,
+        .udp_table      = &udplite_table,
         .seq_fops       = {
                 .owner  =       THIS_MODULE,
         },
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 08e4cbbe3f04..3b67ce7786ec 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -144,6 +144,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
 static inline void
 _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 {
+        int onlyproto = 0;
         u16 offset = skb_network_header_len(skb);
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct ipv6_opt_hdr *exthdr;
@@ -159,6 +160,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
 
                 switch (nexthdr) {
+                case NEXTHDR_FRAGMENT:
+                        onlyproto = 1;
                 case NEXTHDR_ROUTING:
                 case NEXTHDR_HOP:
                 case NEXTHDR_DEST:
@@ -172,7 +175,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
+                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
                                 __be16 *ports = (__be16 *)exthdr;
 
                                 fl->fl_ip_sport = ports[!!reverse];
@@ -182,7 +185,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                         return;
 
                 case IPPROTO_ICMPV6:
-                        if (pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
+                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
                                 u8 *icmp = (u8 *)exthdr;
 
                                 fl->fl_icmp_type = icmp[0];
@@ -193,7 +196,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 case IPPROTO_MH:
-                        if (pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
+                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
                                 mh = (struct ip6_mh *)exthdr;
 
@@ -274,7 +277,6 @@ static struct dst_ops xfrm6_dst_ops = {
         .ifdown =               xfrm6_dst_ifdown,
         .local_out =            __ip6_local_out,
         .gc_thresh =            1024,
-        .entry_size =           sizeof(struct xfrm_dst),
         .entries =              ATOMIC_INIT(0),
 };
 
diff --git a/net/ipx/sysctl_net_ipx.c b/net/ipx/sysctl_net_ipx.c
index 92fef864e852..633fcab35580 100644
--- a/net/ipx/sysctl_net_ipx.c
+++ b/net/ipx/sysctl_net_ipx.c
@@ -23,7 +23,7 @@ static struct ctl_table ipx_table[] = {
                 .data           = &sysctl_ipx_pprop_broadcasting,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         { 0 },
 };
diff --git a/net/irda/irlan/irlan_client.c b/net/irda/irlan/irlan_client.c
index 6be1ec26b30c..42f7d960d055 100644
--- a/net/irda/irlan/irlan_client.c
+++ b/net/irda/irlan/irlan_client.c
@@ -436,7 +436,6 @@ static void irlan_check_response_param(struct irlan_cb *self, char *param,
         __u16 tmp_cpu; /* Temporary value in host order */
         __u8 *bytes;
         int i;
-        DECLARE_MAC_BUF(mac);
 
         IRDA_DEBUG(4, "%s(), parm=%s\n", __func__ , param);
 
@@ -521,8 +520,7 @@ static void irlan_check_response_param(struct irlan_cb *self, char *param,
         /* FILTER_ENTRY, have we got an ethernet address? */
         if (strcmp(param, "FILTER_ENTRY") == 0) {
                 bytes = value;
-                IRDA_DEBUG(4, "Ethernet address = %s\n",
-                           print_mac(mac, bytes));
+                IRDA_DEBUG(4, "Ethernet address = %pM\n", bytes);
                 for (i = 0; i < 6; i++)
                         self->dev->dev_addr[i] = bytes[i];
         }
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index 9a1cd87e7142..774d73a76852 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -207,7 +207,7 @@ static struct irlan_cb *irlan_open(__u32 saddr, __u32 daddr)
         if (!dev)
                 return NULL;
 
-        self = dev->priv;
+        self = netdev_priv(dev);
         self->dev = dev;
 
         /*
diff --git a/net/irda/irsysctl.c b/net/irda/irsysctl.c
index 9ab3df15425d..57f8817c3979 100644
--- a/net/irda/irsysctl.c
+++ b/net/irda/irsysctl.c
@@ -118,8 +118,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_discovery,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &do_discovery,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = do_discovery,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_IRDA_DEVNAME,
@@ -127,8 +127,8 @@ static ctl_table irda_table[] = {
                 .data           = sysctl_devname,
                 .maxlen         = 65,
                 .mode           = 0644,
-                .proc_handler   = &do_devname,
-                .strategy       = &sysctl_string
+                .proc_handler   = do_devname,
+                .strategy       = sysctl_string
         },
 #ifdef CONFIG_IRDA_DEBUG
         {
@@ -137,7 +137,7 @@ static ctl_table irda_table[] = {
                 .data           = &irda_debug,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #endif
 #ifdef CONFIG_IRDA_FAST_RR
@@ -147,7 +147,7 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_fast_poll_increase,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
 #endif
         {
@@ -156,8 +156,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_discovery_slots,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_discovery_slots,
                 .extra2         = &max_discovery_slots
         },
@@ -167,7 +167,7 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_discovery_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         {
                 .ctl_name       = NET_IRDA_SLOT_TIMEOUT,
@@ -175,8 +175,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_slot_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_slot_timeout,
                 .extra2         = &max_slot_timeout
         },
@@ -186,8 +186,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_max_baud_rate,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_baud_rate,
                 .extra2         = &max_max_baud_rate
         },
@@ -197,8 +197,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_min_tx_turn_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_min_tx_turn_time,
                 .extra2         = &max_min_tx_turn_time
         },
@@ -208,8 +208,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_max_tx_data_size,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_tx_data_size,
                 .extra2         = &max_max_tx_data_size
         },
@@ -219,8 +219,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_max_tx_window,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_tx_window,
                 .extra2         = &max_max_tx_window
         },
@@ -230,8 +230,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_max_noreply_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_max_noreply_time,
                 .extra2         = &max_max_noreply_time
         },
@@ -241,8 +241,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_warn_noreply_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_warn_noreply_time,
                 .extra2         = &max_warn_noreply_time
         },
@@ -252,8 +252,8 @@ static ctl_table irda_table[] = {
                 .data           = &sysctl_lap_keepalive_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_lap_keepalive_time,
                 .extra2         = &max_lap_keepalive_time
         },
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index 48212c0a961c..b58bd7c6cdf8 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -27,8 +27,7 @@
 
 static void llc_ui_format_mac(struct seq_file *seq, u8 *addr)
 {
-        DECLARE_MAC_BUF(mac);
-        seq_printf(seq, "%s", print_mac(mac, addr));
+        seq_printf(seq, "%pM", addr);
 }
 
 static struct sock *llc_get_sk_idx(loff_t pos)
diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
index 5bef1dcf18e3..57b9304d444c 100644
--- a/net/llc/sysctl_net_llc.c
+++ b/net/llc/sysctl_net_llc.c
@@ -20,8 +20,8 @@ static struct ctl_table llc2_timeout_table[] = {
                 .data           = &sysctl_llc2_ack_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_LLC2_BUSY_TIMEOUT,
@@ -29,8 +29,8 @@ static struct ctl_table llc2_timeout_table[] = {
                 .data           = &sysctl_llc2_busy_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_LLC2_P_TIMEOUT,
@@ -38,8 +38,8 @@ static struct ctl_table llc2_timeout_table[] = {
                 .data           = &sysctl_llc2_p_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         {
                 .ctl_name       = NET_LLC2_REJ_TIMEOUT,
@@ -47,8 +47,8 @@ static struct ctl_table llc2_timeout_table[] = {
                 .data           = &sysctl_llc2_rej_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         { 0 },
 };
@@ -60,8 +60,8 @@ static struct ctl_table llc_station_table[] = {
                 .data           = &sysctl_llc_station_ack_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
+                .strategy       = sysctl_jiffies,
         },
         { 0 },
 };
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 855126a3039d..16423f94801b 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -17,13 +17,6 @@
 #include "rate.h"
 #include "mesh.h"
 
-struct ieee80211_hw *wiphy_to_hw(struct wiphy *wiphy)
-{
-        struct ieee80211_local *local = wiphy_priv(wiphy);
-        return &local->hw;
-}
-EXPORT_SYMBOL(wiphy_to_hw);
-
 static bool nl80211_type_check(enum nl80211_iftype type)
 {
         switch (type) {
@@ -33,6 +26,8 @@ static bool nl80211_type_check(enum nl80211_iftype type)
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
 #endif
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_WDS:
                 return true;
         default:
@@ -401,8 +396,8 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
          */
         if (params->interval) {
                 sdata->local->hw.conf.beacon_int = params->interval;
-                if (ieee80211_hw_config(sdata->local))
-                        return -EINVAL;
+                ieee80211_hw_config(sdata->local,
+                                    IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
                 /*
                  * We updated some parameter so if below bails out
                  * it's not an error.
@@ -589,6 +584,8 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         struct ieee80211_supported_band *sband;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
+
         /*
          * FIXME: updating the flags is racy when this function is
          *        called from ieee80211_change_station(), this will
@@ -629,7 +626,6 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 
         if (params->supported_rates) {
                 rates = 0;
-                sband = local->hw.wiphy->bands[local->oper_channel->band];
 
                 for (i = 0; i < params->supported_rates_len; i++) {
                         int rate = (params->supported_rates[i] & 0x7f) * 5;
@@ -641,10 +637,10 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 sta->sta.supp_rates[local->oper_channel->band] = rates;
         }
 
-        if (params->ht_capa) {
-                ieee80211_ht_cap_ie_to_ht_info(params->ht_capa,
-                                               &sta->sta.ht_info);
-        }
+        if (params->ht_capa)
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                                                  params->ht_capa,
+                                                  &sta->sta.ht_cap);
 
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->plink_action) {
                 switch (params->plink_action) {
@@ -957,6 +953,72 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
         rcu_read_unlock();
         return 0;
 }
+
+static int ieee80211_get_mesh_params(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                struct mesh_config *conf)
+{
+        struct ieee80211_sub_if_data *sdata;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+                return -ENOTSUPP;
+        memcpy(conf, &(sdata->u.mesh.mshcfg), sizeof(struct mesh_config));
+        return 0;
+}
+
+static inline bool _chg_mesh_attr(enum nl80211_meshconf_params parm, u32 mask)
+{
+        return (mask >> (parm-1)) & 0x1;
+}
+
+static int ieee80211_set_mesh_params(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                const struct mesh_config *nconf, u32 mask)
+{
+        struct mesh_config *conf;
+        struct ieee80211_sub_if_data *sdata;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+                return -ENOTSUPP;
+
+        /* Set the config options which we are interested in setting */
+        conf = &(sdata->u.mesh.mshcfg);
+        if (_chg_mesh_attr(NL80211_MESHCONF_RETRY_TIMEOUT, mask))
+                conf->dot11MeshRetryTimeout = nconf->dot11MeshRetryTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_CONFIRM_TIMEOUT, mask))
+                conf->dot11MeshConfirmTimeout = nconf->dot11MeshConfirmTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HOLDING_TIMEOUT, mask))
+                conf->dot11MeshHoldingTimeout = nconf->dot11MeshHoldingTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_MAX_PEER_LINKS, mask))
+                conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
+        if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
+                conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
+        if (_chg_mesh_attr(NL80211_MESHCONF_TTL, mask))
+                conf->dot11MeshTTL = nconf->dot11MeshTTL;
+        if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask))
+                conf->auto_open_plinks = nconf->auto_open_plinks;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
+                conf->dot11MeshHWMPmaxPREQretries =
+                        nconf->dot11MeshHWMPmaxPREQretries;
+        if (_chg_mesh_attr(NL80211_MESHCONF_PATH_REFRESH_TIME, mask))
+                conf->path_refresh_time = nconf->path_refresh_time;
+        if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
+                conf->min_discovery_timeout = nconf->min_discovery_timeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
+                conf->dot11MeshHWMPactivePathTimeout =
+                        nconf->dot11MeshHWMPactivePathTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, mask))
+                conf->dot11MeshHWMPpreqMinInterval =
+                        nconf->dot11MeshHWMPpreqMinInterval;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
+                           mask))
+                conf->dot11MeshHWMPnetDiameterTraversalTime =
+                        nconf->dot11MeshHWMPnetDiameterTraversalTime;
+        return 0;
+}
+
 #endif
 
 static int ieee80211_change_bss(struct wiphy *wiphy,
@@ -972,25 +1034,67 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                 return -EINVAL;
 
         if (params->use_cts_prot >= 0) {
-                sdata->bss_conf.use_cts_prot = params->use_cts_prot;
+                sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
                 changed |= BSS_CHANGED_ERP_CTS_PROT;
         }
         if (params->use_short_preamble >= 0) {
-                sdata->bss_conf.use_short_preamble =
+                sdata->vif.bss_conf.use_short_preamble =
                         params->use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
         if (params->use_short_slot_time >= 0) {
-                sdata->bss_conf.use_short_slot =
+                sdata->vif.bss_conf.use_short_slot =
                         params->use_short_slot_time;
                 changed |= BSS_CHANGED_ERP_SLOT;
         }
 
+        if (params->basic_rates) {
+                int i, j;
+                u32 rates = 0;
+                struct ieee80211_local *local = wiphy_priv(wiphy);
+                struct ieee80211_supported_band *sband =
+                        wiphy->bands[local->oper_channel->band];
+
+                for (i = 0; i < params->basic_rates_len; i++) {
+                        int rate = (params->basic_rates[i] & 0x7f) * 5;
+                        for (j = 0; j < sband->n_bitrates; j++) {
+                                if (sband->bitrates[j].bitrate == rate)
+                                        rates |= BIT(j);
+                        }
+                }
+                sdata->vif.bss_conf.basic_rates = rates;
+                changed |= BSS_CHANGED_BASIC_RATES;
+        }
+
         ieee80211_bss_info_change_notify(sdata, changed);
 
         return 0;
 }
 
+static int ieee80211_set_txq_params(struct wiphy *wiphy,
+                                    struct ieee80211_txq_params *params)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_tx_queue_params p;
+
+        if (!local->ops->conf_tx)
+                return -EOPNOTSUPP;
+
+        memset(&p, 0, sizeof(p));
+        p.aifs = params->aifs;
+        p.cw_max = params->cwmax;
+        p.cw_min = params->cwmin;
+        p.txop = params->txop;
+        if (local->ops->conf_tx(local_to_hw(local), params->queue, &p)) {
+                printk(KERN_DEBUG "%s: failed to set TX queue "
+                       "parameters for queue %d\n", local->mdev->name,
+                       params->queue);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1013,6 +1117,9 @@ struct cfg80211_ops mac80211_config_ops = {
         .change_mpath = ieee80211_change_mpath,
         .get_mpath = ieee80211_get_mpath,
         .dump_mpath = ieee80211_dump_mpath,
+        .set_mesh_params = ieee80211_set_mesh_params,
+        .get_mesh_params = ieee80211_get_mesh_params,
 #endif
         .change_bss = ieee80211_change_bss,
+        .set_txq_params = ieee80211_set_txq_params,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 24ce54463310..2697a2fe608f 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -47,18 +47,14 @@ static const struct file_operations name## _ops = {			\
 
 DEBUGFS_READONLY_FILE(frequency, 20, "%d",
                       local->hw.conf.channel->center_freq);
-DEBUGFS_READONLY_FILE(antenna_sel_tx, 20, "%d",
-                      local->hw.conf.antenna_sel_tx);
-DEBUGFS_READONLY_FILE(antenna_sel_rx, 20, "%d",
-                      local->hw.conf.antenna_sel_rx);
 DEBUGFS_READONLY_FILE(rts_threshold, 20, "%d",
                       local->rts_threshold);
 DEBUGFS_READONLY_FILE(fragmentation_threshold, 20, "%d",
                       local->fragmentation_threshold);
 DEBUGFS_READONLY_FILE(short_retry_limit, 20, "%d",
-                      local->short_retry_limit);
+                      local->hw.conf.short_frame_max_tx_count);
 DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
-                      local->long_retry_limit);
+                      local->hw.conf.long_frame_max_tx_count);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                       local->total_ps_buffered);
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#06x",
@@ -202,8 +198,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         local->debugfs.keys = debugfs_create_dir("keys", phyd);
 
         DEBUGFS_ADD(frequency);
-        DEBUGFS_ADD(antenna_sel_tx);
-        DEBUGFS_ADD(antenna_sel_rx);
         DEBUGFS_ADD(rts_threshold);
         DEBUGFS_ADD(fragmentation_threshold);
         DEBUGFS_ADD(short_retry_limit);
@@ -258,8 +252,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
 void debugfs_hw_del(struct ieee80211_local *local)
 {
         DEBUGFS_DEL(frequency);
-        DEBUGFS_DEL(antenna_sel_tx);
-        DEBUGFS_DEL(antenna_sel_rx);
         DEBUGFS_DEL(rts_threshold);
         DEBUGFS_DEL(fragmentation_threshold);
         DEBUGFS_DEL(short_retry_limit);
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index a3294d109322..6424ac565ae0 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -188,7 +188,6 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
   {
         static int keycount;
         char buf[50];
-        DECLARE_MAC_BUF(mac);
         struct sta_info *sta;
 
         if (!key->local->debugfs.keys)
@@ -206,8 +205,7 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         rcu_read_lock();
         sta = rcu_dereference(key->sta);
         if (sta)
-                sprintf(buf, "../../stations/%s",
-                        print_mac(mac, sta->sta.addr));
+                sprintf(buf, "../../stations/%pM", sta->sta.addr);
         rcu_read_unlock();
 
         /* using sta as a boolean is fine outside RCU lock */
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 2ad504fc3414..c54219301724 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -41,29 +41,6 @@ static ssize_t ieee80211_if_read(
         return ret;
 }
 
-#ifdef CONFIG_MAC80211_MESH
-static ssize_t ieee80211_if_write(
-        struct ieee80211_sub_if_data *sdata,
-        char const __user *userbuf,
-        size_t count, loff_t *ppos,
-        int (*format)(struct ieee80211_sub_if_data *, char *))
-{
-        char buf[10];
-        int buf_size;
-
-        memset(buf, 0x00, sizeof(buf));
-        buf_size = min(count, (sizeof(buf)-1));
-        if (copy_from_user(buf, userbuf, buf_size))
-                return count;
-        read_lock(&dev_base_lock);
-        if (sdata->dev->reg_state == NETREG_REGISTERED)
-                (*format)(sdata, buf);
-        read_unlock(&dev_base_lock);
-
-        return count;
-}
-#endif
-
 #define IEEE80211_IF_FMT(name, field, format_string)                    \
 static ssize_t ieee80211_if_fmt_##name(                                 \
         const struct ieee80211_sub_if_data *sdata, char *buf,           \
@@ -71,19 +48,6 @@ static ssize_t ieee80211_if_fmt_##name(					\
 {                                                                       \
         return scnprintf(buf, buflen, format_string, sdata->field);     \
 }
-#define IEEE80211_IF_WFMT(name, field, type)                            \
-static int ieee80211_if_wfmt_##name(                                    \
-        struct ieee80211_sub_if_data *sdata, char *buf)                 \
-{                                                                       \
-        unsigned long tmp;                                              \
-        char *endp;                                                     \
-                                                                        \
-        tmp = simple_strtoul(buf, &endp, 0);                            \
-        if ((endp == buf) || ((type)tmp != tmp))                        \
-                return -EINVAL;                                         \
-        sdata->field = tmp;                                             \
-        return 0;                                                       \
-}
 #define IEEE80211_IF_FMT_DEC(name, field)                               \
                 IEEE80211_IF_FMT(name, field, "%d\n")
 #define IEEE80211_IF_FMT_HEX(name, field)                               \
@@ -104,8 +68,7 @@ static ssize_t ieee80211_if_fmt_##name(					\
         const struct ieee80211_sub_if_data *sdata, char *buf,           \
         int buflen)                                                     \
 {                                                                       \
-        DECLARE_MAC_BUF(mac);                                           \
-        return scnprintf(buf, buflen, "%s\n", print_mac(mac, sdata->field));\
+        return scnprintf(buf, buflen, "%pM\n", sdata->field);           \
 }
 
 #define __IEEE80211_IF_FILE(name)                                       \
@@ -126,34 +89,6 @@ static const struct file_operations name##_ops = {			\
                 IEEE80211_IF_FMT_##format(name, field)                  \
                 __IEEE80211_IF_FILE(name)
 
-#define __IEEE80211_IF_WFILE(name)                                      \
-static ssize_t ieee80211_if_read_##name(struct file *file,              \
-                                        char __user *userbuf,           \
-                                        size_t count, loff_t *ppos)     \
-{                                                                       \
-        return ieee80211_if_read(file->private_data,                    \
-                                 userbuf, count, ppos,                  \
-                                 ieee80211_if_fmt_##name);              \
-}                                                                       \
-static ssize_t ieee80211_if_write_##name(struct file *file,             \
-                                        const char __user *userbuf,     \
-                                        size_t count, loff_t *ppos)     \
-{                                                                       \
-        return ieee80211_if_write(file->private_data,                   \
-                                 userbuf, count, ppos,                  \
-                                 ieee80211_if_wfmt_##name);             \
-}                                                                       \
-static const struct file_operations name##_ops = {                      \
-        .read = ieee80211_if_read_##name,                               \
-        .write = ieee80211_if_write_##name,                             \
-        .open = mac80211_open_file_generic,                             \
-}
-
-#define IEEE80211_IF_WFILE(name, field, format, type)                   \
-                IEEE80211_IF_FMT_##format(name, field)                  \
-                IEEE80211_IF_WFMT(name, field, type)                    \
-                __IEEE80211_IF_WFILE(name)
-
 /* common attributes */
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
 IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
@@ -184,7 +119,7 @@ static ssize_t ieee80211_if_fmt_flags(
                  sdata->u.sta.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
                  sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
                  sdata->u.sta.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
-                 sdata->bss_conf.use_cts_prot ? "CTS prot\n" : "");
+                 sdata->vif.bss_conf.use_cts_prot ? "CTS prot\n" : "");
 }
 __IEEE80211_IF_FILE(flags);
 
@@ -212,30 +147,30 @@ IEEE80211_IF_FILE(dropped_frames_no_route,
 IEEE80211_IF_FILE(estab_plinks, u.mesh.mshstats.estab_plinks, ATOMIC);
 
 /* Mesh parameters */
-IEEE80211_IF_WFILE(dot11MeshMaxRetries,
-                u.mesh.mshcfg.dot11MeshMaxRetries, DEC, u8);
-IEEE80211_IF_WFILE(dot11MeshRetryTimeout,
-                u.mesh.mshcfg.dot11MeshRetryTimeout, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshConfirmTimeout,
-                u.mesh.mshcfg.dot11MeshConfirmTimeout, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHoldingTimeout,
-                u.mesh.mshcfg.dot11MeshHoldingTimeout, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshTTL, u.mesh.mshcfg.dot11MeshTTL, DEC, u8);
-IEEE80211_IF_WFILE(auto_open_plinks, u.mesh.mshcfg.auto_open_plinks, DEC, u8);
-IEEE80211_IF_WFILE(dot11MeshMaxPeerLinks,
-                u.mesh.mshcfg.dot11MeshMaxPeerLinks, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHWMPactivePathTimeout,
-                u.mesh.mshcfg.dot11MeshHWMPactivePathTimeout, DEC, u32);
-IEEE80211_IF_WFILE(dot11MeshHWMPpreqMinInterval,
-                u.mesh.mshcfg.dot11MeshHWMPpreqMinInterval, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHWMPnetDiameterTraversalTime,
-                u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHWMPmaxPREQretries,
-                u.mesh.mshcfg.dot11MeshHWMPmaxPREQretries, DEC, u8);
-IEEE80211_IF_WFILE(path_refresh_time,
-                u.mesh.mshcfg.path_refresh_time, DEC, u32);
-IEEE80211_IF_WFILE(min_discovery_timeout,
-                u.mesh.mshcfg.min_discovery_timeout, DEC, u16);
+IEEE80211_IF_FILE(dot11MeshMaxRetries,
+                u.mesh.mshcfg.dot11MeshMaxRetries, DEC);
+IEEE80211_IF_FILE(dot11MeshRetryTimeout,
+                u.mesh.mshcfg.dot11MeshRetryTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshConfirmTimeout,
+                u.mesh.mshcfg.dot11MeshConfirmTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshHoldingTimeout,
+                u.mesh.mshcfg.dot11MeshHoldingTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshTTL, u.mesh.mshcfg.dot11MeshTTL, DEC);
+IEEE80211_IF_FILE(auto_open_plinks, u.mesh.mshcfg.auto_open_plinks, DEC);
+IEEE80211_IF_FILE(dot11MeshMaxPeerLinks,
+                u.mesh.mshcfg.dot11MeshMaxPeerLinks, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPactivePathTimeout,
+                u.mesh.mshcfg.dot11MeshHWMPactivePathTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPpreqMinInterval,
+                u.mesh.mshcfg.dot11MeshHWMPpreqMinInterval, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPnetDiameterTraversalTime,
+                u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPmaxPREQretries,
+                u.mesh.mshcfg.dot11MeshHWMPmaxPREQretries, DEC);
+IEEE80211_IF_FILE(path_refresh_time,
+                u.mesh.mshcfg.path_refresh_time, DEC);
+IEEE80211_IF_FILE(min_discovery_timeout,
+                u.mesh.mshcfg.min_discovery_timeout, DEC);
 #endif
 
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index b85c4f27b361..a2fbe0131312 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -39,13 +39,6 @@ static const struct file_operations sta_ ##name## _ops = {		\
         .open = mac80211_open_file_generic,                             \
 }
 
-#define STA_OPS_WR(name)                                                \
-static const struct file_operations sta_ ##name## _ops = {              \
-        .read = sta_##name##_read,                                      \
-        .write = sta_##name##_write,                                    \
-        .open = mac80211_open_file_generic,                             \
-}
-
 #define STA_FILE(name, field, format)                                   \
                 STA_READ_##format(name, field)                          \
                 STA_OPS(name)
@@ -144,7 +137,7 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
         for (i = 0; i < STA_TID_NUM; i++)
                 p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_rx[i]?
+                        sta->ampdu_mlme.tid_state_rx[i] ?
                         sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
 
         p += scnprintf(p, sizeof(buf)+buf-p, "\n TX  :");
@@ -155,84 +148,20 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
         for (i = 0; i < STA_TID_NUM; i++)
                 p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i]?
+                        sta->ampdu_mlme.tid_state_tx[i] ?
                         sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
 
         p += scnprintf(p, sizeof(buf)+buf-p, "\n SSN :");
         for (i = 0; i < STA_TID_NUM; i++)
                 p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i]?
+                        sta->ampdu_mlme.tid_state_tx[i] ?
                         sta->ampdu_mlme.tid_tx[i]->ssn : 0);
 
         p += scnprintf(p, sizeof(buf)+buf-p, "\n");
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
-
-static ssize_t sta_agg_status_write(struct file *file,
-                const char __user *user_buf, size_t count, loff_t *ppos)
-{
-        struct sta_info *sta = file->private_data;
-        struct ieee80211_local *local = sta->sdata->local;
-        struct ieee80211_hw *hw = &local->hw;
-        u8 *da = sta->sta.addr;
-        static int tid_static_tx[16] = {0, 0, 0, 0, 0, 0, 0, 0,
-                                        0, 0, 0, 0, 0, 0, 0, 0};
-        static int tid_static_rx[16] = {1, 1, 1, 1, 1, 1, 1, 1,
-                                        1, 1, 1, 1, 1, 1, 1, 1};
-        char *endp;
-        char buf[32];
-        int buf_size, rs;
-        unsigned int tid_num;
-        char state[4];
-
-        memset(buf, 0x00, sizeof(buf));
-        buf_size = min(count, (sizeof(buf)-1));
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-
-        tid_num = simple_strtoul(buf, &endp, 0);
-        if (endp == buf)
-                return -EINVAL;
-
-        if ((tid_num >= 100) && (tid_num <= 115)) {
-                /* toggle Rx aggregation command */
-                tid_num = tid_num - 100;
-                if (tid_static_rx[tid_num] == 1) {
-                        strcpy(state, "off");
-                        ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
-                                        WLAN_REASON_QSTA_REQUIRE_SETUP);
-                        sta->ampdu_mlme.tid_state_rx[tid_num] |=
-                                        HT_AGG_STATE_DEBUGFS_CTL;
-                        tid_static_rx[tid_num] = 0;
-                } else {
-                        strcpy(state, "on ");
-                        sta->ampdu_mlme.tid_state_rx[tid_num] &=
-                                        ~HT_AGG_STATE_DEBUGFS_CTL;
-                        tid_static_rx[tid_num] = 1;
-                }
-                printk(KERN_DEBUG "debugfs - try switching tid %u %s\n",
-                                tid_num, state);
-        } else if ((tid_num >= 0) && (tid_num <= 15)) {
-                /* toggle Tx aggregation command */
-                if (tid_static_tx[tid_num] == 0) {
-                        strcpy(state, "on ");
-                        rs =  ieee80211_start_tx_ba_session(hw, da, tid_num);
-                        if (rs == 0)
-                                tid_static_tx[tid_num] = 1;
-                } else {
-                        strcpy(state, "off");
-                        rs =  ieee80211_stop_tx_ba_session(hw, da, tid_num, 1);
-                        if (rs == 0)
-                                tid_static_tx[tid_num] = 0;
-                }
-                printk(KERN_DEBUG "debugfs - switching tid %u %s, return=%d\n",
-                                tid_num, state, rs);
-        }
-
-        return count;
-}
-STA_OPS_WR(agg_status);
+STA_OPS(agg_status);
 
 #define DEBUGFS_ADD(name) \
         sta->debugfs.name = debugfs_create_file(#name, 0400, \
@@ -246,15 +175,14 @@ STA_OPS_WR(agg_status);
 void ieee80211_sta_debugfs_add(struct sta_info *sta)
 {
         struct dentry *stations_dir = sta->local->debugfs.stations;
-        DECLARE_MAC_BUF(mbuf);
-        u8 *mac;
+        u8 mac[3*ETH_ALEN];
 
         sta->debugfs.add_has_run = true;
 
         if (!stations_dir)
                 return;
 
-        mac = print_mac(mbuf, sta->sta.addr);
+        snprintf(mac, sizeof(mac), "%pM", sta->sta.addr);
 
         /*
          * This might fail due to a race condition:
diff --git a/net/mac80211/event.c b/net/mac80211/event.c
index 8de60de70bc9..0d95561c0ee0 100644
--- a/net/mac80211/event.c
+++ b/net/mac80211/event.c
@@ -21,14 +21,13 @@ void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int ke
 {
         union iwreq_data wrqu;
         char *buf = kmalloc(128, GFP_ATOMIC);
-        DECLARE_MAC_BUF(mac);
 
         if (buf) {
                 /* TODO: needed parameters: count, key type, TSC */
                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
-                        "keyid=%d %scast addr=%s)",
+                        "keyid=%d %scast addr=%pM)",
                         keyidx, hdr->addr1[0] & 0x01 ? "broad" : "uni",
-                        print_mac(mac, hdr->addr2));
+                        hdr->addr2);
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.data.length = strlen(buf);
                 wireless_send_event(sdata->dev, IWEVCUSTOM, &wrqu, buf);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index dc7d9a3d70d5..3e231d756776 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -20,50 +20,125 @@
 #include "sta_info.h"
 #include "wme.h"
 
-int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
-                                   struct ieee80211_ht_info *ht_info)
+void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
+                                       struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct ieee80211_sta_ht_cap *ht_cap)
 {
+        u8 ampdu_info, tx_mcs_set_cap;
+        int i, max_tx_streams;
 
-        if (ht_info == NULL)
-                return -EINVAL;
+        BUG_ON(!ht_cap);
+
+        memset(ht_cap, 0, sizeof(*ht_cap));
+
+        if (!ht_cap_ie)
+                return;
 
-        memset(ht_info, 0, sizeof(*ht_info));
+        ht_cap->ht_supported = true;
 
-        if (ht_cap_ie) {
-                u8 ampdu_info = ht_cap_ie->ampdu_params_info;
+        ht_cap->cap = ht_cap->cap & sband->ht_cap.cap;
+        ht_cap->cap &= ~IEEE80211_HT_CAP_SM_PS;
+        ht_cap->cap |= sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS;
 
-                ht_info->ht_supported = 1;
-                ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
-                ht_info->ampdu_factor =
-                        ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
-                ht_info->ampdu_density =
-                        (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
-                memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
-        } else
-                ht_info->ht_supported = 0;
+        ampdu_info = ht_cap_ie->ampdu_params_info;
+        ht_cap->ampdu_factor =
+                ampdu_info & IEEE80211_HT_AMPDU_PARM_FACTOR;
+        ht_cap->ampdu_density =
+                (ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
 
-        return 0;
+        /* own MCS TX capabilities */
+        tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
+
+        /* can we TX with MCS rates? */
+        if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
+                return;
+
+        /* Counting from 0, therefore +1 */
+        if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_RX_DIFF)
+                max_tx_streams =
+                        ((tx_mcs_set_cap & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
+                                >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
+        else
+                max_tx_streams = IEEE80211_HT_MCS_TX_MAX_STREAMS;
+
+        /*
+         * 802.11n D5.0 20.3.5 / 20.6 says:
+         * - indices 0 to 7 and 32 are single spatial stream
+         * - 8 to 31 are multiple spatial streams using equal modulation
+         *   [8..15 for two streams, 16..23 for three and 24..31 for four]
+         * - remainder are multiple spatial streams using unequal modulation
+         */
+        for (i = 0; i < max_tx_streams; i++)
+                ht_cap->mcs.rx_mask[i] =
+                        sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
+
+        if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
+                for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
+                     i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                        ht_cap->mcs.rx_mask[i] =
+                                sband->ht_cap.mcs.rx_mask[i] &
+                                        ht_cap_ie->mcs.rx_mask[i];
+
+        /* handle MCS rate 32 too */
+        if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
+                ht_cap->mcs.rx_mask[32/8] |= 1;
 }
 
-int ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                        struct ieee80211_ht_addt_info *ht_add_info_ie,
-                        struct ieee80211_ht_bss_info *bss_info)
+/*
+ * ieee80211_enable_ht should be called only after the operating band
+ * has been determined as ht configuration depends on the hw's
+ * HT abilities for a specific band.
+ */
+u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
+                        struct ieee80211_ht_info *hti,
+                        u16 ap_ht_cap_flags)
 {
-        if (bss_info == NULL)
-                return -EINVAL;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_bss_ht_conf ht;
+        u32 changed = 0;
+        bool enable_ht = true, ht_changed;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        memset(bss_info, 0, sizeof(*bss_info));
+        memset(&ht, 0, sizeof(ht));
 
-        if (ht_add_info_ie) {
-                u16 op_mode;
-                op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
+        /* HT is not supported */
+        if (!sband->ht_cap.ht_supported)
+                enable_ht = false;
 
-                bss_info->primary_channel = ht_add_info_ie->control_chan;
-                bss_info->bss_cap = ht_add_info_ie->ht_param;
-                bss_info->bss_op_mode = (u8)(op_mode & 0xff);
+        /* check that channel matches the right operating channel */
+        if (local->hw.conf.channel->center_freq !=
+            ieee80211_channel_to_frequency(hti->control_chan))
+                enable_ht = false;
+
+        /*
+         * XXX: This is totally incorrect when there are multiple virtual
+         *      interfaces, needs to be fixed later.
+         */
+        ht_changed = local->hw.conf.ht.enabled != enable_ht;
+        local->hw.conf.ht.enabled = enable_ht;
+        if (ht_changed)
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_HT);
+
+        /* disable HT */
+        if (!enable_ht)
+                return 0;
+        ht.secondary_channel_offset =
+                hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
+        ht.width_40_ok =
+                !(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
+                (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
+                (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY);
+        ht.operation_mode = le16_to_cpu(hti->operation_mode);
+
+        /* if bss configuration changed store the new one */
+        if (memcmp(&sdata->vif.bss_conf.ht, &ht, sizeof(ht))) {
+                changed |= BSS_CHANGED_HT;
+                sdata->vif.bss_conf.ht = ht;
         }
 
-        return 0;
+        return changed;
 }
 
 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
@@ -241,7 +316,6 @@ void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *r
         struct ieee80211_hw *hw = &local->hw;
         struct sta_info *sta;
         int ret, i;
-        DECLARE_MAC_BUF(mac);
 
         rcu_read_lock();
 
@@ -269,8 +343,8 @@ void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *r
         BUG_ON(!local->ops->ampdu_action);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx BA session stop requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
@@ -383,14 +457,13 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         u16 start_seq_num;
         u8 *state;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
-        if (tid >= STA_TID_NUM)
+        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
                 return -EINVAL;
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         rcu_read_lock();
@@ -442,17 +515,19 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         (unsigned long)&sta->timer_to_tid[tid];
         init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 
-        /* create a new queue for this aggregation */
-        ret = ieee80211_ht_agg_queue_add(local, sta, tid);
+        if (hw->ampdu_queues) {
+                /* create a new queue for this aggregation */
+                ret = ieee80211_ht_agg_queue_add(local, sta, tid);
 
-        /* case no queue is available to aggregation
-         * don't switch to aggregation */
-        if (ret) {
+                /* case no queue is available to aggregation
+                 * don't switch to aggregation */
+                if (ret) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - queue unavailable for"
-                                        " tid %d\n", tid);
+                        printk(KERN_DEBUG "BA request denied - "
+                               "queue unavailable for tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto err_unlock_queue;
+                        goto err_unlock_queue;
+                }
         }
         sdata = sta->sdata;
 
@@ -471,7 +546,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 /* No need to requeue the packets in the agg queue, since we
                  * held the tx lock: no packet could be enqueued to the newly
                  * allocated queue */
-                ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
+                if (hw->ampdu_queues)
+                        ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
                                         " tid %d\n", tid);
@@ -481,7 +557,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         }
 
         /* Will put all the packets in the new SW queue */
-        ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
+        if (hw->ampdu_queues)
+                ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
         spin_unlock_bh(&sta->lock);
 
         /* send an addBA request */
@@ -524,7 +601,6 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         struct sta_info *sta;
         u8 *state;
         int ret = 0;
-        DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM)
                 return -EINVAL;
@@ -546,11 +622,12 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         }
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Tx BA session stop requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
+        if (hw->ampdu_queues)
+                ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
 
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
@@ -563,7 +640,8 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         if (ret) {
                 WARN_ON(ret != -EBUSY);
                 *state = HT_AGG_STATE_OPERATIONAL;
-                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                if (hw->ampdu_queues)
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
                 goto stop_BA_exit;
         }
 
@@ -579,7 +657,6 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         struct ieee80211_local *local = hw_to_local(hw);
         struct sta_info *sta;
         u8 *state;
-        DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -594,8 +671,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         if (!sta) {
                 rcu_read_unlock();
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %s\n",
-                                print_mac(mac, ra));
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 #endif
                 return;
         }
@@ -621,7 +697,8 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
 #endif
-                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                if (hw->ampdu_queues)
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
         }
         spin_unlock_bh(&sta->lock);
         rcu_read_unlock();
@@ -634,7 +711,6 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         struct sta_info *sta;
         u8 *state;
         int agg_queue;
-        DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -645,16 +721,15 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         }
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Stopping Tx BA session for %s tid %d\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         rcu_read_lock();
         sta = sta_info_get(local, ra);
         if (!sta) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %s\n",
-                                print_mac(mac, ra));
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 #endif
                 rcu_read_unlock();
                 return;
@@ -677,16 +752,18 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
                 ieee80211_send_delba(sta->sdata, ra, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
-        agg_queue = sta->tid_to_tx_q[tid];
-
-        ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
-
-        /* We just requeued the all the frames that were in the
-         * removed queue, and since we might miss a softirq we do
-         * netif_schedule_queue.  ieee80211_wake_queue is not used
-         * here as this queue is not necessarily stopped
-         */
-        netif_schedule_queue(netdev_get_tx_queue(local->mdev, agg_queue));
+        if (hw->ampdu_queues) {
+                agg_queue = sta->tid_to_tx_q[tid];
+                ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
+
+                /* We just requeued the all the frames that were in the
+                 * removed queue, and since we might miss a softirq we do
+                 * netif_schedule_queue.  ieee80211_wake_queue is not used
+                 * here as this queue is not necessarily stopped
+                 */
+                netif_schedule_queue(netdev_get_tx_queue(local->mdev,
+                                                         agg_queue));
+        }
         spin_lock_bh(&sta->lock);
         *state = HT_AGG_STATE_IDLE;
         sta->ampdu_mlme.addba_req_num[tid] = 0;
@@ -783,7 +860,6 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
         u8 dialog_token;
         int ret = -EOPNOTSUPP;
-        DECLARE_MAC_BUF(mac);
 
         /* extract session parameters from addba request frame */
         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
@@ -801,15 +877,16 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* sanity check for incoming parameters:
          * check if configuration can support the BA policy
          * and if buffer size does not exceeds max value */
+        /* XXX: check own ht delayed BA capability?? */
         if (((ba_policy != 1)
-                && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
+                && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
                 status = WLAN_STATUS_INVALID_QOS_PARAM;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "AddBA Req with bad params from "
-                                "%s on tid %u. policy %d, buffer size %d\n",
-                                print_mac(mac, mgmt->sa), tid, ba_policy,
+                                "%pM on tid %u. policy %d, buffer size %d\n",
+                                mgmt->sa, tid, ba_policy,
                                 buf_size);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 goto end_no_lock;
@@ -820,7 +897,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
                 sband = local->hw.wiphy->bands[conf->channel->band];
                 buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_info.ampdu_factor;
+                buf_size = buf_size << sband->ht_cap.ampdu_factor;
         }
 
 
@@ -831,8 +908,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "unexpected AddBA Req from "
-                                "%s on tid %u\n",
-                                print_mac(mac, mgmt->sa), tid);
+                                "%pM on tid %u\n",
+                                mgmt->sa, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 goto end;
         }
@@ -910,7 +987,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 {
         struct ieee80211_hw *hw = &local->hw;
         u16 capab;
-        u16 tid;
+        u16 tid, start_seq_num;
         u8 *state;
 
         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
@@ -943,9 +1020,18 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 *state |= HT_ADDBA_RECEIVED_MSK;
                 sta->ampdu_mlme.addba_req_num[tid] = 0;
 
-                if (*state == HT_AGG_STATE_OPERATIONAL)
+                if (*state == HT_AGG_STATE_OPERATIONAL &&
+                    local->hw.ampdu_queues)
                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
 
+                if (local->ops->ampdu_action) {
+                        (void)local->ops->ampdu_action(hw,
+                                               IEEE80211_AMPDU_TX_RESUME,
+                                               &sta->sta, tid, &start_seq_num);
+                }
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Resuming TX aggregation for tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
                 spin_unlock_bh(&sta->lock);
         } else {
                 sta->ampdu_mlme.addba_req_num[tid]++;
@@ -964,7 +1050,6 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         u16 tid, params;
         u16 initiator;
-        DECLARE_MAC_BUF(mac);
 
         params = le16_to_cpu(mgmt->u.action.u.delba.params);
         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
@@ -972,9 +1057,8 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         if (net_ratelimit())
-                printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
-                        print_mac(mac, mgmt->sa),
-                        initiator ? "initiator" : "recipient", tid,
+                printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
+                        mgmt->sa, initiator ? "initiator" : "recipient", tid,
                         mgmt->u.action.u.delba.reason_code);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 156e42a003ae..155a20410017 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -23,6 +23,7 @@
 #include <linux/types.h>
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
+#include <net/cfg80211.h>
 #include <net/wireless.h>
 #include <net/iw_handler.h>
 #include <net/mac80211.h>
@@ -142,7 +143,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 #define IEEE80211_TX_FRAGMENTED         BIT(0)
 #define IEEE80211_TX_UNICAST            BIT(1)
 #define IEEE80211_TX_PS_BUFFERED        BIT(2)
-#define IEEE80211_TX_PROBE_LAST_FRAG    BIT(3)
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
@@ -153,11 +153,6 @@ struct ieee80211_tx_data {
         struct ieee80211_key *key;
 
         struct ieee80211_channel *channel;
-        s8 rate_idx;
-        /* use this rate (if set) for last fragment; rate can
-         * be set to lower rate for the first fragments, e.g.,
-         * when using CTS protection with IEEE 802.11g. */
-        s8 last_frag_rate_idx;
 
         /* Extra fragments (in addition to the first fragment
          * in skb) */
@@ -203,9 +198,7 @@ struct ieee80211_rx_data {
 struct ieee80211_tx_stored_packet {
         struct sk_buff *skb;
         struct sk_buff **extra_frag;
-        s8 last_frag_rate_idx;
         int num_extra_frag;
-        bool last_frag_rate_ctrl_probe;
 };
 
 struct beacon_data {
@@ -219,9 +212,6 @@ struct ieee80211_if_ap {
 
         struct list_head vlans;
 
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        size_t ssid_len;
-
         /* yes, this looks ugly, but guarantees that we can later use
          * bitmap_empty :)
          * NB: don't touch this bitmap, use sta_info_{set,clear}_tim_bit */
@@ -255,26 +245,6 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-struct mesh_config {
-        /* Timeouts in ms */
-        /* Mesh plink management parameters */
-        u16 dot11MeshRetryTimeout;
-        u16 dot11MeshConfirmTimeout;
-        u16 dot11MeshHoldingTimeout;
-        u16 dot11MeshMaxPeerLinks;
-        u8  dot11MeshMaxRetries;
-        u8  dot11MeshTTL;
-        bool auto_open_plinks;
-        /* HWMP parameters */
-        u8  dot11MeshHWMPmaxPREQretries;
-        u32 path_refresh_time;
-        u16 min_discovery_timeout;
-        u32 dot11MeshHWMPactivePathTimeout;
-        u16 dot11MeshHWMPpreqMinInterval;
-        u16 dot11MeshHWMPnetDiameterTraversalTime;
-};
-
-
 /* flags used in struct ieee80211_if_sta.flags */
 #define IEEE80211_STA_SSID_SET          BIT(0)
 #define IEEE80211_STA_BSSID_SET         BIT(1)
@@ -438,8 +408,7 @@ struct ieee80211_sub_if_data {
         struct ieee80211_key *keys[NUM_DEFAULT_KEYS];
         struct ieee80211_key *default_key;
 
-        /* BSS configuration for this interface. */
-        struct ieee80211_bss_conf bss_conf;
+        u16 sequence_number;
 
         /*
          * AP this belongs to: self in AP mode and
@@ -633,8 +602,6 @@ struct ieee80211_local {
 
         int rts_threshold;
         int fragmentation_threshold;
-        int short_retry_limit; /* dot11ShortRetryLimit */
-        int long_retry_limit; /* dot11LongRetryLimit */
 
         struct crypto_blkcipher *wep_tx_tfm;
         struct crypto_blkcipher *wep_rx_tfm;
@@ -727,8 +694,6 @@ struct ieee80211_local {
                 struct dentry *rcdir;
                 struct dentry *rcname;
                 struct dentry *frequency;
-                struct dentry *antenna_sel_tx;
-                struct dentry *antenna_sel_rx;
                 struct dentry *rts_threshold;
                 struct dentry *fragmentation_threshold;
                 struct dentry *short_retry_limit;
@@ -817,7 +782,7 @@ struct ieee802_11_elems {
         u8 *wmm_info;
         u8 *wmm_param;
         struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_addt_info *ht_info_elem;
+        struct ieee80211_ht_info *ht_info_elem;
         u8 *mesh_config;
         u8 *mesh_id;
         u8 *peer_link;
@@ -869,11 +834,6 @@ static inline struct ieee80211_hw *local_to_hw(
         return &local->hw;
 }
 
-struct sta_attribute {
-        struct attribute attr;
-        ssize_t (*show)(const struct sta_info *, char *buf);
-        ssize_t (*store)(struct sta_info *, const char *buf, size_t count);
-};
 
 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 {
@@ -882,12 +842,9 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 }
 
 
-int ieee80211_hw_config(struct ieee80211_local *local);
+int ieee80211_hw_config(struct ieee80211_local *local, u32 changed);
 int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed);
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
-u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
-                        struct ieee80211_ht_info *req_ht_cap,
-                        struct ieee80211_ht_bss_info *req_bss_cap);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed);
 void ieee80211_configure_filter(struct ieee80211_local *local);
@@ -968,11 +925,12 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
 /* HT */
-int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
-                                   struct ieee80211_ht_info *ht_info);
-int ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                        struct ieee80211_ht_addt_info *ht_add_info_ie,
-                        struct ieee80211_ht_bss_info *bss_info);
+void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
+                                       struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct ieee80211_sta_ht_cap *ht_cap);
+u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
+                        struct ieee80211_ht_info *hti,
+                        u16 ap_ht_cap_flags);
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
 
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8336fee68d3e..cde145221b61 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -65,7 +65,7 @@ static int ieee80211_open(struct net_device *dev)
         struct ieee80211_if_init_conf conf;
         u32 changed = 0;
         int res;
-        bool need_hw_reconfig = 0;
+        u32 hw_reconf_flags = 0;
         u8 null_addr[ETH_ALEN] = {0};
 
         /* fail early if user set an invalid address */
@@ -152,7 +152,8 @@ static int ieee80211_open(struct net_device *dev)
                         res = local->ops->start(local_to_hw(local));
                 if (res)
                         goto err_del_bss;
-                need_hw_reconfig = 1;
+                /* we're brought up, everything changes */
+                hw_reconf_flags = ~0;
                 ieee80211_led_radio(local, local->hw.conf.radio_enabled);
         }
 
@@ -198,8 +199,10 @@ static int ieee80211_open(struct net_device *dev)
 
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
-                if (local->monitors == 1)
+                if (local->monitors == 1) {
                         local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
+                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_RADIOTAP;
+                }
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
                         local->fif_fcsfail++;
@@ -279,8 +282,8 @@ static int ieee80211_open(struct net_device *dev)
                 atomic_inc(&local->iff_promiscs);
 
         local->open_count++;
-        if (need_hw_reconfig) {
-                ieee80211_hw_config(local);
+        if (hw_reconf_flags) {
+                ieee80211_hw_config(local, hw_reconf_flags);
                 /*
                  * set default queue parameters so drivers don't
                  * need to initialise the hardware if the hardware
@@ -322,6 +325,7 @@ static int ieee80211_stop(struct net_device *dev)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
+        u32 hw_reconf_flags = 0;
 
         /*
          * Stop TX on this interface first.
@@ -405,8 +409,10 @@ static int ieee80211_stop(struct net_device *dev)
                 }
 
                 local->monitors--;
-                if (local->monitors == 0)
+                if (local->monitors == 0) {
                         local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
+                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_RADIOTAP;
+                }
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
                         local->fif_fcsfail--;
@@ -504,8 +510,15 @@ static int ieee80211_stop(struct net_device *dev)
 
                 tasklet_disable(&local->tx_pending_tasklet);
                 tasklet_disable(&local->tasklet);
+
+                /* no reconfiguring after stop! */
+                hw_reconf_flags = 0;
         }
 
+        /* do after stop to avoid reconfiguring when we stop anyway */
+        if (hw_reconf_flags)
+                ieee80211_hw_config(local, hw_reconf_flags);
+
         return 0;
 }
 
@@ -682,7 +695,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
         ieee80211_setup_sdata(sdata, type);
 
         /* reset some values that shouldn't be kept across type changes */
-        sdata->bss_conf.basic_rates =
+        sdata->vif.bss_conf.basic_rates =
                 ieee80211_mandatory_rates(sdata->local,
                         sdata->local->hw.conf.channel->band);
         sdata->drop_unencrypted = 0;
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index a5b06fe71980..999f7aa42326 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -132,7 +132,6 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
         const u8 *addr;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
         assert_key_lock();
         might_sleep();
@@ -154,16 +153,15 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
                 printk(KERN_ERR "mac80211-%s: failed to set key "
-                       "(%d, %s) to hardware (%d)\n",
+                       "(%d, %pM) to hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, print_mac(mac, addr), ret);
+                       key->conf.keyidx, addr, ret);
 }
 
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
         const u8 *addr;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
         assert_key_lock();
         might_sleep();
@@ -186,9 +184,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 
         if (ret)
                 printk(KERN_ERR "mac80211-%s: failed to remove key "
-                       "(%d, %s) from hardware (%d)\n",
+                       "(%d, %pM) from hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, print_mac(mac, addr), ret);
+                       key->conf.keyidx, addr, ret);
 
         spin_lock(&todo_lock);
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index ae62ad40ad63..d631dc96c323 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -41,6 +41,8 @@
  */
 struct ieee80211_tx_status_rtap_hdr {
         struct ieee80211_radiotap_header hdr;
+        u8 rate;
+        u8 padding_for_rate;
         __le16 tx_flags;
         u8 data_retries;
 } __attribute__ ((packed));
@@ -169,19 +171,13 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
         conf.changed = changed;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+            sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 conf.bssid = sdata->u.sta.bssid;
-                conf.ssid = sdata->u.sta.ssid;
-                conf.ssid_len = sdata->u.sta.ssid_len;
-        } else if (sdata->vif.type == NL80211_IFTYPE_AP) {
+        else if (sdata->vif.type == NL80211_IFTYPE_AP)
                 conf.bssid = sdata->dev->dev_addr;
-                conf.ssid = sdata->u.ap.ssid;
-                conf.ssid_len = sdata->u.ap.ssid_len;
-        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 u8 zero[ETH_ALEN] = { 0 };
                 conf.bssid = zero;
-                conf.ssid = zero;
-                conf.ssid_len = 0;
         } else {
                 WARN_ON(1);
                 return -EINVAL;
@@ -190,136 +186,48 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
         if (WARN_ON(!conf.bssid && (changed & IEEE80211_IFCC_BSSID)))
                 return -EINVAL;
 
-        if (WARN_ON(!conf.ssid && (changed & IEEE80211_IFCC_SSID)))
-                return -EINVAL;
-
         return local->ops->config_interface(local_to_hw(local),
                                             &sdata->vif, &conf);
 }
 
-int ieee80211_hw_config(struct ieee80211_local *local)
+int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
         struct ieee80211_channel *chan;
         int ret = 0;
+        int power;
+
+        might_sleep();
 
         if (local->sw_scanning)
                 chan = local->scan_channel;
         else
                 chan = local->oper_channel;
 
-        local->hw.conf.channel = chan;
+        if (chan != local->hw.conf.channel) {
+                local->hw.conf.channel = chan;
+                changed |= IEEE80211_CONF_CHANGE_CHANNEL;
+        }
+
 
         if (!local->hw.conf.power_level)
-                local->hw.conf.power_level = chan->max_power;
+                power = chan->max_power;
         else
-                local->hw.conf.power_level = min(chan->max_power,
-                                               local->hw.conf.power_level);
-
-        local->hw.conf.max_antenna_gain = chan->max_antenna_gain;
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: HW CONFIG: freq=%d\n",
-               wiphy_name(local->hw.wiphy), chan->center_freq);
-#endif
-
-        if (local->open_count)
-                ret = local->ops->config(local_to_hw(local), &local->hw.conf);
-
-        return ret;
-}
-
-/**
- * ieee80211_handle_ht should be used only after legacy configuration
- * has been determined namely band, as ht configuration depends upon
- * the hardware's HT abilities for a _specific_ band.
- */
-u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
-                           struct ieee80211_ht_info *req_ht_cap,
-                           struct ieee80211_ht_bss_info *req_bss_cap)
-{
-        struct ieee80211_conf *conf = &local->hw.conf;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_ht_info ht_conf;
-        struct ieee80211_ht_bss_info ht_bss_conf;
-        u32 changed = 0;
-        int i;
-        u8 max_tx_streams = IEEE80211_HT_CAP_MAX_STREAMS;
-        u8 tx_mcs_set_cap;
-
-        sband = local->hw.wiphy->bands[conf->channel->band];
-
-        memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
-        memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));
-
-        /* HT is not supported */
-        if (!sband->ht_info.ht_supported) {
-                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-                goto out;
+                power = min(chan->max_power, local->hw.conf.power_level);
+        if (local->hw.conf.power_level != power) {
+                changed |= IEEE80211_CONF_CHANGE_POWER;
+                local->hw.conf.power_level = power;
         }
 
-        /* disable HT */
-        if (!enable_ht) {
-                if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
-                        changed |= BSS_CHANGED_HT;
-                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-                conf->ht_conf.ht_supported = 0;
-                goto out;
+        if (changed && local->open_count) {
+                ret = local->ops->config(local_to_hw(local), changed);
+                /*
+                 * HW reconfiguration should never fail, the driver has told
+                 * us what it can support so it should live up to that promise.
+                 */
+                WARN_ON(ret);
         }
 
-
-        if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
-                changed |= BSS_CHANGED_HT;
-
-        conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
-        ht_conf.ht_supported = 1;
-
-        ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
-        ht_conf.cap &= ~(IEEE80211_HT_CAP_SM_PS);
-        ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_SM_PS;
-        ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
-        ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
-        ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
-
-        ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
-        ht_conf.ampdu_density = req_ht_cap->ampdu_density;
-
-        /* Bits 96-100 */
-        tx_mcs_set_cap = sband->ht_info.supp_mcs_set[12];
-
-        /* configure suppoerted Tx MCS according to requested MCS
-         * (based in most cases on Rx capabilities of peer) and self
-         * Tx MCS capabilities (as defined by low level driver HW
-         * Tx capabilities) */
-        if (!(tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_DEFINED))
-                goto check_changed;
-
-        /* Counting from 0 therfore + 1 */
-        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_RX_DIFF)
-                max_tx_streams = ((tx_mcs_set_cap &
-                                IEEE80211_HT_CAP_MCS_TX_STREAMS) >> 2) + 1;
-
-        for (i = 0; i < max_tx_streams; i++)
-                ht_conf.supp_mcs_set[i] =
-                        sband->ht_info.supp_mcs_set[i] &
-                                        req_ht_cap->supp_mcs_set[i];
-
-        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_UEQM)
-                for (i = IEEE80211_SUPP_MCS_SET_UEQM;
-                     i < IEEE80211_SUPP_MCS_SET_LEN; i++)
-                        ht_conf.supp_mcs_set[i] =
-                                sband->ht_info.supp_mcs_set[i] &
-                                        req_ht_cap->supp_mcs_set[i];
-
-check_changed:
-        /* if bss configuration changed store the new one */
-        if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
-            memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
-                changed |= BSS_CHANGED_HT;
-                memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
-                memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
-        }
-out:
-        return changed;
+        return ret;
 }
 
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
@@ -336,15 +244,18 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         if (local->ops->bss_info_changed)
                 local->ops->bss_info_changed(local_to_hw(local),
                                              &sdata->vif,
-                                             &sdata->bss_conf,
+                                             &sdata->vif.bss_conf,
                                              changed);
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
 {
-        sdata->bss_conf.use_cts_prot = 0;
-        sdata->bss_conf.use_short_preamble = 0;
-        return BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_ERP_PREAMBLE;
+        sdata->vif.bss_conf.use_cts_prot = false;
+        sdata->vif.bss_conf.use_short_preamble = false;
+        sdata->vif.bss_conf.use_short_slot = false;
+        return BSS_CHANGED_ERP_CTS_PROT |
+               BSS_CHANGED_ERP_PREAMBLE |
+               BSS_CHANGED_ERP_SLOT;
 }
 
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
@@ -466,8 +377,6 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                                             struct sta_info *sta,
                                             struct sk_buff *skb)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-
         sta->tx_filtered_count++;
 
         /*
@@ -514,10 +423,9 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                 return;
         }
 
-        if (!test_sta_flags(sta, WLAN_STA_PS) &&
-            !(info->flags & IEEE80211_TX_CTL_REQUEUE)) {
+        if (!test_sta_flags(sta, WLAN_STA_PS) && !skb->requeue) {
                 /* Software retry the packet once */
-                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                skb->requeue = 1;
                 ieee80211_remove_tx_extra(local, sta->key, skb);
                 dev_queue_xmit(skb);
                 return;
@@ -547,13 +455,28 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
         struct sta_info *sta;
+        int retry_count = -1, i;
+
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                /* the HW cannot have attempted that rate */
+                if (i >= hw->max_rates) {
+                        info->status.rates[i].idx = -1;
+                        info->status.rates[i].count = 0;
+                }
+
+                retry_count += info->status.rates[i].count;
+        }
+        if (retry_count < 0)
+                retry_count = 0;
 
         rcu_read_lock();
 
+        sband = local->hw.wiphy->bands[info->band];
+
         sta = sta_info_get(local, hdr->addr1);
 
         if (sta) {
-                if (info->status.excessive_retries &&
+                if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
                     test_sta_flags(sta, WLAN_STA_PS)) {
                         /*
                          * The STA is in power save mode, so assume
@@ -584,12 +507,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         rcu_read_unlock();
                         return;
                 } else {
-                        if (info->status.excessive_retries)
+                        if (!(info->flags & IEEE80211_TX_STAT_ACK))
                                 sta->tx_retry_failed++;
-                        sta->tx_retry_count += info->status.retry_count;
+                        sta->tx_retry_count += retry_count;
                 }
 
-                sband = local->hw.wiphy->bands[info->band];
                 rate_control_tx_status(local, sband, sta, skb);
         }
 
@@ -610,9 +532,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         local->dot11TransmittedFrameCount++;
                         if (is_multicast_ether_addr(hdr->addr1))
                                 local->dot11MulticastTransmittedFrameCount++;
-                        if (info->status.retry_count > 0)
+                        if (retry_count > 0)
                                 local->dot11RetryCount++;
-                        if (info->status.retry_count > 1)
+                        if (retry_count > 1)
                                 local->dot11MultipleRetryCount++;
                 }
 
@@ -656,19 +578,30 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
         rthdr->hdr.it_present =
                 cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
+                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES) |
+                            (1 << IEEE80211_RADIOTAP_RATE));
 
         if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
             !is_multicast_ether_addr(hdr->addr1))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
 
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) &&
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
+        /*
+         * XXX: Once radiotap gets the bitmap reset thing the vendor
+         *      extensions proposal contains, we can actually report
+         *      the whole set of tries we did.
+         */
+        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+                rthdr->rate = sband->bitrates[
+                                info->status.rates[0].idx].bitrate / 5;
 
-        rthdr->data_retries = info->status.retry_count;
+        /* for now report the total retry_count */
+        rthdr->data_retries = retry_count;
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
@@ -753,13 +686,14 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         BUG_ON(!ops->configure_filter);
         local->ops = ops;
 
-        local->hw.queues = 1; /* default */
-
+        /* set up some defaults */
+        local->hw.queues = 1;
+        local->hw.max_rates = 1;
         local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
         local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
-        local->short_retry_limit = 7;
-        local->long_retry_limit = 4;
-        local->hw.conf.radio_enabled = 1;
+        local->hw.conf.long_frame_max_tx_count = 4;
+        local->hw.conf.short_frame_max_tx_count = 7;
+        local->hw.conf.radio_enabled = true;
 
         INIT_LIST_HEAD(&local->interfaces);
 
@@ -1013,7 +947,7 @@ static int __init ieee80211_init(void)
 
         BUILD_BUG_ON(sizeof(struct ieee80211_tx_info) > sizeof(skb->cb));
         BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, driver_data) +
-                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE > sizeof(skb->cb));
+                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE > sizeof(skb->cb));
 
         ret = rc80211_minstrel_init();
         if (ret)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 8013277924f2..82f568e94365 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -238,7 +238,7 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 
         pos = skb_put(skb, 21);
         *pos++ = WLAN_EID_MESH_CONFIG;
-        *pos++ = MESH_CFG_LEN;
+        *pos++ = IEEE80211_MESH_CONFIG_LEN;
         /* Version */
         *pos++ = 1;
 
@@ -473,7 +473,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                                         size_t len,
                                         struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_local *local= sdata->local;
+        struct ieee80211_local *local = sdata->local;
         struct ieee802_11_elems elems;
         struct ieee80211_channel *channel;
         u64 supp_rates = 0;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index e10471c6ba42..c197ab545e54 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -145,9 +145,6 @@ struct mesh_rmc {
 };
 
 
-/* Mesh IEs constants */
-#define MESH_CFG_LEN            19
-
 /*
  * MESH_CFG_COMP_LEN Includes:
  *      - Active path selection protocol ID.
@@ -157,7 +154,7 @@ struct mesh_rmc {
  * Does not include mesh capabilities, which may vary across nodes in the same
  * mesh
  */
-#define MESH_CFG_CMP_LEN        17
+#define MESH_CFG_CMP_LEN        (IEEE80211_MESH_CONFIG_LEN - 2)
 
 /* Default values, timeouts in ms */
 #define MESH_TTL                5
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 501c7831adb4..e8d573d592e7 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -218,12 +218,16 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
 
         if (sta->fail_avg >= 100)
                 return MAX_METRIC;
+
+        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)
+                return MAX_METRIC;
+
         err = (sta->fail_avg << ARITH_SHIFT) / 100;
 
         /* bitrate is in units of 100 Kbps, while we need rate in units of
          * 1Mbps. This will be corrected on tx_time computation.
          */
-        rate = sband->bitrates[sta->last_txrate_idx].bitrate;
+        rate = sband->bitrates[sta->last_tx_rate.idx].bitrate;
         tx_time = (device_constant + 10 * test_frame_len / rate);
         estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
         result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT) ;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index faac101c0f85..929ba542fd72 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -257,9 +257,6 @@ static void mesh_plink_timer(unsigned long data)
         struct sta_info *sta;
         __le16 llid, plid, reason;
         struct ieee80211_sub_if_data *sdata;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
         /*
          * This STA is valid because sta_info_destroy() will
@@ -274,8 +271,8 @@ static void mesh_plink_timer(unsigned long data)
                 spin_unlock_bh(&sta->lock);
                 return;
         }
-        mpl_dbg("Mesh plink timer for %s fired on state %d\n",
-                        print_mac(mac, sta->sta.addr), sta->plink_state);
+        mpl_dbg("Mesh plink timer for %pM fired on state %d\n",
+                sta->sta.addr, sta->plink_state);
         reason = 0;
         llid = sta->llid;
         plid = sta->plid;
@@ -287,9 +284,9 @@ static void mesh_plink_timer(unsigned long data)
                 /* retry timer */
                 if (sta->plink_retries < dot11MeshMaxRetries(sdata)) {
                         u32 rand;
-                        mpl_dbg("Mesh plink for %s (retry, timeout): %d %d\n",
-                                        print_mac(mac, sta->sta.addr),
-                                        sta->plink_retries, sta->plink_timeout);
+                        mpl_dbg("Mesh plink for %pM (retry, timeout): %d %d\n",
+                                sta->sta.addr, sta->plink_retries,
+                                sta->plink_timeout);
                         get_random_bytes(&rand, sizeof(u32));
                         sta->plink_timeout = sta->plink_timeout +
                                              rand % sta->plink_timeout;
@@ -337,9 +334,6 @@ int mesh_plink_open(struct sta_info *sta)
 {
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
@@ -351,8 +345,8 @@ int mesh_plink_open(struct sta_info *sta)
         sta->plink_state = PLINK_OPN_SNT;
         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
         spin_unlock_bh(&sta->lock);
-        mpl_dbg("Mesh plink: starting establishment with %s\n",
-                print_mac(mac, sta->sta.addr));
+        mpl_dbg("Mesh plink: starting establishment with %pM\n",
+                sta->sta.addr);
 
         return mesh_plink_frame_tx(sdata, PLINK_OPEN,
                                    sta->sta.addr, llid, 0, 0);
@@ -360,10 +354,6 @@ int mesh_plink_open(struct sta_info *sta)
 
 void mesh_plink_block(struct sta_info *sta)
 {
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
-
         spin_lock_bh(&sta->lock);
         __mesh_plink_deactivate(sta);
         sta->plink_state = PLINK_BLOCKED;
@@ -374,12 +364,8 @@ int mesh_plink_close(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         __le16 llid, plid, reason;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
-        mpl_dbg("Mesh plink: closing link with %s\n",
-                        print_mac(mac, sta->sta.addr));
+        mpl_dbg("Mesh plink: closing link with %pM\n", sta->sta.addr);
         spin_lock_bh(&sta->lock);
         sta->reason = cpu_to_le16(MESH_LINK_CANCELLED);
         reason = sta->reason;
@@ -417,9 +403,6 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         u8 ie_len;
         u8 *baseaddr;
         __le16 plid, llid, reason;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
         /* need action_code, aux */
         if (len < IEEE80211_MIN_ACTION_SIZE + 3)
@@ -557,10 +540,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
         }
 
-        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %s %d %d %d %d\n",
-                        print_mac(mac, mgmt->sa), sta->plink_state,
-                        le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
-                        event);
+        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %d %d %d %d\n",
+                mgmt->sa, sta->plink_state,
+                le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
+                event);
         reason = 0;
         switch (sta->plink_state) {
                 /* spin_unlock as soon as state is updated at each case */
@@ -660,8 +643,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plink_state = PLINK_ESTAB;
                         mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
-                        mpl_dbg("Mesh plink with %s ESTABLISHED\n",
-                                        print_mac(mac, sta->sta.addr));
+                        mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
+                                sta->sta.addr);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -693,8 +676,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plink_state = PLINK_ESTAB;
                         mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
-                        mpl_dbg("Mesh plink with %s ESTABLISHED\n",
-                                        print_mac(mac, sta->sta.addr));
+                        mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
+                                sta->sta.addr);
                         mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
                                             plid, 0);
                         break;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 409bb7716236..4d76bf25bada 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -236,7 +236,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *ies, *ht_add_ie;
+        u8 *pos, *ies, *ht_ie;
         int i, len, count, rates_len, supp_rates_len;
         u16 capab;
         struct ieee80211_bss *bss;
@@ -393,24 +393,25 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         /* wmm support is a must to HT */
         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
-            sband->ht_info.ht_supported &&
-            (ht_add_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_EXTRA_INFO))) {
-                struct ieee80211_ht_addt_info *ht_add_info =
-                        (struct ieee80211_ht_addt_info *)ht_add_ie;
-                u16 cap = sband->ht_info.cap;
+            sband->ht_cap.ht_supported &&
+            (ht_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_INFORMATION)) &&
+            ht_ie[1] >= sizeof(struct ieee80211_ht_info)) {
+                struct ieee80211_ht_info *ht_info =
+                        (struct ieee80211_ht_info *)(ht_ie + 2);
+                u16 cap = sband->ht_cap.cap;
                 __le16 tmp;
                 u32 flags = local->hw.conf.channel->flags;
 
-                switch (ht_add_info->ht_param & IEEE80211_HT_IE_CHA_SEC_OFFSET) {
-                case IEEE80211_HT_IE_CHA_SEC_ABOVE:
+                switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                         if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
                         }
                         break;
-                case IEEE80211_HT_IE_CHA_SEC_BELOW:
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
                         if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
                         }
                         break;
@@ -424,9 +425,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &tmp, sizeof(u16));
                 pos += sizeof(u16);
                 /* TODO: needs a define here for << 2 */
-                *pos++ = sband->ht_info.ampdu_factor |
-                         (sband->ht_info.ampdu_density << 2);
-                memcpy(pos, sband->ht_info.supp_mcs_set, 16);
+                *pos++ = sband->ht_cap.ampdu_factor |
+                         (sband->ht_cap.ampdu_density << 2);
+                memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
         }
 
         kfree(ifsta->assocreq_ies);
@@ -568,25 +569,35 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         }
 }
 
-static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
-                                           bool use_protection,
-                                           bool use_short_preamble)
+static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
+                                           u16 capab, bool erp_valid, u8 erp)
 {
-        struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        DECLARE_MAC_BUF(mac);
 #endif
         u32 changed = 0;
+        bool use_protection;
+        bool use_short_preamble;
+        bool use_short_slot;
+
+        if (erp_valid) {
+                use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
+                use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
+        } else {
+                use_protection = false;
+                use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
+        }
+
+        use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
 
         if (use_protection != bss_conf->use_cts_prot) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
-                               "%s)\n",
+                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_protection ? "enabled" : "disabled",
-                               print_mac(mac, ifsta->bssid));
+                               ifsta->bssid);
                 }
 #endif
                 bss_conf->use_cts_prot = use_protection;
@@ -597,40 +608,28 @@ static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
-                               " (BSSID=%s)\n",
+                               " (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_short_preamble ? "short" : "long",
-                               print_mac(mac, ifsta->bssid));
+                               ifsta->bssid);
                 }
 #endif
                 bss_conf->use_short_preamble = use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
 
-        return changed;
-}
-
-static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
-                                   u8 erp_value)
-{
-        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
-        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
-
-        return ieee80211_handle_protect_preamb(sdata,
-                        use_protection, use_short_preamble);
-}
-
-static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
-                                           struct ieee80211_bss *bss)
-{
-        u32 changed = 0;
-
-        if (bss->has_erp_value)
-                changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
-        else {
-                u16 capab = bss->capability;
-                changed |= ieee80211_handle_protect_preamb(sdata, false,
-                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        if (use_short_slot != bss_conf->use_short_slot) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: switched to %s slot"
+                               " (BSSID=%s)\n",
+                               sdata->dev->name,
+                               use_short_slot ? "short" : "long",
+                               ifsta->bssid);
+                }
+#endif
+                bss_conf->use_short_slot = use_short_slot;
+                changed |= BSS_CHANGED_ERP_SLOT;
         }
 
         return changed;
@@ -701,14 +700,15 @@ static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
 
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
+                                     struct ieee80211_if_sta *ifsta,
+                                     u32 bss_info_changed)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
-        u32 changed = BSS_CHANGED_ASSOC;
 
         struct ieee80211_bss *bss;
 
+        bss_info_changed |= BSS_CHANGED_ASSOC;
         ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
@@ -719,22 +719,16 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                                    ifsta->ssid, ifsta->ssid_len);
         if (bss) {
                 /* set timing information */
-                sdata->bss_conf.beacon_int = bss->beacon_int;
-                sdata->bss_conf.timestamp = bss->timestamp;
-                sdata->bss_conf.dtim_period = bss->dtim_period;
+                sdata->vif.bss_conf.beacon_int = bss->beacon_int;
+                sdata->vif.bss_conf.timestamp = bss->timestamp;
+                sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
-                changed |= ieee80211_handle_bss_capability(sdata, bss);
+                bss_info_changed |= ieee80211_handle_bss_capability(sdata,
+                        bss->capability, bss->has_erp_value, bss->erp_value);
 
                 ieee80211_rx_bss_put(local, bss);
         }
 
-        if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
-                changed |= BSS_CHANGED_HT;
-                sdata->bss_conf.assoc_ht = 1;
-                sdata->bss_conf.ht_conf = &conf->ht_conf;
-                sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
-        }
-
         ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
         memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
         ieee80211_sta_send_associnfo(sdata, ifsta);
@@ -742,14 +736,14 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         ifsta->last_probe = jiffies;
         ieee80211_led_assoc(local, 1);
 
-        sdata->bss_conf.assoc = 1;
+        sdata->vif.bss_conf.assoc = 1;
         /*
          * For now just always ask the driver to update the basic rateset
          * when we have associated, we aren't checking whether it actually
          * changed or not.
          */
-        changed |= BSS_CHANGED_BASIC_RATES;
-        ieee80211_bss_info_change_notify(sdata, changed);
+        bss_info_changed |= BSS_CHANGED_BASIC_RATES;
+        ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
@@ -760,18 +754,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta)
 {
-        DECLARE_MAC_BUF(mac);
-
         ifsta->direct_probe_tries++;
         if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: direct probe to AP %s timed out\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
+                       sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata, ifsta);
                 return;
         }
 
-        printk(KERN_DEBUG "%s: direct probe to AP %s try %d\n",
-                        sdata->dev->name, print_mac(mac, ifsta->bssid),
+        printk(KERN_DEBUG "%s: direct probe to AP %pM try %d\n",
+                        sdata->dev->name, ifsta->bssid,
                         ifsta->direct_probe_tries);
 
         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
@@ -791,20 +784,19 @@ static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta)
 {
-        DECLARE_MAC_BUF(mac);
-
         ifsta->auth_tries++;
         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: authentication with AP %s"
+                printk(KERN_DEBUG "%s: authentication with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                       sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata, ifsta);
                 return;
         }
 
         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
-        printk(KERN_DEBUG "%s: authenticate with AP %s\n",
-               sdata->dev->name, print_mac(mac, ifsta->bssid));
+        printk(KERN_DEBUG "%s: authenticate with AP %pM\n",
+               sdata->dev->name, ifsta->bssid);
 
         ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
 
@@ -817,7 +809,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        u32 changed = BSS_CHANGED_ASSOC;
+        u32 changed = 0;
 
         rcu_read_lock();
 
@@ -851,15 +843,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
         changed |= ieee80211_reset_erp_info(sdata);
 
-        if (sdata->bss_conf.assoc_ht)
-                changed |= BSS_CHANGED_HT;
-
-        sdata->bss_conf.assoc_ht = 0;
-        sdata->bss_conf.ht_conf = NULL;
-        sdata->bss_conf.ht_bss_conf = NULL;
-
         ieee80211_led_assoc(local, 0);
-        sdata->bss_conf.assoc = 0;
+        changed |= BSS_CHANGED_ASSOC;
+        sdata->vif.bss_conf.assoc = false;
 
         ieee80211_sta_send_apinfo(sdata, ifsta);
 
@@ -871,6 +857,11 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 
         sta_info_destroy(sta);
+
+        local->hw.conf.ht.enabled = false;
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_HT);
+
+        ieee80211_bss_info_change_notify(sdata, changed);
 }
 
 static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
@@ -914,20 +905,19 @@ static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
                                 struct ieee80211_if_sta *ifsta)
 {
-        DECLARE_MAC_BUF(mac);
-
         ifsta->assoc_tries++;
         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: association with AP %s"
+                printk(KERN_DEBUG "%s: association with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                       sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata, ifsta);
                 return;
         }
 
         ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
-        printk(KERN_DEBUG "%s: associate with AP %s\n",
-               sdata->dev->name, print_mac(mac, ifsta->bssid));
+        printk(KERN_DEBUG "%s: associate with AP %pM\n",
+               sdata->dev->name, ifsta->bssid);
         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
                        "mixed-cell disabled - abort association\n", sdata->dev->name);
@@ -947,7 +937,6 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int disassoc;
-        DECLARE_MAC_BUF(mac);
 
         /* TODO: start monitoring current AP signal quality and number of
          * missed beacons. Scan other channels every now and then and search
@@ -960,8 +949,8 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
 
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
-                printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                printk(KERN_DEBUG "%s: No STA entry for own AP %pM\n",
+                       sdata->dev->name, ifsta->bssid);
                 disassoc = 1;
         } else {
                 disassoc = 0;
@@ -969,9 +958,9 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
                                 printk(KERN_DEBUG "%s: No ProbeResp from "
-                                       "current AP %s - assume out of "
+                                       "current AP %pM - assume out of "
                                        "range\n",
-                                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                                       sdata->dev->name, ifsta->bssid);
                                 disassoc = 1;
                         } else
                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
@@ -1032,7 +1021,6 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                                    size_t len)
 {
         u16 auth_alg, auth_transaction, status_code;
-        DECLARE_MAC_BUF(mac);
 
         if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
             sdata->vif.type != NL80211_IFTYPE_ADHOC)
@@ -1125,7 +1113,6 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                                      size_t len)
 {
         u16 reason_code;
-        DECLARE_MAC_BUF(mac);
 
         if (len < 24 + 2)
                 return;
@@ -1136,7 +1123,8 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
-                printk(KERN_DEBUG "%s: deauthenticated\n", sdata->dev->name);
+                printk(KERN_DEBUG "%s: deauthenticated (Reason: %u)\n",
+                                sdata->dev->name, reason_code);
 
         if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
             ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
@@ -1157,7 +1145,6 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
                                        size_t len)
 {
         u16 reason_code;
-        DECLARE_MAC_BUF(mac);
 
         if (len < 24 + 2)
                 return;
@@ -1168,7 +1155,8 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
-                printk(KERN_DEBUG "%s: disassociated\n", sdata->dev->name);
+                printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
+                                sdata->dev->name, reason_code);
 
         if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
                 ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
@@ -1192,11 +1180,12 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         u64 rates, basic_rates;
         u16 capab_info, status_code, aid;
         struct ieee802_11_elems elems;
-        struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
         u8 *pos;
+        u32 changed = 0;
         int i, j;
-        DECLARE_MAC_BUF(mac);
-        bool have_higher_than_11mbit = false;
+        bool have_higher_than_11mbit = false, newsta = false;
+        u16 ap_ht_cap_flags;
 
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
@@ -1214,9 +1203,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
 
-        printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
+        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
                "status=%d aid=%d)\n",
-               sdata->dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
+               sdata->dev->name, reassoc ? "Rea" : "A", mgmt->sa,
                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
 
         if (status_code != WLAN_STATUS_SUCCESS) {
@@ -1259,7 +1248,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
                 struct ieee80211_bss *bss;
-                int err;
+
+                newsta = true;
 
                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
                 if (!sta) {
@@ -1278,13 +1268,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                         ieee80211_rx_bss_put(local, bss);
                 }
 
-                err = sta_info_insert(sta);
-                if (err) {
-                        printk(KERN_DEBUG "%s: failed to insert STA entry for"
-                               " the AP (error %d)\n", sdata->dev->name, err);
-                        rcu_read_unlock();
-                        return;
-                }
                 /* update new sta with its last rx activity */
                 sta->last_rx = jiffies;
         }
@@ -1308,34 +1291,40 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         for (i = 0; i < elems.supp_rates_len; i++) {
                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
+                bool is_basic = !!(elems.supp_rates[i] & 0x80);
 
                 if (rate > 110)
                         have_higher_than_11mbit = true;
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate)
+                        if (sband->bitrates[j].bitrate == rate) {
                                 rates |= BIT(j);
-                        if (elems.supp_rates[i] & 0x80)
-                                basic_rates |= BIT(j);
+                                if (is_basic)
+                                        basic_rates |= BIT(j);
+                                break;
+                        }
                 }
         }
 
         for (i = 0; i < elems.ext_supp_rates_len; i++) {
                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
+                bool is_basic = !!(elems.supp_rates[i] & 0x80);
 
                 if (rate > 110)
                         have_higher_than_11mbit = true;
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate)
+                        if (sband->bitrates[j].bitrate == rate) {
                                 rates |= BIT(j);
-                        if (elems.ext_supp_rates[i] & 0x80)
-                                basic_rates |= BIT(j);
+                                if (is_basic)
+                                        basic_rates |= BIT(j);
+                                break;
+                        }
                 }
         }
 
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
-        sdata->bss_conf.basic_rates = basic_rates;
+        sdata->vif.bss_conf.basic_rates = basic_rates;
 
         /* cf. IEEE 802.11 9.2.12 */
         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
@@ -1344,31 +1333,43 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
-            (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
-                struct ieee80211_ht_bss_info bss_info;
-                ieee80211_ht_cap_ie_to_ht_info(
-                                elems.ht_cap_elem, &sta->sta.ht_info);
-                ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                                elems.ht_info_elem, &bss_info);
-                ieee80211_handle_ht(local, 1, &sta->sta.ht_info, &bss_info);
-        }
+        if (elems.ht_cap_elem)
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                                elems.ht_cap_elem, &sta->sta.ht_cap);
+
+        ap_ht_cap_flags = sta->sta.ht_cap.cap;
 
         rate_control_rate_init(sta);
 
-        if (elems.wmm_param) {
+        if (elems.wmm_param)
                 set_sta_flags(sta, WLAN_STA_WME);
-                rcu_read_unlock();
+
+        if (newsta) {
+                int err = sta_info_insert(sta);
+                if (err) {
+                        printk(KERN_DEBUG "%s: failed to insert STA entry for"
+                               " the AP (error %d)\n", sdata->dev->name, err);
+                        rcu_read_unlock();
+                        return;
+                }
+        }
+
+        rcu_read_unlock();
+
+        if (elems.wmm_param)
                 ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
                                          elems.wmm_param_len);
-        } else
-                rcu_read_unlock();
+
+        if (elems.ht_info_elem && elems.wmm_param &&
+            (ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
+                                               ap_ht_cap_flags);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, ifsta);
+        ieee80211_set_associated(sdata, ifsta, changed);
 
         ieee80211_associated(sdata, ifsta);
 }
@@ -1386,6 +1387,13 @@ static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_supported_band *sband;
         union iwreq_data wrqu;
 
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "response\n", sdata->dev->name);
+                return -ENOMEM;
+        }
+
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         /* Remove possible STA entries from other IBSS networks. */
@@ -1411,63 +1419,62 @@ static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 return res;
 
         /* Build IBSS probe response */
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
-        if (skb) {
-                skb_reserve(skb, local->hw.extra_tx_headroom);
 
-                mgmt = (struct ieee80211_mgmt *)
-                        skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-                memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_PROBE_RESP);
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-                mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(local->hw.conf.beacon_int);
-                mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
-                mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
-
-                pos = skb_put(skb, 2 + ifsta->ssid_len);
-                *pos++ = WLAN_EID_SSID;
-                *pos++ = ifsta->ssid_len;
-                memcpy(pos, ifsta->ssid, ifsta->ssid_len);
-
-                rates = bss->supp_rates_len;
-                if (rates > 8)
-                        rates = 8;
-                pos = skb_put(skb, 2 + rates);
-                *pos++ = WLAN_EID_SUPP_RATES;
-                *pos++ = rates;
-                memcpy(pos, bss->supp_rates, rates);
+        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-                if (bss->band == IEEE80211_BAND_2GHZ) {
-                        pos = skb_put(skb, 2 + 1);
-                        *pos++ = WLAN_EID_DS_PARAMS;
-                        *pos++ = 1;
-                        *pos++ = ieee80211_frequency_to_channel(bss->freq);
-                }
+        mgmt = (struct ieee80211_mgmt *)
+                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
+        memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                IEEE80211_STYPE_PROBE_RESP);
+        memset(mgmt->da, 0xff, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        mgmt->u.beacon.beacon_int =
+                cpu_to_le16(local->hw.conf.beacon_int);
+        mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
+        mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
 
-                pos = skb_put(skb, 2 + 2);
-                *pos++ = WLAN_EID_IBSS_PARAMS;
-                *pos++ = 2;
-                /* FIX: set ATIM window based on scan results */
-                *pos++ = 0;
-                *pos++ = 0;
+        pos = skb_put(skb, 2 + ifsta->ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ifsta->ssid_len;
+        memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 
-                if (bss->supp_rates_len > 8) {
-                        rates = bss->supp_rates_len - 8;
-                        pos = skb_put(skb, 2 + rates);
-                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                        *pos++ = rates;
-                        memcpy(pos, &bss->supp_rates[8], rates);
-                }
+        rates = bss->supp_rates_len;
+        if (rates > 8)
+                rates = 8;
+        pos = skb_put(skb, 2 + rates);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = rates;
+        memcpy(pos, bss->supp_rates, rates);
+
+        if (bss->band == IEEE80211_BAND_2GHZ) {
+                pos = skb_put(skb, 2 + 1);
+                *pos++ = WLAN_EID_DS_PARAMS;
+                *pos++ = 1;
+                *pos++ = ieee80211_frequency_to_channel(bss->freq);
+        }
 
-                ifsta->probe_resp = skb;
+        pos = skb_put(skb, 2 + 2);
+        *pos++ = WLAN_EID_IBSS_PARAMS;
+        *pos++ = 2;
+        /* FIX: set ATIM window based on scan results */
+        *pos++ = 0;
+        *pos++ = 0;
 
-                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        if (bss->supp_rates_len > 8) {
+                rates = bss->supp_rates_len - 8;
+                pos = skb_put(skb, 2 + rates);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = rates;
+                memcpy(pos, &bss->supp_rates[8], rates);
         }
 
+        ifsta->probe_resp = skb;
+
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+
+
         rates = 0;
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         for (i = 0; i < bss->supp_rates_len; i++) {
@@ -1507,8 +1514,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         u64 beacon_timestamp, rx_timestamp;
         u64 supp_rates = 0;
         enum ieee80211_band band = rx_status->band;
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
 
         if (elems->ds_params && elems->ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
@@ -1538,10 +1543,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         if (sta->sta.supp_rates[band] != prev_rates)
                                 printk(KERN_DEBUG "%s: updated supp_rates set "
-                                    "for %s based on beacon info (0x%llx | "
+                                    "for %pM based on beacon info (0x%llx | "
                                     "0x%llx -> 0x%llx)\n",
                                     sdata->dev->name,
-                                    print_mac(mac, sta->sta.addr),
+                                    sta->sta.addr,
                                     (unsigned long long) prev_rates,
                                     (unsigned long long) supp_rates,
                                     (unsigned long long) sta->sta.supp_rates[band]);
@@ -1605,10 +1610,9 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         /* can't merge without knowing the TSF */
                         rx_timestamp = -1LLU;
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "RX beacon SA=%s BSSID="
-                       "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-                       print_mac(mac, mgmt->sa),
-                       print_mac(mac2, mgmt->bssid),
+                printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
+                       "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+                       mgmt->sa, mgmt->bssid,
                        (unsigned long long)rx_timestamp,
                        (unsigned long long)beacon_timestamp,
                        (unsigned long long)(rx_timestamp - beacon_timestamp),
@@ -1617,8 +1621,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 if (beacon_timestamp > rx_timestamp) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: beacon TSF higher than "
-                               "local TSF - IBSS merge with BSSID %s\n",
-                               sdata->dev->name, print_mac(mac, mgmt->bssid));
+                               "local TSF - IBSS merge with BSSID %pM\n",
+                               sdata->dev->name, mgmt->bssid);
 #endif
                         ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
                         ieee80211_ibss_add_sta(sdata, NULL,
@@ -1671,8 +1675,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         size_t baselen;
         struct ieee802_11_elems elems;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local->hw.conf;
         u32 changed = 0;
+        bool erp_valid;
+        u8 erp_value = 0;
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
@@ -1694,22 +1699,42 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
                                  elems.wmm_param_len);
 
-        if (elems.erp_info && elems.erp_info_len >= 1)
-                changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
-        else {
-                u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
-                changed |= ieee80211_handle_protect_preamb(sdata, false,
-                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+
+        if (elems.erp_info && elems.erp_info_len >= 1) {
+                erp_valid = true;
+                erp_value = elems.erp_info[0];
+        } else {
+                erp_valid = false;
         }
+        changed |= ieee80211_handle_bss_capability(sdata,
+                        le16_to_cpu(mgmt->u.beacon.capab_info),
+                        erp_valid, erp_value);
+
+
+        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param) {
+                struct sta_info *sta;
+                struct ieee80211_supported_band *sband;
+                u16 ap_ht_cap_flags;
+
+                rcu_read_lock();
+
+                sta = sta_info_get(local, ifsta->bssid);
+                if (!sta) {
+                        rcu_read_unlock();
+                        return;
+                }
+
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        if (elems.ht_cap_elem && elems.ht_info_elem &&
-            elems.wmm_param && conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
-                struct ieee80211_ht_bss_info bss_info;
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                                elems.ht_cap_elem, &sta->sta.ht_cap);
 
-                ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                                elems.ht_info_elem, &bss_info);
-                changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf,
-                                               &bss_info);
+                ap_ht_cap_flags = sta->sta.ht_cap.cap;
+
+                rcu_read_unlock();
+
+                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
+                                               ap_ht_cap_flags);
         }
 
         ieee80211_bss_info_change_notify(sdata, changed);
@@ -1727,11 +1752,6 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
         u8 *pos, *end;
-        DECLARE_MAC_BUF(mac);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        DECLARE_MAC_BUF(mac2);
-        DECLARE_MAC_BUF(mac3);
-#endif
 
         if (sdata->vif.type != NL80211_IFTYPE_ADHOC ||
             ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
@@ -1744,10 +1764,10 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
                 tx_last_beacon = 1;
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
-               "%s (tx_last_beacon=%d)\n",
-               sdata->dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
-               print_mac(mac3, mgmt->bssid), tx_last_beacon);
+        printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
+               " (tx_last_beacon=%d)\n",
+               sdata->dev->name, mgmt->sa, mgmt->da,
+               mgmt->bssid, tx_last_beacon);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         if (!tx_last_beacon)
@@ -1763,8 +1783,8 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
             pos + 2 + pos[1] > end) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
-                       "from %s\n",
-                       sdata->dev->name, print_mac(mac, mgmt->sa));
+                       "from %pM\n",
+                       sdata->dev->name, mgmt->sa);
 #endif
                 return;
         }
@@ -1783,8 +1803,8 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         resp = (struct ieee80211_mgmt *) skb->data;
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
-               sdata->dev->name, print_mac(mac, resp->da));
+        printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
+               sdata->dev->name, resp->da);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
         ieee80211_tx_skb(sdata, skb, 0);
 }
@@ -1990,7 +2010,6 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
         u8 bssid[ETH_ALEN], *pos;
         int i;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
 #if 0
         /* Easier testing, use fixed BSSID. */
@@ -2006,8 +2025,8 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
         bssid[0] |= 0x02;
 #endif
 
-        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
-               sdata->dev->name, print_mac(mac, bssid));
+        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
+               sdata->dev->name, bssid);
 
         bss = ieee80211_rx_bss_add(local, bssid,
                                    local->hw.conf.channel->center_freq,
@@ -2050,8 +2069,6 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
         int found = 0;
         u8 bssid[ETH_ALEN];
         int active_ibss;
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
 
         if (ifsta->ssid_len == 0)
                 return -EINVAL;
@@ -2068,8 +2085,7 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
                         continue;
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "   bssid=%s found\n",
-                       print_mac(mac, bss->bssid));
+                printk(KERN_DEBUG "   bssid=%pM found\n", bss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
                 memcpy(bssid, bss->bssid, ETH_ALEN);
                 found = 1;
@@ -2080,9 +2096,8 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         if (found)
-                printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
-                       "%s\n", print_mac(mac, bssid),
-                       print_mac(mac2, ifsta->bssid));
+                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
+                       "%pM\n", bssid, ifsta->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
@@ -2099,9 +2114,9 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
                 if (!bss)
                         goto dont_join;
 
-                printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
+                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
-                       sdata->dev->name, print_mac(mac, bssid));
+                       sdata->dev->name, bssid);
                 ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
                 ieee80211_rx_bss_put(local, bss);
                 return ret;
@@ -2343,7 +2358,6 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        DECLARE_MAC_BUF(mac);
         int band = local->hw.conf.channel->band;
 
         /* TODO: Could consider removing the least recently used entry and
@@ -2351,7 +2365,7 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
-                               "entry %s\n", sdata->dev->name, print_mac(mac, addr));
+                               "entry %pM\n", sdata->dev->name, addr);
                 }
                 return NULL;
         }
@@ -2360,8 +2374,8 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                 return NULL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), print_mac(mac, addr), sdata->dev->name);
+        printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
+               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
 #endif
 
         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
@@ -2408,7 +2422,6 @@ void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
 {
         struct ieee80211_if_sta *ifsta;
-        int res;
 
         if (len > IEEE80211_MAX_SSID_LEN)
                 return -EINVAL;
@@ -2420,19 +2433,6 @@ int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size
                 memcpy(ifsta->ssid, ssid, len);
                 ifsta->ssid_len = len;
                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-
-                res = 0;
-                /*
-                 * Hack! MLME code needs to be cleaned up to have different
-                 * entry points for configuration and internal selection change
-                 */
-                if (netif_running(sdata->dev))
-                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
-                if (res) {
-                        printk(KERN_DEBUG "%s: Failed to config new SSID to "
-                               "the low-level driver\n", sdata->dev->name);
-                        return res;
-                }
         }
 
         if (len)
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 5d786720d935..3fa7ab285066 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -199,48 +199,44 @@ static void rate_control_release(struct kref *kref)
 }
 
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_supported_band *sband,
-                           struct sta_info *sta, struct sk_buff *skb,
-                           struct rate_selection *sel)
+                           struct sta_info *sta,
+                           struct ieee80211_tx_rate_control *txrc)
 {
         struct rate_control_ref *ref = sdata->local->rate_ctrl;
         void *priv_sta = NULL;
         struct ieee80211_sta *ista = NULL;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         int i;
 
-        sel->rate_idx = -1;
-        sel->nonerp_idx = -1;
-        sel->probe_idx = -1;
-        sel->max_rate_idx = sdata->max_ratectrl_rateidx;
-
         if (sta) {
                 ista = &sta->sta;
                 priv_sta = sta->rate_ctrl_priv;
         }
 
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                info->control.rates[i].idx = -1;
+                info->control.rates[i].flags = 0;
+                info->control.rates[i].count = 1;
+        }
+
         if (sta && sdata->force_unicast_rateidx > -1)
-                sel->rate_idx = sdata->force_unicast_rateidx;
+                info->control.rates[0].idx = sdata->force_unicast_rateidx;
         else
-                ref->ops->get_rate(ref->priv, sband, ista, priv_sta, skb, sel);
-
-        if (sdata->max_ratectrl_rateidx > -1 &&
-            sel->rate_idx > sdata->max_ratectrl_rateidx)
-                sel->rate_idx = sdata->max_ratectrl_rateidx;
-
-        BUG_ON(sel->rate_idx < 0);
-
-        /* Select a non-ERP backup rate. */
-        if (sel->nonerp_idx < 0) {
-                for (i = 0; i < sband->n_bitrates; i++) {
-                        struct ieee80211_rate *rate = &sband->bitrates[i];
-                        if (sband->bitrates[sel->rate_idx].bitrate < rate->bitrate)
-                                break;
-
-                        if (rate_supported(ista, sband->band, i) &&
-                            !(rate->flags & IEEE80211_RATE_ERP_G))
-                                sel->nonerp_idx = i;
-                }
+                ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
+
+        /*
+         * try to enforce the maximum rate the user wanted
+         */
+        if (sdata->max_ratectrl_rateidx > -1)
+                for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                        if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS)
+                                continue;
+                        info->control.rates[i].idx =
+                                min_t(s8, info->control.rates[i].idx,
+                                      sdata->max_ratectrl_rateidx);
         }
+
+        BUG_ON(info->control.rates[0].idx < 0);
 }
 
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref)
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index d0092f847f82..928da625e281 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -31,9 +31,8 @@ struct rate_control_ref {
 struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local);
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_supported_band *sband,
-                           struct sta_info *sta, struct sk_buff *skb,
-                           struct rate_selection *sel);
+                           struct sta_info *sta,
+                           struct ieee80211_tx_rate_control *txrc);
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
 
@@ -64,12 +63,6 @@ static inline void rate_control_rate_init(struct sta_info *sta)
 }
 
 
-static inline void rate_control_clear(struct ieee80211_local *local)
-{
-        struct rate_control_ref *ref = local->rate_ctrl;
-        ref->ops->clear(ref->priv);
-}
-
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
                                            struct ieee80211_sta *sta,
                                            gfp_t gfp)
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index f6d69dab07a3..2b3b490a6073 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -126,7 +126,9 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
                         mr->adjusted_retry_count = mr->retry_count >> 1;
                         if (mr->adjusted_retry_count > 2)
                                 mr->adjusted_retry_count = 2;
+                        mr->sample_limit = 4;
                 } else {
+                        mr->sample_limit = -1;
                         mr->adjusted_retry_count = mr->retry_count;
                 }
                 if (!mr->adjusted_retry_count)
@@ -169,30 +171,20 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_tx_altrate *ar = info->status.retries;
-        struct minstrel_priv *mp = priv;
-        int i, ndx, tries;
-        int success = 0;
-
-        if (!info->status.excessive_retries)
-                success = 1;
+        struct ieee80211_tx_rate *ar = info->status.rates;
+        int i, ndx;
+        int success;
 
-        if (!mp->has_mrr || (ar[0].rate_idx < 0)) {
-                ndx = rix_to_ndx(mi, info->tx_rate_idx);
-                tries = info->status.retry_count + 1;
-                mi->r[ndx].success += success;
-                mi->r[ndx].attempts += tries;
-                return;
-        }
+        success = !!(info->flags & IEEE80211_TX_STAT_ACK);
 
-        for (i = 0; i < 4; i++) {
-                if (ar[i].rate_idx < 0)
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                if (ar[i].idx < 0)
                         break;
 
-                ndx = rix_to_ndx(mi, ar[i].rate_idx);
-                mi->r[ndx].attempts += ar[i].limit + 1;
+                ndx = rix_to_ndx(mi, ar[i].idx);
+                mi->r[ndx].attempts += ar[i].count;
 
-                if ((i != 3) && (ar[i + 1].rate_idx < 0))
+                if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
                         mi->r[ndx].success += success;
         }
 
@@ -210,9 +202,9 @@ minstrel_get_retry_count(struct minstrel_rate *mr,
 {
         unsigned int retry = mr->adjusted_retry_count;
 
-        if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
                 retry = max(2U, min(mr->retry_count_rtscts, retry));
-        else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)
+        else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
                 retry = max(2U, min(mr->retry_count_cts, retry));
         return retry;
 }
@@ -233,15 +225,16 @@ minstrel_get_next_sample(struct minstrel_sta_info *mi)
         return sample_ndx;
 }
 
-void
-minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
-                  struct ieee80211_sta *sta, void *priv_sta,
-                  struct sk_buff *skb, struct rate_selection *sel)
+static void
+minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+                  void *priv_sta, struct ieee80211_tx_rate_control *txrc)
 {
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
-        struct ieee80211_tx_altrate *ar = info->control.retries;
+        struct ieee80211_tx_rate *ar = info->control.rates;
         unsigned int ndx, sample_ndx = 0;
         bool mrr;
         bool sample_slower = false;
@@ -251,16 +244,12 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
         int sample_rate;
 
         if (!sta || !mi || use_low_rate(skb)) {
-                sel->rate_idx = rate_lowest_index(sband, sta);
+                ar[0].idx = rate_lowest_index(sband, sta);
+                ar[0].count = mp->max_retry;
                 return;
         }
 
-        mrr = mp->has_mrr;
-
-        /* mac80211 does not allow mrr for RTS/CTS */
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
-                mrr = false;
+        mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
 
         if (time_after(jiffies, mi->stats_update + (mp->update_interval *
                         HZ) / 1000))
@@ -278,7 +267,8 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
                         (mi->sample_count + mi->sample_deferred / 2);
 
         /* delta > 0: sampling required */
-        if (delta > 0) {
+        if ((delta > 0) && (mrr || !mi->prev_sample)) {
+                struct minstrel_rate *msr;
                 if (mi->packet_count >= 10000) {
                         mi->sample_deferred = 0;
                         mi->sample_count = 0;
@@ -297,13 +287,20 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
                 }
 
                 sample_ndx = minstrel_get_next_sample(mi);
+                msr = &mi->r[sample_ndx];
                 sample = true;
-                sample_slower = mrr && (mi->r[sample_ndx].perfect_tx_time >
+                sample_slower = mrr && (msr->perfect_tx_time >
                         mi->r[ndx].perfect_tx_time);
 
                 if (!sample_slower) {
-                        ndx = sample_ndx;
-                        mi->sample_count++;
+                        if (msr->sample_limit != 0) {
+                                ndx = sample_ndx;
+                                mi->sample_count++;
+                                if (msr->sample_limit > 0)
+                                        msr->sample_limit--;
+                        } else {
+                                sample = false;
+                        }
                 } else {
                         /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
                          * packets that have the sampling rate deferred to the
@@ -315,13 +312,22 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
                         mi->sample_deferred++;
                 }
         }
-        sel->rate_idx = mi->r[ndx].rix;
-        info->control.retry_limit = minstrel_get_retry_count(&mi->r[ndx], info);
+        mi->prev_sample = sample;
+
+        /* If we're not using MRR and the sampling rate already
+         * has a probability of >95%, we shouldn't be attempting
+         * to use it, as this only wastes precious airtime */
+        if (!mrr && sample && (mi->r[ndx].probability > 17100))
+                ndx = mi->max_tp_rate;
+
+        ar[0].idx = mi->r[ndx].rix;
+        ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
 
         if (!mrr) {
-                ar[0].rate_idx = mi->lowest_rix;
-                ar[0].limit = mp->max_retry;
-                ar[1].rate_idx = -1;
+                if (!sample)
+                        ar[0].count = mp->max_retry;
+                ar[1].idx = mi->lowest_rix;
+                ar[1].count = mp->max_retry;
                 return;
         }
 
@@ -336,9 +342,9 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
         }
         mrr_ndx[1] = mi->max_prob_rate;
         mrr_ndx[2] = 0;
-        for (i = 0; i < 3; i++) {
-                ar[i].rate_idx = mi->r[mrr_ndx[i]].rix;
-                ar[i].limit = mi->r[mrr_ndx[i]].adjusted_retry_count;
+        for (i = 1; i < 4; i++) {
+                ar[i].idx = mi->r[mrr_ndx[i - 1]].rix;
+                ar[i].count = mi->r[mrr_ndx[i - 1]].adjusted_retry_count;
         }
 }
 
@@ -415,6 +421,7 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
                 /* calculate maximum number of retransmissions before
                  * fallback (based on maximum segment size) */
+                mr->sample_limit = -1;
                 mr->retry_count = 1;
                 mr->retry_count_cts = 1;
                 mr->retry_count_rtscts = 1;
@@ -500,11 +507,6 @@ minstrel_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
         kfree(mi);
 }
 
-static void
-minstrel_clear(void *priv)
-{
-}
-
 static void *
 minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
 {
@@ -532,13 +534,13 @@ minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
         /* maximum time that the hw is allowed to stay in one MRR segment */
         mp->segment_size = 6000;
 
-        if (hw->max_altrate_tries > 0)
-                mp->max_retry = hw->max_altrate_tries;
+        if (hw->max_rate_tries > 0)
+                mp->max_retry = hw->max_rate_tries;
         else
                 /* safe default, does not necessarily have to match hw properties */
                 mp->max_retry = 7;
 
-        if (hw->max_altrates >= 3)
+        if (hw->max_rates >= 4)
                 mp->has_mrr = true;
 
         mp->hw = hw;
@@ -558,7 +560,6 @@ static struct rate_control_ops mac80211_minstrel = {
         .tx_status = minstrel_tx_status,
         .get_rate = minstrel_get_rate,
         .rate_init = minstrel_rate_init,
-        .clear = minstrel_clear,
         .alloc = minstrel_alloc,
         .free = minstrel_free,
         .alloc_sta = minstrel_alloc_sta,
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 9a90a6aee043..869fe0ef951d 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -16,6 +16,7 @@ struct minstrel_rate {
         unsigned int perfect_tx_time;
         unsigned int ack_time;
 
+        int sample_limit;
         unsigned int retry_count;
         unsigned int retry_count_cts;
         unsigned int retry_count_rtscts;
@@ -57,6 +58,7 @@ struct minstrel_sta_info {
 
         int n_rates;
         struct minstrel_rate *r;
+        bool prev_sample;
 
         /* sampling table */
         u8 *sample_table;
diff --git a/net/mac80211/rc80211_pid.h b/net/mac80211/rc80211_pid.h
index 01d64d53f3b9..1a873f00691a 100644
--- a/net/mac80211/rc80211_pid.h
+++ b/net/mac80211/rc80211_pid.h
@@ -49,7 +49,7 @@
 
 /* Arithmetic right shift for positive and negative values for ISO C. */
 #define RC_PID_DO_ARITH_RIGHT_SHIFT(x, y) \
-        (x) < 0 ? -((-(x)) >> (y)) : (x) >> (y)
+        ((x) < 0 ? -((-(x)) >> (y)) : (x) >> (y))
 
 enum rc_pid_event_type {
         RC_PID_EVENT_TYPE_TX_STATUS,
@@ -61,6 +61,7 @@ enum rc_pid_event_type {
 union rc_pid_event_data {
         /* RC_PID_EVENT_TX_STATUS */
         struct {
+                u32 flags;
                 struct ieee80211_tx_info tx_status;
         };
         /* RC_PID_EVENT_TYPE_RATE_CHANGE */
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 86eb374e3b87..2328ba568039 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -241,7 +241,7 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (info->tx_rate_idx != spinfo->txrate_idx)
+        if (info->status.rates[0].idx != spinfo->txrate_idx)
                 return;
 
         spinfo->tx_num_xmit++;
@@ -253,10 +253,10 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
         /* We count frames that totally failed to be transmitted as two bad
          * frames, those that made it out but had some retries as one good and
          * one bad frame. */
-        if (info->status.excessive_retries) {
+        if (!(info->flags & IEEE80211_TX_STAT_ACK)) {
                 spinfo->tx_num_failed += 2;
                 spinfo->tx_num_xmit++;
-        } else if (info->status.retry_count) {
+        } else if (info->status.rates[0].count) {
                 spinfo->tx_num_failed++;
                 spinfo->tx_num_xmit++;
         }
@@ -270,23 +270,32 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
 }
 
 static void
-rate_control_pid_get_rate(void *priv, struct ieee80211_supported_band *sband,
-                          struct ieee80211_sta *sta, void *priv_sta,
-                          struct sk_buff *skb,
-                          struct rate_selection *sel)
+rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
+                          void *priv_sta,
+                          struct ieee80211_tx_rate_control *txrc)
 {
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct rc_pid_sta_info *spinfo = priv_sta;
         int rateidx;
         u16 fc;
 
+        if (txrc->rts)
+                info->control.rates[0].count =
+                        txrc->hw->conf.long_frame_max_tx_count;
+        else
+                info->control.rates[0].count =
+                        txrc->hw->conf.short_frame_max_tx_count;
+
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         fc = le16_to_cpu(hdr->frame_control);
         if (!sta || !spinfo ||
             (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1)) {
-                sel->rate_idx = rate_lowest_index(sband, sta);
+                info->control.rates[0].idx = rate_lowest_index(sband, sta);
                 return;
         }
 
@@ -295,7 +304,7 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_supported_band *sband,
         if (rateidx >= sband->n_bitrates)
                 rateidx = sband->n_bitrates - 1;
 
-        sel->rate_idx = rateidx;
+        info->control.rates[0].idx = rateidx;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_tx_rate(&spinfo->events,
@@ -437,10 +446,6 @@ static void rate_control_pid_free(void *priv)
         kfree(pinfo);
 }
 
-static void rate_control_pid_clear(void *priv)
-{
-}
-
 static void *rate_control_pid_alloc_sta(void *priv, struct ieee80211_sta *sta,
                                         gfp_t gfp)
 {
@@ -471,7 +476,6 @@ static struct rate_control_ops mac80211_rcpid = {
         .tx_status = rate_control_pid_tx_status,
         .get_rate = rate_control_pid_get_rate,
         .rate_init = rate_control_pid_rate_init,
-        .clear = rate_control_pid_clear,
         .alloc = rate_control_pid_alloc,
         .free = rate_control_pid_free,
         .alloc_sta = rate_control_pid_alloc_sta,
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index 8121d3bc6835..a08a9b530347 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -43,6 +43,7 @@ void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
 {
         union rc_pid_event_data evd;
 
+        evd.flags = stat->flags;
         memcpy(&evd.tx_status, stat, sizeof(struct ieee80211_tx_info));
         rate_control_pid_event(buf, RC_PID_EVENT_TYPE_TX_STATUS, &evd);
 }
@@ -167,8 +168,8 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
         switch (ev->type) {
         case RC_PID_EVENT_TYPE_TX_STATUS:
                 p += snprintf(pb + p, length - p, "tx_status %u %u",
-                              ev->data.tx_status.status.excessive_retries,
-                              ev->data.tx_status.status.retry_count);
+                              !(ev->data.flags & IEEE80211_TX_STAT_ACK),
+                              ev->data.tx_status.status.rates[0].idx);
                 break;
         case RC_PID_EVENT_TYPE_RATE_CHANGE:
                 p += snprintf(pb + p, length - p, "rate_change %d %d",
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index cf6b121e1bbf..648a1d0e6c82 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -26,10 +26,11 @@
 #include "tkip.h"
 #include "wme.h"
 
-u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                                struct tid_ampdu_rx *tid_agg_rx,
-                                struct sk_buff *skb, u16 mpdu_seq_num,
-                                int bar_req);
+static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                           struct tid_ampdu_rx *tid_agg_rx,
+                                           struct sk_buff *skb,
+                                           u16 mpdu_seq_num,
+                                           int bar_req);
 /*
  * monitor mode reception
  *
@@ -653,13 +654,12 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 static void ap_sta_ps_start(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        DECLARE_MAC_BUF(mac);
 
         atomic_inc(&sdata->bss->num_sta_ps);
         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
-               sdata->dev->name, print_mac(mac, sta->sta.addr), sta->sta.aid);
+        printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
+               sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
@@ -669,8 +669,6 @@ static int ap_sta_ps_end(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         int sent = 0;
-        struct ieee80211_tx_info *info;
-        DECLARE_MAC_BUF(mac);
 
         atomic_dec(&sdata->bss->num_sta_ps);
 
@@ -680,27 +678,25 @@ static int ap_sta_ps_end(struct sta_info *sta)
                 sta_info_clear_tim_bit(sta);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
-               sdata->dev->name, print_mac(mac, sta->sta.addr), sta->sta.aid);
+        printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
+               sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
         /* Send all buffered frames to the station */
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
-                info = IEEE80211_SKB_CB(skb);
                 sent++;
-                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                skb->requeue = 1;
                 dev_queue_xmit(skb);
         }
         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-                info = IEEE80211_SKB_CB(skb);
                 local->total_ps_buffered--;
                 sent++;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
+                printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
                        "since STA not sleeping anymore\n", sdata->dev->name,
-                       print_mac(mac, sta->sta.addr), sta->sta.aid);
+                       sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                skb->requeue = 1;
                 dev_queue_xmit(skb);
         }
 
@@ -789,15 +785,12 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 struct ieee80211_hdr *hdr =
                         (struct ieee80211_hdr *) entry->skb_list.next->data;
-                DECLARE_MAC_BUF(mac);
-                DECLARE_MAC_BUF(mac2);
                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
-                       "addr1=%s addr2=%s\n",
+                       "addr1=%pM addr2=%pM\n",
                        sdata->dev->name, idx,
                        jiffies - entry->first_frag_time, entry->seq,
-                       entry->last_frag, print_mac(mac, hdr->addr1),
-                       print_mac(mac2, hdr->addr2));
+                       entry->last_frag, hdr->addr1, hdr->addr2);
 #endif
                 __skb_queue_purge(&entry->skb_list);
         }
@@ -866,7 +859,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         unsigned int frag, seq;
         struct ieee80211_fragment_entry *entry;
         struct sk_buff *skb;
-        DECLARE_MAC_BUF(mac);
 
         hdr = (struct ieee80211_hdr *)rx->skb->data;
         fc = hdr->frame_control;
@@ -970,7 +962,6 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
         struct sk_buff *skb;
         int no_pending_pkts;
-        DECLARE_MAC_BUF(mac);
         __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
 
         if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
@@ -1001,8 +992,8 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
-                       print_mac(mac, rx->sta->sta.addr), rx->sta->sta.aid,
+                printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
+                       rx->sta->sta.addr, rx->sta->sta.aid,
                        skb_queue_len(&rx->sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
@@ -1025,9 +1016,9 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                  *        Should we send it a null-func frame indicating we
                  *        have nothing buffered for it?
                  */
-                printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
+                printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
                        "though there are no buffered frames for it\n",
-                       rx->dev->name, print_mac(mac, rx->sta->sta.addr));
+                       rx->dev->name, rx->sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         }
 
@@ -1097,10 +1088,6 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
         u8 src[ETH_ALEN] __aligned(2);
         struct sk_buff *skb = rx->skb;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
-        DECLARE_MAC_BUF(mac3);
-        DECLARE_MAC_BUF(mac4);
 
         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                 return -1;
@@ -1279,7 +1266,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         int remaining, err;
         u8 dst[ETH_ALEN];
         u8 src[ETH_ALEN];
-        DECLARE_MAC_BUF(mac);
 
         if (unlikely(!ieee80211_is_data(fc)))
                 return RX_CONTINUE;
@@ -1552,14 +1538,6 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                 return RX_DROP_MONITOR;
 
-        /*
-         * FIXME: revisit this, I'm sure we should handle most
-         *        of these frames in other modes as well!
-         */
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                return RX_CONTINUE;
-
         switch (mgmt->u.action.category) {
         case WLAN_CATEGORY_BACK:
                 switch (mgmt->u.action.u.addba_req.action_code) {
@@ -1632,8 +1610,6 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
 {
         int keyidx;
         unsigned int hdrlen;
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (rx->skb->len >= hdrlen + 4)
@@ -2002,17 +1978,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
 static inline int seq_less(u16 sq1, u16 sq2)
 {
-        return (((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1));
+        return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
 }
 
 static inline u16 seq_inc(u16 sq)
 {
-        return ((sq + 1) & SEQ_MASK);
+        return (sq + 1) & SEQ_MASK;
 }
 
 static inline u16 seq_sub(u16 sq1, u16 sq2)
 {
-        return ((sq1 - sq2) & SEQ_MASK);
+        return (sq1 - sq2) & SEQ_MASK;
 }
 
 
@@ -2020,10 +1996,11 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
  * As it function blongs to Rx path it must be called with
  * the proper rcu_read_lock protection for its flow.
  */
-u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                                struct tid_ampdu_rx *tid_agg_rx,
-                                struct sk_buff *skb, u16 mpdu_seq_num,
-                                int bar_req)
+static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                           struct tid_ampdu_rx *tid_agg_rx,
+                                           struct sk_buff *skb,
+                                           u16 mpdu_seq_num,
+                                           int bar_req)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rx_status status;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 416bb41099f3..f5c7c3371929 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -159,7 +159,7 @@ ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_i
 {
         struct ieee80211_bss *bss;
 
-        if (mesh_config_len != MESH_CFG_LEN)
+        if (mesh_config_len != IEEE80211_MESH_CONFIG_LEN)
                 return NULL;
 
         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
@@ -448,18 +448,17 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 
         if (local->hw_scanning) {
                 local->hw_scanning = false;
-                if (ieee80211_hw_config(local))
-                        printk(KERN_DEBUG "%s: failed to restore operational "
-                               "channel after scan\n", wiphy_name(local->hw.wiphy));
-
+                /*
+                 * Somebody might have requested channel change during scan
+                 * that we won't have acted upon, try now. ieee80211_hw_config
+                 * will set the flag based on actual changes.
+                 */
+                ieee80211_hw_config(local, 0);
                 goto done;
         }
 
         local->sw_scanning = false;
-        if (ieee80211_hw_config(local))
-                printk(KERN_DEBUG "%s: failed to restore operational "
-                       "channel after scan\n", wiphy_name(local->hw.wiphy));
-
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         netif_tx_lock_bh(local->mdev);
         netif_addr_lock(local->mdev);
@@ -546,12 +545,9 @@ void ieee80211_scan_work(struct work_struct *work)
 
                 if (!skip) {
                         local->scan_channel = chan;
-                        if (ieee80211_hw_config(local)) {
-                                printk(KERN_DEBUG "%s: failed to set freq to "
-                                       "%d MHz for scan\n", wiphy_name(local->hw.wiphy),
-                                       chan->center_freq);
+                        if (ieee80211_hw_config(local,
+                                                IEEE80211_CONF_CHANGE_CHANNEL))
                                 skip = 1;
-                        }
                 }
 
                 /* advance state machine to next channel/band */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7fef8ea1f5ec..b22110a4a75e 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -137,14 +137,12 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_local *local, int idx,
 static void __sta_info_free(struct ieee80211_local *local,
                             struct sta_info *sta)
 {
-        DECLARE_MAC_BUF(mbuf);
-
         rate_control_free_sta(sta);
         rate_control_put(sta->rate_ctrl);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Destroyed STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->sta.addr));
+        printk(KERN_DEBUG "%s: Destroyed STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         kfree(sta);
@@ -222,7 +220,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int i;
-        DECLARE_MAC_BUF(mbuf);
 
         sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
         if (!sta)
@@ -263,8 +260,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         skb_queue_head_init(&sta->tx_filtered);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Allocated STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->sta.addr));
+        printk(KERN_DEBUG "%s: Allocated STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
 #ifdef CONFIG_MAC80211_MESH
@@ -281,7 +278,6 @@ int sta_info_insert(struct sta_info *sta)
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         unsigned long flags;
         int err = 0;
-        DECLARE_MAC_BUF(mac);
 
         /*
          * Can't be a WARN_ON because it can be triggered through a race:
@@ -294,7 +290,7 @@ int sta_info_insert(struct sta_info *sta)
         }
 
         if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->dev->dev_addr) == 0 ||
-                    is_multicast_ether_addr(sta->sta.addr))) {
+                    is_multicast_ether_addr(sta->sta.addr))) {
                 err = -EINVAL;
                 goto out_free;
         }
@@ -322,8 +318,8 @@ int sta_info_insert(struct sta_info *sta)
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Inserted STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mac, sta->sta.addr));
+        printk(KERN_DEBUG "%s: Inserted STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         spin_unlock_irqrestore(&local->sta_lock, flags);
@@ -423,9 +419,6 @@ static void __sta_info_unlink(struct sta_info **sta)
 {
         struct ieee80211_local *local = (*sta)->local;
         struct ieee80211_sub_if_data *sdata = (*sta)->sdata;
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        DECLARE_MAC_BUF(mbuf);
-#endif
         /*
          * pull caller's reference if we're already gone.
          */
@@ -468,8 +461,8 @@ static void __sta_info_unlink(struct sta_info **sta)
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Removed STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, (*sta)->sta.addr));
+        printk(KERN_DEBUG "%s: Removed STA %pM\n",
+               wiphy_name(local->hw.wiphy), (*sta)->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         /*
@@ -544,7 +537,6 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         unsigned long flags;
         struct sk_buff *skb;
         struct ieee80211_sub_if_data *sdata;
-        DECLARE_MAC_BUF(mac);
 
         if (skb_queue_empty(&sta->ps_tx_buf))
                 return;
@@ -564,8 +556,8 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                 sdata = sta->sdata;
                 local->total_ps_buffered--;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "Buffered frame expired (STA "
-                       "%s)\n", print_mac(mac, sta->sta.addr));
+                printk(KERN_DEBUG "Buffered frame expired (STA %pM)\n",
+                       sta->sta.addr);
 #endif
                 dev_kfree_skb(skb);
 
@@ -809,15 +801,14 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta, *tmp;
         LIST_HEAD(tmp_list);
-        DECLARE_MAC_BUF(mac);
         unsigned long flags;
 
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
-                               sdata->dev->name, print_mac(mac, sta->sta.addr));
+                        printk(KERN_DEBUG "%s: expiring inactive STA %pM\n",
+                               sdata->dev->name, sta->sta.addr);
 #endif
                         __sta_info_unlink(&sta);
                         if (sta)
@@ -830,7 +821,7 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 }
 
 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
-                                         const u8 *addr)
+                                         const u8 *addr)
 {
         struct sta_info *sta = sta_info_get(hw_to_local(hw), addr);
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 168a39a298bd..5ad9250b63ab 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -160,18 +160,20 @@ struct sta_ampdu_mlme {
  * @list: global linked list entry
  * @hnext: hash table linked list pointer
  * @local: pointer to the global information
- * @sdata: TBD
- * @key: TBD
- * @rate_ctrl: TBD
- * @rate_ctrl_priv: TBD
+ * @sdata: virtual interface this station belongs to
+ * @key: peer key negotiated with this station, if any
+ * @rate_ctrl: rate control algorithm reference
+ * @rate_ctrl_priv: rate control private per-STA pointer
+ * @last_tx_rate: rate used for last transmit, to report to userspace as
+ *      "the" transmit rate
  * @lock: used for locking all fields that require locking, see comments
  *      in the header file.
  * @flaglock: spinlock for flags accesses
  * @addr: MAC address of this STA
  * @aid: STA's unique AID (1..2007, 0 = not assigned yet),
  *      only used in AP (and IBSS?) mode
- * @listen_interval: TBD
- * @pin_status: TBD
+ * @listen_interval: listen interval of this station, when we're acting as AP
+ * @pin_status: used internally for pinning a STA struct into memory
  * @flags: STA flags, see &enum ieee80211_sta_info_flags
  * @ps_tx_buf: buffer of frames to transmit to this station
  *      when it leaves power saving state
@@ -180,8 +182,8 @@ struct sta_ampdu_mlme {
  *      power saving state
  * @rx_packets: Number of MSDUs received from this STA
  * @rx_bytes: Number of bytes received from this STA
- * @wep_weak_iv_count: TBD
- * @last_rx: TBD
+ * @wep_weak_iv_count: number of weak WEP IVs received from this station
+ * @last_rx: time (in jiffies) when last frame was received from this STA
  * @num_duplicates: number of duplicate frames received from this STA
  * @rx_fragments: number of received MPDUs
  * @rx_dropped: number of dropped MPDUs from this STA
@@ -189,26 +191,26 @@ struct sta_ampdu_mlme {
  * @last_qual: qual of last received frame from this STA
  * @last_noise: noise of last received frame from this STA
  * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
- * @tx_filtered_count: TBD
- * @tx_retry_failed: TBD
- * @tx_retry_count: TBD
+ * @tx_filtered_count: number of frames the hardware filtered for this STA
+ * @tx_retry_failed: number of frames that failed retry
+ * @tx_retry_count: total number of retries for frames to this STA
  * @fail_avg: moving percentage of failed MSDUs
  * @tx_packets: number of RX/TX MSDUs
- * @tx_bytes: TBD
+ * @tx_bytes: number of bytes transmitted to this STA
  * @tx_fragments: number of transmitted MPDUs
- * @last_txrate_idx: Index of the last used transmit rate
- * @tid_seq: TBD
- * @ampdu_mlme: TBD
+ * @last_txrate: description of the last used transmit rate
+ * @tid_seq: per-TID sequence numbers for sending to this STA
+ * @ampdu_mlme: A-MPDU state machine state
  * @timer_to_tid: identity mapping to ID timers
  * @tid_to_tx_q: map tid to tx queue
  * @llid: Local link ID
  * @plid: Peer link ID
  * @reason: Cancel reason on PLINK_HOLDING state
  * @plink_retries: Retries in establishment
- * @ignore_plink_timer: TBD
- * @plink_state plink_state: TBD
- * @plink_timeout: TBD
- * @plink_timer: TBD
+ * @ignore_plink_timer: ignore the peer-link timer (used internally)
+ * @plink_state: peer link state
+ * @plink_timeout: timeout of peer link
+ * @plink_timer: peer link watch timer
  * @debugfs: debug filesystem info
  * @sta: station information we share with the driver
  */
@@ -267,7 +269,7 @@ struct sta_info {
         unsigned long tx_packets;
         unsigned long tx_bytes;
         unsigned long tx_fragments;
-        unsigned int last_txrate_idx;
+        struct ieee80211_tx_rate last_tx_rate;
         u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
 
         /*
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 34b32bc8f609..38fa111d2dc6 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -263,10 +263,9 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
              (iv32 == key->u.tkip.rx[queue].iv32 &&
               iv16 <= key->u.tkip.rx[queue].iv16))) {
 #ifdef CONFIG_MAC80211_TKIP_DEBUG
-                DECLARE_MAC_BUF(mac);
                 printk(KERN_DEBUG "TKIP replay detected for RX frame from "
-                       "%s (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
-                       print_mac(mac, ta),
+                       "%pM (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
+                       ta,
                        iv32, iv16, key->u.tkip.rx[queue].iv32,
                        key->u.tkip.rx[queue].iv16);
 #endif
@@ -287,9 +286,8 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                 {
                         int i;
                         u8 key_offset = NL80211_TKIP_DATA_OFFSET_ENCR_KEY;
-                        DECLARE_MAC_BUF(mac);
-                        printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=%s"
-                               " TK=", print_mac(mac, ta));
+                        printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=%pM"
+                               " TK=", ta);
                         for (i = 0; i < 16; i++)
                                 printk("%02x ",
                                        key->conf.key[key_offset + i]);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1460537faf33..0d81b2cfd1a6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -46,13 +46,20 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
         struct ieee80211_hdr *hdr;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+        /* assume HW handles this */
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
+                return 0;
+
+        /* uh huh? */
+        if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
+                return 0;
 
         sband = local->hw.wiphy->bands[tx->channel->band];
-        txrate = &sband->bitrates[tx->rate_idx];
+        txrate = &sband->bitrates[info->control.rates[0].idx];
 
-        erp = 0;
-        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
-                erp = txrate->flags & IEEE80211_RATE_ERP_G;
+        erp = txrate->flags & IEEE80211_RATE_ERP_G;
 
         /*
          * data and mgmt (except PS Poll):
@@ -116,7 +123,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                 if (r->bitrate > txrate->bitrate)
                         break;
 
-                if (tx->sdata->bss_conf.basic_rates & BIT(i))
+                if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
                         rate = r->bitrate;
 
                 switch (sband->band) {
@@ -150,7 +157,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
          * to closest integer */
 
         dur = ieee80211_frame_duration(local, 10, rate, erp,
-                                tx->sdata->bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble);
 
         if (next_frag_len) {
                 /* Frame is fragmented: duration increases with time needed to
@@ -159,7 +166,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                 /* next fragment */
                 dur += ieee80211_frame_duration(local, next_frag_len,
                                 txrate->bitrate, erp,
-                                tx->sdata->bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble);
         }
 
         return cpu_to_le16(dur);
@@ -201,10 +208,9 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                              tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                              ieee80211_is_data(hdr->frame_control))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                        DECLARE_MAC_BUF(mac);
                         printk(KERN_DEBUG "%s: dropped data frame to not "
-                               "associated station %s\n",
-                               tx->dev->name, print_mac(mac, hdr->addr1));
+                               "associated station %pM\n",
+                               tx->dev->name, hdr->addr1);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
                         return TX_DROP;
@@ -331,7 +337,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         u32 staflags;
-        DECLARE_MAC_BUF(mac);
 
         if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)))
                 return TX_CONTINUE;
@@ -341,9 +346,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         if (unlikely((staflags & WLAN_STA_PS) &&
                      !(staflags & WLAN_STA_PSPOLL))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %s aid %d: PS buffer (entries "
+                printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
                        "before %d)\n",
-                       print_mac(mac, sta->sta.addr), sta->sta.aid,
+                       sta->sta.addr, sta->sta.aid,
                        skb_queue_len(&sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
@@ -352,9 +357,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                         if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: STA %s TX "
+                                printk(KERN_DEBUG "%s: STA %pM TX "
                                        "buffer full - dropping oldest frame\n",
-                                       tx->dev->name, print_mac(mac, sta->sta.addr));
+                                       tx->dev->name, sta->sta.addr);
                         }
 #endif
                         dev_kfree_skb(old);
@@ -371,9 +376,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) {
-                printk(KERN_DEBUG "%s: STA %s in PS mode, but pspoll "
+                printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
                        "set -> send frame\n", tx->dev->name,
-                       print_mac(mac, sta->sta.addr));
+                       sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         clear_sta_flags(sta, WLAN_STA_PSPOLL);
@@ -439,140 +444,154 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 {
-        struct rate_selection rsel;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (void *)tx->skb->data;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate;
+        int i, len;
+        bool inval = false, rts = false, short_preamble = false;
+        struct ieee80211_tx_rate_control txrc;
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+        memset(&txrc, 0, sizeof(txrc));
 
-        if (likely(tx->rate_idx < 0)) {
-                rate_control_get_rate(tx->sdata, sband, tx->sta,
-                                      tx->skb, &rsel);
-                if (tx->sta)
-                        tx->sta->last_txrate_idx = rsel.rate_idx;
-                tx->rate_idx = rsel.rate_idx;
-                if (unlikely(rsel.probe_idx >= 0)) {
-                        info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                        info->control.retries[0].rate_idx = tx->rate_idx;
-                        info->control.retries[0].limit = tx->local->hw.max_altrate_tries;
-                        tx->rate_idx = rsel.probe_idx;
-                } else if (info->control.retries[0].limit == 0)
-                        info->control.retries[0].rate_idx = -1;
-
-                if (unlikely(tx->rate_idx < 0))
-                        return TX_DROP;
-        } else
-                info->control.retries[0].rate_idx = -1;
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        if (tx->sdata->bss_conf.use_cts_prot &&
-            (tx->flags & IEEE80211_TX_FRAGMENTED) && (rsel.nonerp_idx >= 0)) {
-                tx->last_frag_rate_idx = tx->rate_idx;
-                if (rsel.probe_idx >= 0)
-                        tx->flags &= ~IEEE80211_TX_PROBE_LAST_FRAG;
-                else
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                tx->rate_idx = rsel.nonerp_idx;
-                info->tx_rate_idx = rsel.nonerp_idx;
-                info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-        } else {
-                tx->last_frag_rate_idx = tx->rate_idx;
-                info->tx_rate_idx = tx->rate_idx;
+        len = min_t(int, tx->skb->len + FCS_LEN,
+                         tx->local->fragmentation_threshold);
+
+        /* set up the tx rate control struct we give the RC algo */
+        txrc.hw = local_to_hw(tx->local);
+        txrc.sband = sband;
+        txrc.bss_conf = &tx->sdata->vif.bss_conf;
+        txrc.skb = tx->skb;
+        txrc.reported_rate.idx = -1;
+        txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
+
+        /* set up RTS protection if desired */
+        if (tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD &&
+            len > tx->local->rts_threshold) {
+                txrc.rts = rts = true;
         }
-        info->tx_rate_idx = tx->rate_idx;
 
-        return TX_CONTINUE;
-}
+        /*
+         * Use short preamble if the BSS can handle it, but not for
+         * management frames unless we know the receiver can handle
+         * that -- the management frame might be to a station that
+         * just wants a probe response.
+         */
+        if (tx->sdata->vif.bss_conf.use_short_preamble &&
+            (ieee80211_is_data(hdr->frame_control) ||
+             (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
+                txrc.short_preamble = short_preamble = true;
 
-static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        struct ieee80211_supported_band *sband;
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+        rate_control_get_rate(tx->sdata, tx->sta, &txrc);
+
+        if (unlikely(info->control.rates[0].idx < 0))
+                return TX_DROP;
+
+        if (txrc.reported_rate.idx < 0)
+                txrc.reported_rate = info->control.rates[0];
 
         if (tx->sta)
-                info->control.sta = &tx->sta->sta;
+                tx->sta->last_tx_rate = txrc.reported_rate;
 
-        if (!info->control.retry_limit) {
-                if (!is_multicast_ether_addr(hdr->addr1)) {
-                        int len = min_t(int, tx->skb->len + FCS_LEN,
-                                        tx->local->fragmentation_threshold);
-                        if (len > tx->local->rts_threshold
-                            && tx->local->rts_threshold <
-                                                IEEE80211_MAX_RTS_THRESHOLD) {
-                                info->flags |= IEEE80211_TX_CTL_USE_RTS_CTS;
-                                info->flags |=
-                                        IEEE80211_TX_CTL_LONG_RETRY_LIMIT;
-                                info->control.retry_limit =
-                                        tx->local->long_retry_limit;
-                        } else {
-                                info->control.retry_limit =
-                                        tx->local->short_retry_limit;
-                        }
-                } else {
-                        info->control.retry_limit = 1;
-                }
-        }
+        if (unlikely(!info->control.rates[0].count))
+                info->control.rates[0].count = 1;
 
-        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
-                /* Do not use multiple retry rates when sending fragmented
-                 * frames.
-                 * TODO: The last fragment could still use multiple retry
-                 * rates. */
-                info->control.retries[0].rate_idx = -1;
+        if (is_multicast_ether_addr(hdr->addr1)) {
+                /*
+                 * XXX: verify the rate is in the basic rateset
+                 */
+                return TX_CONTINUE;
         }
 
-        /* Use CTS protection for unicast frames sent using extended rates if
-         * there are associated non-ERP stations and RTS/CTS is not configured
-         * for the frame. */
-        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
-            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_ERP_G) &&
-            (tx->flags & IEEE80211_TX_UNICAST) &&
-            tx->sdata->bss_conf.use_cts_prot &&
-            !(info->flags & IEEE80211_TX_CTL_USE_RTS_CTS))
-                info->flags |= IEEE80211_TX_CTL_USE_CTS_PROTECT;
-
-        /* Transmit data frames using short preambles if the driver supports
-         * short preambles at the selected rate and short preambles are
-         * available on the network at the current point in time. */
-        if (ieee80211_is_data(hdr->frame_control) &&
-            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
-            tx->sdata->bss_conf.use_short_preamble &&
-            (!tx->sta || test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))) {
-                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+        /*
+         * set up the RTS/CTS rate as the fastest basic rate
+         * that is not faster than the data rate
+         *
+         * XXX: Should this check all retry rates?
+         */
+        if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+                s8 baserate = 0;
+
+                rate = &sband->bitrates[info->control.rates[0].idx];
+
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        /* must be a basic rate */
+                        if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
+                                continue;
+                        /* must not be faster than the data rate */
+                        if (sband->bitrates[i].bitrate > rate->bitrate)
+                                continue;
+                        /* maximum */
+                        if (sband->bitrates[baserate].bitrate <
+                             sband->bitrates[i].bitrate)
+                                baserate = i;
+                }
+
+                info->control.rts_cts_rate_idx = baserate;
         }
 
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)) {
-                struct ieee80211_rate *rate;
-                s8 baserate = -1;
-                int idx;
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                /*
+                 * make sure there's no valid rate following
+                 * an invalid one, just in case drivers don't
+                 * take the API seriously to stop at -1.
+                 */
+                if (inval) {
+                        info->control.rates[i].idx = -1;
+                        continue;
+                }
+                if (info->control.rates[i].idx < 0) {
+                        inval = true;
+                        continue;
+                }
 
-                /* Do not use multiple retry rates when using RTS/CTS */
-                info->control.retries[0].rate_idx = -1;
+                /*
+                 * For now assume MCS is already set up correctly, this
+                 * needs to be fixed.
+                 */
+                if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
+                        WARN_ON(info->control.rates[i].idx > 76);
+                        continue;
+                }
 
-                /* Use min(data rate, max base rate) as CTS/RTS rate */
-                rate = &sband->bitrates[tx->rate_idx];
+                /* set up RTS protection if desired */
+                if (rts)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_RTS_CTS;
 
-                for (idx = 0; idx < sband->n_bitrates; idx++) {
-                        if (sband->bitrates[idx].bitrate > rate->bitrate)
-                                continue;
-                        if (tx->sdata->bss_conf.basic_rates & BIT(idx) &&
-                            (baserate < 0 ||
-                             (sband->bitrates[baserate].bitrate
-                              < sband->bitrates[idx].bitrate)))
-                                baserate = idx;
+                /* RC is busted */
+                if (WARN_ON_ONCE(info->control.rates[i].idx >=
+                                 sband->n_bitrates)) {
+                        info->control.rates[i].idx = -1;
+                        continue;
                 }
 
-                if (baserate >= 0)
-                        info->control.rts_cts_rate_idx = baserate;
-                else
-                        info->control.rts_cts_rate_idx = 0;
+                rate = &sband->bitrates[info->control.rates[i].idx];
+
+                /* set up short preamble */
+                if (short_preamble &&
+                    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
+
+                /* set up G protection */
+                if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
+                    rate->flags & IEEE80211_RATE_ERP_G)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_CTS_PROTECT;
         }
 
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
         if (tx->sta)
                 info->control.sta = &tx->sta->sta;
 
@@ -602,8 +621,18 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         if (ieee80211_hdrlen(hdr->frame_control) < 24)
                 return TX_CONTINUE;
 
+        /*
+         * Anything but QoS data that has a sequence number field
+         * (is long enough) gets a sequence number from the global
+         * counter.
+         */
         if (!ieee80211_is_data_qos(hdr->frame_control)) {
+                /* driver should assign sequence number */
                 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+                /* for pure STA mode without beacons, we can do it */
+                hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
+                tx->sdata->sequence_number += 0x10;
+                tx->sdata->sequence_number &= IEEE80211_SCTL_SEQ;
                 return TX_CONTINUE;
         }
 
@@ -632,6 +661,7 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         size_t hdrlen, per_fragm, num_fragm, payload_len, left;
         struct sk_buff **frags, *first, *frag;
@@ -648,9 +678,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
          * This scenario is handled in __ieee80211_tx_prepare but extra
          * caution taken here as fragmented ampdu may cause Tx stop.
          */
-        if (WARN_ON(tx->flags & IEEE80211_TX_CTL_AMPDU ||
-                    skb_get_queue_mapping(tx->skb) >=
-                        ieee80211_num_regular_queues(&tx->local->hw)))
+        if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
                 return TX_DROP;
 
         first = tx->skb;
@@ -684,20 +712,45 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                                       IEEE80211_ENCRYPT_TAILROOM);
                 if (!frag)
                         goto fail;
+
                 /* Make sure that all fragments use the same priority so
                  * that they end up using the same TX queue */
                 frag->priority = first->priority;
+
                 skb_reserve(frag, tx->local->tx_headroom +
                                   IEEE80211_ENCRYPT_HEADROOM);
+
+                /* copy TX information */
+                info = IEEE80211_SKB_CB(frag);
+                memcpy(info, first->cb, sizeof(frag->cb));
+
+                /* copy/fill in 802.11 header */
                 fhdr = (struct ieee80211_hdr *) skb_put(frag, hdrlen);
                 memcpy(fhdr, first->data, hdrlen);
-                if (i == num_fragm - 2)
-                        fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
                 fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG));
+
+                if (i == num_fragm - 2) {
+                        /* clear MOREFRAGS bit for the last fragment */
+                        fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
+                } else {
+                        /*
+                         * No multi-rate retries for fragmented frames, that
+                         * would completely throw off the NAV at other STAs.
+                         */
+                        info->control.rates[1].idx = -1;
+                        info->control.rates[2].idx = -1;
+                        info->control.rates[3].idx = -1;
+                        info->control.rates[4].idx = -1;
+                        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
+                        info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+                }
+
+                /* copy data */
                 copylen = left > per_fragm ? per_fragm : left;
                 memcpy(skb_put(frag, copylen), pos, copylen);
-                memcpy(frag->cb, first->cb, sizeof(frag->cb));
+
                 skb_copy_queue_mapping(frag, first);
+
                 frag->do_not_encrypt = first->do_not_encrypt;
 
                 pos += copylen;
@@ -757,12 +810,10 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
                                               tx->extra_frag[0]->len);
 
         for (i = 0; i < tx->num_extra_frag; i++) {
-                if (i + 1 < tx->num_extra_frag) {
+                if (i + 1 < tx->num_extra_frag)
                         next_len = tx->extra_frag[i + 1]->len;
-                } else {
+                else
                         next_len = 0;
-                        tx->rate_idx = tx->last_frag_rate_idx;
-                }
 
                 hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data;
                 hdr->duration_id = ieee80211_duration(tx, 0, next_len);
@@ -815,7 +866,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
@@ -829,8 +879,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
          */
 
         while (!ret) {
-                int i, target_rate;
-
                 ret = ieee80211_radiotap_iterator_next(&iterator);
 
                 if (ret)
@@ -844,38 +892,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                  * get_unaligned((type *)iterator.this_arg) to dereference
                  * iterator.this_arg for type "type" safely on all arches.
                 */
-                case IEEE80211_RADIOTAP_RATE:
-                        /*
-                         * radiotap rate u8 is in 500kbps units eg, 0x02=1Mbps
-                         * ieee80211 rate int is in 100kbps units eg, 0x0a=1Mbps
-                         */
-                        target_rate = (*iterator.this_arg) * 5;
-                        for (i = 0; i < sband->n_bitrates; i++) {
-                                struct ieee80211_rate *r;
-
-                                r = &sband->bitrates[i];
-
-                                if (r->bitrate == target_rate) {
-                                        tx->rate_idx = i;
-                                        break;
-                                }
-                        }
-                        break;
-
-                case IEEE80211_RADIOTAP_ANTENNA:
-                        /*
-                         * radiotap uses 0 for 1st ant, mac80211 is 1 for
-                         * 1st ant
-                         */
-                        info->antenna_sel_tx = (*iterator.this_arg) + 1;
-                        break;
-
-#if 0
-                case IEEE80211_RADIOTAP_DBM_TX_POWER:
-                        control->power_level = *iterator.this_arg;
-                        break;
-#endif
-
                 case IEEE80211_RADIOTAP_FLAGS:
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
                                 /*
@@ -933,7 +949,8 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        int hdrlen;
+        int hdrlen, tid;
+        u8 *qc, *state;
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
@@ -941,8 +958,6 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->local = local;
         tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         tx->channel = local->hw.conf.channel;
-        tx->rate_idx = -1;
-        tx->last_frag_rate_idx = -1;
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
          * it will be cleared/left by radiotap as desired.
@@ -966,6 +981,15 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 
         tx->sta = sta_info_get(local, hdr->addr1);
 
+        if (tx->sta && ieee80211_is_data_qos(hdr->frame_control)) {
+                qc = ieee80211_get_qos_ctl(hdr);
+                tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+
+                state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
+                if (*state == HT_AGG_STATE_OPERATIONAL)
+                        info->flags |= IEEE80211_TX_CTL_AMPDU;
+        }
+
         if (is_multicast_ether_addr(hdr->addr1)) {
                 tx->flags &= ~IEEE80211_TX_UNICAST;
                 info->flags |= IEEE80211_TX_CTL_NO_ACK;
@@ -1043,23 +1067,11 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                         if (!tx->extra_frag[i])
                                 continue;
                         info = IEEE80211_SKB_CB(tx->extra_frag[i]);
-                        info->flags &= ~(IEEE80211_TX_CTL_USE_RTS_CTS |
-                                         IEEE80211_TX_CTL_USE_CTS_PROTECT |
-                                         IEEE80211_TX_CTL_CLEAR_PS_FILT |
+                        info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
                                          IEEE80211_TX_CTL_FIRST_FRAGMENT);
                         if (netif_subqueue_stopped(local->mdev,
                                                    tx->extra_frag[i]))
                                 return IEEE80211_TX_FRAG_AGAIN;
-                        if (i == tx->num_extra_frag) {
-                                info->tx_rate_idx = tx->last_frag_rate_idx;
-
-                                if (tx->flags & IEEE80211_TX_PROBE_LAST_FRAG)
-                                        info->flags |=
-                                                IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                                else
-                                        info->flags &=
-                                                ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                        }
 
                         ret = local->ops->tx(local_to_hw(local),
                                             tx->extra_frag[i]);
@@ -1168,7 +1180,7 @@ retry:
                  * queues, there's no reason for a driver to reject
                  * a frame there, warn and drop it.
                  */
-                if (WARN_ON(queue >= ieee80211_num_regular_queues(&local->hw)))
+                if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
                         goto drop;
 
                 store = &local->pending_packet[queue];
@@ -1196,9 +1208,6 @@ retry:
                 store->skb = skb;
                 store->extra_frag = tx.extra_frag;
                 store->num_extra_frag = tx.num_extra_frag;
-                store->last_frag_rate_idx = tx.last_frag_rate_idx;
-                store->last_frag_rate_ctrl_probe =
-                        !!(tx.flags & IEEE80211_TX_PROBE_LAST_FRAG);
         }
  out:
         rcu_read_unlock();
@@ -1593,12 +1602,10 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                        compare_ether_addr(dev->dev_addr,
                                           skb->data + ETH_ALEN) == 0))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                DECLARE_MAC_BUF(mac);
-
                 if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: dropped frame to %s"
+                        printk(KERN_DEBUG "%s: dropped frame to %pM"
                                " (unauthorized port)\n", dev->name,
-                               print_mac(mac, hdr.addr1));
+                               hdr.addr1);
 #endif
 
                 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
@@ -1757,10 +1764,7 @@ void ieee80211_tx_pending(unsigned long data)
                 store = &local->pending_packet[i];
                 tx.extra_frag = store->extra_frag;
                 tx.num_extra_frag = store->num_extra_frag;
-                tx.last_frag_rate_idx = store->last_frag_rate_idx;
                 tx.flags = 0;
-                if (store->last_frag_rate_ctrl_probe)
-                        tx.flags |= IEEE80211_TX_PROBE_LAST_FRAG;
                 ret = __ieee80211_tx(local, store->skb, &tx);
                 if (ret) {
                         if (ret == IEEE80211_TX_FRAG_AGAIN)
@@ -1848,7 +1852,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
         struct ieee80211_if_sta *ifsta = NULL;
-        struct rate_selection rsel;
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band = local->hw.conf.channel->band;
@@ -1952,33 +1955,23 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         skb->do_not_encrypt = 1;
 
         info->band = band;
-        rate_control_get_rate(sdata, sband, NULL, skb, &rsel);
-
-        if (unlikely(rsel.rate_idx < 0)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
-                               "no rate found\n",
-                               wiphy_name(local->hw.wiphy));
-                }
-                dev_kfree_skb_any(skb);
-                skb = NULL;
-                goto out;
-        }
+        /*
+         * XXX: For now, always use the lowest rate
+         */
+        info->control.rates[0].idx = 0;
+        info->control.rates[0].count = 1;
+        info->control.rates[1].idx = -1;
+        info->control.rates[2].idx = -1;
+        info->control.rates[3].idx = -1;
+        info->control.rates[4].idx = -1;
+        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
 
         info->control.vif = vif;
-        info->tx_rate_idx = rsel.rate_idx;
 
         info->flags |= IEEE80211_TX_CTL_NO_ACK;
         info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
-        if (sdata->bss_conf.use_short_preamble &&
-            sband->bitrates[rsel.rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
-
-        info->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-        info->control.retry_limit = 1;
-
-out:
+ out:
         rcu_read_unlock();
         return skb;
 }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index cee4884b9d06..0f841317c7e9 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -239,7 +239,7 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
         erp = 0;
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                short_preamble = sdata->bss_conf.use_short_preamble;
+                short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
         }
@@ -272,7 +272,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         erp = 0;
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                short_preamble = sdata->bss_conf.use_short_preamble;
+                short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
         }
@@ -312,7 +312,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         erp = 0;
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                short_preamble = sdata->bss_conf.use_short_preamble;
+                short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
         }
@@ -532,8 +532,8 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         if (elen >= sizeof(struct ieee80211_ht_cap))
                                 elems->ht_cap_elem = (void *)pos;
                         break;
-                case WLAN_EID_HT_EXTRA_INFO:
-                        if (elen >= sizeof(struct ieee80211_ht_addt_info))
+                case WLAN_EID_HT_INFORMATION:
+                        if (elen >= sizeof(struct ieee80211_ht_info))
                                 elems->ht_info_elem = (void *)pos;
                         break;
                 case WLAN_EID_MESH_ID:
@@ -638,19 +638,15 @@ int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freqMHz)
 
         if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
-                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
-                                "%d MHz\n", sdata->dev->name, chan->center_freq);
+                    chan->flags & IEEE80211_CHAN_NO_IBSS)
                         return ret;
-                }
                 local->oper_channel = chan;
 
                 if (local->sw_scanning || local->hw_scanning)
                         ret = 0;
                 else
-                        ret = ieee80211_hw_config(local);
-
-                rate_control_clear(local);
+                        ret = ieee80211_hw_config(
+                                local, IEEE80211_CONF_CHANGE_CHANNEL);
         }
 
         return ret;
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index f0e2d3ecb5c4..7bbb98e846a3 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -49,17 +49,19 @@ void ieee80211_wep_free(struct ieee80211_local *local)
         crypto_free_blkcipher(local->wep_rx_tfm);
 }
 
-static inline int ieee80211_wep_weak_iv(u32 iv, int keylen)
+static inline bool ieee80211_wep_weak_iv(u32 iv, int keylen)
 {
-        /* Fluhrer, Mantin, and Shamir have reported weaknesses in the
+        /*
+         * Fluhrer, Mantin, and Shamir have reported weaknesses in the
          * key scheduling algorithm of RC4. At least IVs (KeyByte + 3,
-         * 0xff, N) can be used to speedup attacks, so avoid using them. */
+         * 0xff, N) can be used to speedup attacks, so avoid using them.
+         */
         if ((iv & 0xff00) == 0xff00) {
                 u8 B = (iv >> 16) & 0xff;
                 if (B >= 3 && B < 3 + keylen)
-                        return 1;
+                        return true;
         }
-        return 0;
+        return false;
 }
 
 
@@ -268,7 +270,7 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
 }
 
 
-u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
+bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         unsigned int hdrlen;
@@ -276,16 +278,13 @@ u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
         u32 iv;
 
         if (!ieee80211_has_protected(hdr->frame_control))
-                return NULL;
+                return false;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         ivpos = skb->data + hdrlen;
         iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
 
-        if (ieee80211_wep_weak_iv(iv, key->conf.keylen))
-                return ivpos;
-
-        return NULL;
+        return ieee80211_wep_weak_iv(iv, key->conf.keylen);
 }
 
 ieee80211_rx_result
@@ -329,6 +328,8 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
 {
+        int i;
+
         ieee80211_tx_set_protected(tx);
 
         if (wep_encrypt_skb(tx, tx->skb) < 0) {
@@ -337,9 +338,8 @@ ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
         }
 
         if (tx->extra_frag) {
-                int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (wep_encrypt_skb(tx, tx->extra_frag[i]) < 0) {
+                        if (wep_encrypt_skb(tx, tx->extra_frag[i])) {
                                 I802_DEBUG_INC(tx->local->
                                                tx_handlers_drop_wep);
                                 return TX_DROP;
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index e587172115b8..d3f0db48314e 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -26,7 +26,7 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
 int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
-u8 *ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
+bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
 ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 742f811ca416..63f36e9d1af8 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -147,7 +147,7 @@ static int ieee80211_ioctl_giwname(struct net_device *dev,
         sband = local->hw.wiphy->bands[IEEE80211_BAND_5GHZ];
         if (sband) {
                 is_a = 1;
-                is_ht |= sband->ht_info.ht_supported;
+                is_ht |= sband->ht_cap.ht_supported;
         }
 
         sband = local->hw.wiphy->bands[IEEE80211_BAND_2GHZ];
@@ -160,7 +160,7 @@ static int ieee80211_ioctl_giwname(struct net_device *dev,
                         if (sband->bitrates[i].bitrate == 60)
                                 is_g = 1;
                 }
-                is_ht |= sband->ht_info.ht_supported;
+                is_ht |= sband->ht_cap.ht_supported;
         }
 
         strcpy(name, "IEEE 802.11");
@@ -407,13 +407,6 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                 return 0;
         }
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                memcpy(sdata->u.ap.ssid, ssid, len);
-                memset(sdata->u.ap.ssid + len, 0,
-                       IEEE80211_MAX_SSID_LEN - len);
-                sdata->u.ap.ssid_len = len;
-                return ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
-        }
         return -EOPNOTSUPP;
 }
 
@@ -437,15 +430,6 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                 return res;
         }
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                len = sdata->u.ap.ssid_len;
-                if (len > IW_ESSID_MAX_SIZE)
-                        len = IW_ESSID_MAX_SIZE;
-                memcpy(ssid, sdata->u.ap.ssid, len);
-                data->length = len;
-                data->flags = 1;
-                return 0;
-        }
         return -EOPNOTSUPP;
 }
 
@@ -636,8 +620,8 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
 
         sta = sta_info_get(local, sdata->u.sta.bssid);
 
-        if (sta && sta->last_txrate_idx < sband->n_bitrates)
-                rate->value = sband->bitrates[sta->last_txrate_idx].bitrate;
+        if (sta && !(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS))
+                rate->value = sband->bitrates[sta->last_tx_rate.idx].bitrate;
         else
                 rate->value = 0;
 
@@ -656,45 +640,35 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
                                       union iwreq_data *data, char *extra)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        bool need_reconfig = 0;
+        struct ieee80211_channel* chan = local->hw.conf.channel;
+        u32 reconf_flags = 0;
         int new_power_level;
 
         if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
                 return -EINVAL;
         if (data->txpower.flags & IW_TXPOW_RANGE)
                 return -EINVAL;
+        if (!chan)
+                return -EINVAL;
 
-        if (data->txpower.fixed) {
-                new_power_level = data->txpower.value;
-        } else {
-                /*
-                 * Automatic power level. Use maximum power for the current
-                 * channel. Should be part of rate control.
-                 */
-                struct ieee80211_channel* chan = local->hw.conf.channel;
-                if (!chan)
-                        return -EINVAL;
-
+        if (data->txpower.fixed)
+                new_power_level = min(data->txpower.value, chan->max_power);
+        else /* Automatic power level setting */
                 new_power_level = chan->max_power;
-        }
 
         if (local->hw.conf.power_level != new_power_level) {
                 local->hw.conf.power_level = new_power_level;
-                need_reconfig = 1;
+                reconf_flags |= IEEE80211_CONF_CHANGE_POWER;
         }
 
         if (local->hw.conf.radio_enabled != !(data->txpower.disabled)) {
                 local->hw.conf.radio_enabled = !(data->txpower.disabled);
-                need_reconfig = 1;
+                reconf_flags |= IEEE80211_CONF_CHANGE_RADIO_ENABLED;
                 ieee80211_led_radio(local, local->hw.conf.radio_enabled);
         }
 
-        if (need_reconfig) {
-                ieee80211_hw_config(local);
-                /* The return value of hw_config is not of big interest here,
-                 * as it doesn't say that it failed because of _this_ config
-                 * change or something else. Ignore it. */
-        }
+        if (reconf_flags)
+                ieee80211_hw_config(local, reconf_flags);
 
         return 0;
 }
@@ -806,21 +780,16 @@ static int ieee80211_ioctl_siwretry(struct net_device *dev,
             (retry->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
                 return -EINVAL;
 
-        if (retry->flags & IW_RETRY_MAX)
-                local->long_retry_limit = retry->value;
-        else if (retry->flags & IW_RETRY_MIN)
-                local->short_retry_limit = retry->value;
-        else {
-                local->long_retry_limit = retry->value;
-                local->short_retry_limit = retry->value;
+        if (retry->flags & IW_RETRY_MAX) {
+                local->hw.conf.long_frame_max_tx_count = retry->value;
+        } else if (retry->flags & IW_RETRY_MIN) {
+                local->hw.conf.short_frame_max_tx_count = retry->value;
+        } else {
+                local->hw.conf.long_frame_max_tx_count = retry->value;
+                local->hw.conf.short_frame_max_tx_count = retry->value;
         }
 
-        if (local->ops->set_retry_limit) {
-                return local->ops->set_retry_limit(
-                        local_to_hw(local),
-                        local->short_retry_limit,
-                        local->long_retry_limit);
-        }
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_RETRY_LIMITS);
 
         return 0;
 }
@@ -837,14 +806,15 @@ static int ieee80211_ioctl_giwretry(struct net_device *dev,
                 /* first return min value, iwconfig will ask max value
                  * later if needed */
                 retry->flags |= IW_RETRY_LIMIT;
-                retry->value = local->short_retry_limit;
-                if (local->long_retry_limit != local->short_retry_limit)
+                retry->value = local->hw.conf.short_frame_max_tx_count;
+                if (local->hw.conf.long_frame_max_tx_count !=
+                    local->hw.conf.short_frame_max_tx_count)
                         retry->flags |= IW_RETRY_MIN;
                 return 0;
         }
         if (retry->flags & IW_RETRY_MAX) {
                 retry->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
-                retry->value = local->long_retry_limit;
+                retry->value = local->hw.conf.long_frame_max_tx_count;
         }
 
         return 0;
@@ -980,7 +950,7 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
 
         if (wrq->disabled) {
                 conf->flags &= ~IEEE80211_CONF_PS;
-                return ieee80211_hw_config(local);
+                return ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 
         switch (wrq->flags & IW_POWER_MODE) {
@@ -993,7 +963,7 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
                 return -EINVAL;
         }
 
-        return ieee80211_hw_config(local);
+        return ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 }
 
 static int ieee80211_ioctl_giwpower(struct net_device *dev,
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 139b5f267b34..ac71b38f7cb5 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -114,8 +114,8 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         struct ieee80211_master_priv *mpriv = netdev_priv(dev);
         struct ieee80211_local *local = mpriv->local;
+        struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct sta_info *sta;
         u16 queue;
         u8 tid;
@@ -124,21 +124,19 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
         if (unlikely(queue >= local->hw.queues))
                 queue = local->hw.queues - 1;
 
-        if (info->flags & IEEE80211_TX_CTL_REQUEUE) {
+        if (skb->requeue) {
+                if (!hw->ampdu_queues)
+                        return queue;
+
                 rcu_read_lock();
                 sta = sta_info_get(local, hdr->addr1);
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
                 if (sta) {
-                        struct ieee80211_hw *hw = &local->hw;
                         int ampdu_queue = sta->tid_to_tx_q[tid];
 
                         if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool)) {
+                            test_bit(ampdu_queue, local->queue_pool))
                                 queue = ampdu_queue;
-                                info->flags |= IEEE80211_TX_CTL_AMPDU;
-                        } else {
-                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                        }
                 }
                 rcu_read_unlock();
 
@@ -159,20 +157,18 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
                 *p++ = ack_policy | tid;
                 *p = 0;
 
+                if (!hw->ampdu_queues)
+                        return queue;
+
                 rcu_read_lock();
 
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
                         int ampdu_queue = sta->tid_to_tx_q[tid];
-                        struct ieee80211_hw *hw = &local->hw;
 
                         if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool)) {
+                            test_bit(ampdu_queue, local->queue_pool))
                                 queue = ampdu_queue;
-                                info->flags |= IEEE80211_TX_CTL_AMPDU;
-                        } else {
-                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                        }
                 }
 
                 rcu_read_unlock();
@@ -206,13 +202,11 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
                          * on the previous queue
                          * since HT is strict in order */
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                        if (net_ratelimit()) {
-                                DECLARE_MAC_BUF(mac);
+                        if (net_ratelimit())
                                 printk(KERN_DEBUG "allocated aggregation queue"
-                                        " %d tid %d addr %s pool=0x%lX\n",
-                                        i, tid, print_mac(mac, sta->sta.addr),
+                                        " %d tid %d addr %pM pool=0x%lX\n",
+                                        i, tid, sta->sta.addr,
                                         local->queue_pool[0]);
-                        }
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                         return 0;
                 }
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 6db649480e8f..7aa63caf8d50 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -49,8 +49,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
             !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) &&
             !wpa_test) {
-                /* hwaccel - with no need for preallocated room for Michael MIC
-                 */
+                /* hwaccel - with no need for preallocated room for MMIC */
                 return TX_CONTINUE;
         }
 
@@ -67,8 +66,6 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 #else
         authenticator = 1;
 #endif
-        /* At this point we know we're using ALG_TKIP. To get the MIC key
-         * we now will rely on the offset from the ieee80211_key_conf::key */
         key_offset = authenticator ?
                 NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
                 NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
@@ -90,11 +87,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         u8 mic[MICHAEL_MIC_LEN];
         struct sk_buff *skb = rx->skb;
         int authenticator = 1, wpa_test = 0;
-        DECLARE_MAC_BUF(mac);
 
-        /*
-         * No way to verify the MIC if the hardware stripped it
-         */
+        /* No way to verify the MIC if the hardware stripped it */
         if (rx->status->flag & RX_FLAG_MMIC_STRIPPED)
                 return RX_CONTINUE;
 
@@ -116,8 +110,6 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 #else
         authenticator = 1;
 #endif
-        /* At this point we know we're using ALG_TKIP. To get the MIC key
-         * we now will rely on the offset from the ieee80211_key_conf::key */
         key_offset = authenticator ?
                 NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
                 NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
@@ -202,6 +194,7 @@ ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
+        int i;
 
         ieee80211_tx_set_protected(tx);
 
@@ -209,9 +202,8 @@ ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
                 return TX_DROP;
 
         if (tx->extra_frag) {
-                int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (tkip_encrypt_skb(tx, tx->extra_frag[i]) < 0)
+                        if (tkip_encrypt_skb(tx, tx->extra_frag[i]))
                                 return TX_DROP;
                 }
         }
@@ -227,7 +219,6 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         int hdrlen, res, hwaccel = 0, wpa_test = 0;
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
-        DECLARE_MAC_BUF(mac);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -350,7 +341,7 @@ static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
 }
 
 
-static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
+static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
 {
         pn[0] = hdr[7];
         pn[1] = hdr[6];
@@ -358,7 +349,6 @@ static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
         pn[3] = hdr[4];
         pn[4] = hdr[1];
         pn[5] = hdr[0];
-        return (hdr[3] >> 6) & 0x03;
 }
 
 
@@ -373,7 +363,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
-                /* hwaccel - with no need for preallocated room for CCMP "
+                /* hwaccel - with no need for preallocated room for CCMP
                  * header or MIC fields */
                 info->control.hw_key = &tx->key->conf;
                 return 0;
@@ -426,6 +416,7 @@ ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
+        int i;
 
         ieee80211_tx_set_protected(tx);
 
@@ -433,9 +424,8 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
                 return TX_DROP;
 
         if (tx->extra_frag) {
-                int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i]) < 0)
+                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i]))
                                 return TX_DROP;
                 }
         }
@@ -453,7 +443,6 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
         u8 pn[CCMP_PN_LEN];
         int data_len;
-        DECLARE_MAC_BUF(mac);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -468,7 +457,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
             (rx->status->flag & RX_FLAG_IV_STRIPPED))
                 return RX_CONTINUE;
 
-        (void) ccmp_hdr2pn(pn, skb->data + hdrlen);
+        ccmp_hdr2pn(pn, skb->data + hdrlen);
 
         if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) {
                 key->u.ccmp.replays++;
@@ -483,9 +472,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
                             key->u.ccmp.tfm, key->u.ccmp.rx_crypto_buf,
                             skb->data + hdrlen + CCMP_HDR_LEN, data_len,
                             skb->data + skb->len - CCMP_MIC_LEN,
-                            skb->data + hdrlen + CCMP_HDR_LEN)) {
+                            skb->data + hdrlen + CCMP_HDR_LEN))
                         return RX_DROP_UNUSABLE;
-                }
         }
 
         memcpy(key->u.ccmp.rx_pn[rx->queue], pn, CCMP_PN_LEN);
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 9a24332fbed8..60aba45023ff 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -820,13 +820,11 @@ static int ip_vs_conn_seq_show(struct seq_file *seq, void *v)
 
 #ifdef CONFIG_IP_VS_IPV6
                 if (cp->af == AF_INET6)
-                        seq_printf(seq,
-                                "%-3s " NIP6_FMT " %04X " NIP6_FMT
-                                " %04X " NIP6_FMT " %04X %-11s %7lu\n",
+                        seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X %pI6 %04X %-11s %7lu\n",
                                 ip_vs_proto_name(cp->protocol),
-                                NIP6(cp->caddr.in6), ntohs(cp->cport),
-                                NIP6(cp->vaddr.in6), ntohs(cp->vport),
-                                NIP6(cp->daddr.in6), ntohs(cp->dport),
+                                &cp->caddr.in6, ntohs(cp->cport),
+                                &cp->vaddr.in6, ntohs(cp->vport),
+                                &cp->daddr.in6, ntohs(cp->dport),
                                 ip_vs_state_name(cp->protocol, cp->state),
                                 (cp->timer.expires-jiffies)/HZ);
                 else
@@ -883,13 +881,11 @@ static int ip_vs_conn_sync_seq_show(struct seq_file *seq, void *v)
 
 #ifdef CONFIG_IP_VS_IPV6
                 if (cp->af == AF_INET6)
-                        seq_printf(seq,
-                                "%-3s " NIP6_FMT " %04X " NIP6_FMT
-                                " %04X " NIP6_FMT " %04X %-11s %-6s %7lu\n",
+                        seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X %pI6 %04X %-11s %-6s %7lu\n",
                                 ip_vs_proto_name(cp->protocol),
-                                NIP6(cp->caddr.in6), ntohs(cp->cport),
-                                NIP6(cp->vaddr.in6), ntohs(cp->vport),
-                                NIP6(cp->daddr.in6), ntohs(cp->dport),
+                                &cp->caddr.in6, ntohs(cp->cport),
+                                &cp->vaddr.in6, ntohs(cp->vport),
+                                &cp->daddr.in6, ntohs(cp->dport),
                                 ip_vs_state_name(cp->protocol, cp->state),
                                 ip_vs_origin_name(cp->flags),
                                 (cp->timer.expires-jiffies)/HZ);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 958abf3e5f8c..cb3e031335eb 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -730,9 +730,9 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related)
         if (ic == NULL)
                 return NF_DROP;
 
-        IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
+        IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %pI4->%pI4\n",
                   ic->type, ntohs(icmp_id(ic)),
-                  NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
+                  &iph->saddr, &iph->daddr);
 
         /*
          * Work through seeing if this is for us.
@@ -805,9 +805,9 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related)
         if (ic == NULL)
                 return NF_DROP;
 
-        IP_VS_DBG(12, "Outgoing ICMPv6 (%d,%d) " NIP6_FMT "->" NIP6_FMT "\n",
+        IP_VS_DBG(12, "Outgoing ICMPv6 (%d,%d) %pI6->%pI6\n",
                   ic->icmp6_type, ntohs(icmpv6_id(ic)),
-                  NIP6(iph->saddr), NIP6(iph->daddr));
+                  &iph->saddr, &iph->daddr);
 
         /*
          * Work through seeing if this is for us.
@@ -1070,9 +1070,9 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
         if (ic == NULL)
                 return NF_DROP;
 
-        IP_VS_DBG(12, "Incoming ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
+        IP_VS_DBG(12, "Incoming ICMP (%d,%d) %pI4->%pI4\n",
                   ic->type, ntohs(icmp_id(ic)),
-                  NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
+                  &iph->saddr, &iph->daddr);
 
         /*
          * Work through seeing if this is for us.
@@ -1127,8 +1127,8 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
         /* Ensure the checksum is correct */
         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
                 /* Failed checksum! */
-                IP_VS_DBG(1, "Incoming ICMP: failed checksum from %d.%d.%d.%d!\n",
-                          NIPQUAD(iph->saddr));
+                IP_VS_DBG(1, "Incoming ICMP: failed checksum from %pI4!\n",
+                          &iph->saddr);
                 goto out;
         }
 
@@ -1175,9 +1175,9 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)
         if (ic == NULL)
                 return NF_DROP;
 
-        IP_VS_DBG(12, "Incoming ICMPv6 (%d,%d) " NIP6_FMT "->" NIP6_FMT "\n",
+        IP_VS_DBG(12, "Incoming ICMPv6 (%d,%d) %pI6->%pI6\n",
                   ic->icmp6_type, ntohs(icmpv6_id(ic)),
-                  NIP6(iph->saddr), NIP6(iph->daddr));
+                  &iph->saddr, &iph->daddr);
 
         /*
          * Work through seeing if this is for us.
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0302cf3e5039..e01061f49cdc 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1168,15 +1168,9 @@ ip_vs_add_service(struct ip_vs_service_user_kern *u,
         }
 
 #ifdef CONFIG_IP_VS_IPV6
-        if (u->af == AF_INET6) {
-                if (!sched->supports_ipv6) {
-                        ret = -EAFNOSUPPORT;
-                        goto out_err;
-                }
-                if ((u->netmask < 1) || (u->netmask > 128)) {
-                        ret = -EINVAL;
-                        goto out_err;
-                }
+        if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
+                ret = -EINVAL;
+                goto out_err;
         }
 #endif
 
@@ -1272,15 +1266,9 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
         old_sched = sched;
 
 #ifdef CONFIG_IP_VS_IPV6
-        if (u->af == AF_INET6) {
-                if (!sched->supports_ipv6) {
-                        ret = -EAFNOSUPPORT;
-                        goto out;
-                }
-                if ((u->netmask < 1) || (u->netmask > 128)) {
-                        ret = -EINVAL;
-                        goto out;
-                }
+        if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
+                ret = -EINVAL;
+                goto out;
         }
 #endif
 
@@ -1557,7 +1545,7 @@ static struct ctl_table vs_vars[] = {
                 .data           = &sysctl_ip_vs_amemthresh,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
 #ifdef CONFIG_IP_VS_DEBUG
         {
@@ -1565,7 +1553,7 @@ static struct ctl_table vs_vars[] = {
                 .data           = &sysctl_ip_vs_debug_level,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
 #endif
         {
@@ -1573,28 +1561,28 @@ static struct ctl_table vs_vars[] = {
                 .data           = &sysctl_ip_vs_am_droprate,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "drop_entry",
                 .data           = &sysctl_ip_vs_drop_entry,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_do_defense_mode,
+                .proc_handler   = proc_do_defense_mode,
         },
         {
                 .procname       = "drop_packet",
                 .data           = &sysctl_ip_vs_drop_packet,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_do_defense_mode,
+                .proc_handler   = proc_do_defense_mode,
         },
         {
                 .procname       = "secure_tcp",
                 .data           = &sysctl_ip_vs_secure_tcp,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_do_defense_mode,
+                .proc_handler   = proc_do_defense_mode,
         },
 #if 0
         {
@@ -1602,84 +1590,84 @@ static struct ctl_table vs_vars[] = {
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_synsent",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_synrecv",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_finwait",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_timewait",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_close",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_closewait",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_lastack",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_listen",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_synack",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_udp",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "timeout_icmp",
                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
 #endif
         {
@@ -1687,35 +1675,35 @@ static struct ctl_table vs_vars[] = {
                 .data           = &sysctl_ip_vs_cache_bypass,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "expire_nodest_conn",
                 .data           = &sysctl_ip_vs_expire_nodest_conn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "expire_quiescent_template",
                 .data           = &sysctl_ip_vs_expire_quiescent_template,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "sync_threshold",
                 .data           = &sysctl_ip_vs_sync_threshold,
                 .maxlen         = sizeof(sysctl_ip_vs_sync_threshold),
                 .mode           = 0644,
-                .proc_handler   = &proc_do_sync_threshold,
+                .proc_handler   = proc_do_sync_threshold,
         },
         {
                 .procname       = "nat_icmp_send",
                 .data           = &sysctl_ip_vs_nat_icmp_send,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         { .ctl_name = 0 }
 };
@@ -1867,9 +1855,9 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                 if (iter->table == ip_vs_svc_table) {
 #ifdef CONFIG_IP_VS_IPV6
                         if (svc->af == AF_INET6)
-                                seq_printf(seq, "%s  [" NIP6_FMT "]:%04X %s ",
+                                seq_printf(seq, "%s  [%pI6]:%04X %s ",
                                            ip_vs_proto_name(svc->protocol),
-                                           NIP6(svc->addr.in6),
+                                           &svc->addr.in6,
                                            ntohs(svc->port),
                                            svc->scheduler->name);
                         else
@@ -1895,9 +1883,9 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
 #ifdef CONFIG_IP_VS_IPV6
                         if (dest->af == AF_INET6)
                                 seq_printf(seq,
-                                           "  -> [" NIP6_FMT "]:%04X"
+                                           "  -> [%pI6]:%04X"
                                            "      %-7s %-6d %-10d %-10d\n",
-                                           NIP6(dest->addr.in6),
+                                           &dest->addr.in6,
                                            ntohs(dest->port),
                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
                                            atomic_read(&dest->weight),
@@ -2141,8 +2129,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 
         /* Check for valid protocol: TCP or UDP, even for fwmark!=0 */
         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP) {
-                IP_VS_ERR("set_ctl: invalid protocol: %d %d.%d.%d.%d:%d %s\n",
-                          usvc.protocol, NIPQUAD(usvc.addr.ip),
+                IP_VS_ERR("set_ctl: invalid protocol: %d %pI4:%d %s\n",
+                          usvc.protocol, &usvc.addr.ip,
                           ntohs(usvc.port), usvc.sched_name);
                 ret = -EFAULT;
                 goto out_unlock;
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index a16943fd72f1..a9dac74bb13f 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -64,9 +64,16 @@ struct ip_vs_dh_bucket {
 /*
  *      Returns hash value for IPVS DH entry
  */
-static inline unsigned ip_vs_dh_hashkey(__be32 addr)
+static inline unsigned ip_vs_dh_hashkey(int af, const union nf_inet_addr *addr)
 {
-        return (ntohl(addr)*2654435761UL) & IP_VS_DH_TAB_MASK;
+        __be32 addr_fold = addr->ip;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                addr_fold = addr->ip6[0]^addr->ip6[1]^
+                            addr->ip6[2]^addr->ip6[3];
+#endif
+        return (ntohl(addr_fold)*2654435761UL) & IP_VS_DH_TAB_MASK;
 }
 
 
@@ -74,9 +81,10 @@ static inline unsigned ip_vs_dh_hashkey(__be32 addr)
  *      Get ip_vs_dest associated with supplied parameters.
  */
 static inline struct ip_vs_dest *
-ip_vs_dh_get(struct ip_vs_dh_bucket *tbl, __be32 addr)
+ip_vs_dh_get(int af, struct ip_vs_dh_bucket *tbl,
+             const union nf_inet_addr *addr)
 {
-        return (tbl[ip_vs_dh_hashkey(addr)]).dest;
+        return (tbl[ip_vs_dh_hashkey(af, addr)]).dest;
 }
 
 
@@ -202,12 +210,14 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 {
         struct ip_vs_dest *dest;
         struct ip_vs_dh_bucket *tbl;
-        struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_iphdr iph;
+
+        ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 
         IP_VS_DBG(6, "ip_vs_dh_schedule(): Scheduling...\n");
 
         tbl = (struct ip_vs_dh_bucket *)svc->sched_data;
-        dest = ip_vs_dh_get(tbl, iph->daddr);
+        dest = ip_vs_dh_get(svc->af, tbl, &iph.daddr);
         if (!dest
             || !(dest->flags & IP_VS_DEST_F_AVAILABLE)
             || atomic_read(&dest->weight) <= 0
@@ -215,11 +225,10 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 return NULL;
         }
 
-        IP_VS_DBG(6, "DH: destination IP address %u.%u.%u.%u "
-                  "--> server %u.%u.%u.%u:%d\n",
-                  NIPQUAD(iph->daddr),
-                  NIPQUAD(dest->addr.ip),
-                  ntohs(dest->port));
+        IP_VS_DBG_BUF(6, "DH: destination IP address %s --> server %s:%d\n",
+                      IP_VS_DBG_ADDR(svc->af, &iph.daddr),
+                      IP_VS_DBG_ADDR(svc->af, &dest->addr),
+                      ntohs(dest->port));
 
         return dest;
 }
@@ -234,9 +243,6 @@ static struct ip_vs_scheduler ip_vs_dh_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_dh_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        0,
-#endif
         .init_service =         ip_vs_dh_init_svc,
         .done_service =         ip_vs_dh_done_svc,
         .update_service =       ip_vs_dh_update_svc,
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 2e7dbd8b73a4..428edbf481cc 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -178,10 +178,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                            &start, &end) != 1)
                         return 1;
 
-                IP_VS_DBG(7, "PASV response (%u.%u.%u.%u:%d) -> "
-                          "%u.%u.%u.%u:%d detected\n",
-                          NIPQUAD(from.ip), ntohs(port),
-                          NIPQUAD(cp->caddr.ip), 0);
+                IP_VS_DBG(7, "PASV response (%pI4:%d) -> %pI4:%d detected\n",
+                          &from.ip, ntohs(port), &cp->caddr.ip, 0);
 
                 /*
                  * Now update or create an connection entry for it
@@ -312,8 +310,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                    &start, &end) != 1)
                 return 1;
 
-        IP_VS_DBG(7, "PORT %u.%u.%u.%u:%d detected\n",
-                  NIPQUAD(to.ip), ntohs(port));
+        IP_VS_DBG(7, "PORT %pI4:%d detected\n", &to.ip, ntohs(port));
 
         /* Passive mode off */
         cp->app_data = NULL;
@@ -321,9 +318,9 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         /*
          * Now update or create a connection entry for it
          */
-        IP_VS_DBG(7, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
+        IP_VS_DBG(7, "protocol %s %pI4:%d %pI4:%d\n",
                   ip_vs_proto_name(iph->protocol),
-                  NIPQUAD(to.ip), ntohs(port), NIPQUAD(cp->vaddr.ip), 0);
+                  &to.ip, ntohs(port), &cp->vaddr.ip, 0);
 
         n_cp = ip_vs_conn_in_get(AF_INET, iph->protocol,
                                  &to, port,
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 6ecef3518cac..9394f539966a 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -86,7 +86,8 @@ static int sysctl_ip_vs_lblc_expiration = 24*60*60*HZ;
  */
 struct ip_vs_lblc_entry {
         struct list_head        list;
-        __be32                  addr;           /* destination IP address */
+        int                     af;             /* address family */
+        union nf_inet_addr      addr;           /* destination IP address */
         struct ip_vs_dest       *dest;          /* real server (cache) */
         unsigned long           lastuse;        /* last used time */
 };
@@ -115,7 +116,7 @@ static ctl_table vs_vars_table[] = {
                 .data           = &sysctl_ip_vs_lblc_expiration,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         { .ctl_name = 0 }
 };
@@ -137,9 +138,17 @@ static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
 /*
  *      Returns hash value for IPVS LBLC entry
  */
-static inline unsigned ip_vs_lblc_hashkey(__be32 addr)
+static inline unsigned
+ip_vs_lblc_hashkey(int af, const union nf_inet_addr *addr)
 {
-        return (ntohl(addr)*2654435761UL) & IP_VS_LBLC_TAB_MASK;
+        __be32 addr_fold = addr->ip;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                addr_fold = addr->ip6[0]^addr->ip6[1]^
+                            addr->ip6[2]^addr->ip6[3];
+#endif
+        return (ntohl(addr_fold)*2654435761UL) & IP_VS_LBLC_TAB_MASK;
 }
 
 
@@ -150,7 +159,7 @@ static inline unsigned ip_vs_lblc_hashkey(__be32 addr)
 static void
 ip_vs_lblc_hash(struct ip_vs_lblc_table *tbl, struct ip_vs_lblc_entry *en)
 {
-        unsigned hash = ip_vs_lblc_hashkey(en->addr);
+        unsigned hash = ip_vs_lblc_hashkey(en->af, &en->addr);
 
         list_add(&en->list, &tbl->bucket[hash]);
         atomic_inc(&tbl->entries);
@@ -162,13 +171,14 @@ ip_vs_lblc_hash(struct ip_vs_lblc_table *tbl, struct ip_vs_lblc_entry *en)
  *  lock
  */
 static inline struct ip_vs_lblc_entry *
-ip_vs_lblc_get(struct ip_vs_lblc_table *tbl, __be32 addr)
+ip_vs_lblc_get(int af, struct ip_vs_lblc_table *tbl,
+               const union nf_inet_addr *addr)
 {
-        unsigned hash = ip_vs_lblc_hashkey(addr);
+        unsigned hash = ip_vs_lblc_hashkey(af, addr);
         struct ip_vs_lblc_entry *en;
 
         list_for_each_entry(en, &tbl->bucket[hash], list)
-                if (en->addr == addr)
+                if (ip_vs_addr_equal(af, &en->addr, addr))
                         return en;
 
         return NULL;
@@ -180,12 +190,12 @@ ip_vs_lblc_get(struct ip_vs_lblc_table *tbl, __be32 addr)
  * address to a server. Called under write lock.
  */
 static inline struct ip_vs_lblc_entry *
-ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, __be32 daddr,
+ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, const union nf_inet_addr *daddr,
                struct ip_vs_dest *dest)
 {
         struct ip_vs_lblc_entry *en;
 
-        en = ip_vs_lblc_get(tbl, daddr);
+        en = ip_vs_lblc_get(dest->af, tbl, daddr);
         if (!en) {
                 en = kmalloc(sizeof(*en), GFP_ATOMIC);
                 if (!en) {
@@ -193,7 +203,8 @@ ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, __be32 daddr,
                         return NULL;
                 }
 
-                en->addr = daddr;
+                en->af = dest->af;
+                ip_vs_addr_copy(dest->af, &en->addr, daddr);
                 en->lastuse = jiffies;
 
                 atomic_inc(&dest->refcnt);
@@ -369,7 +380,7 @@ static int ip_vs_lblc_done_svc(struct ip_vs_service *svc)
 
 
 static inline struct ip_vs_dest *
-__ip_vs_lblc_schedule(struct ip_vs_service *svc, struct iphdr *iph)
+__ip_vs_lblc_schedule(struct ip_vs_service *svc)
 {
         struct ip_vs_dest *dest, *least;
         int loh, doh;
@@ -420,12 +431,13 @@ __ip_vs_lblc_schedule(struct ip_vs_service *svc, struct iphdr *iph)
                 }
         }
 
-        IP_VS_DBG(6, "LBLC: server %d.%d.%d.%d:%d "
-                  "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr.ip), ntohs(least->port),
-                  atomic_read(&least->activeconns),
-                  atomic_read(&least->refcnt),
-                  atomic_read(&least->weight), loh);
+        IP_VS_DBG_BUF(6, "LBLC: server %s:%d "
+                      "activeconns %d refcnt %d weight %d overhead %d\n",
+                      IP_VS_DBG_ADDR(least->af, &least->addr),
+                      ntohs(least->port),
+                      atomic_read(&least->activeconns),
+                      atomic_read(&least->refcnt),
+                      atomic_read(&least->weight), loh);
 
         return least;
 }
@@ -459,15 +471,17 @@ static struct ip_vs_dest *
 ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 {
         struct ip_vs_lblc_table *tbl = svc->sched_data;
-        struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_iphdr iph;
         struct ip_vs_dest *dest = NULL;
         struct ip_vs_lblc_entry *en;
 
+        ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
+
         IP_VS_DBG(6, "ip_vs_lblc_schedule(): Scheduling...\n");
 
         /* First look in our cache */
         read_lock(&svc->sched_lock);
-        en = ip_vs_lblc_get(tbl, iph->daddr);
+        en = ip_vs_lblc_get(svc->af, tbl, &iph.daddr);
         if (en) {
                 /* We only hold a read lock, but this is atomic */
                 en->lastuse = jiffies;
@@ -491,7 +505,7 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 goto out;
 
         /* No cache entry or it is invalid, time to schedule */
-        dest = __ip_vs_lblc_schedule(svc, iph);
+        dest = __ip_vs_lblc_schedule(svc);
         if (!dest) {
                 IP_VS_DBG(1, "no destination available\n");
                 return NULL;
@@ -499,15 +513,13 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 
         /* If we fail to create a cache entry, we'll just use the valid dest */
         write_lock(&svc->sched_lock);
-        ip_vs_lblc_new(tbl, iph->daddr, dest);
+        ip_vs_lblc_new(tbl, &iph.daddr, dest);
         write_unlock(&svc->sched_lock);
 
 out:
-        IP_VS_DBG(6, "LBLC: destination IP address %u.%u.%u.%u "
-                  "--> server %u.%u.%u.%u:%d\n",
-                  NIPQUAD(iph->daddr),
-                  NIPQUAD(dest->addr.ip),
-                  ntohs(dest->port));
+        IP_VS_DBG_BUF(6, "LBLC: destination IP address %s --> server %s:%d\n",
+                      IP_VS_DBG_ADDR(svc->af, &iph.daddr),
+                      IP_VS_DBG_ADDR(svc->af, &dest->addr), ntohs(dest->port));
 
         return dest;
 }
@@ -522,9 +534,6 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_lblc_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        0,
-#endif
         .init_service =         ip_vs_lblc_init_svc,
         .done_service =         ip_vs_lblc_done_svc,
         .schedule =             ip_vs_lblc_schedule,
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 1f75ea83bcf8..92dc76a6842c 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -202,12 +202,13 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
                 }
         }
 
-        IP_VS_DBG(6, "ip_vs_dest_set_min: server %d.%d.%d.%d:%d "
-                  "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr.ip), ntohs(least->port),
-                  atomic_read(&least->activeconns),
-                  atomic_read(&least->refcnt),
-                  atomic_read(&least->weight), loh);
+        IP_VS_DBG_BUF(6, "ip_vs_dest_set_min: server %s:%d "
+                      "activeconns %d refcnt %d weight %d overhead %d\n",
+                      IP_VS_DBG_ADDR(least->af, &least->addr),
+                      ntohs(least->port),
+                      atomic_read(&least->activeconns),
+                      atomic_read(&least->refcnt),
+                      atomic_read(&least->weight), loh);
         return least;
 }
 
@@ -248,12 +249,12 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
                 }
         }
 
-        IP_VS_DBG(6, "ip_vs_dest_set_max: server %d.%d.%d.%d:%d "
-                  "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(most->addr.ip), ntohs(most->port),
-                  atomic_read(&most->activeconns),
-                  atomic_read(&most->refcnt),
-                  atomic_read(&most->weight), moh);
+        IP_VS_DBG_BUF(6, "ip_vs_dest_set_max: server %s:%d "
+                      "activeconns %d refcnt %d weight %d overhead %d\n",
+                      IP_VS_DBG_ADDR(most->af, &most->addr), ntohs(most->port),
+                      atomic_read(&most->activeconns),
+                      atomic_read(&most->refcnt),
+                      atomic_read(&most->weight), moh);
         return most;
 }
 
@@ -264,7 +265,8 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
  */
 struct ip_vs_lblcr_entry {
         struct list_head        list;
-        __be32                   addr;           /* destination IP address */
+        int                     af;             /* address family */
+        union nf_inet_addr      addr;           /* destination IP address */
         struct ip_vs_dest_set   set;            /* destination server set */
         unsigned long           lastuse;        /* last used time */
 };
@@ -293,7 +295,7 @@ static ctl_table vs_vars_table[] = {
                 .data           = &sysctl_ip_vs_lblcr_expiration,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         { .ctl_name = 0 }
 };
@@ -311,9 +313,17 @@ static inline void ip_vs_lblcr_free(struct ip_vs_lblcr_entry *en)
 /*
  *      Returns hash value for IPVS LBLCR entry
  */
-static inline unsigned ip_vs_lblcr_hashkey(__be32 addr)
+static inline unsigned
+ip_vs_lblcr_hashkey(int af, const union nf_inet_addr *addr)
 {
-        return (ntohl(addr)*2654435761UL) & IP_VS_LBLCR_TAB_MASK;
+        __be32 addr_fold = addr->ip;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                addr_fold = addr->ip6[0]^addr->ip6[1]^
+                            addr->ip6[2]^addr->ip6[3];
+#endif
+        return (ntohl(addr_fold)*2654435761UL) & IP_VS_LBLCR_TAB_MASK;
 }
 
 
@@ -324,7 +334,7 @@ static inline unsigned ip_vs_lblcr_hashkey(__be32 addr)
 static void
 ip_vs_lblcr_hash(struct ip_vs_lblcr_table *tbl, struct ip_vs_lblcr_entry *en)
 {
-        unsigned hash = ip_vs_lblcr_hashkey(en->addr);
+        unsigned hash = ip_vs_lblcr_hashkey(en->af, &en->addr);
 
         list_add(&en->list, &tbl->bucket[hash]);
         atomic_inc(&tbl->entries);
@@ -336,13 +346,14 @@ ip_vs_lblcr_hash(struct ip_vs_lblcr_table *tbl, struct ip_vs_lblcr_entry *en)
  *  read lock.
  */
 static inline struct ip_vs_lblcr_entry *
-ip_vs_lblcr_get(struct ip_vs_lblcr_table *tbl, __be32 addr)
+ip_vs_lblcr_get(int af, struct ip_vs_lblcr_table *tbl,
+                const union nf_inet_addr *addr)
 {
-        unsigned hash = ip_vs_lblcr_hashkey(addr);
+        unsigned hash = ip_vs_lblcr_hashkey(af, addr);
         struct ip_vs_lblcr_entry *en;
 
         list_for_each_entry(en, &tbl->bucket[hash], list)
-                if (en->addr == addr)
+                if (ip_vs_addr_equal(af, &en->addr, addr))
                         return en;
 
         return NULL;
@@ -354,12 +365,12 @@ ip_vs_lblcr_get(struct ip_vs_lblcr_table *tbl, __be32 addr)
  * IP address to a server. Called under write lock.
  */
 static inline struct ip_vs_lblcr_entry *
-ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl,  __be32 daddr,
+ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl, const union nf_inet_addr *daddr,
                 struct ip_vs_dest *dest)
 {
         struct ip_vs_lblcr_entry *en;
 
-        en = ip_vs_lblcr_get(tbl, daddr);
+        en = ip_vs_lblcr_get(dest->af, tbl, daddr);
         if (!en) {
                 en = kmalloc(sizeof(*en), GFP_ATOMIC);
                 if (!en) {
@@ -367,7 +378,8 @@ ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl,  __be32 daddr,
                         return NULL;
                 }
 
-                en->addr = daddr;
+                en->af = dest->af;
+                ip_vs_addr_copy(dest->af, &en->addr, daddr);
                 en->lastuse = jiffies;
 
                 /* initilize its dest set */
@@ -544,7 +556,7 @@ static int ip_vs_lblcr_done_svc(struct ip_vs_service *svc)
 
 
 static inline struct ip_vs_dest *
-__ip_vs_lblcr_schedule(struct ip_vs_service *svc, struct iphdr *iph)
+__ip_vs_lblcr_schedule(struct ip_vs_service *svc)
 {
         struct ip_vs_dest *dest, *least;
         int loh, doh;
@@ -596,12 +608,13 @@ __ip_vs_lblcr_schedule(struct ip_vs_service *svc, struct iphdr *iph)
                 }
         }
 
-        IP_VS_DBG(6, "LBLCR: server %d.%d.%d.%d:%d "
-                  "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr.ip), ntohs(least->port),
-                  atomic_read(&least->activeconns),
-                  atomic_read(&least->refcnt),
-                  atomic_read(&least->weight), loh);
+        IP_VS_DBG_BUF(6, "LBLCR: server %s:%d "
+                      "activeconns %d refcnt %d weight %d overhead %d\n",
+                      IP_VS_DBG_ADDR(least->af, &least->addr),
+                      ntohs(least->port),
+                      atomic_read(&least->activeconns),
+                      atomic_read(&least->refcnt),
+                      atomic_read(&least->weight), loh);
 
         return least;
 }
@@ -635,15 +648,17 @@ static struct ip_vs_dest *
 ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 {
         struct ip_vs_lblcr_table *tbl = svc->sched_data;
-        struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_iphdr iph;
         struct ip_vs_dest *dest = NULL;
         struct ip_vs_lblcr_entry *en;
 
+        ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
+
         IP_VS_DBG(6, "ip_vs_lblcr_schedule(): Scheduling...\n");
 
         /* First look in our cache */
         read_lock(&svc->sched_lock);
-        en = ip_vs_lblcr_get(tbl, iph->daddr);
+        en = ip_vs_lblcr_get(svc->af, tbl, &iph.daddr);
         if (en) {
                 /* We only hold a read lock, but this is atomic */
                 en->lastuse = jiffies;
@@ -673,7 +688,7 @@ ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 }
 
                 /* The cache entry is invalid, time to schedule */
-                dest = __ip_vs_lblcr_schedule(svc, iph);
+                dest = __ip_vs_lblcr_schedule(svc);
                 if (!dest) {
                         IP_VS_DBG(1, "no destination available\n");
                         read_unlock(&svc->sched_lock);
@@ -691,7 +706,7 @@ ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 goto out;
 
         /* No cache entry, time to schedule */
-        dest = __ip_vs_lblcr_schedule(svc, iph);
+        dest = __ip_vs_lblcr_schedule(svc);
         if (!dest) {
                 IP_VS_DBG(1, "no destination available\n");
                 return NULL;
@@ -699,15 +714,13 @@ ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 
         /* If we fail to create a cache entry, we'll just use the valid dest */
         write_lock(&svc->sched_lock);
-        ip_vs_lblcr_new(tbl, iph->daddr, dest);
+        ip_vs_lblcr_new(tbl, &iph.daddr, dest);
         write_unlock(&svc->sched_lock);
 
 out:
-        IP_VS_DBG(6, "LBLCR: destination IP address %u.%u.%u.%u "
-                  "--> server %u.%u.%u.%u:%d\n",
-                  NIPQUAD(iph->daddr),
-                  NIPQUAD(dest->addr.ip),
-                  ntohs(dest->port));
+        IP_VS_DBG_BUF(6, "LBLCR: destination IP address %s --> server %s:%d\n",
+                      IP_VS_DBG_ADDR(svc->af, &iph.daddr),
+                      IP_VS_DBG_ADDR(svc->af, &dest->addr), ntohs(dest->port));
 
         return dest;
 }
@@ -722,9 +735,6 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_lblcr_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        0,
-#endif
         .init_service =         ip_vs_lblcr_init_svc,
         .done_service =         ip_vs_lblcr_done_svc,
         .schedule =             ip_vs_lblcr_schedule,
diff --git a/net/netfilter/ipvs/ip_vs_lc.c b/net/netfilter/ipvs/ip_vs_lc.c
index b69f808ac461..51912cab777b 100644
--- a/net/netfilter/ipvs/ip_vs_lc.c
+++ b/net/netfilter/ipvs/ip_vs_lc.c
@@ -81,9 +81,6 @@ static struct ip_vs_scheduler ip_vs_lc_scheduler = {
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_lc_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        1,
-#endif
         .schedule =             ip_vs_lc_schedule,
 };
 
diff --git a/net/netfilter/ipvs/ip_vs_nq.c b/net/netfilter/ipvs/ip_vs_nq.c
index 9a2d8033f08f..6758ad2ceaaf 100644
--- a/net/netfilter/ipvs/ip_vs_nq.c
+++ b/net/netfilter/ipvs/ip_vs_nq.c
@@ -116,9 +116,6 @@ static struct ip_vs_scheduler ip_vs_nq_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_nq_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        1,
-#endif
         .schedule =             ip_vs_nq_schedule,
 };
 
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c
index 0791f9e08feb..a01520e3d6b8 100644
--- a/net/netfilter/ipvs/ip_vs_proto.c
+++ b/net/netfilter/ipvs/ip_vs_proto.c
@@ -164,26 +164,21 @@ ip_vs_tcpudp_debug_packet_v4(struct ip_vs_protocol *pp,
         if (ih == NULL)
                 sprintf(buf, "%s TRUNCATED", pp->name);
         else if (ih->frag_off & htons(IP_OFFSET))
-                sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u frag",
-                        pp->name, NIPQUAD(ih->saddr),
-                        NIPQUAD(ih->daddr));
+                sprintf(buf, "%s %pI4->%pI4 frag",
+                        pp->name, &ih->saddr, &ih->daddr);
         else {
                 __be16 _ports[2], *pptr
 ;
                 pptr = skb_header_pointer(skb, offset + ih->ihl*4,
                                           sizeof(_ports), _ports);
                 if (pptr == NULL)
-                        sprintf(buf, "%s TRUNCATED %u.%u.%u.%u->%u.%u.%u.%u",
-                                pp->name,
-                                NIPQUAD(ih->saddr),
-                                NIPQUAD(ih->daddr));
+                        sprintf(buf, "%s TRUNCATED %pI4->%pI4",
+                                pp->name, &ih->saddr, &ih->daddr);
                 else
-                        sprintf(buf, "%s %u.%u.%u.%u:%u->%u.%u.%u.%u:%u",
+                        sprintf(buf, "%s %pI4:%u->%pI4:%u",
                                 pp->name,
-                                NIPQUAD(ih->saddr),
-                                ntohs(pptr[0]),
-                                NIPQUAD(ih->daddr),
-                                ntohs(pptr[1]));
+                                &ih->saddr, ntohs(pptr[0]),
+                                &ih->daddr, ntohs(pptr[1]));
         }
 
         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
@@ -203,26 +198,21 @@ ip_vs_tcpudp_debug_packet_v6(struct ip_vs_protocol *pp,
         if (ih == NULL)
                 sprintf(buf, "%s TRUNCATED", pp->name);
         else if (ih->nexthdr == IPPROTO_FRAGMENT)
-                sprintf(buf, "%s " NIP6_FMT "->" NIP6_FMT " frag",
-                        pp->name, NIP6(ih->saddr),
-                        NIP6(ih->daddr));
+                sprintf(buf, "%s %pI6->%pI6 frag",
+                        pp->name, &ih->saddr, &ih->daddr);
         else {
                 __be16 _ports[2], *pptr;
 
                 pptr = skb_header_pointer(skb, offset + sizeof(struct ipv6hdr),
                                           sizeof(_ports), _ports);
                 if (pptr == NULL)
-                        sprintf(buf, "%s TRUNCATED " NIP6_FMT "->" NIP6_FMT,
-                                pp->name,
-                                NIP6(ih->saddr),
-                                NIP6(ih->daddr));
+                        sprintf(buf, "%s TRUNCATED %pI6->%pI6",
+                                pp->name, &ih->saddr, &ih->daddr);
                 else
-                        sprintf(buf, "%s " NIP6_FMT ":%u->" NIP6_FMT ":%u",
+                        sprintf(buf, "%s %pI6:%u->%pI6:%u",
                                 pp->name,
-                                NIP6(ih->saddr),
-                                ntohs(pptr[0]),
-                                NIP6(ih->daddr),
-                                ntohs(pptr[1]));
+                                &ih->saddr, ntohs(pptr[0]),
+                                &ih->daddr, ntohs(pptr[1]));
         }
 
         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
diff --git a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
index 80ab0c8e5b4a..79f56c1e7c19 100644
--- a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
@@ -135,9 +135,8 @@ ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
         if (ih == NULL)
                 sprintf(buf, "%s TRUNCATED", pp->name);
         else
-                sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
-                        pp->name, NIPQUAD(ih->saddr),
-                        NIPQUAD(ih->daddr));
+                sprintf(buf, "%s %pI4->%pI4",
+                        pp->name, &ih->saddr, &ih->daddr);
 
         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
 }
@@ -154,9 +153,8 @@ ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
         if (ih == NULL)
                 sprintf(buf, "%s TRUNCATED", pp->name);
         else
-                sprintf(buf, "%s " NIP6_FMT "->" NIP6_FMT,
-                        pp->name, NIP6(ih->saddr),
-                        NIP6(ih->daddr));
+                sprintf(buf, "%s %pI6->%pI6",
+                        pp->name, &ih->saddr, &ih->daddr);
 
         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
 }
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index dd4566ea2bff..8cba41802850 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -192,8 +192,8 @@ tcp_snat_handler(struct sk_buff *skb,
         /* Adjust TCP checksums */
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 tcp_partial_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
-                                        htonl(oldlen),
-                                        htonl(skb->len - tcphoff));
+                                        htons(oldlen),
+                                        htons(skb->len - tcphoff));
         } else if (!cp->app) {
                 /* Only port and addr are changed, do fast csum update */
                 tcp_fast_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
@@ -267,8 +267,8 @@ tcp_dnat_handler(struct sk_buff *skb,
          */
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 tcp_partial_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
-                                        htonl(oldlen),
-                                        htonl(skb->len - tcphoff));
+                                        htons(oldlen),
+                                        htons(skb->len - tcphoff));
         } else if (!cp->app) {
                 /* Only port and addr are changed, do fast csum update */
                 tcp_fast_csum_update(cp->af, tcph, &cp->vaddr, &cp->daddr,
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index 6eb6039d6343..d2930a71084b 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -203,8 +203,8 @@ udp_snat_handler(struct sk_buff *skb,
          */
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
-                                        htonl(oldlen),
-                                        htonl(skb->len - udphoff));
+                                        htons(oldlen),
+                                        htons(skb->len - udphoff));
         } else if (!cp->app && (udph->check != 0)) {
                 /* Only port and addr are changed, do fast csum update */
                 udp_fast_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
@@ -279,8 +279,8 @@ udp_dnat_handler(struct sk_buff *skb,
          */
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
-                                        htonl(oldlen),
-                                        htonl(skb->len - udphoff));
+                                        htons(oldlen),
+                                        htons(skb->len - udphoff));
         } else if (!cp->app && (udph->check != 0)) {
                 /* Only port and addr are changed, do fast csum update */
                 udp_fast_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
diff --git a/net/netfilter/ipvs/ip_vs_rr.c b/net/netfilter/ipvs/ip_vs_rr.c
index a22195f68ac4..8fb51c169eb8 100644
--- a/net/netfilter/ipvs/ip_vs_rr.c
+++ b/net/netfilter/ipvs/ip_vs_rr.c
@@ -89,9 +89,6 @@ static struct ip_vs_scheduler ip_vs_rr_scheduler = {
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_rr_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        1,
-#endif
         .init_service =         ip_vs_rr_init_svc,
         .update_service =       ip_vs_rr_update_svc,
         .schedule =             ip_vs_rr_schedule,
diff --git a/net/netfilter/ipvs/ip_vs_sed.c b/net/netfilter/ipvs/ip_vs_sed.c
index 7d2f22f04b83..691a6a0086e1 100644
--- a/net/netfilter/ipvs/ip_vs_sed.c
+++ b/net/netfilter/ipvs/ip_vs_sed.c
@@ -118,9 +118,6 @@ static struct ip_vs_scheduler ip_vs_sed_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_sed_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        1,
-#endif
         .schedule =             ip_vs_sed_schedule,
 };
 
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 1d96de27fefd..0e53955ef139 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -61,9 +61,16 @@ struct ip_vs_sh_bucket {
 /*
  *      Returns hash value for IPVS SH entry
  */
-static inline unsigned ip_vs_sh_hashkey(__be32 addr)
+static inline unsigned ip_vs_sh_hashkey(int af, const union nf_inet_addr *addr)
 {
-        return (ntohl(addr)*2654435761UL) & IP_VS_SH_TAB_MASK;
+        __be32 addr_fold = addr->ip;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                addr_fold = addr->ip6[0]^addr->ip6[1]^
+                            addr->ip6[2]^addr->ip6[3];
+#endif
+        return (ntohl(addr_fold)*2654435761UL) & IP_VS_SH_TAB_MASK;
 }
 
 
@@ -71,9 +78,10 @@ static inline unsigned ip_vs_sh_hashkey(__be32 addr)
  *      Get ip_vs_dest associated with supplied parameters.
  */
 static inline struct ip_vs_dest *
-ip_vs_sh_get(struct ip_vs_sh_bucket *tbl, __be32 addr)
+ip_vs_sh_get(int af, struct ip_vs_sh_bucket *tbl,
+             const union nf_inet_addr *addr)
 {
-        return (tbl[ip_vs_sh_hashkey(addr)]).dest;
+        return (tbl[ip_vs_sh_hashkey(af, addr)]).dest;
 }
 
 
@@ -199,12 +207,14 @@ ip_vs_sh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 {
         struct ip_vs_dest *dest;
         struct ip_vs_sh_bucket *tbl;
-        struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_iphdr iph;
+
+        ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 
         IP_VS_DBG(6, "ip_vs_sh_schedule(): Scheduling...\n");
 
         tbl = (struct ip_vs_sh_bucket *)svc->sched_data;
-        dest = ip_vs_sh_get(tbl, iph->saddr);
+        dest = ip_vs_sh_get(svc->af, tbl, &iph.saddr);
         if (!dest
             || !(dest->flags & IP_VS_DEST_F_AVAILABLE)
             || atomic_read(&dest->weight) <= 0
@@ -212,11 +222,10 @@ ip_vs_sh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 return NULL;
         }
 
-        IP_VS_DBG(6, "SH: source IP address %u.%u.%u.%u "
-                  "--> server %u.%u.%u.%u:%d\n",
-                  NIPQUAD(iph->saddr),
-                  NIPQUAD(dest->addr.ip),
-                  ntohs(dest->port));
+        IP_VS_DBG_BUF(6, "SH: source IP address %s --> server %s:%d\n",
+                      IP_VS_DBG_ADDR(svc->af, &iph.saddr),
+                      IP_VS_DBG_ADDR(svc->af, &dest->addr),
+                      ntohs(dest->port));
 
         return dest;
 }
@@ -231,9 +240,6 @@ static struct ip_vs_scheduler ip_vs_sh_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list  =              LIST_HEAD_INIT(ip_vs_sh_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        0,
-#endif
         .init_service =         ip_vs_sh_init_svc,
         .done_service =         ip_vs_sh_done_svc,
         .update_service =       ip_vs_sh_update_svc,
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index de5e7e118eed..6be5d4efa51b 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -580,8 +580,8 @@ static int bind_mcastif_addr(struct socket *sock, char *ifname)
                 IP_VS_ERR("You probably need to specify IP address on "
                           "multicast interface.\n");
 
-        IP_VS_DBG(7, "binding socket with (%s) %u.%u.%u.%u\n",
-                  ifname, NIPQUAD(addr));
+        IP_VS_DBG(7, "binding socket with (%s) %pI4\n",
+                  ifname, &addr);
 
         /* Now bind the socket with the address of multicast interface */
         sin.sin_family       = AF_INET;
diff --git a/net/netfilter/ipvs/ip_vs_wlc.c b/net/netfilter/ipvs/ip_vs_wlc.c
index 8c596e712599..57b452bbb4ea 100644
--- a/net/netfilter/ipvs/ip_vs_wlc.c
+++ b/net/netfilter/ipvs/ip_vs_wlc.c
@@ -106,9 +106,6 @@ static struct ip_vs_scheduler ip_vs_wlc_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_wlc_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        1,
-#endif
         .schedule =             ip_vs_wlc_schedule,
 };
 
diff --git a/net/netfilter/ipvs/ip_vs_wrr.c b/net/netfilter/ipvs/ip_vs_wrr.c
index 7ea92fed50bf..2f618dc29c5b 100644
--- a/net/netfilter/ipvs/ip_vs_wrr.c
+++ b/net/netfilter/ipvs/ip_vs_wrr.c
@@ -213,9 +213,6 @@ static struct ip_vs_scheduler ip_vs_wrr_scheduler = {
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_wrr_scheduler.n_list),
-#ifdef CONFIG_IP_VS_IPV6
-        .supports_ipv6 =        1,
-#endif
         .init_service =         ip_vs_wrr_init_svc,
         .done_service =         ip_vs_wrr_done_svc,
         .update_service =       ip_vs_wrr_update_svc,
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index e90d52f199bc..425ab144f15d 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -82,14 +82,13 @@ __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
 
                         if (ip_route_output_key(&init_net, &rt, &fl)) {
                                 spin_unlock(&dest->dst_lock);
-                                IP_VS_DBG_RL("ip_route_output error, "
-                                             "dest: %u.%u.%u.%u\n",
-                                             NIPQUAD(dest->addr.ip));
+                                IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
+                                             &dest->addr.ip);
                                 return NULL;
                         }
                         __ip_vs_dst_set(dest, rtos, dst_clone(&rt->u.dst));
-                        IP_VS_DBG(10, "new dst %u.%u.%u.%u, refcnt=%d, rtos=%X\n",
-                                  NIPQUAD(dest->addr.ip),
+                        IP_VS_DBG(10, "new dst %pI4, refcnt=%d, rtos=%X\n",
+                                  &dest->addr.ip,
                                   atomic_read(&rt->u.dst.__refcnt), rtos);
                 }
                 spin_unlock(&dest->dst_lock);
@@ -104,8 +103,8 @@ __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
                 };
 
                 if (ip_route_output_key(&init_net, &rt, &fl)) {
-                        IP_VS_DBG_RL("ip_route_output error, dest: "
-                                     "%u.%u.%u.%u\n", NIPQUAD(cp->daddr.ip));
+                        IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
+                                     &cp->daddr.ip);
                         return NULL;
                 }
         }
@@ -141,14 +140,13 @@ __ip_vs_get_out_rt_v6(struct ip_vs_conn *cp)
                                                                  NULL, &fl);
                         if (!rt) {
                                 spin_unlock(&dest->dst_lock);
-                                IP_VS_DBG_RL("ip6_route_output error, "
-                                             "dest: " NIP6_FMT "\n",
-                                             NIP6(dest->addr.in6));
+                                IP_VS_DBG_RL("ip6_route_output error, dest: %pI6\n",
+                                             &dest->addr.in6);
                                 return NULL;
                         }
                         __ip_vs_dst_set(dest, 0, dst_clone(&rt->u.dst));
-                        IP_VS_DBG(10, "new dst " NIP6_FMT ", refcnt=%d\n",
-                                  NIP6(dest->addr.in6),
+                        IP_VS_DBG(10, "new dst %pI6, refcnt=%d\n",
+                                  &dest->addr.in6,
                                   atomic_read(&rt->u.dst.__refcnt));
                 }
                 spin_unlock(&dest->dst_lock);
@@ -167,8 +165,8 @@ __ip_vs_get_out_rt_v6(struct ip_vs_conn *cp)
 
                 rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
                 if (!rt) {
-                        IP_VS_DBG_RL("ip6_route_output error, dest: "
-                                     NIP6_FMT "\n", NIP6(cp->daddr.in6));
+                        IP_VS_DBG_RL("ip6_route_output error, dest: %pI6\n",
+                                     &cp->daddr.in6);
                         return NULL;
                 }
         }
@@ -237,8 +235,8 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         EnterFunction(10);
 
         if (ip_route_output_key(&init_net, &rt, &fl)) {
-                IP_VS_DBG_RL("ip_vs_bypass_xmit(): ip_route_output error, "
-                             "dest: %u.%u.%u.%u\n", NIPQUAD(iph->daddr));
+                IP_VS_DBG_RL("ip_vs_bypass_xmit(): ip_route_output error, dest: %pI4\n",
+                             &iph->daddr);
                 goto tx_error_icmp;
         }
 
@@ -301,8 +299,8 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
         if (!rt) {
-                IP_VS_DBG_RL("ip_vs_bypass_xmit_v6(): ip6_route_output error, "
-                             "dest: " NIP6_FMT "\n", NIP6(iph->daddr));
+                IP_VS_DBG_RL("ip_vs_bypass_xmit_v6(): ip6_route_output error, dest: %pI6\n",
+                             &iph->daddr);
                 goto tx_error_icmp;
         }
 
diff --git a/net/netfilter/nf_conntrack_acct.c b/net/netfilter/nf_conntrack_acct.c
index b92df5c1dfcf..9fe8982bd7c9 100644
--- a/net/netfilter/nf_conntrack_acct.c
+++ b/net/netfilter/nf_conntrack_acct.c
@@ -35,7 +35,7 @@ static struct ctl_table acct_sysctl_table[] = {
                 .data           = &init_net.ct.sysctl_acct,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {}
 };
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 4f7107107e99..629500901bd4 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -462,16 +462,13 @@ static int help(struct sk_buff *skb,
                    different IP address.  Simply don't record it for
                    NAT. */
                 if (cmd.l3num == PF_INET) {
-                        pr_debug("conntrack_ftp: NOT RECORDING: " NIPQUAD_FMT
-                                 " != " NIPQUAD_FMT "\n",
-                                 NIPQUAD(cmd.u3.ip),
-                                 NIPQUAD(ct->tuplehash[dir].tuple.src.u3.ip));
+                        pr_debug("conntrack_ftp: NOT RECORDING: %pI4 != %pI4\n",
+                                 &cmd.u3.ip,
+                                 &ct->tuplehash[dir].tuple.src.u3.ip);
                 } else {
-                        pr_debug("conntrack_ftp: NOT RECORDING: " NIP6_FMT
-                                 " != " NIP6_FMT "\n",
-                                 NIP6(*((struct in6_addr *)cmd.u3.ip6)),
-                                 NIP6(*((struct in6_addr *)
-                                        ct->tuplehash[dir].tuple.src.u3.ip6)));
+                        pr_debug("conntrack_ftp: NOT RECORDING: %pI6 != %pI6\n",
+                                 cmd.u3.ip6,
+                                 ct->tuplehash[dir].tuple.src.u3.ip6);
                 }
 
                 /* Thanks to Cristiano Lincoln Mattos
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index c1504f71cdff..99bc803d1dd1 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -850,10 +850,8 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
             get_h225_addr(ct, *data, &setup->destCallSignalAddress,
                           &addr, &port) &&
             memcmp(&addr, &ct->tuplehash[!dir].tuple.src.u3, sizeof(addr))) {
-                pr_debug("nf_ct_q931: set destCallSignalAddress "
-                         NIP6_FMT ":%hu->" NIP6_FMT ":%hu\n",
-                         NIP6(*(struct in6_addr *)&addr), ntohs(port),
-                         NIP6(*(struct in6_addr *)&ct->tuplehash[!dir].tuple.src.u3),
+                pr_debug("nf_ct_q931: set destCallSignalAddress %pI6:%hu->%pI6:%hu\n",
+                         &addr, ntohs(port), &ct->tuplehash[!dir].tuple.src.u3,
                          ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
                 ret = set_h225_addr(skb, data, dataoff,
                                     &setup->destCallSignalAddress,
@@ -868,10 +866,8 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
             get_h225_addr(ct, *data, &setup->sourceCallSignalAddress,
                           &addr, &port) &&
             memcmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3, sizeof(addr))) {
-                pr_debug("nf_ct_q931: set sourceCallSignalAddress "
-                         NIP6_FMT ":%hu->" NIP6_FMT ":%hu\n",
-                         NIP6(*(struct in6_addr *)&addr), ntohs(port),
-                         NIP6(*(struct in6_addr *)&ct->tuplehash[!dir].tuple.dst.u3),
+                pr_debug("nf_ct_q931: set sourceCallSignalAddress %pI6:%hu->%pI6:%hu\n",
+                         &addr, ntohs(port), &ct->tuplehash[!dir].tuple.dst.u3,
                          ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
                 ret = set_h225_addr(skb, data, dataoff,
                                     &setup->sourceCallSignalAddress,
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 20633fdf7e6b..4d681a04447e 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -156,9 +156,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
                 /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
 
                 iph = ip_hdr(skb);
-                pr_debug("DCC found in master %u.%u.%u.%u:%u %u.%u.%u.%u:%u\n",
-                         NIPQUAD(iph->saddr), ntohs(th->source),
-                         NIPQUAD(iph->daddr), ntohs(th->dest));
+                pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
+                         &iph->saddr, ntohs(th->source),
+                         &iph->daddr, ntohs(th->dest));
 
                 for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
                         if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
@@ -185,10 +185,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
                             tuple->dst.u3.ip != htonl(dcc_ip)) {
                                 if (net_ratelimit())
                                         printk(KERN_WARNING
-                                                "Forged DCC command from "
-                                                "%u.%u.%u.%u: %u.%u.%u.%u:%u\n",
-                                                NIPQUAD(tuple->src.u3.ip),
-                                                HIPQUAD(dcc_ip), dcc_port);
+                                                "Forged DCC command from %pI4: %pI4:%u\n",
+                                                &tuple->src.u3.ip,
+                                                &dcc_ip, dcc_port);
                                 continue;
                         }
 
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index dbe680af85d2..4be80d7b8795 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -67,7 +67,7 @@ static struct ctl_table generic_sysctl_table[] = {
                 .data           = &nf_ct_generic_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = 0
@@ -80,7 +80,7 @@ static struct ctl_table generic_compat_sysctl_table[] = {
                 .data           = &nf_ct_generic_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = 0
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index ae8c2609e230..c2bd457bc2f2 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -548,49 +548,49 @@ static struct ctl_table sctp_sysctl_table[] = {
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_sctp_timeout_cookie_wait",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_sctp_timeout_cookie_echoed",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_sctp_timeout_established",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_sctp_timeout_shutdown_sent",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_sctp_timeout_shutdown_recd",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name = 0
@@ -604,49 +604,49 @@ static struct ctl_table sctp_compat_sysctl_table[] = {
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_sctp_timeout_cookie_wait",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_sctp_timeout_cookie_echoed",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_sctp_timeout_established",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_sctp_timeout_shutdown_sent",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_sctp_timeout_shutdown_recd",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
                 .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name = 0
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index f947ec41e391..a1edb9c1adee 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1192,70 +1192,70 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_established",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_close",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
                 .data           = &nf_ct_tcp_timeout_max_retrans,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
                 .data           = &nf_ct_tcp_timeout_unacknowledged,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
@@ -1263,7 +1263,7 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .data           = &nf_ct_tcp_loose,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
@@ -1271,7 +1271,7 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .data           = &nf_ct_tcp_be_liberal,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
@@ -1279,7 +1279,7 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .data           = &nf_ct_tcp_max_retrans,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = 0
@@ -1293,63 +1293,63 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_established",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_close",
                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
                 .data           = &nf_ct_tcp_timeout_max_retrans,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
@@ -1357,7 +1357,7 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
                 .data           = &nf_ct_tcp_loose,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
@@ -1365,7 +1365,7 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
                 .data           = &nf_ct_tcp_be_liberal,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
@@ -1373,7 +1373,7 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
                 .data           = &nf_ct_tcp_max_retrans,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = 0
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 7c2ca48698be..2b8b1f579f93 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -143,14 +143,14 @@ static struct ctl_table udp_sysctl_table[] = {
                 .data           = &nf_ct_udp_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_udp_timeout_stream",
                 .data           = &nf_ct_udp_timeout_stream,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = 0
@@ -163,14 +163,14 @@ static struct ctl_table udp_compat_sysctl_table[] = {
                 .data           = &nf_ct_udp_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "ip_conntrack_udp_timeout_stream",
                 .data           = &nf_ct_udp_timeout_stream,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = 0
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index d22d839e4f94..4579d8de13b1 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -151,7 +151,7 @@ static struct ctl_table udplite_sysctl_table[] = {
                 .data           = &nf_ct_udplite_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -159,7 +159,7 @@ static struct ctl_table udplite_sysctl_table[] = {
                 .data           = &nf_ct_udplite_timeout_stream,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .ctl_name       = 0
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 98106d4e89f0..f37b9b74c6a8 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -336,7 +336,7 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .data           = &nf_conntrack_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_COUNT,
@@ -344,7 +344,7 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .data           = &init_net.ct.count,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_BUCKETS,
@@ -352,7 +352,7 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .data           = &nf_conntrack_htable_size,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_CHECKSUM,
@@ -360,7 +360,7 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .data           = &init_net.ct.sysctl_checksum,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = NET_NF_CONNTRACK_LOG_INVALID,
@@ -368,8 +368,8 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .data           = &init_net.ct.sysctl_log_invalid,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &log_invalid_proto_min,
                 .extra2         = &log_invalid_proto_max,
         },
@@ -379,7 +379,7 @@ static ctl_table nf_ct_sysctl_table[] = {
                 .data           = &nf_ct_expect_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         { .ctl_name = 0 }
 };
@@ -393,7 +393,7 @@ static ctl_table nf_ct_netfilter_table[] = {
                 .data           = &nf_conntrack_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         { .ctl_name = 0 }
 };
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 6fc4292d46e6..f97fded024c4 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -893,23 +893,21 @@ static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
 
         switch (family) {
         case NFPROTO_IPV4:
-                return seq_printf(s, "%ld %u.%u.%u.%u:%u->"
-                                     "%u.%u.%u.%u:%u %u %u %u\n",
+                return seq_printf(s, "%ld %pI4:%u->%pI4:%u %u %u %u\n",
                                  (long)(ent->expires - jiffies)/HZ,
-                                 NIPQUAD(ent->dst.ip.src),
+                                 &ent->dst.ip.src,
                                  ntohs(ent->dst.src_port),
-                                 NIPQUAD(ent->dst.ip.dst),
+                                 &ent->dst.ip.dst,
                                  ntohs(ent->dst.dst_port),
                                  ent->rateinfo.credit, ent->rateinfo.credit_cap,
                                  ent->rateinfo.cost);
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
         case NFPROTO_IPV6:
-                return seq_printf(s, "%ld " NIP6_FMT ":%u->"
-                                     NIP6_FMT ":%u %u %u %u\n",
+                return seq_printf(s, "%ld %pI6:%u->%pI6:%u %u %u %u\n",
                                  (long)(ent->expires - jiffies)/HZ,
-                                 NIP6(*(struct in6_addr *)&ent->dst.ip6.src),
+                                 &ent->dst.ip6.src,
                                  ntohs(ent->dst.src_port),
-                                 NIP6(*(struct in6_addr *)&ent->dst.ip6.dst),
+                                 &ent->dst.ip6.dst,
                                  ntohs(ent->dst.dst_port),
                                  ent->rateinfo.credit, ent->rateinfo.credit_cap,
                                  ent->rateinfo.cost);
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 7ac54eab0b00..501f9b623188 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -26,12 +26,11 @@ iprange_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
                 if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
                           || ntohl(iph->saddr) > ntohl(info->src.max_ip))
                          ^ !!(info->flags & IPRANGE_SRC_INV)) {
-                        pr_debug("src IP %u.%u.%u.%u NOT in range %s"
-                                 "%u.%u.%u.%u-%u.%u.%u.%u\n",
-                                 NIPQUAD(iph->saddr),
+                        pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
+                                 &iph->saddr,
                                  info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
-                                 NIPQUAD(info->src.min_ip),
-                                 NIPQUAD(info->src.max_ip));
+                                 &info->src.min_ip,
+                                 &info->src.max_ip);
                         return false;
                 }
         }
@@ -39,12 +38,11 @@ iprange_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
                 if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
                           || ntohl(iph->daddr) > ntohl(info->dst.max_ip))
                          ^ !!(info->flags & IPRANGE_DST_INV)) {
-                        pr_debug("dst IP %u.%u.%u.%u NOT in range %s"
-                                 "%u.%u.%u.%u-%u.%u.%u.%u\n",
-                                 NIPQUAD(iph->daddr),
+                        pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
+                                 &iph->daddr,
                                  info->flags & IPRANGE_DST_INV ? "(INV) " : "",
-                                 NIPQUAD(info->dst.min_ip),
-                                 NIPQUAD(info->dst.max_ip));
+                                 &info->dst.min_ip,
+                                 &info->dst.max_ip);
                         return false;
                 }
         }
@@ -63,12 +61,11 @@ iprange_mt4(const struct sk_buff *skb, const struct xt_match_param *par)
                 m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
                 m ^= !!(info->flags & IPRANGE_SRC_INV);
                 if (m) {
-                        pr_debug("src IP " NIPQUAD_FMT " NOT in range %s"
-                                 NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
-                                 NIPQUAD(iph->saddr),
+                        pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
+                                 &iph->saddr,
                                  (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
-                                 NIPQUAD(info->src_max.ip),
-                                 NIPQUAD(info->src_max.ip));
+                                 &info->src_max.ip,
+                                 &info->src_max.ip);
                         return false;
                 }
         }
@@ -77,12 +74,11 @@ iprange_mt4(const struct sk_buff *skb, const struct xt_match_param *par)
                 m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
                 m ^= !!(info->flags & IPRANGE_DST_INV);
                 if (m) {
-                        pr_debug("dst IP " NIPQUAD_FMT " NOT in range %s"
-                                 NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
-                                 NIPQUAD(iph->daddr),
+                        pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
+                                 &iph->daddr,
                                  (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
-                                 NIPQUAD(info->dst_min.ip),
-                                 NIPQUAD(info->dst_max.ip));
+                                 &info->dst_min.ip,
+                                 &info->dst_max.ip);
                         return false;
                 }
         }
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 280c471bcdf4..3c3dd22b1d06 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -422,13 +422,11 @@ static int recent_seq_show(struct seq_file *seq, void *v)
 
         i = (e->index - 1) % ip_pkt_list_tot;
         if (e->family == NFPROTO_IPV4)
-                seq_printf(seq, "src=" NIPQUAD_FMT " ttl: %u last_seen: %lu "
-                           "oldest_pkt: %u", NIPQUAD(e->addr.ip), e->ttl,
-                           e->stamps[i], e->index);
+                seq_printf(seq, "src=%pI4 ttl: %u last_seen: %lu oldest_pkt: %u",
+                           &e->addr.ip, e->ttl, e->stamps[i], e->index);
         else
-                seq_printf(seq, "src=" NIP6_FMT " ttl: %u last_seen: %lu "
-                           "oldest_pkt: %u", NIP6(e->addr.in6), e->ttl,
-                           e->stamps[i], e->index);
+                seq_printf(seq, "src=%pI6 ttl: %u last_seen: %lu oldest_pkt: %u",
+                           &e->addr.in6, e->ttl, e->stamps[i], e->index);
         for (i = 0; i < e->nstamps; i++)
                 seq_printf(seq, "%s %lu", i ? "," : "", e->stamps[i]);
         seq_printf(seq, "\n");
diff --git a/net/netlabel/netlabel_addrlist.c b/net/netlabel/netlabel_addrlist.c
index 249f6b92f153..834c6eb7f484 100644
--- a/net/netlabel/netlabel_addrlist.c
+++ b/net/netlabel/netlabel_addrlist.c
@@ -337,7 +337,7 @@ void netlbl_af4list_audit_addr(struct audit_buffer *audit_buf,
 
         if (dev != NULL)
                 audit_log_format(audit_buf, " netif=%s", dev);
-        audit_log_format(audit_buf, " %s=" NIPQUAD_FMT, dir, NIPQUAD(addr));
+        audit_log_format(audit_buf, " %s=%pI4", dir, &addr);
         if (mask_val != 0xffffffff) {
                 u32 mask_len = 0;
                 while (mask_val > 0) {
@@ -371,7 +371,7 @@ void netlbl_af6list_audit_addr(struct audit_buffer *audit_buf,
 
         if (dev != NULL)
                 audit_log_format(audit_buf, " netif=%s", dev);
-        audit_log_format(audit_buf, " %s=" NIP6_FMT, dir, NIP6(*addr));
+        audit_log_format(audit_buf, " %s=%pI6", dir, addr);
         if (ntohl(mask->s6_addr32[3]) != 0xffffffff) {
                 u32 mask_len = 0;
                 u32 mask_val;
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index 2d106cfe1d27..c83fea7da9a8 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -233,7 +233,7 @@ size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
  *
  * Returns the number of bytes copied.
  */
-int nla_memcpy(void *dest, struct nlattr *src, int count)
+int nla_memcpy(void *dest, const struct nlattr *src, int count)
 {
         int minlen = min_t(int, count, nla_len(src));
 
diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
index 34c96c9674df..7b49591fe87c 100644
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -41,8 +41,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_default_path_quality,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_quality,
                 .extra2         = &max_quality
         },
@@ -52,8 +52,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_obsolescence_count_initialiser,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_obs,
                 .extra2         = &max_obs
         },
@@ -63,8 +63,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_network_ttl_initialiser,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_ttl,
                 .extra2         = &max_ttl
         },
@@ -74,8 +74,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_transport_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_t1,
                 .extra2         = &max_t1
         },
@@ -85,8 +85,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_transport_maximum_tries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_n2,
                 .extra2         = &max_n2
         },
@@ -96,8 +96,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_transport_acknowledge_delay,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_t2,
                 .extra2         = &max_t2
         },
@@ -107,8 +107,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_transport_busy_delay,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_t4,
                 .extra2         = &max_t4
         },
@@ -118,8 +118,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_transport_requested_window_size,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_window,
                 .extra2         = &max_window
         },
@@ -129,8 +129,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_transport_no_activity_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_idle,
                 .extra2         = &max_idle
         },
@@ -140,8 +140,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_routing_control,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_route,
                 .extra2         = &max_route
         },
@@ -151,8 +151,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_link_fails_count,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_fails,
                 .extra2         = &max_fails
         },
@@ -162,8 +162,8 @@ static ctl_table nr_table[] = {
                 .data           = &sysctl_netrom_reset_circuit,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_reset,
                 .extra2         = &max_reset
         },
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c718e7e3f7de..b4870a34c435 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -910,6 +910,7 @@ static int packet_release(struct socket *sock)
         skb_queue_purge(&sk->sk_receive_queue);
         sk_refcnt_debug_release(sk);
 
+        sock_prot_inuse_add(net, sk->sk_prot, -1);
         sock_put(sk);
         return 0;
 }
@@ -1085,6 +1086,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
         write_lock_bh(&net->packet.sklist_lock);
         sk_add_node(sk, &net->packet.sklist);
         write_unlock_bh(&net->packet.sklist_lock);
+        sock_prot_inuse_add(net, &packet_proto, 1);
         return(0);
 out:
         return err;
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 9978afbd9f2a..e6e8e44852e5 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -41,7 +41,6 @@ struct gprs_dev {
         void                    (*old_write_space)(struct sock *);
 
         struct net_device       *net;
-        struct net_device_stats stats;
 
         struct sk_buff_head     tx_queue;
         struct work_struct      tx_work;
@@ -49,14 +48,14 @@ struct gprs_dev {
         unsigned                tx_max;
 };
 
-static int gprs_type_trans(struct sk_buff *skb)
+static __be16 gprs_type_trans(struct sk_buff *skb)
 {
         const u8 *pvfc;
         u8 buf;
 
         pvfc = skb_header_pointer(skb, 0, 1, &buf);
         if (!pvfc)
-                return 0;
+                return htons(0);
         /* Look at IP version field */
         switch (*pvfc >> 4) {
         case 4:
@@ -64,7 +63,7 @@ static int gprs_type_trans(struct sk_buff *skb)
         case 6:
                 return htons(ETH_P_IPV6);
         }
-        return 0;
+        return htons(0);
 }
 
 /*
@@ -83,8 +82,9 @@ static void gprs_state_change(struct sock *sk)
 
 static int gprs_recv(struct gprs_dev *dev, struct sk_buff *skb)
 {
+        struct net_device *net = dev->net;
         int err = 0;
-        u16 protocol = gprs_type_trans(skb);
+        __be16 protocol = gprs_type_trans(skb);
 
         if (!protocol) {
                 err = -EINVAL;
@@ -99,7 +99,7 @@ static int gprs_recv(struct gprs_dev *dev, struct sk_buff *skb)
                  * so wrap the IP packet as a single fragment of an head-less
                  * socket buffer. The network stack will pull what it needs,
                  * but at least, the whole IP payload is not memcpy'd. */
-                rskb = netdev_alloc_skb(dev->net, 0);
+                rskb = netdev_alloc_skb(net, 0);
                 if (!rskb) {
                         err = -ENOBUFS;
                         goto drop;
@@ -123,11 +123,11 @@ static int gprs_recv(struct gprs_dev *dev, struct sk_buff *skb)
 
         skb->protocol = protocol;
         skb_reset_mac_header(skb);
-        skb->dev = dev->net;
+        skb->dev = net;
 
-        if (likely(dev->net->flags & IFF_UP)) {
-                dev->stats.rx_packets++;
-                dev->stats.rx_bytes += skb->len;
+        if (likely(net->flags & IFF_UP)) {
+                net->stats.rx_packets++;
+                net->stats.rx_bytes += skb->len;
                 netif_rx(skb);
                 skb = NULL;
         } else
@@ -136,7 +136,7 @@ static int gprs_recv(struct gprs_dev *dev, struct sk_buff *skb)
 drop:
         if (skb) {
                 dev_kfree_skb(skb);
-                dev->stats.rx_dropped++;
+                net->stats.rx_dropped++;
         }
         return err;
 }
@@ -199,14 +199,15 @@ static int gprs_xmit(struct sk_buff *skb, struct net_device *net)
 static void gprs_tx(struct work_struct *work)
 {
         struct gprs_dev *dev = container_of(work, struct gprs_dev, tx_work);
+        struct net_device *net = dev->net;
         struct sock *sk = dev->sk;
         struct sk_buff *skb;
 
         while ((skb = skb_dequeue(&dev->tx_queue)) != NULL) {
                 int err;
 
-                dev->stats.tx_bytes += skb->len;
-                dev->stats.tx_packets++;
+                net->stats.tx_bytes += skb->len;
+                net->stats.tx_packets++;
 
                 skb_orphan(skb);
                 skb_set_owner_w(skb, sk);
@@ -215,9 +216,9 @@ static void gprs_tx(struct work_struct *work)
                 err = pep_write(sk, skb);
                 if (err) {
                         LIMIT_NETDEBUG(KERN_WARNING"%s: TX error (%d)\n",
-                                        dev->net->name, err);
-                        dev->stats.tx_aborted_errors++;
-                        dev->stats.tx_errors++;
+                                        net->name, err);
+                        net->stats.tx_aborted_errors++;
+                        net->stats.tx_errors++;
                 }
                 release_sock(sk);
         }
@@ -236,13 +237,6 @@ static int gprs_set_mtu(struct net_device *net, int new_mtu)
         return 0;
 }
 
-static struct net_device_stats *gprs_get_stats(struct net_device *net)
-{
-        struct gprs_dev *dev = netdev_priv(net);
-
-        return &dev->stats;
-}
-
 static void gprs_setup(struct net_device *net)
 {
         net->features           = NETIF_F_FRAGLIST;
@@ -256,7 +250,6 @@ static void gprs_setup(struct net_device *net)
         net->destructor         = free_netdev;
         net->hard_start_xmit    = gprs_xmit; /* mandatory */
         net->change_mtu         = gprs_set_mtu;
-        net->get_stats          = gprs_get_stats;
 }
 
 /*
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index 600a4309b8c8..0e3347bbdb12 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -89,7 +89,7 @@ static struct ctl_table phonet_table[] = {
                 .data           = &local_port_range,
                 .maxlen         = sizeof(local_port_range),
                 .mode           = 0644,
-                .proc_handler   = &proc_local_port_range,
+                .proc_handler   = proc_local_port_range,
                 .strategy       = NULL,
         },
         { .ctl_name = 0 }
diff --git a/net/rfkill/rfkill-input.c b/net/rfkill/rfkill-input.c
index bfdade72e066..84efde97c5a7 100644
--- a/net/rfkill/rfkill-input.c
+++ b/net/rfkill/rfkill-input.c
@@ -24,138 +24,318 @@ MODULE_AUTHOR("Dmitry Torokhov <dtor@mail.ru>");
 MODULE_DESCRIPTION("Input layer to RF switch connector");
 MODULE_LICENSE("GPL");
 
+enum rfkill_input_master_mode {
+        RFKILL_INPUT_MASTER_DONOTHING = 0,
+        RFKILL_INPUT_MASTER_RESTORE = 1,
+        RFKILL_INPUT_MASTER_UNBLOCKALL = 2,
+        RFKILL_INPUT_MASTER_MAX,        /* marker */
+};
+
+/* Delay (in ms) between consecutive switch ops */
+#define RFKILL_OPS_DELAY 200
+
+static enum rfkill_input_master_mode rfkill_master_switch_mode =
+                                        RFKILL_INPUT_MASTER_UNBLOCKALL;
+module_param_named(master_switch_mode, rfkill_master_switch_mode, uint, 0);
+MODULE_PARM_DESC(master_switch_mode,
+        "SW_RFKILL_ALL ON should: 0=do nothing; 1=restore; 2=unblock all");
+
+enum rfkill_global_sched_op {
+        RFKILL_GLOBAL_OP_EPO = 0,
+        RFKILL_GLOBAL_OP_RESTORE,
+        RFKILL_GLOBAL_OP_UNLOCK,
+        RFKILL_GLOBAL_OP_UNBLOCK,
+};
+
+/*
+ * Currently, the code marked with RFKILL_NEED_SWSET is inactive.
+ * If handling of EV_SW SW_WLAN/WWAN/BLUETOOTH/etc is needed in the
+ * future, when such events are added, that code will be necessary.
+ */
+
 struct rfkill_task {
-        struct work_struct work;
-        enum rfkill_type type;
-        struct mutex mutex; /* ensures that task is serialized */
-        spinlock_t lock; /* for accessing last and desired state */
-        unsigned long last; /* last schedule */
-        enum rfkill_state desired_state; /* on/off */
+        struct delayed_work dwork;
+
+        /* ensures that task is serialized */
+        struct mutex mutex;
+
+        /* protects everything below */
+        spinlock_t lock;
+
+        /* pending regular switch operations (1=pending) */
+        unsigned long sw_pending[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
+
+#ifdef RFKILL_NEED_SWSET
+        /* set operation pending (1=pending) */
+        unsigned long sw_setpending[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
+
+        /* desired state for pending set operation (1=unblock) */
+        unsigned long sw_newstate[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
+#endif
+
+        /* should the state be complemented (1=yes) */
+        unsigned long sw_togglestate[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
+
+        bool global_op_pending;
+        enum rfkill_global_sched_op op;
+
+        /* last time it was scheduled */
+        unsigned long last_scheduled;
 };
 
+static void __rfkill_handle_global_op(enum rfkill_global_sched_op op)
+{
+        unsigned int i;
+
+        switch (op) {
+        case RFKILL_GLOBAL_OP_EPO:
+                rfkill_epo();
+                break;
+        case RFKILL_GLOBAL_OP_RESTORE:
+                rfkill_restore_states();
+                break;
+        case RFKILL_GLOBAL_OP_UNLOCK:
+                rfkill_remove_epo_lock();
+                break;
+        case RFKILL_GLOBAL_OP_UNBLOCK:
+                rfkill_remove_epo_lock();
+                for (i = 0; i < RFKILL_TYPE_MAX; i++)
+                        rfkill_switch_all(i, RFKILL_STATE_UNBLOCKED);
+                break;
+        default:
+                /* memory corruption or bug, fail safely */
+                rfkill_epo();
+                WARN(1, "Unknown requested operation %d! "
+                        "rfkill Emergency Power Off activated\n",
+                        op);
+        }
+}
+
+#ifdef RFKILL_NEED_SWSET
+static void __rfkill_handle_normal_op(const enum rfkill_type type,
+                        const bool sp, const bool s, const bool c)
+{
+        enum rfkill_state state;
+
+        if (sp)
+                state = (s) ? RFKILL_STATE_UNBLOCKED :
+                              RFKILL_STATE_SOFT_BLOCKED;
+        else
+                state = rfkill_get_global_state(type);
+
+        if (c)
+                state = rfkill_state_complement(state);
+
+        rfkill_switch_all(type, state);
+}
+#else
+static void __rfkill_handle_normal_op(const enum rfkill_type type,
+                        const bool c)
+{
+        enum rfkill_state state;
+
+        state = rfkill_get_global_state(type);
+        if (c)
+                state = rfkill_state_complement(state);
+
+        rfkill_switch_all(type, state);
+}
+#endif
+
 static void rfkill_task_handler(struct work_struct *work)
 {
-        struct rfkill_task *task = container_of(work, struct rfkill_task, work);
+        struct rfkill_task *task = container_of(work,
+                                        struct rfkill_task, dwork.work);
+        bool doit = true;
 
         mutex_lock(&task->mutex);
 
-        rfkill_switch_all(task->type, task->desired_state);
+        spin_lock_irq(&task->lock);
+        while (doit) {
+                if (task->global_op_pending) {
+                        enum rfkill_global_sched_op op = task->op;
+                        task->global_op_pending = false;
+                        memset(task->sw_pending, 0, sizeof(task->sw_pending));
+                        spin_unlock_irq(&task->lock);
+
+                        __rfkill_handle_global_op(op);
+
+                        /* make sure we do at least one pass with
+                         * !task->global_op_pending */
+                        spin_lock_irq(&task->lock);
+                        continue;
+                } else if (!rfkill_is_epo_lock_active()) {
+                        unsigned int i = 0;
+
+                        while (!task->global_op_pending &&
+                                                i < RFKILL_TYPE_MAX) {
+                                if (test_and_clear_bit(i, task->sw_pending)) {
+                                        bool c;
+#ifdef RFKILL_NEED_SWSET
+                                        bool sp, s;
+                                        sp = test_and_clear_bit(i,
+                                                        task->sw_setpending);
+                                        s = test_bit(i, task->sw_newstate);
+#endif
+                                        c = test_and_clear_bit(i,
+                                                        task->sw_togglestate);
+                                        spin_unlock_irq(&task->lock);
+
+#ifdef RFKILL_NEED_SWSET
+                                        __rfkill_handle_normal_op(i, sp, s, c);
+#else
+                                        __rfkill_handle_normal_op(i, c);
+#endif
+
+                                        spin_lock_irq(&task->lock);
+                                }
+                                i++;
+                        }
+                }
+                doit = task->global_op_pending;
+        }
+        spin_unlock_irq(&task->lock);
 
         mutex_unlock(&task->mutex);
 }
 
-static void rfkill_task_epo_handler(struct work_struct *work)
+static struct rfkill_task rfkill_task = {
+        .dwork = __DELAYED_WORK_INITIALIZER(rfkill_task.dwork,
+                                rfkill_task_handler),
+        .mutex = __MUTEX_INITIALIZER(rfkill_task.mutex),
+        .lock = __SPIN_LOCK_UNLOCKED(rfkill_task.lock),
+};
+
+static unsigned long rfkill_ratelimit(const unsigned long last)
 {
-        rfkill_epo();
+        const unsigned long delay = msecs_to_jiffies(RFKILL_OPS_DELAY);
+        return (time_after(jiffies, last + delay)) ? 0 : delay;
 }
 
-static DECLARE_WORK(epo_work, rfkill_task_epo_handler);
+static void rfkill_schedule_ratelimited(void)
+{
+        if (!delayed_work_pending(&rfkill_task.dwork)) {
+                schedule_delayed_work(&rfkill_task.dwork,
+                                rfkill_ratelimit(rfkill_task.last_scheduled));
+                rfkill_task.last_scheduled = jiffies;
+        }
+}
 
-static void rfkill_schedule_epo(void)
+static void rfkill_schedule_global_op(enum rfkill_global_sched_op op)
 {
-        schedule_work(&epo_work);
+        unsigned long flags;
+
+        spin_lock_irqsave(&rfkill_task.lock, flags);
+        rfkill_task.op = op;
+        rfkill_task.global_op_pending = true;
+        if (op == RFKILL_GLOBAL_OP_EPO && !rfkill_is_epo_lock_active()) {
+                /* bypass the limiter for EPO */
+                cancel_delayed_work(&rfkill_task.dwork);
+                schedule_delayed_work(&rfkill_task.dwork, 0);
+                rfkill_task.last_scheduled = jiffies;
+        } else
+                rfkill_schedule_ratelimited();
+        spin_unlock_irqrestore(&rfkill_task.lock, flags);
 }
 
-static void rfkill_schedule_set(struct rfkill_task *task,
+#ifdef RFKILL_NEED_SWSET
+/* Use this if you need to add EV_SW SW_WLAN/WWAN/BLUETOOTH/etc handling */
+
+static void rfkill_schedule_set(enum rfkill_type type,
                                 enum rfkill_state desired_state)
 {
         unsigned long flags;
 
-        if (unlikely(work_pending(&epo_work)))
+        if (rfkill_is_epo_lock_active())
                 return;
 
-        spin_lock_irqsave(&task->lock, flags);
-
-        if (time_after(jiffies, task->last + msecs_to_jiffies(200))) {
-                task->desired_state = desired_state;
-                task->last = jiffies;
-                schedule_work(&task->work);
+        spin_lock_irqsave(&rfkill_task.lock, flags);
+        if (!rfkill_task.global_op_pending) {
+                set_bit(type, rfkill_task.sw_pending);
+                set_bit(type, rfkill_task.sw_setpending);
+                clear_bit(type, rfkill_task.sw_togglestate);
+                if (desired_state)
+                        set_bit(type,  rfkill_task.sw_newstate);
+                else
+                        clear_bit(type, rfkill_task.sw_newstate);
+                rfkill_schedule_ratelimited();
         }
-
-        spin_unlock_irqrestore(&task->lock, flags);
+        spin_unlock_irqrestore(&rfkill_task.lock, flags);
 }
+#endif
 
-static void rfkill_schedule_toggle(struct rfkill_task *task)
+static void rfkill_schedule_toggle(enum rfkill_type type)
 {
         unsigned long flags;
 
-        if (unlikely(work_pending(&epo_work)))
+        if (rfkill_is_epo_lock_active())
                 return;
 
-        spin_lock_irqsave(&task->lock, flags);
-
-        if (time_after(jiffies, task->last + msecs_to_jiffies(200))) {
-                task->desired_state =
-                                rfkill_state_complement(task->desired_state);
-                task->last = jiffies;
-                schedule_work(&task->work);
+        spin_lock_irqsave(&rfkill_task.lock, flags);
+        if (!rfkill_task.global_op_pending) {
+                set_bit(type, rfkill_task.sw_pending);
+                change_bit(type, rfkill_task.sw_togglestate);
+                rfkill_schedule_ratelimited();
         }
-
-        spin_unlock_irqrestore(&task->lock, flags);
+        spin_unlock_irqrestore(&rfkill_task.lock, flags);
 }
 
-#define DEFINE_RFKILL_TASK(n, t)                                \
-        struct rfkill_task n = {                                \
-                .work = __WORK_INITIALIZER(n.work,              \
-                                rfkill_task_handler),           \
-                .type = t,                                      \
-                .mutex = __MUTEX_INITIALIZER(n.mutex),          \
-                .lock = __SPIN_LOCK_UNLOCKED(n.lock),           \
-                .desired_state = RFKILL_STATE_UNBLOCKED,        \
-        }
-
-static DEFINE_RFKILL_TASK(rfkill_wlan, RFKILL_TYPE_WLAN);
-static DEFINE_RFKILL_TASK(rfkill_bt, RFKILL_TYPE_BLUETOOTH);
-static DEFINE_RFKILL_TASK(rfkill_uwb, RFKILL_TYPE_UWB);
-static DEFINE_RFKILL_TASK(rfkill_wimax, RFKILL_TYPE_WIMAX);
-static DEFINE_RFKILL_TASK(rfkill_wwan, RFKILL_TYPE_WWAN);
-
 static void rfkill_schedule_evsw_rfkillall(int state)
 {
-        /* EVERY radio type. state != 0 means radios ON */
-        /* handle EPO (emergency power off) through shortcut */
         if (state) {
-                rfkill_schedule_set(&rfkill_wwan,
-                                    RFKILL_STATE_UNBLOCKED);
-                rfkill_schedule_set(&rfkill_wimax,
-                                    RFKILL_STATE_UNBLOCKED);
-                rfkill_schedule_set(&rfkill_uwb,
-                                    RFKILL_STATE_UNBLOCKED);
-                rfkill_schedule_set(&rfkill_bt,
-                                    RFKILL_STATE_UNBLOCKED);
-                rfkill_schedule_set(&rfkill_wlan,
-                                    RFKILL_STATE_UNBLOCKED);
+                switch (rfkill_master_switch_mode) {
+                case RFKILL_INPUT_MASTER_UNBLOCKALL:
+                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_UNBLOCK);
+                        break;
+                case RFKILL_INPUT_MASTER_RESTORE:
+                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_RESTORE);
+                        break;
+                case RFKILL_INPUT_MASTER_DONOTHING:
+                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_UNLOCK);
+                        break;
+                default:
+                        /* memory corruption or driver bug! fail safely */
+                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_EPO);
+                        WARN(1, "Unknown rfkill_master_switch_mode (%d), "
+                                "driver bug or memory corruption detected!\n",
+                                rfkill_master_switch_mode);
+                        break;
+                }
         } else
-                rfkill_schedule_epo();
+                rfkill_schedule_global_op(RFKILL_GLOBAL_OP_EPO);
 }
 
 static void rfkill_event(struct input_handle *handle, unsigned int type,
                         unsigned int code, int data)
 {
         if (type == EV_KEY && data == 1) {
+                enum rfkill_type t;
+
                 switch (code) {
                 case KEY_WLAN:
-                        rfkill_schedule_toggle(&rfkill_wlan);
+                        t = RFKILL_TYPE_WLAN;
                         break;
                 case KEY_BLUETOOTH:
-                        rfkill_schedule_toggle(&rfkill_bt);
+                        t = RFKILL_TYPE_BLUETOOTH;
                         break;
                 case KEY_UWB:
-                        rfkill_schedule_toggle(&rfkill_uwb);
+                        t = RFKILL_TYPE_UWB;
                         break;
                 case KEY_WIMAX:
-                        rfkill_schedule_toggle(&rfkill_wimax);
+                        t = RFKILL_TYPE_WIMAX;
                         break;
                 default:
-                        break;
+                        return;
                 }
+                rfkill_schedule_toggle(t);
+                return;
         } else if (type == EV_SW) {
                 switch (code) {
                 case SW_RFKILL_ALL:
                         rfkill_schedule_evsw_rfkillall(data);
-                        break;
+                        return;
                 default:
-                        break;
+                        return;
                 }
         }
 }
@@ -256,18 +436,23 @@ static struct input_handler rfkill_handler = {
 
 static int __init rfkill_handler_init(void)
 {
-        unsigned long last_run = jiffies - msecs_to_jiffies(500);
-        rfkill_wlan.last = last_run;
-        rfkill_bt.last = last_run;
-        rfkill_uwb.last = last_run;
-        rfkill_wimax.last = last_run;
+        if (rfkill_master_switch_mode >= RFKILL_INPUT_MASTER_MAX)
+                return -EINVAL;
+
+        /*
+         * The penalty to not doing this is a possible RFKILL_OPS_DELAY delay
+         * at the first use.  Acceptable, but if we can avoid it, why not?
+         */
+        rfkill_task.last_scheduled =
+                        jiffies - msecs_to_jiffies(RFKILL_OPS_DELAY) - 1;
         return input_register_handler(&rfkill_handler);
 }
 
 static void __exit rfkill_handler_exit(void)
 {
         input_unregister_handler(&rfkill_handler);
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&rfkill_task.dwork);
+        rfkill_remove_epo_lock();
 }
 
 module_init(rfkill_handler_init);
diff --git a/net/rfkill/rfkill-input.h b/net/rfkill/rfkill-input.h
index bbfa646157c6..fe8df6b5b935 100644
--- a/net/rfkill/rfkill-input.h
+++ b/net/rfkill/rfkill-input.h
@@ -14,5 +14,8 @@
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state);
 void rfkill_epo(void);
 void rfkill_restore_states(void);
+void rfkill_remove_epo_lock(void);
+bool rfkill_is_epo_lock_active(void);
+enum rfkill_state rfkill_get_global_state(const enum rfkill_type type);
 
 #endif /* __RFKILL_INPUT_H */
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 25ba3bd57e66..ec26eae8004d 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -51,6 +51,7 @@ struct rfkill_gsw_state {
 
 static struct rfkill_gsw_state rfkill_global_states[RFKILL_TYPE_MAX];
 static unsigned long rfkill_states_lockdflt[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
+static bool rfkill_epo_lock_active;
 
 static BLOCKING_NOTIFIER_HEAD(rfkill_notifier_list);
 
@@ -264,11 +265,14 @@ static void __rfkill_switch_all(const enum rfkill_type type,
  *
  * Acquires rfkill_global_mutex and calls __rfkill_switch_all(@type, @state).
  * Please refer to __rfkill_switch_all() for details.
+ *
+ * Does nothing if the EPO lock is active.
  */
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
 {
         mutex_lock(&rfkill_global_mutex);
-        __rfkill_switch_all(type, state);
+        if (!rfkill_epo_lock_active)
+                __rfkill_switch_all(type, state);
         mutex_unlock(&rfkill_global_mutex);
 }
 EXPORT_SYMBOL(rfkill_switch_all);
@@ -289,6 +293,7 @@ void rfkill_epo(void)
 
         mutex_lock(&rfkill_global_mutex);
 
+        rfkill_epo_lock_active = true;
         list_for_each_entry(rfkill, &rfkill_list, node) {
                 mutex_lock(&rfkill->mutex);
                 rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
@@ -317,6 +322,7 @@ void rfkill_restore_states(void)
 
         mutex_lock(&rfkill_global_mutex);
 
+        rfkill_epo_lock_active = false;
         for (i = 0; i < RFKILL_TYPE_MAX; i++)
                 __rfkill_switch_all(i, rfkill_global_states[i].default_state);
         mutex_unlock(&rfkill_global_mutex);
@@ -324,6 +330,48 @@ void rfkill_restore_states(void)
 EXPORT_SYMBOL_GPL(rfkill_restore_states);
 
 /**
+ * rfkill_remove_epo_lock - unlock state changes
+ *
+ * Used by rfkill-input manually unlock state changes, when
+ * the EPO switch is deactivated.
+ */
+void rfkill_remove_epo_lock(void)
+{
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_epo_lock_active = false;
+        mutex_unlock(&rfkill_global_mutex);
+}
+EXPORT_SYMBOL_GPL(rfkill_remove_epo_lock);
+
+/**
+ * rfkill_is_epo_lock_active - returns true EPO is active
+ *
+ * Returns 0 (false) if there is NOT an active EPO contidion,
+ * and 1 (true) if there is an active EPO contition, which
+ * locks all radios in one of the BLOCKED states.
+ *
+ * Can be called in atomic context.
+ */
+bool rfkill_is_epo_lock_active(void)
+{
+        return rfkill_epo_lock_active;
+}
+EXPORT_SYMBOL_GPL(rfkill_is_epo_lock_active);
+
+/**
+ * rfkill_get_global_state - returns global state for a type
+ * @type: the type to get the global state of
+ *
+ * Returns the current global state for a given wireless
+ * device type.
+ */
+enum rfkill_state rfkill_get_global_state(const enum rfkill_type type)
+{
+        return rfkill_global_states[type].current_state;
+}
+EXPORT_SYMBOL_GPL(rfkill_get_global_state);
+
+/**
  * rfkill_force_state - Force the internal rfkill radio state
  * @rfkill: pointer to the rfkill class to modify.
  * @state: the current radio state the class should be forced to.
@@ -431,9 +479,15 @@ static ssize_t rfkill_state_store(struct device *dev,
             state != RFKILL_STATE_SOFT_BLOCKED)
                 return -EINVAL;
 
-        if (mutex_lock_interruptible(&rfkill->mutex))
-                return -ERESTARTSYS;
-        error = rfkill_toggle_radio(rfkill, state, 0);
+        error = mutex_lock_killable(&rfkill->mutex);
+        if (error)
+                return error;
+
+        if (!rfkill_epo_lock_active)
+                error = rfkill_toggle_radio(rfkill, state, 0);
+        else
+                error = -EPERM;
+
         mutex_unlock(&rfkill->mutex);
 
         return error ? error : count;
@@ -472,12 +526,12 @@ static ssize_t rfkill_claim_store(struct device *dev,
          * Take the global lock to make sure the kernel is not in
          * the middle of rfkill_switch_all
          */
-        error = mutex_lock_interruptible(&rfkill_global_mutex);
+        error = mutex_lock_killable(&rfkill_global_mutex);
         if (error)
                 return error;
 
         if (rfkill->user_claim != claim) {
-                if (!claim) {
+                if (!claim && !rfkill_epo_lock_active) {
                         mutex_lock(&rfkill->mutex);
                         rfkill_toggle_radio(rfkill,
                                         rfkill_global_states[rfkill->type].current_state,
@@ -527,8 +581,17 @@ static int rfkill_resume(struct device *dev)
 
                 dev->power.power_state.event = PM_EVENT_ON;
 
-                /* restore radio state AND notify everybody */
-                rfkill_toggle_radio(rfkill, rfkill->state, 1);
+                /*
+                 * If we are under EPO, kick transmitter offline,
+                 * otherwise restore to pre-suspend state.
+                 *
+                 * Issue a notification in any case
+                 */
+                rfkill_toggle_radio(rfkill,
+                                rfkill_epo_lock_active ?
+                                        RFKILL_STATE_SOFT_BLOCKED :
+                                        rfkill->state,
+                                1);
 
                 mutex_unlock(&rfkill->mutex);
         }
@@ -711,7 +774,7 @@ static void rfkill_led_trigger_register(struct rfkill *rfkill)
         int error;
 
         if (!rfkill->led_trigger.name)
-                rfkill->led_trigger.name = rfkill->dev.bus_id;
+                rfkill->led_trigger.name = dev_name(&rfkill->dev);
         if (!rfkill->led_trigger.activate)
                 rfkill->led_trigger.activate = rfkill_led_trigger_activate;
         error = led_trigger_register(&rfkill->led_trigger);
@@ -752,8 +815,7 @@ int __must_check rfkill_register(struct rfkill *rfkill)
                         "badly initialized rfkill struct\n"))
                 return -EINVAL;
 
-        snprintf(dev->bus_id, sizeof(dev->bus_id),
-                 "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);
+        dev_set_name(dev, "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);
 
         rfkill_led_trigger_register(rfkill);
 
@@ -833,6 +895,7 @@ int rfkill_set_default(enum rfkill_type type, enum rfkill_state state)
 
         if (!test_and_set_bit(type, rfkill_states_lockdflt)) {
                 rfkill_global_states[type].default_state = state;
+                rfkill_global_states[type].current_state = state;
                 error = 0;
         } else
                 error = -EPERM;
diff --git a/net/rose/sysctl_net_rose.c b/net/rose/sysctl_net_rose.c
index 20be3485a97f..3bfe504faf86 100644
--- a/net/rose/sysctl_net_rose.c
+++ b/net/rose/sysctl_net_rose.c
@@ -31,8 +31,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_restart_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
@@ -42,8 +42,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_call_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
@@ -53,8 +53,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_reset_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
@@ -64,8 +64,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_clear_request_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
@@ -75,8 +75,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_no_activity_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_idle,
                 .extra2         = &max_idle
         },
@@ -86,8 +86,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_ack_hold_back_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_timer,
                 .extra2         = &max_timer
         },
@@ -97,8 +97,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_routing_control,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_route,
                 .extra2         = &max_route
         },
@@ -108,8 +108,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_link_fail_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_ftimer,
                 .extra2         = &max_ftimer
         },
@@ -119,8 +119,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_maximum_vcs,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_maxvcs,
                 .extra2         = &max_maxvcs
         },
@@ -130,8 +130,8 @@ static ctl_table rose_table[] = {
                 .data           = &sysctl_rose_window_size,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &min_window,
                 .extra2         = &max_window
         },
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 32e489118beb..d7d2bed7a699 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -96,9 +96,9 @@ static int rxrpc_validate_address(struct rxrpc_sock *rx,
 
         switch (srx->transport.family) {
         case AF_INET:
-                _debug("INET: %x @ %u.%u.%u.%u",
+                _debug("INET: %x @ %pI4",
                        ntohs(srx->transport.sin.sin_port),
-                       NIPQUAD(srx->transport.sin.sin_addr));
+                       &srx->transport.sin.sin_addr);
                 if (srx->transport_len > 8)
                         memset((void *)&srx->transport + 8, 0,
                                srx->transport_len - 8);
diff --git a/net/rxrpc/ar-error.c b/net/rxrpc/ar-error.c
index 6cb3e8890e7e..d4d1ae26d293 100644
--- a/net/rxrpc/ar-error.c
+++ b/net/rxrpc/ar-error.c
@@ -49,8 +49,7 @@ void rxrpc_UDP_error_report(struct sock *sk)
         addr = *(__be32 *)(skb_network_header(skb) + serr->addr_offset);
         port = serr->port;
 
-        _net("Rx UDP Error from "NIPQUAD_FMT":%hu",
-             NIPQUAD(addr), ntohs(port));
+        _net("Rx UDP Error from %pI4:%hu", &addr, ntohs(port));
         _debug("Msg l:%d d:%d", skb->len, skb->data_len);
 
         peer = rxrpc_find_peer(local, addr, port);
diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
index f3a2bd747a8f..807535ff29b5 100644
--- a/net/rxrpc/ar-local.c
+++ b/net/rxrpc/ar-local.c
@@ -131,10 +131,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct sockaddr_rxrpc *srx)
         struct rxrpc_local *local;
         int ret;
 
-        _enter("{%d,%u,%u.%u.%u.%u+%hu}",
+        _enter("{%d,%u,%pI4+%hu}",
                srx->transport_type,
                srx->transport.family,
-               NIPQUAD(srx->transport.sin.sin_addr),
+               &srx->transport.sin.sin_addr,
                ntohs(srx->transport.sin.sin_port));
 
         down_write(&rxrpc_local_sem);
@@ -143,10 +143,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct sockaddr_rxrpc *srx)
         read_lock_bh(&rxrpc_local_lock);
 
         list_for_each_entry(local, &rxrpc_locals, link) {
-                _debug("CMP {%d,%u,%u.%u.%u.%u+%hu}",
+                _debug("CMP {%d,%u,%pI4+%hu}",
                        local->srx.transport_type,
                        local->srx.transport.family,
-                       NIPQUAD(local->srx.transport.sin.sin_addr),
+                       &local->srx.transport.sin.sin_addr,
                        ntohs(local->srx.transport.sin.sin_port));
 
                 if (local->srx.transport_type != srx->transport_type ||
@@ -188,11 +188,11 @@ struct rxrpc_local *rxrpc_lookup_local(struct sockaddr_rxrpc *srx)
 
         up_write(&rxrpc_local_sem);
 
-        _net("LOCAL new %d {%d,%u,%u.%u.%u.%u+%hu}",
+        _net("LOCAL new %d {%d,%u,%pI4+%hu}",
              local->debug_id,
              local->srx.transport_type,
              local->srx.transport.family,
-             NIPQUAD(local->srx.transport.sin.sin_addr),
+             &local->srx.transport.sin.sin_addr,
              ntohs(local->srx.transport.sin.sin_port));
 
         _leave(" = %p [new]", local);
@@ -203,11 +203,11 @@ found_local:
         read_unlock_bh(&rxrpc_local_lock);
         up_write(&rxrpc_local_sem);
 
-        _net("LOCAL old %d {%d,%u,%u.%u.%u.%u+%hu}",
+        _net("LOCAL old %d {%d,%u,%pI4+%hu}",
              local->debug_id,
              local->srx.transport_type,
              local->srx.transport.family,
-             NIPQUAD(local->srx.transport.sin.sin_addr),
+             &local->srx.transport.sin.sin_addr,
              ntohs(local->srx.transport.sin.sin_port));
 
         _leave(" = %p [reuse]", local);
diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
index 2abe2081a5e8..edc026c1eb76 100644
--- a/net/rxrpc/ar-peer.c
+++ b/net/rxrpc/ar-peer.c
@@ -123,10 +123,10 @@ struct rxrpc_peer *rxrpc_get_peer(struct sockaddr_rxrpc *srx, gfp_t gfp)
         const char *new = "old";
         int usage;
 
-        _enter("{%d,%d,%u.%u.%u.%u+%hu}",
+        _enter("{%d,%d,%pI4+%hu}",
                srx->transport_type,
                srx->transport_len,
-               NIPQUAD(srx->transport.sin.sin_addr),
+               &srx->transport.sin.sin_addr,
                ntohs(srx->transport.sin.sin_port));
 
         /* search the peer list first */
@@ -177,12 +177,12 @@ struct rxrpc_peer *rxrpc_get_peer(struct sockaddr_rxrpc *srx, gfp_t gfp)
         new = "new";
 
 success:
-        _net("PEER %s %d {%d,%u,%u.%u.%u.%u+%hu}",
+        _net("PEER %s %d {%d,%u,%pI4+%hu}",
              new,
              peer->debug_id,
              peer->srx.transport_type,
              peer->srx.transport.family,
-             NIPQUAD(peer->srx.transport.sin.sin_addr),
+             &peer->srx.transport.sin.sin_addr,
              ntohs(peer->srx.transport.sin.sin_port));
 
         _leave(" = %p {u=%d}", peer, atomic_read(&peer->usage));
diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
index 017322e2786d..38047f713f2c 100644
--- a/net/rxrpc/ar-proc.c
+++ b/net/rxrpc/ar-proc.c
@@ -61,12 +61,12 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
         call = list_entry(v, struct rxrpc_call, link);
         trans = call->conn->trans;
 
-        sprintf(lbuff, NIPQUAD_FMT":%u",
-                NIPQUAD(trans->local->srx.transport.sin.sin_addr),
+        sprintf(lbuff, "%pI4:%u",
+                &trans->local->srx.transport.sin.sin_addr,
                 ntohs(trans->local->srx.transport.sin.sin_port));
 
-        sprintf(rbuff, NIPQUAD_FMT":%u",
-                NIPQUAD(trans->peer->srx.transport.sin.sin_addr),
+        sprintf(rbuff, "%pI4:%u",
+                &trans->peer->srx.transport.sin.sin_addr,
                 ntohs(trans->peer->srx.transport.sin.sin_port));
 
         seq_printf(seq,
@@ -144,12 +144,12 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
         conn = list_entry(v, struct rxrpc_connection, link);
         trans = conn->trans;
 
-        sprintf(lbuff, NIPQUAD_FMT":%u",
-                NIPQUAD(trans->local->srx.transport.sin.sin_addr),
+        sprintf(lbuff, "%pI4:%u",
+                &trans->local->srx.transport.sin.sin_addr,
                 ntohs(trans->local->srx.transport.sin.sin_port));
 
-        sprintf(rbuff, NIPQUAD_FMT":%u",
-                NIPQUAD(trans->peer->srx.transport.sin.sin_addr),
+        sprintf(rbuff, "%pI4:%u",
+                &trans->peer->srx.transport.sin.sin_addr,
                 ntohs(trans->peer->srx.transport.sin.sin_port));
 
         seq_printf(seq,
diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
index 64069c8769a5..0936e1acc30e 100644
--- a/net/rxrpc/ar-transport.c
+++ b/net/rxrpc/ar-transport.c
@@ -78,10 +78,10 @@ struct rxrpc_transport *rxrpc_get_transport(struct rxrpc_local *local,
         const char *new = "old";
         int usage;
 
-        _enter("{%u.%u.%u.%u+%hu},{%u.%u.%u.%u+%hu},",
-               NIPQUAD(local->srx.transport.sin.sin_addr),
+        _enter("{%pI4+%hu},{%pI4+%hu},",
+               &local->srx.transport.sin.sin_addr,
                ntohs(local->srx.transport.sin.sin_port),
-               NIPQUAD(peer->srx.transport.sin.sin_addr),
+               &peer->srx.transport.sin.sin_addr,
                ntohs(peer->srx.transport.sin.sin_port));
 
         /* search the transport list first */
@@ -149,10 +149,10 @@ struct rxrpc_transport *rxrpc_find_transport(struct rxrpc_local *local,
 {
         struct rxrpc_transport *trans;
 
-        _enter("{%u.%u.%u.%u+%hu},{%u.%u.%u.%u+%hu},",
-               NIPQUAD(local->srx.transport.sin.sin_addr),
+        _enter("{%pI4+%hu},{%pI4+%hu},",
+               &local->srx.transport.sin.sin_addr,
                ntohs(local->srx.transport.sin.sin_port),
-               NIPQUAD(peer->srx.transport.sin.sin_addr),
+               &peer->srx.transport.sin.sin_addr,
                ntohs(peer->srx.transport.sin.sin_port));
 
         /* search the transport list */
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index ba3f6e49fddc..ef8f91030a15 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -897,7 +897,7 @@ static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
         /* get the IPv4 address of the entity that requested the ticket */
         memcpy(&addr, p, sizeof(addr));
         p += 4;
-        _debug("KIV ADDR : "NIPQUAD_FMT, NIPQUAD(addr));
+        _debug("KIV ADDR : %pI4", &addr);
 
         /* get the session key from the ticket */
         memcpy(&key, p, sizeof(key));
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 6767e54155db..4f7ef0db302b 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -194,6 +194,17 @@ config NET_SCH_NETEM
 
           If unsure, say N.
 
+config NET_SCH_DRR
+        tristate "Deficit Round Robin scheduler (DRR)"
+        help
+          Say Y here if you want to use the Deficit Round Robin (DRR) packet
+          scheduling algorithm.
+
+          To compile this driver as a module, choose M here: the module
+          will be called sch_drr.
+
+          If unsure, say N.
+
 config NET_SCH_INGRESS
         tristate "Ingress Qdisc"
         depends on NET_CLS_ACT
@@ -316,6 +327,17 @@ config NET_CLS_FLOW
           To compile this code as a module, choose M here: the
           module will be called cls_flow.
 
+config NET_CLS_CGROUP
+        bool "Control Group Classifier"
+        select NET_CLS
+        depends on CGROUPS
+        ---help---
+          Say Y here if you want to classify packets based on the control
+          cgroup of their process.
+
+          To compile this code as a module, choose M here: the
+          module will be called cls_cgroup.
+
 config NET_EMATCH
         bool "Extended Matches"
         select NET_CLS
diff --git a/net/sched/Makefile b/net/sched/Makefile
index e60c9925b269..54d950cd4b8d 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_NET_SCH_PRIO)	+= sch_prio.o
 obj-$(CONFIG_NET_SCH_MULTIQ)    += sch_multiq.o
 obj-$(CONFIG_NET_SCH_ATM)       += sch_atm.o
 obj-$(CONFIG_NET_SCH_NETEM)     += sch_netem.o
+obj-$(CONFIG_NET_SCH_DRR)       += sch_drr.o
 obj-$(CONFIG_NET_CLS_U32)       += cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)    += cls_route.o
 obj-$(CONFIG_NET_CLS_FW)        += cls_fw.o
@@ -38,6 +39,7 @@ obj-$(CONFIG_NET_CLS_TCINDEX)	+= cls_tcindex.o
 obj-$(CONFIG_NET_CLS_RSVP6)     += cls_rsvp6.o
 obj-$(CONFIG_NET_CLS_BASIC)     += cls_basic.o
 obj-$(CONFIG_NET_CLS_FLOW)      += cls_flow.o
+obj-$(CONFIG_NET_CLS_CGROUP)    += cls_cgroup.o
 obj-$(CONFIG_NET_EMATCH)        += ematch.o
 obj-$(CONFIG_NET_EMATCH_CMP)    += em_cmp.o
 obj-$(CONFIG_NET_EMATCH_NBYTE)  += em_nbyte.o
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 16e7ac9774e5..173fcc4b050d 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -531,7 +531,8 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
         if (src->action) {
                 struct tc_action *act;
                 tcf_tree_lock(tp);
-                act = xchg(&dst->action, src->action);
+                act = dst->action;
+                dst->action = src->action;
                 tcf_tree_unlock(tp);
                 if (act)
                         tcf_action_destroy(act, TCA_ACT_UNBIND);
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 956915c217d6..4e2bda854119 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -102,7 +102,7 @@ static inline void basic_delete_filter(struct tcf_proto *tp,
 
 static void basic_destroy(struct tcf_proto *tp)
 {
-        struct basic_head *head = (struct basic_head *) xchg(&tp->root, NULL);
+        struct basic_head *head = tp->root;
         struct basic_filter *f, *n;
 
         list_for_each_entry_safe(f, n, &head->flist, link) {
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
new file mode 100644
index 000000000000..0d68b1975983
--- /dev/null
+++ b/net/sched/cls_cgroup.c
@@ -0,0 +1,288 @@
+/*
+ * net/sched/cls_cgroup.c       Control Group Classifier
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ * Authors:     Thomas Graf <tgraf@suug.ch>
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+#include <linux/cgroup.h>
+#include <net/rtnetlink.h>
+#include <net/pkt_cls.h>
+
+struct cgroup_cls_state
+{
+        struct cgroup_subsys_state css;
+        u32 classid;
+};
+
+static inline struct cgroup_cls_state *net_cls_state(struct cgroup *cgrp)
+{
+        return (struct cgroup_cls_state *)
+                cgroup_subsys_state(cgrp, net_cls_subsys_id);
+}
+
+static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
+                                                 struct cgroup *cgrp)
+{
+        struct cgroup_cls_state *cs;
+
+        if (!(cs = kzalloc(sizeof(*cs), GFP_KERNEL)))
+                return ERR_PTR(-ENOMEM);
+
+        if (cgrp->parent)
+                cs->classid = net_cls_state(cgrp->parent)->classid;
+
+        return &cs->css;
+}
+
+static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp)
+{
+        kfree(ss);
+}
+
+static u64 read_classid(struct cgroup *cgrp, struct cftype *cft)
+{
+        return net_cls_state(cgrp)->classid;
+}
+
+static int write_classid(struct cgroup *cgrp, struct cftype *cft, u64 value)
+{
+        if (!cgroup_lock_live_group(cgrp))
+                return -ENODEV;
+
+        net_cls_state(cgrp)->classid = (u32) value;
+
+        cgroup_unlock();
+
+        return 0;
+}
+
+static struct cftype ss_files[] = {
+        {
+                .name = "classid",
+                .read_u64 = read_classid,
+                .write_u64 = write_classid,
+        },
+};
+
+static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp)
+{
+        return cgroup_add_files(cgrp, ss, ss_files, ARRAY_SIZE(ss_files));
+}
+
+struct cgroup_subsys net_cls_subsys = {
+        .name           = "net_cls",
+        .create         = cgrp_create,
+        .destroy        = cgrp_destroy,
+        .populate       = cgrp_populate,
+        .subsys_id      = net_cls_subsys_id,
+};
+
+struct cls_cgroup_head
+{
+        u32                     handle;
+        struct tcf_exts         exts;
+        struct tcf_ematch_tree  ematches;
+};
+
+static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp,
+                               struct tcf_result *res)
+{
+        struct cls_cgroup_head *head = tp->root;
+        struct cgroup_cls_state *cs;
+        int ret = 0;
+
+        /*
+         * Due to the nature of the classifier it is required to ignore all
+         * packets originating from softirq context as accessing `current'
+         * would lead to false results.
+         *
+         * This test assumes that all callers of dev_queue_xmit() explicitely
+         * disable bh. Knowing this, it is possible to detect softirq based
+         * calls by looking at the number of nested bh disable calls because
+         * softirqs always disables bh.
+         */
+        if (softirq_count() != SOFTIRQ_OFFSET)
+                return -1;
+
+        rcu_read_lock();
+        cs = (struct cgroup_cls_state *) task_subsys_state(current,
+                                                           net_cls_subsys_id);
+        if (cs->classid && tcf_em_tree_match(skb, &head->ematches, NULL)) {
+                res->classid = cs->classid;
+                res->class = 0;
+                ret = tcf_exts_exec(skb, &head->exts, res);
+        } else
+                ret = -1;
+
+        rcu_read_unlock();
+
+        return ret;
+}
+
+static unsigned long cls_cgroup_get(struct tcf_proto *tp, u32 handle)
+{
+        return 0UL;
+}
+
+static void cls_cgroup_put(struct tcf_proto *tp, unsigned long f)
+{
+}
+
+static int cls_cgroup_init(struct tcf_proto *tp)
+{
+        return 0;
+}
+
+static const struct tcf_ext_map cgroup_ext_map = {
+        .action = TCA_CGROUP_ACT,
+        .police = TCA_CGROUP_POLICE,
+};
+
+static const struct nla_policy cgroup_policy[TCA_CGROUP_MAX + 1] = {
+        [TCA_CGROUP_EMATCHES]   = { .type = NLA_NESTED },
+};
+
+static int cls_cgroup_change(struct tcf_proto *tp, unsigned long base,
+                             u32 handle, struct nlattr **tca,
+                             unsigned long *arg)
+{
+        struct nlattr *tb[TCA_CGROUP_MAX+1];
+        struct cls_cgroup_head *head = tp->root;
+        struct tcf_ematch_tree t;
+        struct tcf_exts e;
+        int err;
+
+        if (head == NULL) {
+                if (!handle)
+                        return -EINVAL;
+
+                head = kzalloc(sizeof(*head), GFP_KERNEL);
+                if (head == NULL)
+                        return -ENOBUFS;
+
+                head->handle = handle;
+
+                tcf_tree_lock(tp);
+                tp->root = head;
+                tcf_tree_unlock(tp);
+        }
+
+        if (handle != head->handle)
+                return -ENOENT;
+
+        err = nla_parse_nested(tb, TCA_CGROUP_MAX, tca[TCA_OPTIONS],
+                               cgroup_policy);
+        if (err < 0)
+                return err;
+
+        err = tcf_exts_validate(tp, tb, tca[TCA_RATE], &e, &cgroup_ext_map);
+        if (err < 0)
+                return err;
+
+        err = tcf_em_tree_validate(tp, tb[TCA_CGROUP_EMATCHES], &t);
+        if (err < 0)
+                return err;
+
+        tcf_exts_change(tp, &head->exts, &e);
+        tcf_em_tree_change(tp, &head->ematches, &t);
+
+        return 0;
+}
+
+static void cls_cgroup_destroy(struct tcf_proto *tp)
+{
+        struct cls_cgroup_head *head = tp->root;
+
+        if (head) {
+                tcf_exts_destroy(tp, &head->exts);
+                tcf_em_tree_destroy(tp, &head->ematches);
+                kfree(head);
+        }
+}
+
+static int cls_cgroup_delete(struct tcf_proto *tp, unsigned long arg)
+{
+        return -EOPNOTSUPP;
+}
+
+static void cls_cgroup_walk(struct tcf_proto *tp, struct tcf_walker *arg)
+{
+        struct cls_cgroup_head *head = tp->root;
+
+        if (arg->count < arg->skip)
+                goto skip;
+
+        if (arg->fn(tp, (unsigned long) head, arg) < 0) {
+                arg->stop = 1;
+                return;
+        }
+skip:
+        arg->count++;
+}
+
+static int cls_cgroup_dump(struct tcf_proto *tp, unsigned long fh,
+                           struct sk_buff *skb, struct tcmsg *t)
+{
+        struct cls_cgroup_head *head = tp->root;
+        unsigned char *b = skb_tail_pointer(skb);
+        struct nlattr *nest;
+
+        t->tcm_handle = head->handle;
+
+        nest = nla_nest_start(skb, TCA_OPTIONS);
+        if (nest == NULL)
+                goto nla_put_failure;
+
+        if (tcf_exts_dump(skb, &head->exts, &cgroup_ext_map) < 0 ||
+            tcf_em_tree_dump(skb, &head->ematches, TCA_CGROUP_EMATCHES) < 0)
+                goto nla_put_failure;
+
+        nla_nest_end(skb, nest);
+
+        if (tcf_exts_dump_stats(skb, &head->exts, &cgroup_ext_map) < 0)
+                goto nla_put_failure;
+
+        return skb->len;
+
+nla_put_failure:
+        nlmsg_trim(skb, b);
+        return -1;
+}
+
+static struct tcf_proto_ops cls_cgroup_ops __read_mostly = {
+        .kind           =       "cgroup",
+        .init           =       cls_cgroup_init,
+        .change         =       cls_cgroup_change,
+        .classify       =       cls_cgroup_classify,
+        .destroy        =       cls_cgroup_destroy,
+        .get            =       cls_cgroup_get,
+        .put            =       cls_cgroup_put,
+        .delete         =       cls_cgroup_delete,
+        .walk           =       cls_cgroup_walk,
+        .dump           =       cls_cgroup_dump,
+        .owner          =       THIS_MODULE,
+};
+
+static int __init init_cgroup_cls(void)
+{
+        return register_tcf_proto_ops(&cls_cgroup_ops);
+}
+
+static void __exit exit_cgroup_cls(void)
+{
+        unregister_tcf_proto_ops(&cls_cgroup_ops);
+}
+
+module_init(init_cgroup_cls);
+module_exit(exit_cgroup_cls);
+MODULE_LICENSE("GPL");
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index b0f90e593af0..6d6e87585fb1 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -148,7 +148,7 @@ fw_delete_filter(struct tcf_proto *tp, struct fw_filter *f)
 
 static void fw_destroy(struct tcf_proto *tp)
 {
-        struct fw_head *head = (struct fw_head*)xchg(&tp->root, NULL);
+        struct fw_head *head = tp->root;
         struct fw_filter *f;
         int h;
 
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index e3d8455eebc2..bdf1f4172eef 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -260,7 +260,7 @@ route4_delete_filter(struct tcf_proto *tp, struct route4_filter *f)
 
 static void route4_destroy(struct tcf_proto *tp)
 {
-        struct route4_head *head = xchg(&tp->root, NULL);
+        struct route4_head *head = tp->root;
         int h1, h2;
 
         if (head == NULL)
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 7a7bff5ded24..e806f2314b5e 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -13,12 +13,6 @@
 #include <net/netlink.h>
 #include <net/pkt_cls.h>
 
-
-/*
- * Not quite sure if we need all the xchgs Alexey uses when accessing things.
- * Can always add them later ... :)
- */
-
 /*
  * Passing parameters to the root seems to be done more awkwardly than really
  * necessary. At least, u32 doesn't seem to use such dirty hacks. To be
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 246f9065ce34..05d178008cbc 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -387,7 +387,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
 static void u32_destroy(struct tcf_proto *tp)
 {
         struct tc_u_common *tp_c = tp->data;
-        struct tc_u_hnode *root_ht = xchg(&tp->root, NULL);
+        struct tc_u_hnode *root_ht = tp->root;
 
         WARN_ON(root_ht == NULL);
 
@@ -479,7 +479,7 @@ static int u32_set_parms(struct tcf_proto *tp, unsigned long base,
         err = -EINVAL;
         if (tb[TCA_U32_LINK]) {
                 u32 handle = nla_get_u32(tb[TCA_U32_LINK]);
-                struct tc_u_hnode *ht_down = NULL;
+                struct tc_u_hnode *ht_down = NULL, *ht_old;
 
                 if (TC_U32_KEY(handle))
                         goto errout;
@@ -493,11 +493,12 @@ static int u32_set_parms(struct tcf_proto *tp, unsigned long base,
                 }
 
                 tcf_tree_lock(tp);
-                ht_down = xchg(&n->ht_down, ht_down);
+                ht_old = n->ht_down;
+                n->ht_down = ht_down;
                 tcf_tree_unlock(tp);
 
-                if (ht_down)
-                        ht_down->refcnt--;
+                if (ht_old)
+                        ht_old->refcnt--;
         }
         if (tb[TCA_U32_CLASSID]) {
                 n->res.classid = nla_get_u32(tb[TCA_U32_CLASSID]);
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index e82519e548d7..aab59409728b 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -71,7 +71,7 @@
  *
  *      static void __exit exit_my_ematch(void)
  *      {
- *              return tcf_em_unregister(&my_ops);
+ *              tcf_em_unregister(&my_ops);
  *      }
  *
  *      module_init(init_my_ematch);
@@ -154,23 +154,11 @@ EXPORT_SYMBOL(tcf_em_register);
  *
  * Returns -ENOENT if no matching ematch was found.
  */
-int tcf_em_unregister(struct tcf_ematch_ops *ops)
+void tcf_em_unregister(struct tcf_ematch_ops *ops)
 {
-        int err = 0;
-        struct tcf_ematch_ops *e;
-
         write_lock(&ematch_mod_lock);
-        list_for_each_entry(e, &ematch_ops, link) {
-                if (e == ops) {
-                        list_del(&e->link);
-                        goto out;
-                }
-        }
-
-        err = -ENOENT;
-out:
+        list_del(&ops->link);
         write_unlock(&ematch_mod_lock);
-        return err;
 }
 EXPORT_SYMBOL(tcf_em_unregister);
 
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 6ab4a2f92ca0..1ef25e6ee1f9 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -97,10 +97,9 @@ static int tclass_notify(struct sk_buff *oskb, struct nlmsghdr *n,
 
    Auxiliary routines:
 
-   ---requeue
+   ---peek
 
-   requeues once dequeued packet. It is used for non-standard or
-   just buggy devices, which can defer output even if netif_queue_stopped()=0.
+   like dequeue but without removing a packet from the queue
 
    ---reset
 
@@ -147,8 +146,14 @@ int register_qdisc(struct Qdisc_ops *qops)
 
         if (qops->enqueue == NULL)
                 qops->enqueue = noop_qdisc_ops.enqueue;
-        if (qops->requeue == NULL)
-                qops->requeue = noop_qdisc_ops.requeue;
+        if (qops->peek == NULL) {
+                if (qops->dequeue == NULL) {
+                        qops->peek = noop_qdisc_ops.peek;
+                } else {
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
         if (qops->dequeue == NULL)
                 qops->dequeue = noop_qdisc_ops.dequeue;
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 43d37256c15e..2a8b83af7c47 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -62,7 +62,7 @@ struct atm_qdisc_data {
         struct atm_flow_data    link;           /* unclassified skbs go here */
         struct atm_flow_data    *flows;         /* NB: "link" is also on this
                                                    list */
-        struct tasklet_struct   task;           /* requeue tasklet */
+        struct tasklet_struct   task;           /* dequeue tasklet */
 };
 
 /* ------------------------- Class/flow operations ------------------------- */
@@ -102,7 +102,8 @@ static int atm_tc_graft(struct Qdisc *sch, unsigned long arg,
                 return -EINVAL;
         if (!new)
                 new = &noop_qdisc;
-        *old = xchg(&flow->q, new);
+        *old = flow->q;
+        flow->q = new;
         if (*old)
                 qdisc_reset(*old);
         return 0;
@@ -480,11 +481,14 @@ static void sch_atm_dequeue(unsigned long data)
                  * If traffic is properly shaped, this won't generate nasty
                  * little bursts. Otherwise, it may ... (but that's okay)
                  */
-                while ((skb = flow->q->dequeue(flow->q))) {
-                        if (!atm_may_send(flow->vcc, skb->truesize)) {
-                                (void)flow->q->ops->requeue(skb, flow->q);
+                while ((skb = flow->q->ops->peek(flow->q))) {
+                        if (!atm_may_send(flow->vcc, skb->truesize))
                                 break;
-                        }
+
+                        skb = qdisc_dequeue_peeked(flow->q);
+                        if (unlikely(!skb))
+                                break;
+
                         pr_debug("atm_tc_dequeue: sending on class %p\n", flow);
                         /* remove any LL header somebody else has attached */
                         skb_pull(skb, skb_network_offset(skb));
@@ -516,27 +520,19 @@ static struct sk_buff *atm_tc_dequeue(struct Qdisc *sch)
 
         pr_debug("atm_tc_dequeue(sch %p,[qdisc %p])\n", sch, p);
         tasklet_schedule(&p->task);
-        skb = p->link.q->dequeue(p->link.q);
+        skb = qdisc_dequeue_peeked(p->link.q);
         if (skb)
                 sch->q.qlen--;
         return skb;
 }
 
-static int atm_tc_requeue(struct sk_buff *skb, struct Qdisc *sch)
+static struct sk_buff *atm_tc_peek(struct Qdisc *sch)
 {
         struct atm_qdisc_data *p = qdisc_priv(sch);
-        int ret;
 
-        pr_debug("atm_tc_requeue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
-        ret = p->link.q->ops->requeue(skb, p->link.q);
-        if (!ret) {
-                sch->q.qlen++;
-                sch->qstats.requeues++;
-        } else if (net_xmit_drop_count(ret)) {
-                sch->qstats.drops++;
-                p->link.qstats.drops++;
-        }
-        return ret;
+        pr_debug("atm_tc_peek(sch %p,[qdisc %p])\n", sch, p);
+
+        return p->link.q->ops->peek(p->link.q);
 }
 
 static unsigned int atm_tc_drop(struct Qdisc *sch)
@@ -694,7 +690,7 @@ static struct Qdisc_ops atm_qdisc_ops __read_mostly = {
         .priv_size      = sizeof(struct atm_qdisc_data),
         .enqueue        = atm_tc_enqueue,
         .dequeue        = atm_tc_dequeue,
-        .requeue        = atm_tc_requeue,
+        .peek           = atm_tc_peek,
         .drop           = atm_tc_drop,
         .init           = atm_tc_init,
         .reset          = atm_tc_reset,
diff --git a/net/sched/sch_blackhole.c b/net/sched/sch_blackhole.c
index 507fb488bc98..094a874b48bc 100644
--- a/net/sched/sch_blackhole.c
+++ b/net/sched/sch_blackhole.c
@@ -33,6 +33,7 @@ static struct Qdisc_ops blackhole_qdisc_ops __read_mostly = {
         .priv_size      = 0,
         .enqueue        = blackhole_enqueue,
         .dequeue        = blackhole_dequeue,
+        .peek           = blackhole_dequeue,
         .owner          = THIS_MODULE,
 };
 
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 03e389e8d945..3a9569a3396c 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -405,40 +405,6 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         return ret;
 }
 
-static int
-cbq_requeue(struct sk_buff *skb, struct Qdisc *sch)
-{
-        struct cbq_sched_data *q = qdisc_priv(sch);
-        struct cbq_class *cl;
-        int ret;
-
-        if ((cl = q->tx_class) == NULL) {
-                kfree_skb(skb);
-                sch->qstats.drops++;
-                return NET_XMIT_CN;
-        }
-        q->tx_class = NULL;
-
-        cbq_mark_toplevel(q, cl);
-
-#ifdef CONFIG_NET_CLS_ACT
-        q->rx_class = cl;
-        cl->q->__parent = sch;
-#endif
-        if ((ret = cl->q->ops->requeue(skb, cl->q)) == 0) {
-                sch->q.qlen++;
-                sch->qstats.requeues++;
-                if (!cl->next_alive)
-                        cbq_activate_class(cl);
-                return 0;
-        }
-        if (net_xmit_drop_count(ret)) {
-                sch->qstats.drops++;
-                cl->qstats.drops++;
-        }
-        return ret;
-}
-
 /* Overlimit actions */
 
 /* TC_CBQ_OVL_CLASSIC: (default) penalize leaf class by adding offtime */
@@ -1669,7 +1635,8 @@ static int cbq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 #endif
                 }
                 sch_tree_lock(sch);
-                *old = xchg(&cl->q, new);
+                *old = cl->q;
+                cl->q = new;
                 qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
                 qdisc_reset(*old);
                 sch_tree_unlock(sch);
@@ -1810,8 +1777,8 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
                         cbq_deactivate_class(cl);
 
                 if (rtab) {
-                        rtab = xchg(&cl->R_tab, rtab);
-                        qdisc_put_rtab(rtab);
+                        qdisc_put_rtab(cl->R_tab);
+                        cl->R_tab = rtab;
                 }
 
                 if (tb[TCA_CBQ_LSSOPT])
@@ -2066,7 +2033,7 @@ static struct Qdisc_ops cbq_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct cbq_sched_data),
         .enqueue        =       cbq_enqueue,
         .dequeue        =       cbq_dequeue,
-        .requeue        =       cbq_requeue,
+        .peek           =       qdisc_peek_dequeued,
         .drop           =       cbq_drop,
         .init           =       cbq_init,
         .reset          =       cbq_reset,
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
new file mode 100644
index 000000000000..8d523d9b636c
--- /dev/null
+++ b/net/sched/sch_drr.c
@@ -0,0 +1,506 @@
+/*
+ * net/sched/sch_drr.c         Deficit Round Robin scheduler
+ *
+ * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/pkt_sched.h>
+#include <net/sch_generic.h>
+#include <net/pkt_sched.h>
+#include <net/pkt_cls.h>
+
+struct drr_class {
+        struct Qdisc_class_common       common;
+        unsigned int                    refcnt;
+        unsigned int                    filter_cnt;
+
+        struct gnet_stats_basic         bstats;
+        struct gnet_stats_queue         qstats;
+        struct gnet_stats_rate_est      rate_est;
+        struct list_head                alist;
+        struct Qdisc                    *qdisc;
+
+        u32                             quantum;
+        u32                             deficit;
+};
+
+struct drr_sched {
+        struct list_head                active;
+        struct tcf_proto                *filter_list;
+        struct Qdisc_class_hash         clhash;
+};
+
+static struct drr_class *drr_find_class(struct Qdisc *sch, u32 classid)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct Qdisc_class_common *clc;
+
+        clc = qdisc_class_find(&q->clhash, classid);
+        if (clc == NULL)
+                return NULL;
+        return container_of(clc, struct drr_class, common);
+}
+
+static void drr_purge_queue(struct drr_class *cl)
+{
+        unsigned int len = cl->qdisc->q.qlen;
+
+        qdisc_reset(cl->qdisc);
+        qdisc_tree_decrease_qlen(cl->qdisc, len);
+}
+
+static const struct nla_policy drr_policy[TCA_DRR_MAX + 1] = {
+        [TCA_DRR_QUANTUM]       = { .type = NLA_U32 },
+};
+
+static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+                            struct nlattr **tca, unsigned long *arg)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl = (struct drr_class *)*arg;
+        struct nlattr *tb[TCA_DRR_MAX + 1];
+        u32 quantum;
+        int err;
+
+        err = nla_parse_nested(tb, TCA_DRR_MAX, tca[TCA_OPTIONS], drr_policy);
+        if (err < 0)
+                return err;
+
+        if (tb[TCA_DRR_QUANTUM]) {
+                quantum = nla_get_u32(tb[TCA_DRR_QUANTUM]);
+                if (quantum == 0)
+                        return -EINVAL;
+        } else
+                quantum = psched_mtu(qdisc_dev(sch));
+
+        if (cl != NULL) {
+                sch_tree_lock(sch);
+                if (tb[TCA_DRR_QUANTUM])
+                        cl->quantum = quantum;
+                sch_tree_unlock(sch);
+
+                if (tca[TCA_RATE])
+                        gen_replace_estimator(&cl->bstats, &cl->rate_est,
+                                              qdisc_root_sleeping_lock(sch),
+                                              tca[TCA_RATE]);
+                return 0;
+        }
+
+        cl = kzalloc(sizeof(struct drr_class), GFP_KERNEL);
+        if (cl == NULL)
+                return -ENOBUFS;
+
+        cl->refcnt         = 1;
+        cl->common.classid = classid;
+        cl->quantum        = quantum;
+        cl->qdisc          = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
+                                               &pfifo_qdisc_ops, classid);
+        if (cl->qdisc == NULL)
+                cl->qdisc = &noop_qdisc;
+
+        if (tca[TCA_RATE])
+                gen_replace_estimator(&cl->bstats, &cl->rate_est,
+                                      qdisc_root_sleeping_lock(sch),
+                                      tca[TCA_RATE]);
+
+        sch_tree_lock(sch);
+        qdisc_class_hash_insert(&q->clhash, &cl->common);
+        sch_tree_unlock(sch);
+
+        qdisc_class_hash_grow(sch, &q->clhash);
+
+        *arg = (unsigned long)cl;
+        return 0;
+}
+
+static void drr_destroy_class(struct Qdisc *sch, struct drr_class *cl)
+{
+        gen_kill_estimator(&cl->bstats, &cl->rate_est);
+        qdisc_destroy(cl->qdisc);
+        kfree(cl);
+}
+
+static int drr_delete_class(struct Qdisc *sch, unsigned long arg)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl = (struct drr_class *)arg;
+
+        if (cl->filter_cnt > 0)
+                return -EBUSY;
+
+        sch_tree_lock(sch);
+
+        drr_purge_queue(cl);
+        qdisc_class_hash_remove(&q->clhash, &cl->common);
+
+        if (--cl->refcnt == 0)
+                drr_destroy_class(sch, cl);
+
+        sch_tree_unlock(sch);
+        return 0;
+}
+
+static unsigned long drr_get_class(struct Qdisc *sch, u32 classid)
+{
+        struct drr_class *cl = drr_find_class(sch, classid);
+
+        if (cl != NULL)
+                cl->refcnt++;
+
+        return (unsigned long)cl;
+}
+
+static void drr_put_class(struct Qdisc *sch, unsigned long arg)
+{
+        struct drr_class *cl = (struct drr_class *)arg;
+
+        if (--cl->refcnt == 0)
+                drr_destroy_class(sch, cl);
+}
+
+static struct tcf_proto **drr_tcf_chain(struct Qdisc *sch, unsigned long cl)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+
+        if (cl)
+                return NULL;
+
+        return &q->filter_list;
+}
+
+static unsigned long drr_bind_tcf(struct Qdisc *sch, unsigned long parent,
+                                  u32 classid)
+{
+        struct drr_class *cl = drr_find_class(sch, classid);
+
+        if (cl != NULL)
+                cl->filter_cnt++;
+
+        return (unsigned long)cl;
+}
+
+static void drr_unbind_tcf(struct Qdisc *sch, unsigned long arg)
+{
+        struct drr_class *cl = (struct drr_class *)arg;
+
+        cl->filter_cnt--;
+}
+
+static int drr_graft_class(struct Qdisc *sch, unsigned long arg,
+                           struct Qdisc *new, struct Qdisc **old)
+{
+        struct drr_class *cl = (struct drr_class *)arg;
+
+        if (new == NULL) {
+                new = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
+                                        &pfifo_qdisc_ops, cl->common.classid);
+                if (new == NULL)
+                        new = &noop_qdisc;
+        }
+
+        sch_tree_lock(sch);
+        drr_purge_queue(cl);
+        *old = cl->qdisc;
+        cl->qdisc = new;
+        sch_tree_unlock(sch);
+        return 0;
+}
+
+static struct Qdisc *drr_class_leaf(struct Qdisc *sch, unsigned long arg)
+{
+        struct drr_class *cl = (struct drr_class *)arg;
+
+        return cl->qdisc;
+}
+
+static void drr_qlen_notify(struct Qdisc *csh, unsigned long arg)
+{
+        struct drr_class *cl = (struct drr_class *)arg;
+
+        if (cl->qdisc->q.qlen == 0)
+                list_del(&cl->alist);
+}
+
+static int drr_dump_class(struct Qdisc *sch, unsigned long arg,
+                          struct sk_buff *skb, struct tcmsg *tcm)
+{
+        struct drr_class *cl = (struct drr_class *)arg;
+        struct nlattr *nest;
+
+        tcm->tcm_parent = TC_H_ROOT;
+        tcm->tcm_handle = cl->common.classid;
+        tcm->tcm_info   = cl->qdisc->handle;
+
+        nest = nla_nest_start(skb, TCA_OPTIONS);
+        if (nest == NULL)
+                goto nla_put_failure;
+        NLA_PUT_U32(skb, TCA_DRR_QUANTUM, cl->quantum);
+        return nla_nest_end(skb, nest);
+
+nla_put_failure:
+        nla_nest_cancel(skb, nest);
+        return -EMSGSIZE;
+}
+
+static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
+                                struct gnet_dump *d)
+{
+        struct drr_class *cl = (struct drr_class *)arg;
+        struct tc_drr_stats xstats;
+
+        memset(&xstats, 0, sizeof(xstats));
+        if (cl->qdisc->q.qlen)
+                xstats.deficit = cl->deficit;
+
+        if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_queue(d, &cl->qdisc->qstats) < 0)
+                return -1;
+
+        return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
+}
+
+static void drr_walk(struct Qdisc *sch, struct qdisc_walker *arg)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl;
+        struct hlist_node *n;
+        unsigned int i;
+
+        if (arg->stop)
+                return;
+
+        for (i = 0; i < q->clhash.hashsize; i++) {
+                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                        if (arg->count < arg->skip) {
+                                arg->count++;
+                                continue;
+                        }
+                        if (arg->fn(sch, (unsigned long)cl, arg) < 0) {
+                                arg->stop = 1;
+                                return;
+                        }
+                        arg->count++;
+                }
+        }
+}
+
+static struct drr_class *drr_classify(struct sk_buff *skb, struct Qdisc *sch,
+                                      int *qerr)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl;
+        struct tcf_result res;
+        int result;
+
+        if (TC_H_MAJ(skb->priority ^ sch->handle) == 0) {
+                cl = drr_find_class(sch, skb->priority);
+                if (cl != NULL)
+                        return cl;
+        }
+
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
+        result = tc_classify(skb, q->filter_list, &res);
+        if (result >= 0) {
+#ifdef CONFIG_NET_CLS_ACT
+                switch (result) {
+                case TC_ACT_QUEUED:
+                case TC_ACT_STOLEN:
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                case TC_ACT_SHOT:
+                        return NULL;
+                }
+#endif
+                cl = (struct drr_class *)res.class;
+                if (cl == NULL)
+                        cl = drr_find_class(sch, res.classid);
+                return cl;
+        }
+        return NULL;
+}
+
+static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl;
+        unsigned int len;
+        int err;
+
+        cl = drr_classify(skb, sch, &err);
+        if (cl == NULL) {
+                if (err & __NET_XMIT_BYPASS)
+                        sch->qstats.drops++;
+                kfree_skb(skb);
+                return err;
+        }
+
+        len = qdisc_pkt_len(skb);
+        err = qdisc_enqueue(skb, cl->qdisc);
+        if (unlikely(err != NET_XMIT_SUCCESS)) {
+                if (net_xmit_drop_count(err)) {
+                        cl->qstats.drops++;
+                        sch->qstats.drops++;
+                }
+                return err;
+        }
+
+        if (cl->qdisc->q.qlen == 1) {
+                list_add_tail(&cl->alist, &q->active);
+                cl->deficit = cl->quantum;
+        }
+
+        cl->bstats.packets++;
+        cl->bstats.bytes += len;
+        sch->bstats.packets++;
+        sch->bstats.bytes += len;
+
+        sch->q.qlen++;
+        return err;
+}
+
+static struct sk_buff *drr_dequeue(struct Qdisc *sch)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl;
+        struct sk_buff *skb;
+        unsigned int len;
+
+        while (!list_empty(&q->active)) {
+                cl = list_first_entry(&q->active, struct drr_class, alist);
+                skb = cl->qdisc->ops->peek(cl->qdisc);
+                if (skb == NULL)
+                        goto skip;
+
+                len = qdisc_pkt_len(skb);
+                if (len <= cl->deficit) {
+                        cl->deficit -= len;
+                        skb = qdisc_dequeue_peeked(cl->qdisc);
+                        if (cl->qdisc->q.qlen == 0)
+                                list_del(&cl->alist);
+                        sch->q.qlen--;
+                        return skb;
+                }
+
+                cl->deficit += cl->quantum;
+skip:
+                list_move_tail(&cl->alist, &q->active);
+        }
+        return NULL;
+}
+
+static unsigned int drr_drop(struct Qdisc *sch)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl;
+        unsigned int len;
+
+        list_for_each_entry(cl, &q->active, alist) {
+                if (cl->qdisc->ops->drop) {
+                        len = cl->qdisc->ops->drop(cl->qdisc);
+                        if (len > 0) {
+                                if (cl->qdisc->q.qlen == 0)
+                                        list_del(&cl->alist);
+                                return len;
+                        }
+                }
+        }
+        return 0;
+}
+
+static int drr_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        int err;
+
+        err = qdisc_class_hash_init(&q->clhash);
+        if (err < 0)
+                return err;
+        INIT_LIST_HEAD(&q->active);
+        return 0;
+}
+
+static void drr_reset_qdisc(struct Qdisc *sch)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl;
+        struct hlist_node *n;
+        unsigned int i;
+
+        for (i = 0; i < q->clhash.hashsize; i++) {
+                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                        if (cl->qdisc->q.qlen)
+                                list_del(&cl->alist);
+                        qdisc_reset(cl->qdisc);
+                }
+        }
+        sch->q.qlen = 0;
+}
+
+static void drr_destroy_qdisc(struct Qdisc *sch)
+{
+        struct drr_sched *q = qdisc_priv(sch);
+        struct drr_class *cl;
+        struct hlist_node *n, *next;
+        unsigned int i;
+
+        tcf_destroy_chain(&q->filter_list);
+
+        for (i = 0; i < q->clhash.hashsize; i++) {
+                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                                          common.hnode)
+                        drr_destroy_class(sch, cl);
+        }
+        qdisc_class_hash_destroy(&q->clhash);
+}
+
+static const struct Qdisc_class_ops drr_class_ops = {
+        .change         = drr_change_class,
+        .delete         = drr_delete_class,
+        .get            = drr_get_class,
+        .put            = drr_put_class,
+        .tcf_chain      = drr_tcf_chain,
+        .bind_tcf       = drr_bind_tcf,
+        .unbind_tcf     = drr_unbind_tcf,
+        .graft          = drr_graft_class,
+        .leaf           = drr_class_leaf,
+        .qlen_notify    = drr_qlen_notify,
+        .dump           = drr_dump_class,
+        .dump_stats     = drr_dump_class_stats,
+        .walk           = drr_walk,
+};
+
+static struct Qdisc_ops drr_qdisc_ops __read_mostly = {
+        .cl_ops         = &drr_class_ops,
+        .id             = "drr",
+        .priv_size      = sizeof(struct drr_sched),
+        .enqueue        = drr_enqueue,
+        .dequeue        = drr_dequeue,
+        .peek           = qdisc_peek_dequeued,
+        .drop           = drr_drop,
+        .init           = drr_init_qdisc,
+        .reset          = drr_reset_qdisc,
+        .destroy        = drr_destroy_qdisc,
+        .owner          = THIS_MODULE,
+};
+
+static int __init drr_init(void)
+{
+        return register_qdisc(&drr_qdisc_ops);
+}
+
+static void __exit drr_exit(void)
+{
+        unregister_qdisc(&drr_qdisc_ops);
+}
+
+module_init(drr_init);
+module_exit(drr_exit);
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index ba43aab3a851..d303daa45d49 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -68,7 +68,8 @@ static int dsmark_graft(struct Qdisc *sch, unsigned long arg,
         }
 
         sch_tree_lock(sch);
-        *old = xchg(&p->q, new);
+        *old = p->q;
+        p->q = new;
         qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
         qdisc_reset(*old);
         sch_tree_unlock(sch);
@@ -313,24 +314,13 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
         return skb;
 }
 
-static int dsmark_requeue(struct sk_buff *skb, struct Qdisc *sch)
+static struct sk_buff *dsmark_peek(struct Qdisc *sch)
 {
         struct dsmark_qdisc_data *p = qdisc_priv(sch);
-        int err;
-
-        pr_debug("dsmark_requeue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
-
-        err = p->q->ops->requeue(skb, p->q);
-        if (err != NET_XMIT_SUCCESS) {
-                if (net_xmit_drop_count(err))
-                        sch->qstats.drops++;
-                return err;
-        }
 
-        sch->q.qlen++;
-        sch->qstats.requeues++;
+        pr_debug("dsmark_peek(sch %p,[qdisc %p])\n", sch, p);
 
-        return NET_XMIT_SUCCESS;
+        return p->q->ops->peek(p->q);
 }
 
 static unsigned int dsmark_drop(struct Qdisc *sch)
@@ -496,7 +486,7 @@ static struct Qdisc_ops dsmark_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct dsmark_qdisc_data),
         .enqueue        =       dsmark_enqueue,
         .dequeue        =       dsmark_dequeue,
-        .requeue        =       dsmark_requeue,
+        .peek           =       dsmark_peek,
         .drop           =       dsmark_drop,
         .init           =       dsmark_init,
         .reset          =       dsmark_reset,
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 23d258bfe8ac..92cfc9d7e3b9 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -83,7 +83,7 @@ struct Qdisc_ops pfifo_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct fifo_sched_data),
         .enqueue        =       pfifo_enqueue,
         .dequeue        =       qdisc_dequeue_head,
-        .requeue        =       qdisc_requeue,
+        .peek           =       qdisc_peek_head,
         .drop           =       qdisc_queue_drop,
         .init           =       fifo_init,
         .reset          =       qdisc_reset_queue,
@@ -98,7 +98,7 @@ struct Qdisc_ops bfifo_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct fifo_sched_data),
         .enqueue        =       bfifo_enqueue,
         .dequeue        =       qdisc_dequeue_head,
-        .requeue        =       qdisc_requeue,
+        .peek           =       qdisc_peek_head,
         .drop           =       qdisc_queue_drop,
         .init           =       fifo_init,
         .reset          =       qdisc_reset_queue,
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index cdcd16fcfeda..5f5efe4e6072 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -224,7 +224,7 @@ static void dev_watchdog(unsigned long arg)
                                 char drivername[64];
                                 WARN_ONCE(1, KERN_INFO "NETDEV WATCHDOG: %s (%s): transmit timed out\n",
                                        dev->name, netdev_drivername(dev, drivername, 64));
-                                dev->tx_timeout(dev);
+                                dev->netdev_ops->ndo_tx_timeout(dev);
                         }
                         if (!mod_timer(&dev->watchdog_timer,
                                        round_jiffies(jiffies +
@@ -239,7 +239,7 @@ static void dev_watchdog(unsigned long arg)
 
 void __netdev_watchdog_up(struct net_device *dev)
 {
-        if (dev->tx_timeout) {
+        if (dev->netdev_ops->ndo_tx_timeout) {
                 if (dev->watchdog_timeo <= 0)
                         dev->watchdog_timeo = 5*HZ;
                 if (!mod_timer(&dev->watchdog_timer,
@@ -311,21 +311,12 @@ static struct sk_buff *noop_dequeue(struct Qdisc * qdisc)
         return NULL;
 }
 
-static int noop_requeue(struct sk_buff *skb, struct Qdisc* qdisc)
-{
-        if (net_ratelimit())
-                printk(KERN_DEBUG "%s deferred output. It is buggy.\n",
-                       skb->dev->name);
-        kfree_skb(skb);
-        return NET_XMIT_CN;
-}
-
 struct Qdisc_ops noop_qdisc_ops __read_mostly = {
         .id             =       "noop",
         .priv_size      =       0,
         .enqueue        =       noop_enqueue,
         .dequeue        =       noop_dequeue,
-        .requeue        =       noop_requeue,
+        .peek           =       noop_dequeue,
         .owner          =       THIS_MODULE,
 };
 
@@ -340,7 +331,6 @@ struct Qdisc noop_qdisc = {
         .flags          =       TCQ_F_BUILTIN,
         .ops            =       &noop_qdisc_ops,
         .list           =       LIST_HEAD_INIT(noop_qdisc.list),
-        .requeue.lock   =       __SPIN_LOCK_UNLOCKED(noop_qdisc.q.lock),
         .q.lock         =       __SPIN_LOCK_UNLOCKED(noop_qdisc.q.lock),
         .dev_queue      =       &noop_netdev_queue,
 };
@@ -351,7 +341,7 @@ static struct Qdisc_ops noqueue_qdisc_ops __read_mostly = {
         .priv_size      =       0,
         .enqueue        =       noop_enqueue,
         .dequeue        =       noop_dequeue,
-        .requeue        =       noop_requeue,
+        .peek           =       noop_dequeue,
         .owner          =       THIS_MODULE,
 };
 
@@ -367,7 +357,6 @@ static struct Qdisc noqueue_qdisc = {
         .flags          =       TCQ_F_BUILTIN,
         .ops            =       &noqueue_qdisc_ops,
         .list           =       LIST_HEAD_INIT(noqueue_qdisc.list),
-        .requeue.lock   =       __SPIN_LOCK_UNLOCKED(noqueue_qdisc.q.lock),
         .q.lock         =       __SPIN_LOCK_UNLOCKED(noqueue_qdisc.q.lock),
         .dev_queue      =       &noqueue_netdev_queue,
 };
@@ -416,10 +405,17 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc* qdisc)
         return NULL;
 }
 
-static int pfifo_fast_requeue(struct sk_buff *skb, struct Qdisc* qdisc)
+static struct sk_buff *pfifo_fast_peek(struct Qdisc* qdisc)
 {
-        qdisc->q.qlen++;
-        return __qdisc_requeue(skb, qdisc, prio2list(skb, qdisc));
+        int prio;
+        struct sk_buff_head *list = qdisc_priv(qdisc);
+
+        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++) {
+                if (!skb_queue_empty(list + prio))
+                        return skb_peek(list + prio);
+        }
+
+        return NULL;
 }
 
 static void pfifo_fast_reset(struct Qdisc* qdisc)
@@ -462,7 +458,7 @@ static struct Qdisc_ops pfifo_fast_ops __read_mostly = {
         .priv_size      =       PFIFO_FAST_BANDS * sizeof(struct sk_buff_head),
         .enqueue        =       pfifo_fast_enqueue,
         .dequeue        =       pfifo_fast_dequeue,
-        .requeue        =       pfifo_fast_requeue,
+        .peek           =       pfifo_fast_peek,
         .init           =       pfifo_fast_init,
         .reset          =       pfifo_fast_reset,
         .dump           =       pfifo_fast_dump,
@@ -488,7 +484,6 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         sch->padded = (char *) sch - (char *) p;
 
         INIT_LIST_HEAD(&sch->list);
-        skb_queue_head_init(&sch->requeue);
         skb_queue_head_init(&sch->q);
         sch->ops = ops;
         sch->enqueue = ops->enqueue;
@@ -531,6 +526,9 @@ void qdisc_reset(struct Qdisc *qdisc)
 
         if (ops->reset)
                 ops->reset(qdisc);
+
+        kfree_skb(qdisc->gso_skb);
+        qdisc->gso_skb = NULL;
 }
 EXPORT_SYMBOL(qdisc_reset);
 
@@ -557,8 +555,6 @@ void qdisc_destroy(struct Qdisc *qdisc)
         dev_put(qdisc_dev(qdisc));
 
         kfree_skb(qdisc->gso_skb);
-        __skb_queue_purge(&qdisc->requeue);
-
         kfree((char *) qdisc - qdisc->padded);
 }
 EXPORT_SYMBOL(qdisc_destroy);
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index c1ad6b8de105..40408d595c08 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -240,26 +240,6 @@ congestion_drop:
         return NET_XMIT_CN;
 }
 
-static int gred_requeue(struct sk_buff *skb, struct Qdisc* sch)
-{
-        struct gred_sched *t = qdisc_priv(sch);
-        struct gred_sched_data *q;
-        u16 dp = tc_index_to_dp(skb);
-
-        if (dp >= t->DPs || (q = t->tab[dp]) == NULL) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "GRED: Unable to relocate VQ 0x%x "
-                               "for requeue, screwing up backlog.\n",
-                               tc_index_to_dp(skb));
-        } else {
-                if (red_is_idling(&q->parms))
-                        red_end_of_idle_period(&q->parms);
-                q->backlog += qdisc_pkt_len(skb);
-        }
-
-        return qdisc_requeue(skb, sch);
-}
-
 static struct sk_buff *gred_dequeue(struct Qdisc* sch)
 {
         struct sk_buff *skb;
@@ -602,7 +582,7 @@ static struct Qdisc_ops gred_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct gred_sched),
         .enqueue        =       gred_enqueue,
         .dequeue        =       gred_dequeue,
-        .requeue        =       gred_requeue,
+        .peek           =       qdisc_peek_head,
         .drop           =       gred_drop,
         .init           =       gred_init,
         .reset          =       gred_reset,
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index c1e77da8cd09..51dd3f401623 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -184,7 +184,6 @@ struct hfsc_sched
         struct rb_root eligible;                /* eligible tree */
         struct list_head droplist;              /* active leaf class list (for
                                                    dropping) */
-        struct sk_buff_head requeue;            /* requeued packet */
         struct qdisc_watchdog watchdog;         /* watchdog timer */
 };
 
@@ -880,28 +879,20 @@ set_passive(struct hfsc_class *cl)
          */
 }
 
-/*
- * hack to get length of first packet in queue.
- */
 static unsigned int
 qdisc_peek_len(struct Qdisc *sch)
 {
         struct sk_buff *skb;
         unsigned int len;
 
-        skb = sch->dequeue(sch);
+        skb = sch->ops->peek(sch);
         if (skb == NULL) {
                 if (net_ratelimit())
                         printk("qdisc_peek_len: non work-conserving qdisc ?\n");
                 return 0;
         }
         len = qdisc_pkt_len(skb);
-        if (unlikely(sch->ops->requeue(skb, sch) != NET_XMIT_SUCCESS)) {
-                if (net_ratelimit())
-                        printk("qdisc_peek_len: failed to requeue\n");
-                qdisc_tree_decrease_qlen(sch, 1);
-                return 0;
-        }
+
         return len;
 }
 
@@ -1211,7 +1202,8 @@ hfsc_graft_class(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 
         sch_tree_lock(sch);
         hfsc_purge_queue(sch, cl);
-        *old = xchg(&cl->qdisc, new);
+        *old = cl->qdisc;
+        cl->qdisc = new;
         sch_tree_unlock(sch);
         return 0;
 }
@@ -1440,7 +1432,6 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
                 return err;
         q->eligible = RB_ROOT;
         INIT_LIST_HEAD(&q->droplist);
-        skb_queue_head_init(&q->requeue);
 
         q->root.cl_common.classid = sch->handle;
         q->root.refcnt  = 1;
@@ -1525,7 +1516,6 @@ hfsc_reset_qdisc(struct Qdisc *sch)
                 hlist_for_each_entry(cl, n, &q->clhash.hash[i], cl_common.hnode)
                         hfsc_reset_class(cl);
         }
-        __skb_queue_purge(&q->requeue);
         q->eligible = RB_ROOT;
         INIT_LIST_HEAD(&q->droplist);
         qdisc_watchdog_cancel(&q->watchdog);
@@ -1550,7 +1540,6 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
                         hfsc_destroy_class(sch, cl);
         }
         qdisc_class_hash_destroy(&q->clhash);
-        __skb_queue_purge(&q->requeue);
         qdisc_watchdog_cancel(&q->watchdog);
 }
 
@@ -1617,8 +1606,6 @@ hfsc_dequeue(struct Qdisc *sch)
 
         if (sch->q.qlen == 0)
                 return NULL;
-        if ((skb = __skb_dequeue(&q->requeue)))
-                goto out;
 
         cur_time = psched_get_time();
 
@@ -1642,7 +1629,7 @@ hfsc_dequeue(struct Qdisc *sch)
                 }
         }
 
-        skb = cl->qdisc->dequeue(cl->qdisc);
+        skb = qdisc_dequeue_peeked(cl->qdisc);
         if (skb == NULL) {
                 if (net_ratelimit())
                         printk("HFSC: Non-work-conserving qdisc ?\n");
@@ -1667,24 +1654,12 @@ hfsc_dequeue(struct Qdisc *sch)
                 set_passive(cl);
         }
 
- out:
         sch->flags &= ~TCQ_F_THROTTLED;
         sch->q.qlen--;
 
         return skb;
 }
 
-static int
-hfsc_requeue(struct sk_buff *skb, struct Qdisc *sch)
-{
-        struct hfsc_sched *q = qdisc_priv(sch);
-
-        __skb_queue_head(&q->requeue, skb);
-        sch->q.qlen++;
-        sch->qstats.requeues++;
-        return NET_XMIT_SUCCESS;
-}
-
 static unsigned int
 hfsc_drop(struct Qdisc *sch)
 {
@@ -1735,7 +1710,7 @@ static struct Qdisc_ops hfsc_qdisc_ops __read_mostly = {
         .dump           = hfsc_dump_qdisc,
         .enqueue        = hfsc_enqueue,
         .dequeue        = hfsc_dequeue,
-        .requeue        = hfsc_requeue,
+        .peek           = qdisc_peek_dequeued,
         .drop           = hfsc_drop,
         .cl_ops         = &hfsc_class_ops,
         .priv_size      = sizeof(struct hfsc_sched),
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index d14f02056ae6..3a119f576bb3 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -551,7 +551,7 @@ static inline void htb_deactivate(struct htb_sched *q, struct htb_class *cl)
 
 static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
-        int ret;
+        int uninitialized_var(ret);
         struct htb_sched *q = qdisc_priv(sch);
         struct htb_class *cl = htb_classify(skb, sch, &ret);
 
@@ -591,47 +591,6 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         return NET_XMIT_SUCCESS;
 }
 
-/* TODO: requeuing packet charges it to policers again !! */
-static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
-{
-        int ret;
-        struct htb_sched *q = qdisc_priv(sch);
-        struct htb_class *cl = htb_classify(skb, sch, &ret);
-        struct sk_buff *tskb;
-
-        if (cl == HTB_DIRECT) {
-                /* enqueue to helper queue */
-                if (q->direct_queue.qlen < q->direct_qlen) {
-                        __skb_queue_head(&q->direct_queue, skb);
-                } else {
-                        __skb_queue_head(&q->direct_queue, skb);
-                        tskb = __skb_dequeue_tail(&q->direct_queue);
-                        kfree_skb(tskb);
-                        sch->qstats.drops++;
-                        return NET_XMIT_CN;
-                }
-#ifdef CONFIG_NET_CLS_ACT
-        } else if (!cl) {
-                if (ret & __NET_XMIT_BYPASS)
-                        sch->qstats.drops++;
-                kfree_skb(skb);
-                return ret;
-#endif
-        } else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) !=
-                   NET_XMIT_SUCCESS) {
-                if (net_xmit_drop_count(ret)) {
-                        sch->qstats.drops++;
-                        cl->qstats.drops++;
-                }
-                return ret;
-        } else
-                htb_activate(q, cl);
-
-        sch->q.qlen++;
-        sch->qstats.requeues++;
-        return NET_XMIT_SUCCESS;
-}
-
 /**
  * htb_charge_class - charges amount "bytes" to leaf and ancestors
  *
@@ -1141,7 +1100,9 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
                     == NULL)
                         return -ENOBUFS;
                 sch_tree_lock(sch);
-                if ((*old = xchg(&cl->un.leaf.q, new)) != NULL) {
+                *old = cl->un.leaf.q;
+                cl->un.leaf.q = new;
+                if (*old != NULL) {
                         qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
                         qdisc_reset(*old);
                 }
@@ -1565,7 +1526,7 @@ static struct Qdisc_ops htb_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct htb_sched),
         .enqueue        =       htb_enqueue,
         .dequeue        =       htb_dequeue,
-        .requeue        =       htb_requeue,
+        .peek           =       qdisc_peek_dequeued,
         .drop           =       htb_drop,
         .init           =       htb_init,
         .reset          =       htb_reset,
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 915f3149dde2..7e151861794b 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -92,40 +92,6 @@ multiq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         return ret;
 }
 
-
-static int
-multiq_requeue(struct sk_buff *skb, struct Qdisc *sch)
-{
-        struct Qdisc *qdisc;
-        struct multiq_sched_data *q = qdisc_priv(sch);
-        int ret;
-
-        qdisc = multiq_classify(skb, sch, &ret);
-#ifdef CONFIG_NET_CLS_ACT
-        if (qdisc == NULL) {
-                if (ret & __NET_XMIT_BYPASS)
-                        sch->qstats.drops++;
-                kfree_skb(skb);
-                return ret;
-        }
-#endif
-
-        ret = qdisc->ops->requeue(skb, qdisc);
-        if (ret == NET_XMIT_SUCCESS) {
-                sch->q.qlen++;
-                sch->qstats.requeues++;
-                if (q->curband)
-                        q->curband--;
-                else
-                        q->curband = q->bands - 1;
-                return NET_XMIT_SUCCESS;
-        }
-        if (net_xmit_drop_count(ret))
-                sch->qstats.drops++;
-        return ret;
-}
-
-
 static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
 {
         struct multiq_sched_data *q = qdisc_priv(sch);
@@ -140,7 +106,7 @@ static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
                         q->curband = 0;
 
                 /* Check that target subqueue is available before
-                 * pulling an skb to avoid excessive requeues
+                 * pulling an skb to avoid head-of-line blocking.
                  */
                 if (!__netif_subqueue_stopped(qdisc_dev(sch), q->curband)) {
                         qdisc = q->queues[q->curband];
@@ -155,6 +121,34 @@ static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
 
 }
 
+static struct sk_buff *multiq_peek(struct Qdisc *sch)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        unsigned int curband = q->curband;
+        struct Qdisc *qdisc;
+        struct sk_buff *skb;
+        int band;
+
+        for (band = 0; band < q->bands; band++) {
+                /* cycle through bands to ensure fairness */
+                curband++;
+                if (curband >= q->bands)
+                        curband = 0;
+
+                /* Check that target subqueue is available before
+                 * pulling an skb to avoid head-of-line blocking.
+                 */
+                if (!__netif_subqueue_stopped(qdisc_dev(sch), curband)) {
+                        qdisc = q->queues[curband];
+                        skb = qdisc->ops->peek(qdisc);
+                        if (skb)
+                                return skb;
+                }
+        }
+        return NULL;
+
+}
+
 static unsigned int multiq_drop(struct Qdisc *sch)
 {
         struct multiq_sched_data *q = qdisc_priv(sch);
@@ -220,7 +214,8 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
         q->bands = qopt->bands;
         for (i = q->bands; i < q->max_bands; i++) {
                 if (q->queues[i] != &noop_qdisc) {
-                        struct Qdisc *child = xchg(&q->queues[i], &noop_qdisc);
+                        struct Qdisc *child = q->queues[i];
+                        q->queues[i] = &noop_qdisc;
                         qdisc_tree_decrease_qlen(child, child->q.qlen);
                         qdisc_destroy(child);
                 }
@@ -230,7 +225,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
 
         for (i = 0; i < q->bands; i++) {
                 if (q->queues[i] == &noop_qdisc) {
-                        struct Qdisc *child;
+                        struct Qdisc *child, *old;
                         child = qdisc_create_dflt(qdisc_dev(sch),
                                                   sch->dev_queue,
                                                   &pfifo_qdisc_ops,
@@ -238,12 +233,13 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
                                                             i + 1));
                         if (child) {
                                 sch_tree_lock(sch);
-                                child = xchg(&q->queues[i], child);
+                                old = q->queues[i];
+                                q->queues[i] = child;
 
-                                if (child != &noop_qdisc) {
-                                        qdisc_tree_decrease_qlen(child,
-                                                                 child->q.qlen);
-                                        qdisc_destroy(child);
+                                if (old != &noop_qdisc) {
+                                        qdisc_tree_decrease_qlen(old,
+                                                                 old->q.qlen);
+                                        qdisc_destroy(old);
                                 }
                                 sch_tree_unlock(sch);
                         }
@@ -451,7 +447,7 @@ static struct Qdisc_ops multiq_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct multiq_sched_data),
         .enqueue        =       multiq_enqueue,
         .dequeue        =       multiq_dequeue,
-        .requeue        =       multiq_requeue,
+        .peek           =       multiq_peek,
         .drop           =       multiq_drop,
         .init           =       multiq_init,
         .reset          =       multiq_reset,
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a11959908d9a..f840d6b27c65 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -233,7 +233,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                  */
                 cb->time_to_send = psched_get_time();
                 q->counter = 0;
-                ret = q->qdisc->ops->requeue(skb, q->qdisc);
+
+                __skb_queue_head(&q->qdisc->q, skb);
+                q->qdisc->qstats.backlog += qdisc_pkt_len(skb);
+                q->qdisc->qstats.requeues++;
+                ret = NET_XMIT_SUCCESS;
         }
 
         if (likely(ret == NET_XMIT_SUCCESS)) {
@@ -248,20 +252,6 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         return ret;
 }
 
-/* Requeue packets but don't change time stamp */
-static int netem_requeue(struct sk_buff *skb, struct Qdisc *sch)
-{
-        struct netem_sched_data *q = qdisc_priv(sch);
-        int ret;
-
-        if ((ret = q->qdisc->ops->requeue(skb, q->qdisc)) == 0) {
-                sch->q.qlen++;
-                sch->qstats.requeues++;
-        }
-
-        return ret;
-}
-
 static unsigned int netem_drop(struct Qdisc* sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
@@ -283,25 +273,22 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
         if (sch->flags & TCQ_F_THROTTLED)
                 return NULL;
 
-        skb = q->qdisc->dequeue(q->qdisc);
+        skb = q->qdisc->ops->peek(q->qdisc);
         if (skb) {
                 const struct netem_skb_cb *cb = netem_skb_cb(skb);
                 psched_time_t now = psched_get_time();
 
                 /* if more time remaining? */
                 if (cb->time_to_send <= now) {
+                        skb = qdisc_dequeue_peeked(q->qdisc);
+                        if (unlikely(!skb))
+                                return NULL;
+
                         pr_debug("netem_dequeue: return skb=%p\n", skb);
                         sch->q.qlen--;
                         return skb;
                 }
 
-                if (unlikely(q->qdisc->ops->requeue(skb, q->qdisc) != NET_XMIT_SUCCESS)) {
-                        qdisc_tree_decrease_qlen(q->qdisc, 1);
-                        sch->qstats.drops++;
-                        printk(KERN_ERR "netem: %s could not requeue\n",
-                               q->qdisc->ops->id);
-                }
-
                 qdisc_watchdog_schedule(&q->watchdog, cb->time_to_send);
         }
 
@@ -344,14 +331,13 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
         root_lock = qdisc_root_sleeping_lock(sch);
 
         spin_lock_bh(root_lock);
-        d = xchg(&q->delay_dist, d);
+        kfree(q->delay_dist);
+        q->delay_dist = d;
         spin_unlock_bh(root_lock);
-
-        kfree(d);
         return 0;
 }
 
-static int get_correlation(struct Qdisc *sch, const struct nlattr *attr)
+static void get_correlation(struct Qdisc *sch, const struct nlattr *attr)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
         const struct tc_netem_corr *c = nla_data(attr);
@@ -359,27 +345,24 @@ static int get_correlation(struct Qdisc *sch, const struct nlattr *attr)
         init_crandom(&q->delay_cor, c->delay_corr);
         init_crandom(&q->loss_cor, c->loss_corr);
         init_crandom(&q->dup_cor, c->dup_corr);
-        return 0;
 }
 
-static int get_reorder(struct Qdisc *sch, const struct nlattr *attr)
+static void get_reorder(struct Qdisc *sch, const struct nlattr *attr)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
         const struct tc_netem_reorder *r = nla_data(attr);
 
         q->reorder = r->probability;
         init_crandom(&q->reorder_cor, r->correlation);
-        return 0;
 }
 
-static int get_corrupt(struct Qdisc *sch, const struct nlattr *attr)
+static void get_corrupt(struct Qdisc *sch, const struct nlattr *attr)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
         const struct tc_netem_corrupt *r = nla_data(attr);
 
         q->corrupt = r->probability;
         init_crandom(&q->corrupt_cor, r->correlation);
-        return 0;
 }
 
 static const struct nla_policy netem_policy[TCA_NETEM_MAX + 1] = {
@@ -438,11 +421,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
         if (q->gap)
                 q->reorder = ~0;
 
-        if (tb[TCA_NETEM_CORR]) {
-                ret = get_correlation(sch, tb[TCA_NETEM_CORR]);
-                if (ret)
-                        return ret;
-        }
+        if (tb[TCA_NETEM_CORR])
+                get_correlation(sch, tb[TCA_NETEM_CORR]);
 
         if (tb[TCA_NETEM_DELAY_DIST]) {
                 ret = get_dist_table(sch, tb[TCA_NETEM_DELAY_DIST]);
@@ -450,17 +430,11 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
                         return ret;
         }
 
-        if (tb[TCA_NETEM_REORDER]) {
-                ret = get_reorder(sch, tb[TCA_NETEM_REORDER]);
-                if (ret)
-                        return ret;
-        }
+        if (tb[TCA_NETEM_REORDER])
+                get_reorder(sch, tb[TCA_NETEM_REORDER]);
 
-        if (tb[TCA_NETEM_CORRUPT]) {
-                ret = get_corrupt(sch, tb[TCA_NETEM_CORRUPT]);
-                if (ret)
-                        return ret;
-        }
+        if (tb[TCA_NETEM_CORRUPT])
+                get_corrupt(sch, tb[TCA_NETEM_CORRUPT]);
 
         return 0;
 }
@@ -541,7 +515,7 @@ static struct Qdisc_ops tfifo_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct fifo_sched_data),
         .enqueue        =       tfifo_enqueue,
         .dequeue        =       qdisc_dequeue_head,
-        .requeue        =       qdisc_requeue,
+        .peek           =       qdisc_peek_head,
         .drop           =       qdisc_queue_drop,
         .init           =       tfifo_init,
         .reset          =       qdisc_reset_queue,
@@ -624,99 +598,12 @@ nla_put_failure:
         return -1;
 }
 
-static int netem_dump_class(struct Qdisc *sch, unsigned long cl,
-                          struct sk_buff *skb, struct tcmsg *tcm)
-{
-        struct netem_sched_data *q = qdisc_priv(sch);
-
-        if (cl != 1)    /* only one class */
-                return -ENOENT;
-
-        tcm->tcm_handle |= TC_H_MIN(1);
-        tcm->tcm_info = q->qdisc->handle;
-
-        return 0;
-}
-
-static int netem_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
-                     struct Qdisc **old)
-{
-        struct netem_sched_data *q = qdisc_priv(sch);
-
-        if (new == NULL)
-                new = &noop_qdisc;
-
-        sch_tree_lock(sch);
-        *old = xchg(&q->qdisc, new);
-        qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
-        qdisc_reset(*old);
-        sch_tree_unlock(sch);
-
-        return 0;
-}
-
-static struct Qdisc *netem_leaf(struct Qdisc *sch, unsigned long arg)
-{
-        struct netem_sched_data *q = qdisc_priv(sch);
-        return q->qdisc;
-}
-
-static unsigned long netem_get(struct Qdisc *sch, u32 classid)
-{
-        return 1;
-}
-
-static void netem_put(struct Qdisc *sch, unsigned long arg)
-{
-}
-
-static int netem_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
-                            struct nlattr **tca, unsigned long *arg)
-{
-        return -ENOSYS;
-}
-
-static int netem_delete(struct Qdisc *sch, unsigned long arg)
-{
-        return -ENOSYS;
-}
-
-static void netem_walk(struct Qdisc *sch, struct qdisc_walker *walker)
-{
-        if (!walker->stop) {
-                if (walker->count >= walker->skip)
-                        if (walker->fn(sch, 1, walker) < 0) {
-                                walker->stop = 1;
-                                return;
-                        }
-                walker->count++;
-        }
-}
-
-static struct tcf_proto **netem_find_tcf(struct Qdisc *sch, unsigned long cl)
-{
-        return NULL;
-}
-
-static const struct Qdisc_class_ops netem_class_ops = {
-        .graft          =       netem_graft,
-        .leaf           =       netem_leaf,
-        .get            =       netem_get,
-        .put            =       netem_put,
-        .change         =       netem_change_class,
-        .delete         =       netem_delete,
-        .walk           =       netem_walk,
-        .tcf_chain      =       netem_find_tcf,
-        .dump           =       netem_dump_class,
-};
-
 static struct Qdisc_ops netem_qdisc_ops __read_mostly = {
         .id             =       "netem",
-        .cl_ops         =       &netem_class_ops,
         .priv_size      =       sizeof(struct netem_sched_data),
         .enqueue        =       netem_enqueue,
         .dequeue        =       netem_dequeue,
-        .requeue        =       netem_requeue,
+        .peek           =       qdisc_peek_dequeued,
         .drop           =       netem_drop,
         .init           =       netem_init,
         .reset          =       netem_reset,
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 504a78cdb718..94cecef70145 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -93,34 +93,20 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         return ret;
 }
 
-
-static int
-prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
+static struct sk_buff *prio_peek(struct Qdisc *sch)
 {
-        struct Qdisc *qdisc;
-        int ret;
-
-        qdisc = prio_classify(skb, sch, &ret);
-#ifdef CONFIG_NET_CLS_ACT
-        if (qdisc == NULL) {
-                if (ret & __NET_XMIT_BYPASS)
-                        sch->qstats.drops++;
-                kfree_skb(skb);
-                return ret;
-        }
-#endif
+        struct prio_sched_data *q = qdisc_priv(sch);
+        int prio;
 
-        if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) {
-                sch->q.qlen++;
-                sch->qstats.requeues++;
-                return NET_XMIT_SUCCESS;
+        for (prio = 0; prio < q->bands; prio++) {
+                struct Qdisc *qdisc = q->queues[prio];
+                struct sk_buff *skb = qdisc->ops->peek(qdisc);
+                if (skb)
+                        return skb;
         }
-        if (net_xmit_drop_count(ret))
-                sch->qstats.drops++;
-        return ret;
+        return NULL;
 }
 
-
 static struct sk_buff *prio_dequeue(struct Qdisc* sch)
 {
         struct prio_sched_data *q = qdisc_priv(sch);
@@ -201,7 +187,8 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
         memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1);
 
         for (i=q->bands; i<TCQ_PRIO_BANDS; i++) {
-                struct Qdisc *child = xchg(&q->queues[i], &noop_qdisc);
+                struct Qdisc *child = q->queues[i];
+                q->queues[i] = &noop_qdisc;
                 if (child != &noop_qdisc) {
                         qdisc_tree_decrease_qlen(child, child->q.qlen);
                         qdisc_destroy(child);
@@ -211,18 +198,19 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
 
         for (i=0; i<q->bands; i++) {
                 if (q->queues[i] == &noop_qdisc) {
-                        struct Qdisc *child;
+                        struct Qdisc *child, *old;
                         child = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
                                                   &pfifo_qdisc_ops,
                                                   TC_H_MAKE(sch->handle, i + 1));
                         if (child) {
                                 sch_tree_lock(sch);
-                                child = xchg(&q->queues[i], child);
+                                old = q->queues[i];
+                                q->queues[i] = child;
 
-                                if (child != &noop_qdisc) {
-                                        qdisc_tree_decrease_qlen(child,
-                                                                 child->q.qlen);
-                                        qdisc_destroy(child);
+                                if (old != &noop_qdisc) {
+                                        qdisc_tree_decrease_qlen(old,
+                                                                 old->q.qlen);
+                                        qdisc_destroy(old);
                                 }
                                 sch_tree_unlock(sch);
                         }
@@ -421,7 +409,7 @@ static struct Qdisc_ops prio_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct prio_sched_data),
         .enqueue        =       prio_enqueue,
         .dequeue        =       prio_dequeue,
-        .requeue        =       prio_requeue,
+        .peek           =       prio_peek,
         .drop           =       prio_drop,
         .init           =       prio_init,
         .reset          =       prio_reset,
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 5da05839e225..2bdf241f6315 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -108,23 +108,6 @@ congestion_drop:
         return NET_XMIT_CN;
 }
 
-static int red_requeue(struct sk_buff *skb, struct Qdisc* sch)
-{
-        struct red_sched_data *q = qdisc_priv(sch);
-        struct Qdisc *child = q->qdisc;
-        int ret;
-
-        if (red_is_idling(&q->parms))
-                red_end_of_idle_period(&q->parms);
-
-        ret = child->ops->requeue(skb, child);
-        if (likely(ret == NET_XMIT_SUCCESS)) {
-                sch->qstats.requeues++;
-                sch->q.qlen++;
-        }
-        return ret;
-}
-
 static struct sk_buff * red_dequeue(struct Qdisc* sch)
 {
         struct sk_buff *skb;
@@ -140,6 +123,14 @@ static struct sk_buff * red_dequeue(struct Qdisc* sch)
         return skb;
 }
 
+static struct sk_buff * red_peek(struct Qdisc* sch)
+{
+        struct red_sched_data *q = qdisc_priv(sch);
+        struct Qdisc *child = q->qdisc;
+
+        return child->ops->peek(child);
+}
+
 static unsigned int red_drop(struct Qdisc* sch)
 {
         struct red_sched_data *q = qdisc_priv(sch);
@@ -211,7 +202,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
         q->limit = ctl->limit;
         if (child) {
                 qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
-                qdisc_destroy(xchg(&q->qdisc, child));
+                qdisc_destroy(q->qdisc);
+                q->qdisc = child;
         }
 
         red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog,
@@ -292,7 +284,8 @@ static int red_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
                 new = &noop_qdisc;
 
         sch_tree_lock(sch);
-        *old = xchg(&q->qdisc, new);
+        *old = q->qdisc;
+        q->qdisc = new;
         qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
         qdisc_reset(*old);
         sch_tree_unlock(sch);
@@ -361,7 +354,7 @@ static struct Qdisc_ops red_qdisc_ops __read_mostly = {
         .cl_ops         =       &red_class_ops,
         .enqueue        =       red_enqueue,
         .dequeue        =       red_dequeue,
-        .requeue        =       red_requeue,
+        .peek           =       red_peek,
         .drop           =       red_drop,
         .init           =       red_init,
         .reset          =       red_reset,
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index fe1508ef0d3d..ab8cfee3c9ce 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -329,71 +329,20 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         return NET_XMIT_CN;
 }
 
-static int
-sfq_requeue(struct sk_buff *skb, struct Qdisc *sch)
+static struct sk_buff *
+sfq_peek(struct Qdisc *sch)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
-        unsigned int hash;
-        sfq_index x;
-        int ret;
-
-        hash = sfq_classify(skb, sch, &ret);
-        if (hash == 0) {
-                if (ret & __NET_XMIT_BYPASS)
-                        sch->qstats.drops++;
-                kfree_skb(skb);
-                return ret;
-        }
-        hash--;
-
-        x = q->ht[hash];
-        if (x == SFQ_DEPTH) {
-                q->ht[hash] = x = q->dep[SFQ_DEPTH].next;
-                q->hash[x] = hash;
-        }
-
-        sch->qstats.backlog += qdisc_pkt_len(skb);
-        __skb_queue_head(&q->qs[x], skb);
-        /* If selected queue has length q->limit+1, this means that
-         * all another queues are empty and we do simple tail drop.
-         * This packet is still requeued at head of queue, tail packet
-         * is dropped.
-         */
-        if (q->qs[x].qlen > q->limit) {
-                skb = q->qs[x].prev;
-                __skb_unlink(skb, &q->qs[x]);
-                sch->qstats.drops++;
-                sch->qstats.backlog -= qdisc_pkt_len(skb);
-                kfree_skb(skb);
-                return NET_XMIT_CN;
-        }
-
-        sfq_inc(q, x);
-        if (q->qs[x].qlen == 1) {               /* The flow is new */
-                if (q->tail == SFQ_DEPTH) {     /* It is the first flow */
-                        q->tail = x;
-                        q->next[x] = x;
-                        q->allot[x] = q->quantum;
-                } else {
-                        q->next[x] = q->next[q->tail];
-                        q->next[q->tail] = x;
-                        q->tail = x;
-                }
-        }
+        sfq_index a;
 
-        if (++sch->q.qlen <= q->limit) {
-                sch->qstats.requeues++;
-                return 0;
-        }
+        /* No active slots */
+        if (q->tail == SFQ_DEPTH)
+                return NULL;
 
-        sch->qstats.drops++;
-        sfq_drop(sch);
-        return NET_XMIT_CN;
+        a = q->next[q->tail];
+        return skb_peek(&q->qs[a]);
 }
 
-
-
-
 static struct sk_buff *
 sfq_dequeue(struct Qdisc *sch)
 {
@@ -624,7 +573,7 @@ static struct Qdisc_ops sfq_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct sfq_sched_data),
         .enqueue        =       sfq_enqueue,
         .dequeue        =       sfq_dequeue,
-        .requeue        =       sfq_requeue,
+        .peek           =       sfq_peek,
         .drop           =       sfq_drop,
         .init           =       sfq_init,
         .reset          =       sfq_reset,
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 94c61598b86a..a2f93c09f3cc 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -139,19 +139,6 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         return 0;
 }
 
-static int tbf_requeue(struct sk_buff *skb, struct Qdisc* sch)
-{
-        struct tbf_sched_data *q = qdisc_priv(sch);
-        int ret;
-
-        if ((ret = q->qdisc->ops->requeue(skb, q->qdisc)) == 0) {
-                sch->q.qlen++;
-                sch->qstats.requeues++;
-        }
-
-        return ret;
-}
-
 static unsigned int tbf_drop(struct Qdisc* sch)
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
@@ -169,7 +156,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
         struct tbf_sched_data *q = qdisc_priv(sch);
         struct sk_buff *skb;
 
-        skb = q->qdisc->dequeue(q->qdisc);
+        skb = q->qdisc->ops->peek(q->qdisc);
 
         if (skb) {
                 psched_time_t now;
@@ -192,6 +179,10 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
                 toks -= L2T(q, len);
 
                 if ((toks|ptoks) >= 0) {
+                        skb = qdisc_dequeue_peeked(q->qdisc);
+                        if (unlikely(!skb))
+                                return NULL;
+
                         q->t_c = now;
                         q->tokens = toks;
                         q->ptokens = ptoks;
@@ -214,12 +205,6 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
                    (cf. CSZ, HPFQ, HFSC)
                  */
 
-                if (q->qdisc->ops->requeue(skb, q->qdisc) != NET_XMIT_SUCCESS) {
-                        /* When requeue fails skb is dropped */
-                        qdisc_tree_decrease_qlen(q->qdisc, 1);
-                        sch->qstats.drops++;
-                }
-
                 sch->qstats.overlimits++;
         }
         return NULL;
@@ -251,6 +236,7 @@ static int tbf_change(struct Qdisc* sch, struct nlattr *opt)
         struct tc_tbf_qopt *qopt;
         struct qdisc_rate_table *rtab = NULL;
         struct qdisc_rate_table *ptab = NULL;
+        struct qdisc_rate_table *tmp;
         struct Qdisc *child = NULL;
         int max_size,n;
 
@@ -299,7 +285,8 @@ static int tbf_change(struct Qdisc* sch, struct nlattr *opt)
         sch_tree_lock(sch);
         if (child) {
                 qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
-                qdisc_destroy(xchg(&q->qdisc, child));
+                qdisc_destroy(q->qdisc);
+                q->qdisc = child;
         }
         q->limit = qopt->limit;
         q->mtu = qopt->mtu;
@@ -307,8 +294,14 @@ static int tbf_change(struct Qdisc* sch, struct nlattr *opt)
         q->buffer = qopt->buffer;
         q->tokens = q->buffer;
         q->ptokens = q->mtu;
-        rtab = xchg(&q->R_tab, rtab);
-        ptab = xchg(&q->P_tab, ptab);
+
+        tmp = q->R_tab;
+        q->R_tab = rtab;
+        rtab = tmp;
+
+        tmp = q->P_tab;
+        q->P_tab = ptab;
+        ptab = tmp;
         sch_tree_unlock(sch);
         err = 0;
 done:
@@ -398,7 +391,8 @@ static int tbf_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
                 new = &noop_qdisc;
 
         sch_tree_lock(sch);
-        *old = xchg(&q->qdisc, new);
+        *old = q->qdisc;
+        q->qdisc = new;
         qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
         qdisc_reset(*old);
         sch_tree_unlock(sch);
@@ -469,7 +463,7 @@ static struct Qdisc_ops tbf_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct tbf_sched_data),
         .enqueue        =       tbf_enqueue,
         .dequeue        =       tbf_dequeue,
-        .requeue        =       tbf_requeue,
+        .peek           =       qdisc_peek_dequeued,
         .drop           =       tbf_drop,
         .init           =       tbf_init,
         .reset          =       tbf_reset,
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index d35ef059abb1..cfc8e7caba62 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -93,16 +93,6 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         return NET_XMIT_DROP;
 }
 
-static int
-teql_requeue(struct sk_buff *skb, struct Qdisc* sch)
-{
-        struct teql_sched_data *q = qdisc_priv(sch);
-
-        __skb_queue_head(&q->q, skb);
-        sch->qstats.requeues++;
-        return 0;
-}
-
 static struct sk_buff *
 teql_dequeue(struct Qdisc* sch)
 {
@@ -123,6 +113,13 @@ teql_dequeue(struct Qdisc* sch)
         return skb;
 }
 
+static struct sk_buff *
+teql_peek(struct Qdisc* sch)
+{
+        /* teql is meant to be used as root qdisc */
+        return NULL;
+}
+
 static __inline__ void
 teql_neigh_release(struct neighbour *n)
 {
@@ -433,7 +430,7 @@ static __init void teql_master_setup(struct net_device *dev)
 
         ops->enqueue    =       teql_enqueue;
         ops->dequeue    =       teql_dequeue;
-        ops->requeue    =       teql_requeue;
+        ops->peek       =       teql_peek;
         ops->init       =       teql_qdisc_init;
         ops->reset      =       teql_reset;
         ops->destroy    =       teql_destroy;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 4124bbb99947..ceaa4aa066ea 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -223,10 +223,9 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
         }
 
-        SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, "
-                          "src:" NIP6_FMT " dst:" NIP6_FMT "\n",
+        SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n",
                           __func__, skb, skb->len,
-                          NIP6(fl.fl6_src), NIP6(fl.fl6_dst));
+                          &fl.fl6_src, &fl.fl6_dst);
 
         SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
 
@@ -252,23 +251,19 @@ static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
                 fl.oif = daddr->v6.sin6_scope_id;
 
 
-        SCTP_DEBUG_PRINTK("%s: DST=" NIP6_FMT " ",
-                          __func__, NIP6(fl.fl6_dst));
+        SCTP_DEBUG_PRINTK("%s: DST=%pI6 ", __func__, &fl.fl6_dst);
 
         if (saddr) {
                 ipv6_addr_copy(&fl.fl6_src, &saddr->v6.sin6_addr);
-                SCTP_DEBUG_PRINTK(
-                        "SRC=" NIP6_FMT " - ",
-                        NIP6(fl.fl6_src));
+                SCTP_DEBUG_PRINTK("SRC=%pI6 - ", &fl.fl6_src);
         }
 
         dst = ip6_route_output(&init_net, NULL, &fl);
         if (!dst->error) {
                 struct rt6_info *rt;
                 rt = (struct rt6_info *)dst;
-                SCTP_DEBUG_PRINTK(
-                        "rt6_dst:" NIP6_FMT " rt6_src:" NIP6_FMT "\n",
-                        NIP6(rt->rt6i_dst.addr), NIP6(rt->rt6i_src.addr));
+                SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
+                        &rt->rt6i_dst.addr, &rt->rt6i_src.addr);
                 return dst;
         }
         SCTP_DEBUG_PRINTK("NO ROUTE\n");
@@ -314,9 +309,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
         __u8 matchlen = 0;
         __u8 bmatchlen;
 
-        SCTP_DEBUG_PRINTK("%s: asoc:%p dst:%p "
-                          "daddr:" NIP6_FMT " ",
-                          __func__, asoc, dst, NIP6(daddr->v6.sin6_addr));
+        SCTP_DEBUG_PRINTK("%s: asoc:%p dst:%p daddr:%pI6 ",
+                          __func__, asoc, dst, &daddr->v6.sin6_addr);
 
         if (!asoc) {
                 ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
@@ -324,8 +318,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
                                    &daddr->v6.sin6_addr,
                                    inet6_sk(&sk->inet.sk)->srcprefs,
                                    &saddr->v6.sin6_addr);
-                SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: " NIP6_FMT "\n",
-                                  NIP6(saddr->v6.sin6_addr));
+                SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: %pI6\n",
+                                  &saddr->v6.sin6_addr);
                 return;
         }
 
@@ -353,12 +347,11 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
 
         if (baddr) {
                 memcpy(saddr, baddr, sizeof(union sctp_addr));
-                SCTP_DEBUG_PRINTK("saddr: " NIP6_FMT "\n",
-                                  NIP6(saddr->v6.sin6_addr));
+                SCTP_DEBUG_PRINTK("saddr: %pI6\n", &saddr->v6.sin6_addr);
         } else {
                 printk(KERN_ERR "%s: asoc:%p Could not find a valid source "
-                       "address for the dest:" NIP6_FMT "\n",
-                       __func__, asoc, NIP6(daddr->v6.sin6_addr));
+                       "address for the dest:%pI6\n",
+                       __func__, asoc, &daddr->v6.sin6_addr);
         }
 
         rcu_read_unlock();
@@ -727,7 +720,7 @@ static int sctp_v6_is_ce(const struct sk_buff *skb)
 /* Dump the v6 addr to the seq file. */
 static void sctp_v6_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
 {
-        seq_printf(seq, NIP6_FMT " ", NIP6(addr->v6.sin6_addr));
+        seq_printf(seq, "%pI6 ", &addr->v6.sin6_addr);
 }
 
 static void sctp_v6_ecn_capable(struct sock *sk)
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 0b65354aaf64..a8ca743241ee 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -482,9 +482,8 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
         if (saddr)
                 fl.fl4_src = saddr->v4.sin_addr.s_addr;
 
-        SCTP_DEBUG_PRINTK("%s: DST:%u.%u.%u.%u, SRC:%u.%u.%u.%u - ",
-                          __func__, NIPQUAD(fl.fl4_dst),
-                          NIPQUAD(fl.fl4_src));
+        SCTP_DEBUG_PRINTK("%s: DST:%pI4, SRC:%pI4 - ",
+                          __func__, &fl.fl4_dst, &fl.fl4_src);
 
         if (!ip_route_output_key(&init_net, &rt, &fl)) {
                 dst = &rt->u.dst;
@@ -540,8 +539,8 @@ out_unlock:
         rcu_read_unlock();
 out:
         if (dst)
-                SCTP_DEBUG_PRINTK("rt_dst:%u.%u.%u.%u, rt_src:%u.%u.%u.%u\n",
-                                  NIPQUAD(rt->rt_dst), NIPQUAD(rt->rt_src));
+                SCTP_DEBUG_PRINTK("rt_dst:%pI4, rt_src:%pI4\n",
+                                  &rt->rt_dst, &rt->rt_src);
         else
                 SCTP_DEBUG_PRINTK("NO ROUTE\n");
 
@@ -646,7 +645,7 @@ static void sctp_v4_addr_v4map(struct sctp_sock *sp, union sctp_addr *addr)
 /* Dump the v4 addr to the seq file. */
 static void sctp_v4_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
 {
-        seq_printf(seq, "%d.%d.%d.%d ", NIPQUAD(addr->v4.sin_addr));
+        seq_printf(seq, "%pI4 ", &addr->v4.sin_addr);
 }
 
 static void sctp_v4_ecn_capable(struct sock *sk)
@@ -866,11 +865,10 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
 {
         struct inet_sock *inet = inet_sk(skb->sk);
 
-        SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, "
-                          "src:%u.%u.%u.%u, dst:%u.%u.%u.%u\n",
+        SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, src:%pI4, dst:%pI4\n",
                           __func__, skb, skb->len,
-                          NIPQUAD(skb->rtable->rt_src),
-                          NIPQUAD(skb->rtable->rt_dst));
+                          &skb->rtable->rt_src,
+                          &skb->rtable->rt_dst);
 
         inet->pmtudisc = transport->param_flags & SPP_PMTUD_ENABLE ?
                          IP_PMTUDISC_DO : IP_PMTUDISC_DONT;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index a6a0ea71ae93..9f2a3eb656e5 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1123,19 +1123,17 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
                 if (from_addr.sa.sa_family == AF_INET6) {
                         if (net_ratelimit())
                                 printk(KERN_WARNING
-                                    "%s association %p could not find address "
-                                    NIP6_FMT "\n",
+                                    "%s association %p could not find address %pI6\n",
                                     __func__,
                                     asoc,
-                                    NIP6(from_addr.v6.sin6_addr));
+                                    &from_addr.v6.sin6_addr);
                 } else {
                         if (net_ratelimit())
                                 printk(KERN_WARNING
-                                    "%s association %p could not find address "
-                                    NIPQUAD_FMT "\n",
+                                    "%s association %p could not find address %pI4\n",
                                     __func__,
                                     asoc,
-                                    NIPQUAD(from_addr.v4.sin_addr.s_addr));
+                                    &from_addr.v4.sin_addr.s_addr);
                 }
                 return SCTP_DISPOSITION_DISCARD;
         }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index a1b904529d5e..0c70eff0b757 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3614,6 +3614,7 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
 
         SCTP_DBG_OBJCNT_INC(sock);
         atomic_inc(&sctp_sockets_allocated);
+        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         return 0;
 }
 
@@ -3628,6 +3629,7 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
         ep = sctp_sk(sk)->ep;
         sctp_endpoint_free(ep);
         atomic_dec(&sctp_sockets_allocated);
+        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 }
 
 /* API 4.1.7 shutdown() - TCP Style Syntax
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 52910697e104..f58e994e6852 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -63,8 +63,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_rto_initial,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
@@ -74,8 +74,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_rto_min,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
@@ -85,8 +85,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_rto_max,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
@@ -96,8 +96,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_valid_cookie_life,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
@@ -107,8 +107,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_max_burst,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &zero,
                 .extra2         = &int_max
         },
@@ -118,8 +118,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_max_retrans_association,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &int_max
         },
@@ -129,8 +129,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_sndbuf_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_SCTP_RCVBUF_POLICY,
@@ -138,8 +138,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_rcvbuf_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_SCTP_PATH_MAX_RETRANS,
@@ -147,8 +147,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_max_retrans_path,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &int_max
         },
@@ -158,8 +158,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_max_retrans_init,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &int_max
         },
@@ -169,8 +169,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_hb_interval,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &one,
                 .extra2         = &timer_max
         },
@@ -180,8 +180,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_cookie_preserve_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_SCTP_RTO_ALPHA,
@@ -189,8 +189,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_rto_alpha,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_SCTP_RTO_BETA,
@@ -198,8 +198,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_rto_beta,
                 .maxlen         = sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_SCTP_ADDIP_ENABLE,
@@ -207,8 +207,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_addip_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_SCTP_PRSCTP_ENABLE,
@@ -216,8 +216,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_prsctp_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = NET_SCTP_SACK_TIMEOUT,
@@ -225,8 +225,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_sack_timeout,
                 .maxlen         = sizeof(long),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .strategy       = sysctl_intvec,
                 .extra1         = &sack_timer_min,
                 .extra2         = &sack_timer_max,
         },
@@ -236,7 +236,7 @@ static ctl_table sctp_table[] = {
                 .data           = &sysctl_sctp_mem,
                 .maxlen         = sizeof(sysctl_sctp_mem),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -244,7 +244,7 @@ static ctl_table sctp_table[] = {
                 .data           = &sysctl_sctp_rmem,
                 .maxlen         = sizeof(sysctl_sctp_rmem),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -252,7 +252,7 @@ static ctl_table sctp_table[] = {
                 .data           = &sysctl_sctp_wmem,
                 .maxlen         = sizeof(sysctl_sctp_wmem),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -260,8 +260,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_auth_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -269,8 +269,8 @@ static ctl_table sctp_table[] = {
                 .data           = &sctp_addip_noauth,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-                .strategy       = &sysctl_intvec
+                .proc_handler   = proc_dointvec,
+                .strategy       = sysctl_intvec
         },
         { .ctl_name = 0 }
 };
diff --git a/net/socket.c b/net/socket.c
index 92764d836891..e9d65ea2687e 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -69,7 +69,6 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/mutex.h>
-#include <linux/thread_info.h>
 #include <linux/wanrouter.h>
 #include <linux/if_bridge.h>
 #include <linux/if_frad.h>
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 4895c341e46d..3ca518386d15 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -271,15 +271,15 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                 case AF_INET: {
                         struct sockaddr_in *sin =
                                         (struct sockaddr_in *)args->address;
-                        snprintf(servername, sizeof(servername), NIPQUAD_FMT,
-                                 NIPQUAD(sin->sin_addr.s_addr));
+                        snprintf(servername, sizeof(servername), "%pI4",
+                                 &sin->sin_addr.s_addr);
                         break;
                 }
                 case AF_INET6: {
                         struct sockaddr_in6 *sin =
                                         (struct sockaddr_in6 *)args->address;
-                        snprintf(servername, sizeof(servername), NIP6_FMT,
-                                 NIP6(sin->sin6_addr));
+                        snprintf(servername, sizeof(servername), "%pI6",
+                                 &sin->sin6_addr);
                         break;
                 }
                 default:
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 41013dd66ac3..03ae007641e4 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -270,10 +270,9 @@ static int rpcb_register_netid4(struct sockaddr_in *address_to_register,
         char buf[32];
 
         /* Construct AF_INET universal address */
-        snprintf(buf, sizeof(buf),
-                        NIPQUAD_FMT".%u.%u",
-                        NIPQUAD(address_to_register->sin_addr.s_addr),
-                        port >> 8, port & 0xff);
+        snprintf(buf, sizeof(buf), "%pI4.%u.%u",
+                 &address_to_register->sin_addr.s_addr,
+                 port >> 8, port & 0xff);
         map->r_addr = buf;
 
         dprintk("RPC:       %sregistering [%u, %u, %s, '%s'] with "
@@ -305,9 +304,9 @@ static int rpcb_register_netid6(struct sockaddr_in6 *address_to_register,
                 snprintf(buf, sizeof(buf), "::.%u.%u",
                                 port >> 8, port & 0xff);
         else
-                snprintf(buf, sizeof(buf), NIP6_FMT".%u.%u",
-                                NIP6(address_to_register->sin6_addr),
-                                port >> 8, port & 0xff);
+                snprintf(buf, sizeof(buf), "%pI6.%u.%u",
+                         &address_to_register->sin6_addr,
+                         port >> 8, port & 0xff);
         map->r_addr = buf;
 
         dprintk("RPC:       %sregistering [%u, %u, %s, '%s'] with "
@@ -422,8 +421,8 @@ int rpcb_getport_sync(struct sockaddr_in *sin, u32 prog, u32 vers, int prot)
         struct rpc_clnt *rpcb_clnt;
         int status;
 
-        dprintk("RPC:       %s(" NIPQUAD_FMT ", %u, %u, %d)\n",
-                __func__, NIPQUAD(sin->sin_addr.s_addr), prog, vers, prot);
+        dprintk("RPC:       %s(%pI4, %u, %u, %d)\n",
+                __func__, &sin->sin_addr.s_addr, prog, vers, prot);
 
         rpcb_clnt = rpcb_create(NULL, (struct sockaddr *)sin,
                                 sizeof(*sin), prot, RPCBVERS_2);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index f24800f2c098..82240e6127b2 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -162,13 +162,9 @@ static void ip_map_request(struct cache_detail *cd,
         struct ip_map *im = container_of(h, struct ip_map, h);
 
         if (ipv6_addr_v4mapped(&(im->m_addr))) {
-                snprintf(text_addr, 20, NIPQUAD_FMT,
-                                ntohl(im->m_addr.s6_addr32[3]) >> 24 & 0xff,
-                                ntohl(im->m_addr.s6_addr32[3]) >> 16 & 0xff,
-                                ntohl(im->m_addr.s6_addr32[3]) >>  8 & 0xff,
-                                ntohl(im->m_addr.s6_addr32[3]) >>  0 & 0xff);
+                snprintf(text_addr, 20, "%pI4", &im->m_addr.s6_addr32[3]);
         } else {
-                snprintf(text_addr, 40, NIP6_FMT, NIP6(im->m_addr));
+                snprintf(text_addr, 40, "%pI6", &im->m_addr);
         }
         qword_add(bpp, blen, im->m_class);
         qword_add(bpp, blen, text_addr);
@@ -208,13 +204,13 @@ static int ip_map_parse(struct cache_detail *cd,
         len = qword_get(&mesg, buf, mlen);
         if (len <= 0) return -EINVAL;
 
-        if (sscanf(buf, NIPQUAD_FMT "%c", &b1, &b2, &b3, &b4, &c) == 4) {
+        if (sscanf(buf, "%u.%u.%u.%u%c", &b1, &b2, &b3, &b4, &c) == 4) {
                 addr.s6_addr32[0] = 0;
                 addr.s6_addr32[1] = 0;
                 addr.s6_addr32[2] = htonl(0xffff);
                 addr.s6_addr32[3] =
                         htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
-       } else if (sscanf(buf, NIP6_FMT "%c",
+       } else if (sscanf(buf, "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x%c",
                         &b1, &b2, &b3, &b4, &b5, &b6, &b7, &b8, &c) == 8) {
                 addr.s6_addr16[0] = htons(b1);
                 addr.s6_addr16[1] = htons(b2);
@@ -278,16 +274,10 @@ static int ip_map_show(struct seq_file *m,
                 dom = im->m_client->h.name;
 
         if (ipv6_addr_v4mapped(&addr)) {
-                seq_printf(m, "%s " NIPQUAD_FMT " %s\n",
-                        im->m_class,
-                        ntohl(addr.s6_addr32[3]) >> 24 & 0xff,
-                        ntohl(addr.s6_addr32[3]) >> 16 & 0xff,
-                        ntohl(addr.s6_addr32[3]) >>  8 & 0xff,
-                        ntohl(addr.s6_addr32[3]) >>  0 & 0xff,
-                        dom);
+                seq_printf(m, "%s %pI4 %s\n",
+                        im->m_class, &addr.s6_addr32[3], dom);
         } else {
-                seq_printf(m, "%s " NIP6_FMT " %s\n",
-                        im->m_class, NIP6(addr), dom);
+                seq_printf(m, "%s %pI6 %s\n", im->m_class, &addr, dom);
         }
         return 0;
 }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 95293f549e9c..6f7d1f2d2f36 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -250,10 +250,10 @@ static int one_sock_name(char *buf, struct svc_sock *svsk)
 
         switch(svsk->sk_sk->sk_family) {
         case AF_INET:
-                len = sprintf(buf, "ipv4 %s %u.%u.%u.%u %d\n",
-                              svsk->sk_sk->sk_protocol==IPPROTO_UDP?
+                len = sprintf(buf, "ipv4 %s %pI4 %d\n",
+                              svsk->sk_sk->sk_protocol == IPPROTO_UDP ?
                               "udp" : "tcp",
-                              NIPQUAD(inet_sk(svsk->sk_sk)->rcv_saddr),
+                              &inet_sk(svsk->sk_sk)->rcv_saddr,
                               inet_sk(svsk->sk_sk)->num);
                 break;
         default:
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 6fb493cbd29f..f8500f018f8a 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -1048,21 +1048,21 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
 
         dprintk("svcrdma: new connection %p accepted with the following "
                 "attributes:\n"
-                "    local_ip        : %d.%d.%d.%d\n"
+                "    local_ip        : %pI4\n"
                 "    local_port      : %d\n"
-                "    remote_ip       : %d.%d.%d.%d\n"
+                "    remote_ip       : %pI4\n"
                 "    remote_port     : %d\n"
                 "    max_sge         : %d\n"
                 "    sq_depth        : %d\n"
                 "    max_requests    : %d\n"
                 "    ord             : %d\n",
                 newxprt,
-                NIPQUAD(((struct sockaddr_in *)&newxprt->sc_cm_id->
-                         route.addr.src_addr)->sin_addr.s_addr),
+                &((struct sockaddr_in *)&newxprt->sc_cm_id->
+                         route.addr.src_addr)->sin_addr.s_addr,
                 ntohs(((struct sockaddr_in *)&newxprt->sc_cm_id->
                        route.addr.src_addr)->sin_port),
-                NIPQUAD(((struct sockaddr_in *)&newxprt->sc_cm_id->
-                         route.addr.dst_addr)->sin_addr.s_addr),
+                &((struct sockaddr_in *)&newxprt->sc_cm_id->
+                         route.addr.dst_addr)->sin_addr.s_addr,
                 ntohs(((struct sockaddr_in *)&newxprt->sc_cm_id->
                        route.addr.dst_addr)->sin_port),
                 newxprt->sc_max_sge,
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 9839c3d94145..1dd6123070e9 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -174,7 +174,7 @@ xprt_rdma_format_addresses(struct rpc_xprt *xprt)
 
         buf = kzalloc(20, GFP_KERNEL);
         if (buf)
-                snprintf(buf, 20, NIPQUAD_FMT, NIPQUAD(addr->sin_addr.s_addr));
+                snprintf(buf, 20, "%pI4", &addr->sin_addr.s_addr);
         xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
 
         buf = kzalloc(8, GFP_KERNEL);
@@ -186,8 +186,8 @@ xprt_rdma_format_addresses(struct rpc_xprt *xprt)
 
         buf = kzalloc(48, GFP_KERNEL);
         if (buf)
-                snprintf(buf, 48, "addr="NIPQUAD_FMT" port=%u proto=%s",
-                        NIPQUAD(addr->sin_addr.s_addr),
+                snprintf(buf, 48, "addr=%pI4 port=%u proto=%s",
+                        &addr->sin_addr.s_addr,
                         ntohs(addr->sin_port), "rdma");
         xprt->address_strings[RPC_DISPLAY_ALL] = buf;
 
@@ -204,8 +204,8 @@ xprt_rdma_format_addresses(struct rpc_xprt *xprt)
 
         buf = kzalloc(30, GFP_KERNEL);
         if (buf)
-                snprintf(buf, 30, NIPQUAD_FMT".%u.%u",
-                        NIPQUAD(addr->sin_addr.s_addr),
+                snprintf(buf, 30, "%pI4.%u.%u",
+                        &addr->sin_addr.s_addr,
                         ntohs(addr->sin_port) >> 8,
                         ntohs(addr->sin_port) & 0xff);
         xprt->address_strings[RPC_DISPLAY_UNIVERSAL_ADDR] = buf;
@@ -369,8 +369,8 @@ xprt_setup_rdma(struct xprt_create *args)
         if (ntohs(sin->sin_port) != 0)
                 xprt_set_bound(xprt);
 
-        dprintk("RPC:       %s: %u.%u.%u.%u:%u\n", __func__,
-                        NIPQUAD(sin->sin_addr.s_addr), ntohs(sin->sin_port));
+        dprintk("RPC:       %s: %pI4:%u\n",
+                __func__, &sin->sin_addr.s_addr, ntohs(sin->sin_port));
 
         /* Set max requests */
         cdata.max_requests = xprt->max_reqs;
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index a5fef5e6c323..78f7f728ef10 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -323,12 +323,11 @@ rpcrdma_conn_upcall(struct rdma_cm_id *id, struct rdma_cm_event *event)
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
                 connstate = -ENODEV;
 connected:
-                dprintk("RPC:       %s: %s: %u.%u.%u.%u:%u"
-                        " (ep 0x%p event 0x%x)\n",
+                dprintk("RPC:       %s: %s: %pI4:%u (ep 0x%p event 0x%x)\n",
                         __func__,
                         (event->event <= 11) ? conn[event->event] :
                                                 "unknown connection error",
-                        NIPQUAD(addr->sin_addr.s_addr),
+                        &addr->sin_addr.s_addr,
                         ntohs(addr->sin_port),
                         ep, event->event);
                 atomic_set(&rpcx_to_rdmax(ep->rep_xprt)->rx_buf.rb_credits, 1);
@@ -348,18 +347,17 @@ connected:
         if (connstate == 1) {
                 int ird = attr.max_dest_rd_atomic;
                 int tird = ep->rep_remote_cma.responder_resources;
-                printk(KERN_INFO "rpcrdma: connection to %u.%u.%u.%u:%u "
+                printk(KERN_INFO "rpcrdma: connection to %pI4:%u "
                         "on %s, memreg %d slots %d ird %d%s\n",
-                        NIPQUAD(addr->sin_addr.s_addr),
+                        &addr->sin_addr.s_addr,
                         ntohs(addr->sin_port),
                         ia->ri_id->device->name,
                         ia->ri_memreg_strategy,
                         xprt->rx_buf.rb_max_requests,
                         ird, ird < 4 && ird < tird / 2 ? " (low!)" : "");
         } else if (connstate < 0) {
-                printk(KERN_INFO "rpcrdma: connection to %u.%u.%u.%u:%u "
-                        "closed (%d)\n",
-                        NIPQUAD(addr->sin_addr.s_addr),
+                printk(KERN_INFO "rpcrdma: connection to %pI4:%u closed (%d)\n",
+                        &addr->sin_addr.s_addr,
                         ntohs(addr->sin_port),
                         connstate);
         }
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 0a50361e3d83..5cbb404c4cdf 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -284,8 +284,7 @@ static void xs_format_ipv4_peer_addresses(struct rpc_xprt *xprt,
 
         buf = kzalloc(20, GFP_KERNEL);
         if (buf) {
-                snprintf(buf, 20, NIPQUAD_FMT,
-                                NIPQUAD(addr->sin_addr.s_addr));
+                snprintf(buf, 20, "%pI4", &addr->sin_addr.s_addr);
         }
         xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
 
@@ -300,8 +299,8 @@ static void xs_format_ipv4_peer_addresses(struct rpc_xprt *xprt,
 
         buf = kzalloc(48, GFP_KERNEL);
         if (buf) {
-                snprintf(buf, 48, "addr="NIPQUAD_FMT" port=%u proto=%s",
-                        NIPQUAD(addr->sin_addr.s_addr),
+                snprintf(buf, 48, "addr=%pI4 port=%u proto=%s",
+                        &addr->sin_addr.s_addr,
                         ntohs(addr->sin_port),
                         protocol);
         }
@@ -323,8 +322,8 @@ static void xs_format_ipv4_peer_addresses(struct rpc_xprt *xprt,
 
         buf = kzalloc(30, GFP_KERNEL);
         if (buf) {
-                snprintf(buf, 30, NIPQUAD_FMT".%u.%u",
-                                NIPQUAD(addr->sin_addr.s_addr),
+                snprintf(buf, 30, "%pI4.%u.%u",
+                                &addr->sin_addr.s_addr,
                                 ntohs(addr->sin_port) >> 8,
                                 ntohs(addr->sin_port) & 0xff);
         }
@@ -342,8 +341,7 @@ static void xs_format_ipv6_peer_addresses(struct rpc_xprt *xprt,
 
         buf = kzalloc(40, GFP_KERNEL);
         if (buf) {
-                snprintf(buf, 40, NIP6_FMT,
-                                NIP6(addr->sin6_addr));
+                snprintf(buf, 40, "%pI6",&addr->sin6_addr);
         }
         xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
 
@@ -358,18 +356,17 @@ static void xs_format_ipv6_peer_addresses(struct rpc_xprt *xprt,
 
         buf = kzalloc(64, GFP_KERNEL);
         if (buf) {
-                snprintf(buf, 64, "addr="NIP6_FMT" port=%u proto=%s",
-                                NIP6(addr->sin6_addr),
+                snprintf(buf, 64, "addr=%pI6 port=%u proto=%s",
+                                &addr->sin6_addr,
                                 ntohs(addr->sin6_port),
                                 protocol);
         }
         xprt->address_strings[RPC_DISPLAY_ALL] = buf;
 
         buf = kzalloc(36, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 36, NIP6_SEQFMT,
-                                NIP6(addr->sin6_addr));
-        }
+        if (buf)
+                snprintf(buf, 36, "%pi6", &addr->sin6_addr);
+
         xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = buf;
 
         buf = kzalloc(8, GFP_KERNEL);
@@ -381,10 +378,10 @@ static void xs_format_ipv6_peer_addresses(struct rpc_xprt *xprt,
 
         buf = kzalloc(50, GFP_KERNEL);
         if (buf) {
-                snprintf(buf, 50, NIP6_FMT".%u.%u",
-                                NIP6(addr->sin6_addr),
-                                ntohs(addr->sin6_port) >> 8,
-                                ntohs(addr->sin6_port) & 0xff);
+                snprintf(buf, 50, "%pI6.%u.%u",
+                         &addr->sin6_addr,
+                         ntohs(addr->sin6_port) >> 8,
+                         ntohs(addr->sin6_port) & 0xff);
         }
         xprt->address_strings[RPC_DISPLAY_UNIVERSAL_ADDR] = buf;
 
@@ -1415,8 +1412,8 @@ static int xs_bind4(struct sock_xprt *transport, struct socket *sock)
                 if (port > last)
                         nloop++;
         } while (err == -EADDRINUSE && nloop != 2);
-        dprintk("RPC:       %s "NIPQUAD_FMT":%u: %s (%d)\n",
-                        __func__, NIPQUAD(myaddr.sin_addr),
+        dprintk("RPC:       %s %pI4:%u: %s (%d)\n",
+                        __func__, &myaddr.sin_addr,
                         port, err ? "failed" : "ok", err);
         return err;
 }
@@ -1448,8 +1445,8 @@ static int xs_bind6(struct sock_xprt *transport, struct socket *sock)
                 if (port > last)
                         nloop++;
         } while (err == -EADDRINUSE && nloop != 2);
-        dprintk("RPC:       xs_bind6 "NIP6_FMT":%u: %s (%d)\n",
-                NIP6(myaddr.sin6_addr), port, err ? "failed" : "ok", err);
+        dprintk("RPC:       xs_bind6 %pI6:%u: %s (%d)\n",
+                &myaddr.sin6_addr, port, err ? "failed" : "ok", err);
         return err;
 }
 
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index fe43ef7dd7e3..f72ba774c246 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -243,12 +243,11 @@ static int recv_notification(struct notifier_block *nb, unsigned long evt,
 static char *eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
 {
         unchar *addr = (unchar *)&a->dev_addr;
-        DECLARE_MAC_BUF(mac);
 
         if (str_size < 18)
                 *str_buf = '\0';
         else
-                sprintf(str_buf, "%s", print_mac(mac, addr));
+                sprintf(str_buf, "%pM", addr);
         return str_buf;
 }
 
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index cd72e22b132b..acab41a48d67 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -555,7 +555,7 @@ static struct name_seq *nametbl_find_seq(u32 type)
         struct name_seq *ns;
 
         dbg("find_seq %u,(%u,0x%x) table = %p, hash[type] = %u\n",
-            type, ntohl(type), type, table.types, hash(type));
+            type, htonl(type), type, table.types, hash(type));
 
         seq_head = &table.types[hash(type)];
         hlist_for_each_entry(ns, seq_node, seq_head, ns_list) {
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index eb90f77bb0e2..e1ca8f744ca5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -164,7 +164,7 @@ static inline int unix_our_peer(struct sock *sk, struct sock *osk)
 
 static inline int unix_may_send(struct sock *sk, struct sock *osk)
 {
-        return (unix_peer(osk) == NULL || unix_our_peer(sk, osk));
+        return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
 }
 
 static inline int unix_recvq_full(struct sock const *sk)
@@ -197,7 +197,7 @@ static inline void unix_release_addr(struct unix_address *addr)
  *              - if started by zero, it is abstract name.
  */
 
-static int unix_mkname(struct sockaddr_un * sunaddr, int len, unsigned *hashp)
+static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned *hashp)
 {
         if (len <= sizeof(short) || len > sizeof(*sunaddr))
                 return -EINVAL;
@@ -211,12 +211,12 @@ static int unix_mkname(struct sockaddr_un * sunaddr, int len, unsigned *hashp)
                  * we are guaranteed that it is a valid memory location in our
                  * kernel address buffer.
                  */
-                ((char *)sunaddr)[len]=0;
+                ((char *)sunaddr)[len] = 0;
                 len = strlen(sunaddr->sun_path)+1+sizeof(short);
                 return len;
         }
 
-        *hashp = unix_hash_fold(csum_partial((char*)sunaddr, len, 0));
+        *hashp = unix_hash_fold(csum_partial(sunaddr, len, 0));
         return len;
 }
 
@@ -295,8 +295,7 @@ static struct sock *unix_find_socket_byinode(struct net *net, struct inode *i)
                 if (!net_eq(sock_net(s), net))
                         continue;
 
-                if(dentry && dentry->d_inode == i)
-                {
+                if (dentry && dentry->d_inode == i) {
                         sock_hold(s);
                         goto found;
                 }
@@ -354,7 +353,7 @@ static void unix_sock_destructor(struct sock *sk)
         WARN_ON(!sk_unhashed(sk));
         WARN_ON(sk->sk_socket);
         if (!sock_flag(sk, SOCK_DEAD)) {
-                printk("Attempt to release alive unix socket: %p\n", sk);
+                printk(KERN_INFO "Attempt to release alive unix socket: %p\n", sk);
                 return;
         }
 
@@ -362,12 +361,14 @@ static void unix_sock_destructor(struct sock *sk)
                 unix_release_addr(u->addr);
 
         atomic_dec(&unix_nr_socks);
+        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 #ifdef UNIX_REFCNT_DEBUG
-        printk(KERN_DEBUG "UNIX %p is destroyed, %d are still alive.\n", sk, atomic_read(&unix_nr_socks));
+        printk(KERN_DEBUG "UNIX %p is destroyed, %d are still alive.\n", sk,
+                atomic_read(&unix_nr_socks));
 #endif
 }
 
-static int unix_release_sock (struct sock *sk, int embrion)
+static int unix_release_sock(struct sock *sk, int embrion)
 {
         struct unix_sock *u = unix_sk(sk);
         struct dentry *dentry;
@@ -392,9 +393,9 @@ static int unix_release_sock (struct sock *sk, int embrion)
 
         wake_up_interruptible_all(&u->peer_wait);
 
-        skpair=unix_peer(sk);
+        skpair = unix_peer(sk);
 
-        if (skpair!=NULL) {
+        if (skpair != NULL) {
                 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
                         unix_state_lock(skpair);
                         /* No more writes */
@@ -414,7 +415,7 @@ static int unix_release_sock (struct sock *sk, int embrion)
         /* Try to flush out this socket. Throw out buffers at least */
 
         while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                if (state==TCP_LISTEN)
+                if (state == TCP_LISTEN)
                         unix_release_sock(skb->sk, 1);
                 /* passed fds are erased in the kfree_skb hook        */
                 kfree_skb(skb);
@@ -453,11 +454,11 @@ static int unix_listen(struct socket *sock, int backlog)
         struct unix_sock *u = unix_sk(sk);
 
         err = -EOPNOTSUPP;
-        if (sock->type!=SOCK_STREAM && sock->type!=SOCK_SEQPACKET)
-                goto out;                       /* Only stream/seqpacket sockets accept */
+        if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
+                goto out;       /* Only stream/seqpacket sockets accept */
         err = -EINVAL;
         if (!u->addr)
-                goto out;                       /* No listens on an unbound socket */
+                goto out;       /* No listens on an unbound socket */
         unix_state_lock(sk);
         if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
                 goto out_unlock;
@@ -566,9 +567,10 @@ static const struct proto_ops unix_seqpacket_ops = {
 };
 
 static struct proto unix_proto = {
-        .name     = "UNIX",
-        .owner    = THIS_MODULE,
-        .obj_size = sizeof(struct unix_sock),
+        .name                   = "UNIX",
+        .owner                  = THIS_MODULE,
+        .sockets_allocated      = &unix_nr_socks,
+        .obj_size               = sizeof(struct unix_sock),
 };
 
 /*
@@ -579,7 +581,7 @@ static struct proto unix_proto = {
  */
 static struct lock_class_key af_unix_sk_receive_queue_lock_key;
 
-static struct sock * unix_create1(struct net *net, struct socket *sock)
+static struct sock *unix_create1(struct net *net, struct socket *sock)
 {
         struct sock *sk = NULL;
         struct unix_sock *u;
@@ -592,7 +594,7 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
         if (!sk)
                 goto out;
 
-        sock_init_data(sock,sk);
+        sock_init_data(sock, sk);
         lockdep_set_class(&sk->sk_receive_queue.lock,
                                 &af_unix_sk_receive_queue_lock_key);
 
@@ -611,6 +613,9 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
 out:
         if (sk == NULL)
                 atomic_dec(&unix_nr_socks);
+        else
+                sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+
         return sk;
 }
 
@@ -630,7 +635,7 @@ static int unix_create(struct net *net, struct socket *sock, int protocol)
                  *      nothing uses it.
                  */
         case SOCK_RAW:
-                sock->type=SOCK_DGRAM;
+                sock->type = SOCK_DGRAM;
         case SOCK_DGRAM:
                 sock->ops = &unix_dgram_ops;
                 break;
@@ -653,7 +658,7 @@ static int unix_release(struct socket *sock)
 
         sock->sk = NULL;
 
-        return unix_release_sock (sk, 0);
+        return unix_release_sock(sk, 0);
 }
 
 static int unix_autobind(struct socket *sock)
@@ -662,7 +667,7 @@ static int unix_autobind(struct socket *sock)
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk);
         static u32 ordernum = 1;
-        struct unix_address * addr;
+        struct unix_address *addr;
         int err;
 
         mutex_lock(&u->readlock);
@@ -681,7 +686,7 @@ static int unix_autobind(struct socket *sock)
 
 retry:
         addr->len = sprintf(addr->name->sun_path+1, "%05x", ordernum) + 1 + sizeof(short);
-        addr->hash = unix_hash_fold(csum_partial((void*)addr->name, addr->len, 0));
+        addr->hash = unix_hash_fold(csum_partial(addr->name, addr->len, 0));
 
         spin_lock(&unix_table_lock);
         ordernum = (ordernum+1)&0xFFFFF;
@@ -736,14 +741,14 @@ static struct sock *unix_find_other(struct net *net,
 
                 path_put(&path);
 
-                err=-EPROTOTYPE;
+                err = -EPROTOTYPE;
                 if (u->sk_type != type) {
                         sock_put(u);
                         goto fail;
                 }
         } else {
                 err = -ECONNREFUSED;
-                u=unix_find_socket_byname(net, sunname, len, type, hash);
+                u = unix_find_socket_byname(net, sunname, len, type, hash);
                 if (u) {
                         struct dentry *dentry;
                         dentry = unix_sk(u)->dentry;
@@ -757,7 +762,7 @@ static struct sock *unix_find_other(struct net *net,
 put_fail:
         path_put(&path);
 fail:
-        *error=err;
+        *error = err;
         return NULL;
 }
 
@@ -767,8 +772,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk);
-        struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr;
-        struct dentry * dentry = NULL;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
+        struct dentry *dentry = NULL;
         struct nameidata nd;
         int err;
         unsigned hash;
@@ -779,7 +784,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (sunaddr->sun_family != AF_UNIX)
                 goto out;
 
-        if (addr_len==sizeof(short)) {
+        if (addr_len == sizeof(short)) {
                 err = unix_autobind(sock);
                 goto out;
         }
@@ -875,8 +880,8 @@ out_mknod_unlock:
         mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
         path_put(&nd.path);
 out_mknod_parent:
-        if (err==-EEXIST)
-                err=-EADDRINUSE;
+        if (err == -EEXIST)
+                err = -EADDRINUSE;
         unix_release_addr(addr);
         goto out_up;
 }
@@ -911,7 +916,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
 {
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
-        struct sockaddr_un *sunaddr=(struct sockaddr_un*)addr;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr;
         struct sock *other;
         unsigned hash;
         int err;
@@ -927,7 +932,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                         goto out;
 
 restart:
-                other=unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
+                other = unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
                 if (!other)
                         goto out;
 
@@ -961,14 +966,14 @@ restart:
          */
         if (unix_peer(sk)) {
                 struct sock *old_peer = unix_peer(sk);
-                unix_peer(sk)=other;
+                unix_peer(sk) = other;
                 unix_state_double_unlock(sk, other);
 
                 if (other != old_peer)
                         unix_dgram_disconnected(sk, old_peer);
                 sock_put(old_peer);
         } else {
-                unix_peer(sk)=other;
+                unix_peer(sk) = other;
                 unix_state_double_unlock(sk, other);
         }
         return 0;
@@ -1004,7 +1009,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo)
 static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                                int addr_len, int flags)
 {
-        struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk), *newu, *otheru;
@@ -1179,13 +1184,13 @@ out:
 
 static int unix_socketpair(struct socket *socka, struct socket *sockb)
 {
-        struct sock *ska=socka->sk, *skb = sockb->sk;
+        struct sock *ska = socka->sk, *skb = sockb->sk;
 
         /* Join our sockets back to back */
         sock_hold(ska);
         sock_hold(skb);
-        unix_peer(ska)=skb;
-        unix_peer(skb)=ska;
+        unix_peer(ska) = skb;
+        unix_peer(skb) = ska;
         ska->sk_peercred.pid = skb->sk_peercred.pid = task_tgid_vnr(current);
         ska->sk_peercred.uid = skb->sk_peercred.uid = current->euid;
         ska->sk_peercred.gid = skb->sk_peercred.gid = current->egid;
@@ -1207,7 +1212,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
         int err;
 
         err = -EOPNOTSUPP;
-        if (sock->type!=SOCK_STREAM && sock->type!=SOCK_SEQPACKET)
+        if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
                 goto out;
 
         err = -EINVAL;
@@ -1246,7 +1251,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
 {
         struct sock *sk = sock->sk;
         struct unix_sock *u;
-        struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
         int err = 0;
 
         if (peer) {
@@ -1286,7 +1291,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         skb->destructor = sock_wfree;
         UNIXCB(skb).fp = NULL;
 
-        for (i=scm->fp->count-1; i>=0; i--)
+        for (i = scm->fp->count-1; i >= 0; i--)
                 unix_notinflight(scm->fp->fp[i]);
 }
 
@@ -1315,7 +1320,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         if (!UNIXCB(skb).fp)
                 return -ENOMEM;
 
-        for (i=scm->fp->count-1; i>=0; i--)
+        for (i = scm->fp->count-1; i >= 0; i--)
                 unix_inflight(scm->fp->fp[i]);
         skb->destructor = unix_destruct_fds;
         return 0;
@@ -1332,7 +1337,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk);
-        struct sockaddr_un *sunaddr=msg->msg_name;
+        struct sockaddr_un *sunaddr = msg->msg_name;
         struct sock *other = NULL;
         int namelen = 0; /* fake GCC */
         int err;
@@ -1373,7 +1378,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 goto out;
 
         skb = sock_alloc_send_skb(sk, len, msg->msg_flags&MSG_DONTWAIT, &err);
-        if (skb==NULL)
+        if (skb == NULL)
                 goto out;
 
         memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
@@ -1385,7 +1390,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         unix_get_secdata(siocb->scm, skb);
 
         skb_reset_transport_header(skb);
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         if (err)
                 goto out_free;
 
@@ -1399,7 +1404,7 @@ restart:
 
                 other = unix_find_other(net, sunaddr, namelen, sk->sk_type,
                                         hash, &err);
-                if (other==NULL)
+                if (other == NULL)
                         goto out_free;
         }
 
@@ -1419,7 +1424,7 @@ restart:
                 err = 0;
                 unix_state_lock(sk);
                 if (unix_peer(sk) == other) {
-                        unix_peer(sk)=NULL;
+                        unix_peer(sk) = NULL;
                         unix_state_unlock(sk);
 
                         unix_dgram_disconnected(sk, other);
@@ -1485,10 +1490,10 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
         struct sock *sk = sock->sk;
         struct sock *other = NULL;
-        struct sockaddr_un *sunaddr=msg->msg_name;
-        int err,size;
+        struct sockaddr_un *sunaddr = msg->msg_name;
+        int err, size;
         struct sk_buff *skb;
-        int sent=0;
+        int sent = 0;
         struct scm_cookie tmp_scm;
 
         if (NULL == siocb->scm)
@@ -1515,8 +1520,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (sk->sk_shutdown & SEND_SHUTDOWN)
                 goto pipe_err;
 
-        while(sent < len)
-        {
+        while (sent < len) {
                 /*
                  *      Optimisation for the fact that under 0.01% of X
                  *      messages typically need breaking up.
@@ -1535,9 +1539,10 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                  *      Grab a buffer
                  */
 
-                skb=sock_alloc_send_skb(sk,size,msg->msg_flags&MSG_DONTWAIT, &err);
+                skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT,
+                                          &err);
 
-                if (skb==NULL)
+                if (skb == NULL)
                         goto out_err;
 
                 /*
@@ -1558,7 +1563,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                         }
                 }
 
-                if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) {
+                err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
+                if (err) {
                         kfree_skb(skb);
                         goto out_err;
                 }
@@ -1572,7 +1578,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 skb_queue_tail(&other->sk_receive_queue, skb);
                 unix_state_unlock(other);
                 other->sk_data_ready(other, size);
-                sent+=size;
+                sent += size;
         }
 
         scm_destroy(siocb->scm);
@@ -1584,8 +1590,8 @@ pipe_err_free:
         unix_state_unlock(other);
         kfree_skb(skb);
 pipe_err:
-        if (sent==0 && !(msg->msg_flags&MSG_NOSIGNAL))
-                send_sig(SIGPIPE,current,0);
+        if (sent == 0 && !(msg->msg_flags&MSG_NOSIGNAL))
+                send_sig(SIGPIPE, current, 0);
         err = -EPIPE;
 out_err:
         scm_destroy(siocb->scm);
@@ -1675,13 +1681,10 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         siocb->scm->creds = *UNIXCREDS(skb);
         unix_set_secdata(siocb->scm, skb);
 
-        if (!(flags & MSG_PEEK))
-        {
+        if (!(flags & MSG_PEEK)) {
                 if (UNIXCB(skb).fp)
                         unix_detach_fds(siocb->scm, skb);
-        }
-        else
-        {
+        } else {
                 /* It is questionable: on PEEK we could:
                    - do not return fds - good, but too simple 8)
                    - return fds, and do not return them on read (old strategy,
@@ -1702,7 +1705,7 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         scm_recv(sock, msg, siocb->scm, flags);
 
 out_free:
-        skb_free_datagram(sk,skb);
+        skb_free_datagram(sk, skb);
 out_unlock:
         mutex_unlock(&u->readlock);
 out:
@@ -1713,7 +1716,7 @@ out:
  *      Sleep until data has arrive. But check for races..
  */
 
-static long unix_stream_data_wait(struct sock * sk, long timeo)
+static long unix_stream_data_wait(struct sock *sk, long timeo)
 {
         DEFINE_WAIT(wait);
 
@@ -1751,7 +1754,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct scm_cookie tmp_scm;
         struct sock *sk = sock->sk;
         struct unix_sock *u = unix_sk(sk);
-        struct sockaddr_un *sunaddr=msg->msg_name;
+        struct sockaddr_un *sunaddr = msg->msg_name;
         int copied = 0;
         int check_creds = 0;
         int target;
@@ -1782,15 +1785,13 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         mutex_lock(&u->readlock);
 
-        do
-        {
+        do {
                 int chunk;
                 struct sk_buff *skb;
 
                 unix_state_lock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
-                if (skb==NULL)
-                {
+                if (skb == NULL) {
                         if (copied >= target)
                                 goto unlock;
 
@@ -1798,7 +1799,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                          *      POSIX 1003.1g mandates this order.
                          */
 
-                        if ((err = sock_error(sk)) != 0)
+                        err = sock_error(sk);
+                        if (err)
                                 goto unlock;
                         if (sk->sk_shutdown & RCV_SHUTDOWN)
                                 goto unlock;
@@ -1825,7 +1827,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 if (check_creds) {
                         /* Never glue messages from different writers */
-                        if (memcmp(UNIXCREDS(skb), &siocb->scm->creds, sizeof(siocb->scm->creds)) != 0) {
+                        if (memcmp(UNIXCREDS(skb), &siocb->scm->creds,
+                                   sizeof(siocb->scm->creds)) != 0) {
                                 skb_queue_head(&sk->sk_receive_queue, skb);
                                 break;
                         }
@@ -1836,8 +1839,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 }
 
                 /* Copy address just once */
-                if (sunaddr)
-                {
+                if (sunaddr) {
                         unix_copy_addr(msg, skb->sk);
                         sunaddr = NULL;
                 }
@@ -1853,16 +1855,14 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 size -= chunk;
 
                 /* Mark read part of skb as used */
-                if (!(flags & MSG_PEEK))
-                {
+                if (!(flags & MSG_PEEK)) {
                         skb_pull(skb, chunk);
 
                         if (UNIXCB(skb).fp)
                                 unix_detach_fds(siocb->scm, skb);
 
                         /* put the skb back if we didn't use it up.. */
-                        if (skb->len)
-                        {
+                        if (skb->len) {
                                 skb_queue_head(&sk->sk_receive_queue, skb);
                                 break;
                         }
@@ -1871,9 +1871,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                         if (siocb->scm->fp)
                                 break;
-                }
-                else
-                {
+                } else {
                         /* It is questionable, see note in unix_dgram_recvmsg.
                          */
                         if (UNIXCB(skb).fp)
@@ -1901,7 +1899,7 @@ static int unix_shutdown(struct socket *sock, int mode)
         if (mode) {
                 unix_state_lock(sk);
                 sk->sk_shutdown |= mode;
-                other=unix_peer(sk);
+                other = unix_peer(sk);
                 if (other)
                         sock_hold(other);
                 unix_state_unlock(sk);
@@ -1936,16 +1934,15 @@ static int unix_shutdown(struct socket *sock, int mode)
 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
-        long amount=0;
+        long amount = 0;
         int err;
 
-        switch(cmd)
-        {
-                case SIOCOUTQ:
-                        amount = atomic_read(&sk->sk_wmem_alloc);
-                        err = put_user(amount, (int __user *)arg);
-                        break;
-                case SIOCINQ:
+        switch (cmd) {
+        case SIOCOUTQ:
+                amount = atomic_read(&sk->sk_wmem_alloc);
+                err = put_user(amount, (int __user *)arg);
+                break;
+        case SIOCINQ:
                 {
                         struct sk_buff *skb;
 
@@ -1962,21 +1959,21 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         } else {
                                 skb = skb_peek(&sk->sk_receive_queue);
                                 if (skb)
-                                        amount=skb->len;
+                                        amount = skb->len;
                         }
                         spin_unlock(&sk->sk_receive_queue.lock);
                         err = put_user(amount, (int __user *)arg);
                         break;
                 }
 
-                default:
-                        err = -ENOIOCTLCMD;
-                        break;
+        default:
+                err = -ENOIOCTLCMD;
+                break;
         }
         return err;
 }
 
-static unsigned int unix_poll(struct file * file, struct socket *sock, poll_table *wait)
+static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
         struct sock *sk = sock->sk;
         unsigned int mask;
@@ -1998,7 +1995,8 @@ static unsigned int unix_poll(struct file * file, struct socket *sock, poll_tabl
                 mask |= POLLIN | POLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
-        if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) && sk->sk_state == TCP_CLOSE)
+        if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) &&
+            sk->sk_state == TCP_CLOSE)
                 mask |= POLLHUP;
 
         /*
@@ -2094,6 +2092,7 @@ struct unix_iter_state {
         struct seq_net_private p;
         int i;
 };
+
 static struct sock *unix_seq_idx(struct seq_file *seq, loff_t pos)
 {
         struct unix_iter_state *iter = seq->private;
@@ -2110,7 +2109,6 @@ static struct sock *unix_seq_idx(struct seq_file *seq, loff_t pos)
         return NULL;
 }
 
-
 static void *unix_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(unix_table_lock)
 {
@@ -2190,7 +2188,6 @@ static const struct seq_operations unix_seq_ops = {
         .show   = unix_seq_show,
 };
 
-
 static int unix_seq_open(struct inode *inode, struct file *file)
 {
         return seq_open_net(inode, file, &unix_seq_ops,
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6d4a9a8de5ef..5a0061d6b9bc 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -104,8 +104,8 @@ static struct sock *unix_get_socket(struct file *filp)
          *      Socket ?
          */
         if (S_ISSOCK(inode->i_mode)) {
-                struct socket * sock = SOCKET_I(inode);
-                struct sock * s = sock->sk;
+                struct socket *sock = SOCKET_I(inode);
+                struct sock *s = sock->sk;
 
                 /*
                  *      PF_UNIX ?
@@ -124,7 +124,7 @@ static struct sock *unix_get_socket(struct file *filp)
 void unix_inflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
-        if(s) {
+        if (s) {
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
                 if (atomic_long_inc_return(&u->inflight) == 1) {
@@ -141,7 +141,7 @@ void unix_inflight(struct file *fp)
 void unix_notinflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
-        if(s) {
+        if (s) {
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
                 BUG_ON(list_empty(&u->link));
@@ -154,7 +154,7 @@ void unix_notinflight(struct file *fp)
 
 static inline struct sk_buff *sock_queue_head(struct sock *sk)
 {
-        return (struct sk_buff *) &sk->sk_receive_queue;
+        return (struct sk_buff *)&sk->sk_receive_queue;
 }
 
 #define receive_queue_for_each_skb(sk, next, skb) \
@@ -364,7 +364,7 @@ void unix_gc(void)
          */
         skb_queue_head_init(&hitlist);
         list_for_each_entry(u, &gc_candidates, link)
-                scan_children(&u->sk, inc_inflight, &hitlist);
+        scan_children(&u->sk, inc_inflight, &hitlist);
 
         spin_unlock(&unix_gc_lock);
 
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 77513d7e35f2..83c093077ebc 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -21,7 +21,7 @@ static ctl_table unix_table[] = {
                 .data           = &init_net.unx.sysctl_max_dgram_qlen,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         { .ctl_name = 0 }
 };
@@ -61,4 +61,3 @@ void unix_sysctl_unregister(struct net *net)
         unregister_sysctl_table(net->unx.ctl);
         kfree(table);
 }
-
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 7f07152bc109..39701dec1dba 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -60,6 +60,8 @@
 
 #define KMEM_SAFETYZONE 8
 
+#define DEV_TO_SLAVE(dev)       (*((struct net_device **)netdev_priv(dev)))
+
 /*
  *      Function Prototypes
  */
@@ -511,7 +513,7 @@ static int wanrouter_device_shutdown(struct wan_device *wandev)
                 if (err)
                         return err;
                 /* The above function deallocates the current dev
-                 * structure. Therefore, we cannot use dev->priv
+                 * structure. Therefore, we cannot use netdev_priv(dev)
                  * as the next element: wandev->dev points to the
                  * next element */
                 dev = wandev->dev;
@@ -589,10 +591,6 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                 err = -EPROTONOSUPPORT;
                 goto out;
         } else {
-                dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
-                err = -ENOBUFS;
-                if (dev == NULL)
-                        goto out;
                 err = wandev->new_if(wandev, dev, cnf);
         }
 
@@ -622,10 +620,9 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                                         wandev->dev = dev;
                                 } else {
                                         for (slave=wandev->dev;
-                                         *((struct net_device **)slave->priv);
-                                 slave = *((struct net_device **)slave->priv));
-
-                                     *((struct net_device **)slave->priv) = dev;
+                                             DEV_TO_SLAVE(slave);
+                                             slave = DEV_TO_SLAVE(slave))
+                                                DEV_TO_SLAVE(slave) = dev;
                                 }
                                 ++wandev->ndev;
 
@@ -636,15 +633,9 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                 }
                 if (wandev->del_if)
                         wandev->del_if(wandev, dev);
+                free_netdev(dev);
         }
 
-        /* This code has moved from del_if() function */
-        kfree(dev->priv);
-        dev->priv = NULL;
-
-        /* Sync PPP is disabled */
-        if (cnf->config_id != WANCONFIG_MPPP)
-                kfree(dev);
 out:
         kfree(cnf);
         return err;
@@ -734,7 +725,7 @@ static int wanrouter_delete_interface(struct wan_device *wandev, char *name)
         dev = wandev->dev;
         prev = NULL;
         while (dev && strcmp(name, dev->name)) {
-                struct net_device **slave = dev->priv;
+                struct net_device **slave = netdev_priv(dev);
                 prev = dev;
                 dev = *slave;
         }
@@ -751,12 +742,12 @@ static int wanrouter_delete_interface(struct wan_device *wandev, char *name)
 
         lock_adapter_irq(&wandev->lock, &smp_flags);
         if (prev) {
-                struct net_device **prev_slave = prev->priv;
-                struct net_device **slave = dev->priv;
+                struct net_device **prev_slave = netdev_priv(prev);
+                struct net_device **slave = netdev_priv(dev);
 
                 *prev_slave = *slave;
         } else {
-                struct net_device **slave = dev->priv;
+                struct net_device **slave = netdev_priv(dev);
                 wandev->dev = *slave;
         }
         --wandev->ndev;
@@ -764,11 +755,6 @@ static int wanrouter_delete_interface(struct wan_device *wandev, char *name)
 
         printk(KERN_INFO "%s: unregistering '%s'\n", wandev->name, dev->name);
 
-        /* Due to new interface linking method using dev->priv,
-         * this code has moved from del_if() function.*/
-        kfree(dev->priv);
-        dev->priv=NULL;
-
         unregister_netdev(dev);
 
         free_netdev(dev);
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 646c7121dbc0..ae7f2262dfb5 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -72,3 +72,13 @@ config WIRELESS_EXT_SYSFS
 
           Say Y if you have programs using it, like old versions of
           hal.
+
+config LIB80211
+        tristate "Common routines for IEEE802.11 drivers"
+        default n
+        help
+          This options enables a library of common routines used
+          by IEEE802.11 wireless LAN drivers.
+
+          Drivers should select this themselves if needed.  Say Y if
+          you want this built into your kernel.
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index b9f943c45f3b..d2d848d445f2 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -1,5 +1,6 @@
 obj-$(CONFIG_WIRELESS_EXT) += wext.o
 obj-$(CONFIG_CFG80211) += cfg80211.o
+obj-$(CONFIG_LIB80211) += lib80211.o
 
 cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o
 cfg80211-$(CONFIG_NL80211) += nl80211.o
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 5031db7b275b..39e3d10fccde 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -236,8 +236,7 @@ struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
         mutex_unlock(&cfg80211_drv_mutex);
 
         /* give it a proper name */
-        snprintf(drv->wiphy.dev.bus_id, BUS_ID_SIZE,
-                 PHY_NAME "%d", drv->idx);
+        dev_set_name(&drv->wiphy.dev, PHY_NAME "%d", drv->idx);
 
         mutex_init(&drv->mtx);
         mutex_init(&drv->devlist_mtx);
@@ -301,12 +300,10 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
+        mutex_lock(&cfg80211_drv_mutex);
+
         /* set up regulatory info */
-        mutex_lock(&cfg80211_reg_mutex);
         wiphy_update_regulatory(wiphy, REGDOM_SET_BY_CORE);
-        mutex_unlock(&cfg80211_reg_mutex);
-
-        mutex_lock(&cfg80211_drv_mutex);
 
         res = device_add(&drv->wiphy.dev);
         if (res)
diff --git a/net/wireless/lib80211.c b/net/wireless/lib80211.c
new file mode 100644
index 000000000000..e71f7d085621
--- /dev/null
+++ b/net/wireless/lib80211.c
@@ -0,0 +1,65 @@
+/*
+ * lib80211 -- common bits for IEEE802.11 drivers
+ *
+ * Copyright(c) 2008 John W. Linville <linville@tuxdriver.com>
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/ctype.h>
+#include <linux/ieee80211.h>
+
+#include <net/lib80211.h>
+
+#define DRV_NAME        "lib80211"
+
+#define DRV_DESCRIPTION "common routines for IEEE802.11 drivers"
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_AUTHOR("John W. Linville <linville@tuxdriver.com>");
+MODULE_LICENSE("GPL");
+
+const char *print_ssid(char *buf, const char *ssid, u8 ssid_len)
+{
+        const char *s = ssid;
+        char *d = buf;
+
+        ssid_len = min_t(u8, ssid_len, IEEE80211_MAX_SSID_LEN);
+        while (ssid_len--) {
+                if (isprint(*s)) {
+                        *d++ = *s++;
+                        continue;
+                }
+
+                *d++ = '\\';
+                if (*s == '\0')
+                        *d++ = '0';
+                else if (*s == '\n')
+                        *d++ = 'n';
+                else if (*s == '\r')
+                        *d++ = 'r';
+                else if (*s == '\t')
+                        *d++ = 't';
+                else if (*s == '\\')
+                        *d++ = '\\';
+                else
+                        d += snprintf(d, 3, "%03o", *s);
+                s++;
+        }
+        *d = '\0';
+        return buf;
+}
+EXPORT_SYMBOL(print_ssid);
+
+static int __init ieee80211_init(void)
+{
+        printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION "\n");
+        return 0;
+}
+
+static void __exit ieee80211_exit(void)
+{
+}
+
+module_init(ieee80211_init);
+module_exit(ieee80211_exit);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 572793c8c7ab..e3e1494e769a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -58,6 +58,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
                                       .len = BUS_ID_SIZE-1 },
+        [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 
         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
@@ -84,7 +85,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
                                                .len = NL80211_MAX_SUPP_RATES },
         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
-        [NL80211_ATTR_MNTR_FLAGS] = { .type = NLA_NESTED },
+        [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
                                 .len = IEEE80211_MAX_MESH_ID_LEN },
         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
@@ -95,6 +96,10 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
+        [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
+                                           .len = NL80211_MAX_SUPP_RATES },
+
+        [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 
         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
                                          .len = NL80211_HT_CAPABILITY_LEN },
@@ -157,6 +162,19 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 if (!nl_band)
                         goto nla_put_failure;
 
+                /* add HT info */
+                if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
+                        NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
+                                sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
+                                &dev->wiphy.bands[band]->ht_cap.mcs);
+                        NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
+                                dev->wiphy.bands[band]->ht_cap.cap);
+                        NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
+                                dev->wiphy.bands[band]->ht_cap.ampdu_factor);
+                        NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
+                                dev->wiphy.bands[band]->ht_cap.ampdu_density);
+                }
+
                 /* add frequencies */
                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
                 if (!nl_freqs)
@@ -269,20 +287,76 @@ static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
         return -ENOBUFS;
 }
 
+static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
+        [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
+        [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
+        [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
+        [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
+        [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
+};
+
+static int parse_txq_params(struct nlattr *tb[],
+                            struct ieee80211_txq_params *txq_params)
+{
+        if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
+            !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
+            !tb[NL80211_TXQ_ATTR_AIFS])
+                return -EINVAL;
+
+        txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
+        txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
+        txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
+        txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
+        txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
+
+        return 0;
+}
+
 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
-        int result;
-
-        if (!info->attrs[NL80211_ATTR_WIPHY_NAME])
-                return -EINVAL;
+        int result = 0, rem_txq_params = 0;
+        struct nlattr *nl_txq_params;
 
         rdev = cfg80211_get_dev_from_info(info);
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        result = cfg80211_dev_rename(rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
+        if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
+                result = cfg80211_dev_rename(
+                        rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
+                if (result)
+                        goto bad_res;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
+                struct ieee80211_txq_params txq_params;
+                struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
+
+                if (!rdev->ops->set_txq_params) {
+                        result = -EOPNOTSUPP;
+                        goto bad_res;
+                }
 
+                nla_for_each_nested(nl_txq_params,
+                                    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
+                                    rem_txq_params) {
+                        nla_parse(tb, NL80211_TXQ_ATTR_MAX,
+                                  nla_data(nl_txq_params),
+                                  nla_len(nl_txq_params),
+                                  txq_params_policy);
+                        result = parse_txq_params(tb, &txq_params);
+                        if (result)
+                                goto bad_res;
+
+                        result = rdev->ops->set_txq_params(&rdev->wiphy,
+                                                           &txq_params);
+                        if (result)
+                                goto bad_res;
+                }
+        }
+
+bad_res:
         cfg80211_put_dev(rdev);
         return result;
 }
@@ -1598,6 +1672,12 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
                 params.use_short_slot_time =
                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
+        if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
+                params.basic_rates =
+                        nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
+                params.basic_rates_len =
+                        nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
+        }
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
@@ -1680,11 +1760,188 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
 #endif
         mutex_lock(&cfg80211_drv_mutex);
-        r = __regulatory_hint(NULL, REGDOM_SET_BY_USER, data, NULL);
+        r = __regulatory_hint(NULL, REGDOM_SET_BY_USER, data);
         mutex_unlock(&cfg80211_drv_mutex);
         return r;
 }
 
+static int nl80211_get_mesh_params(struct sk_buff *skb,
+        struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        struct mesh_config cur_params;
+        int err;
+        struct net_device *dev;
+        void *hdr;
+        struct nlattr *pinfoattr;
+        struct sk_buff *msg;
+
+        /* Look up our device */
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                return err;
+
+        /* Get the mesh params */
+        rtnl_lock();
+        err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
+        rtnl_unlock();
+        if (err)
+                goto out;
+
+        /* Draw up a netlink message to send back */
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOBUFS;
+                goto out;
+        }
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_GET_MESH_PARAMS);
+        if (!hdr)
+                goto nla_put_failure;
+        pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
+        if (!pinfoattr)
+                goto nla_put_failure;
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
+                        cur_params.dot11MeshRetryTimeout);
+        NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
+                        cur_params.dot11MeshConfirmTimeout);
+        NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
+                        cur_params.dot11MeshHoldingTimeout);
+        NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
+                        cur_params.dot11MeshMaxPeerLinks);
+        NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
+                        cur_params.dot11MeshMaxRetries);
+        NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
+                        cur_params.dot11MeshTTL);
+        NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
+                        cur_params.auto_open_plinks);
+        NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
+                        cur_params.dot11MeshHWMPmaxPREQretries);
+        NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
+                        cur_params.path_refresh_time);
+        NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
+                        cur_params.min_discovery_timeout);
+        NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
+                        cur_params.dot11MeshHWMPactivePathTimeout);
+        NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
+                        cur_params.dot11MeshHWMPpreqMinInterval);
+        NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
+                        cur_params.dot11MeshHWMPnetDiameterTraversalTime);
+        nla_nest_end(msg, pinfoattr);
+        genlmsg_end(msg, hdr);
+        err = genlmsg_unicast(msg, info->snd_pid);
+        goto out;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        err = -EMSGSIZE;
+out:
+        /* Cleanup */
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+        return err;
+}
+
+#define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
+do {\
+        if (table[attr_num]) {\
+                cfg.param = nla_fn(table[attr_num]); \
+                mask |= (1 << (attr_num - 1)); \
+        } \
+} while (0);\
+
+static struct nla_policy
+nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
+        [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
+        [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
+        [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
+
+        [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
+        [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
+        [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
+        [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
+};
+
+static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+        u32 mask;
+        struct cfg80211_registered_device *drv;
+        struct net_device *dev;
+        struct mesh_config cfg;
+        struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
+        struct nlattr *parent_attr;
+
+        parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
+        if (!parent_attr)
+                return -EINVAL;
+        if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
+                        parent_attr, nl80211_meshconf_params_policy))
+                return -EINVAL;
+
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                return err;
+
+        /* This makes sure that there aren't more than 32 mesh config
+         * parameters (otherwise our bitfield scheme would not work.) */
+        BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
+
+        /* Fill in the params struct */
+        mask = 0;
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
+                        mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
+                        mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
+                        mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
+                        mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
+                        mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
+                        mask, NL80211_MESHCONF_TTL, nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
+                        mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
+                        mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
+                        nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
+                        mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
+                        mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
+                        nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
+                        mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
+                        nla_get_u32);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
+                        mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
+                        nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
+                        dot11MeshHWMPnetDiameterTraversalTime,
+                        mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
+                        nla_get_u16);
+
+        /* Apply changes */
+        rtnl_lock();
+        err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
+        rtnl_unlock();
+
+        /* cleanup */
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+        return err;
+}
+
+#undef FILL_IN_MESH_PARAM_IF_SET
+
 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 {
         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
@@ -1743,12 +2000,9 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
         mutex_lock(&cfg80211_drv_mutex);
         r = set_regdom(rd);
         mutex_unlock(&cfg80211_drv_mutex);
-        if (r)
-                goto bad_reg;
-
         return r;
 
-bad_reg:
+ bad_reg:
         kfree(rd);
         return -EINVAL;
 }
@@ -1902,6 +2156,18 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_GET_MESH_PARAMS,
+                .doit = nl80211_get_mesh_params,
+                .policy = nl80211_policy,
+                /* can be retrieved by unprivileged users */
+        },
+        {
+                .cmd = NL80211_CMD_SET_MESH_PARAMS,
+                .doit = nl80211_set_mesh_params,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 
 /* multicast groups */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 626dbb688499..4c7e39d466c4 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -42,17 +42,34 @@
 #include "core.h"
 #include "reg.h"
 
-/* wiphy is set if this request's initiator is REGDOM_SET_BY_DRIVER */
+/**
+ * struct regulatory_request - receipt of last regulatory request
+ *
+ * @wiphy: this is set if this request's initiator is
+ *      %REGDOM_SET_BY_COUNTRY_IE or %REGDOM_SET_BY_DRIVER. This
+ *      can be used by the wireless core to deal with conflicts
+ *      and potentially inform users of which devices specifically
+ *      cased the conflicts.
+ * @initiator: indicates who sent this request, could be any of
+ *      of those set in reg_set_by, %REGDOM_SET_BY_*
+ * @alpha2: the ISO / IEC 3166 alpha2 country code of the requested
+ *      regulatory domain. We have a few special codes:
+ *      00 - World regulatory domain
+ *      99 - built by driver but a specific alpha2 cannot be determined
+ *      98 - result of an intersection between two regulatory domains
+ * @intersect: indicates whether the wireless core should intersect
+ *      the requested regulatory domain with the presently set regulatory
+ *      domain.
+ */
 struct regulatory_request {
-        struct list_head list;
         struct wiphy *wiphy;
-        int granted;
         enum reg_set_by initiator;
         char alpha2[2];
+        bool intersect;
 };
 
-static LIST_HEAD(regulatory_requests);
-DEFINE_MUTEX(cfg80211_reg_mutex);
+/* Receipt of information from last regulatory request */
+static struct regulatory_request *last_request;
 
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
@@ -63,8 +80,6 @@ static u32 supported_bandwidths[] = {
         MHZ_TO_KHZ(20),
 };
 
-static struct list_head regulatory_requests;
-
 /* Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
  * information to give us an alpha2 */
@@ -204,7 +219,7 @@ static void reset_regdomains(void)
  * core upon initialization */
 static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 {
-        BUG_ON(list_empty(&regulatory_requests));
+        BUG_ON(!last_request);
 
         reset_regdomains();
 
@@ -300,121 +315,13 @@ static int call_crda(const char *alpha2)
         return kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, envp);
 }
 
-/* This has the logic which determines when a new request
- * should be ignored. */
-static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
-        char *alpha2, struct ieee80211_regdomain *rd)
-{
-        struct regulatory_request *last_request = NULL;
-
-        /* All initial requests are respected */
-        if (list_empty(&regulatory_requests))
-                return 0;
-
-        last_request = list_first_entry(&regulatory_requests,
-                struct regulatory_request, list);
-
-        switch (set_by) {
-        case REGDOM_SET_BY_INIT:
-                return -EINVAL;
-        case REGDOM_SET_BY_CORE:
-                /* Always respect new wireless core hints, should only
-                 * come in for updating the world regulatory domain at init
-                 * anyway */
-                return 0;
-        case REGDOM_SET_BY_COUNTRY_IE:
-                if (last_request->initiator == set_by) {
-                        if (last_request->wiphy != wiphy) {
-                                /* Two cards with two APs claiming different
-                                 * different Country IE alpha2s!
-                                 * You're special!! */
-                                if (!alpha2_equal(last_request->alpha2,
-                                                cfg80211_regdomain->alpha2)) {
-                                        /* XXX: Deal with conflict, consider
-                                         * building a new one out of the
-                                         * intersection */
-                                        WARN_ON(1);
-                                        return -EOPNOTSUPP;
-                                }
-                                return -EALREADY;
-                        }
-                        /* Two consecutive Country IE hints on the same wiphy */
-                        if (!alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
-                                return 0;
-                        return -EALREADY;
-                }
-                if (WARN_ON(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2)),
-                                "Invalid Country IE regulatory hint passed "
-                                "to the wireless core\n")
-                        return -EINVAL;
-                /* We ignore Country IE hints for now, as we haven't yet
-                 * added the dot11MultiDomainCapabilityEnabled flag
-                 * for wiphys */
-                return 1;
-        case REGDOM_SET_BY_DRIVER:
-                BUG_ON(!wiphy);
-                if (last_request->initiator == set_by) {
-                        /* Two separate drivers hinting different things,
-                         * this is possible if you have two devices present
-                         * on a system with different EEPROM regulatory
-                         * readings. XXX: Do intersection, we support only
-                         * the first regulatory hint for now */
-                        if (last_request->wiphy != wiphy)
-                                return -EALREADY;
-                        if (rd)
-                                return -EALREADY;
-                        /* Driver should not be trying to hint different
-                         * regulatory domains! */
-                        BUG_ON(!alpha2_equal(alpha2,
-                                        cfg80211_regdomain->alpha2));
-                        return -EALREADY;
-                }
-                if (last_request->initiator == REGDOM_SET_BY_CORE)
-                        return 0;
-                /* XXX: Handle intersection, and add the
-                 * dot11MultiDomainCapabilityEnabled flag to wiphy. For now
-                 * we assume the driver has this set to false, following the
-                 * 802.11d dot11MultiDomainCapabilityEnabled documentation */
-                if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
-                        return 0;
-                return 0;
-        case REGDOM_SET_BY_USER:
-                if (last_request->initiator == set_by ||
-                                last_request->initiator == REGDOM_SET_BY_CORE)
-                        return 0;
-                /* Drivers can use their wiphy's reg_notifier()
-                 * to override any information */
-                if (last_request->initiator == REGDOM_SET_BY_DRIVER)
-                        return 0;
-                /* XXX: Handle intersection */
-                if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
-                        return -EOPNOTSUPP;
-                return 0;
-        default:
-                return -EINVAL;
-        }
-}
-
-static bool __reg_is_valid_request(const char *alpha2,
-        struct regulatory_request **request)
-{
-        struct regulatory_request *req;
-        if (list_empty(&regulatory_requests))
-                return false;
-        list_for_each_entry(req, &regulatory_requests, list) {
-                if (alpha2_equal(req->alpha2, alpha2)) {
-                        *request = req;
-                        return true;
-                }
-        }
-        return false;
-}
-
 /* Used by nl80211 before kmalloc'ing our regulatory domain */
 bool reg_is_valid_request(const char *alpha2)
 {
-        struct regulatory_request *request = NULL;
-        return  __reg_is_valid_request(alpha2, &request);
+        if (!last_request)
+                return false;
+
+        return alpha2_equal(last_request->alpha2, alpha2);
 }
 
 /* Sanity check on a regulatory rule */
@@ -431,7 +338,7 @@ static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
 
         freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
 
-        if (freq_range->max_bandwidth_khz > freq_diff)
+        if (freq_diff <= 0 || freq_range->max_bandwidth_khz > freq_diff)
                 return false;
 
         return true;
@@ -469,6 +376,143 @@ static u32 freq_max_bandwidth(const struct ieee80211_freq_range *freq_range,
         return 0;
 }
 
+/* Helper for regdom_intersect(), this does the real
+ * mathematical intersection fun */
+static int reg_rules_intersect(
+        const struct ieee80211_reg_rule *rule1,
+        const struct ieee80211_reg_rule *rule2,
+        struct ieee80211_reg_rule *intersected_rule)
+{
+        const struct ieee80211_freq_range *freq_range1, *freq_range2;
+        struct ieee80211_freq_range *freq_range;
+        const struct ieee80211_power_rule *power_rule1, *power_rule2;
+        struct ieee80211_power_rule *power_rule;
+        u32 freq_diff;
+
+        freq_range1 = &rule1->freq_range;
+        freq_range2 = &rule2->freq_range;
+        freq_range = &intersected_rule->freq_range;
+
+        power_rule1 = &rule1->power_rule;
+        power_rule2 = &rule2->power_rule;
+        power_rule = &intersected_rule->power_rule;
+
+        freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
+                freq_range2->start_freq_khz);
+        freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
+                freq_range2->end_freq_khz);
+        freq_range->max_bandwidth_khz = min(freq_range1->max_bandwidth_khz,
+                freq_range2->max_bandwidth_khz);
+
+        freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
+        if (freq_range->max_bandwidth_khz > freq_diff)
+                freq_range->max_bandwidth_khz = freq_diff;
+
+        power_rule->max_eirp = min(power_rule1->max_eirp,
+                power_rule2->max_eirp);
+        power_rule->max_antenna_gain = min(power_rule1->max_antenna_gain,
+                power_rule2->max_antenna_gain);
+
+        intersected_rule->flags = (rule1->flags | rule2->flags);
+
+        if (!is_valid_reg_rule(intersected_rule))
+                return -EINVAL;
+
+        return 0;
+}
+
+/**
+ * regdom_intersect - do the intersection between two regulatory domains
+ * @rd1: first regulatory domain
+ * @rd2: second regulatory domain
+ *
+ * Use this function to get the intersection between two regulatory domains.
+ * Once completed we will mark the alpha2 for the rd as intersected, "98",
+ * as no one single alpha2 can represent this regulatory domain.
+ *
+ * Returns a pointer to the regulatory domain structure which will hold the
+ * resulting intersection of rules between rd1 and rd2. We will
+ * kzalloc() this structure for you.
+ */
+static struct ieee80211_regdomain *regdom_intersect(
+        const struct ieee80211_regdomain *rd1,
+        const struct ieee80211_regdomain *rd2)
+{
+        int r, size_of_regd;
+        unsigned int x, y;
+        unsigned int num_rules = 0, rule_idx = 0;
+        const struct ieee80211_reg_rule *rule1, *rule2;
+        struct ieee80211_reg_rule *intersected_rule;
+        struct ieee80211_regdomain *rd;
+        /* This is just a dummy holder to help us count */
+        struct ieee80211_reg_rule irule;
+
+        /* Uses the stack temporarily for counter arithmetic */
+        intersected_rule = &irule;
+
+        memset(intersected_rule, 0, sizeof(struct ieee80211_reg_rule));
+
+        if (!rd1 || !rd2)
+                return NULL;
+
+        /* First we get a count of the rules we'll need, then we actually
+         * build them. This is to so we can malloc() and free() a
+         * regdomain once. The reason we use reg_rules_intersect() here
+         * is it will return -EINVAL if the rule computed makes no sense.
+         * All rules that do check out OK are valid. */
+
+        for (x = 0; x < rd1->n_reg_rules; x++) {
+                rule1 = &rd1->reg_rules[x];
+                for (y = 0; y < rd2->n_reg_rules; y++) {
+                        rule2 = &rd2->reg_rules[y];
+                        if (!reg_rules_intersect(rule1, rule2,
+                                        intersected_rule))
+                                num_rules++;
+                        memset(intersected_rule, 0,
+                                        sizeof(struct ieee80211_reg_rule));
+                }
+        }
+
+        if (!num_rules)
+                return NULL;
+
+        size_of_regd = sizeof(struct ieee80211_regdomain) +
+                ((num_rules + 1) * sizeof(struct ieee80211_reg_rule));
+
+        rd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (!rd)
+                return NULL;
+
+        for (x = 0; x < rd1->n_reg_rules; x++) {
+                rule1 = &rd1->reg_rules[x];
+                for (y = 0; y < rd2->n_reg_rules; y++) {
+                        rule2 = &rd2->reg_rules[y];
+                        /* This time around instead of using the stack lets
+                         * write to the target rule directly saving ourselves
+                         * a memcpy() */
+                        intersected_rule = &rd->reg_rules[rule_idx];
+                        r = reg_rules_intersect(rule1, rule2,
+                                intersected_rule);
+                        /* No need to memset here the intersected rule here as
+                         * we're not using the stack anymore */
+                        if (r)
+                                continue;
+                        rule_idx++;
+                }
+        }
+
+        if (rule_idx != num_rules) {
+                kfree(rd);
+                return NULL;
+        }
+
+        rd->n_reg_rules = num_rules;
+        rd->alpha2[0] = '9';
+        rd->alpha2[1] = '8';
+
+        return rd;
+}
+
 /* XXX: add support for the rest of enum nl80211_reg_rule_flags, we may
  * want to just have the channel structure use these */
 static u32 map_regdom_flags(u32 rd_flags)
@@ -578,22 +622,81 @@ void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby)
         }
 }
 
+/* Return value which can be used by ignore_request() to indicate
+ * it has been determined we should intersect two regulatory domains */
+#define REG_INTERSECT   1
+
+/* This has the logic which determines when a new request
+ * should be ignored. */
+static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
+                          const char *alpha2)
+{
+        /* All initial requests are respected */
+        if (!last_request)
+                return 0;
+
+        switch (set_by) {
+        case REGDOM_SET_BY_INIT:
+                return -EINVAL;
+        case REGDOM_SET_BY_CORE:
+                /*
+                 * Always respect new wireless core hints, should only happen
+                 * when updating the world regulatory domain at init.
+                 */
+                return 0;
+        case REGDOM_SET_BY_COUNTRY_IE:
+                if (unlikely(!is_an_alpha2(alpha2)))
+                        return -EINVAL;
+                if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE) {
+                        if (last_request->wiphy != wiphy) {
+                                /*
+                                 * Two cards with two APs claiming different
+                                 * different Country IE alpha2s. We could
+                                 * intersect them, but that seems unlikely
+                                 * to be correct. Reject second one for now.
+                                 */
+                                if (!alpha2_equal(alpha2,
+                                                  cfg80211_regdomain->alpha2))
+                                        return -EOPNOTSUPP;
+                                return -EALREADY;
+                        }
+                        /* Two consecutive Country IE hints on the same wiphy */
+                        if (!alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+                                return 0;
+                        return -EALREADY;
+                }
+                /*
+                 * Ignore Country IE hints for now, need to think about
+                 * what we need to do to support multi-domain operation.
+                 */
+                return -EOPNOTSUPP;
+        case REGDOM_SET_BY_DRIVER:
+                if (last_request->initiator == REGDOM_SET_BY_DRIVER)
+                        return -EALREADY;
+                return 0;
+        case REGDOM_SET_BY_USER:
+                if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
+                        return REG_INTERSECT;
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
 /* Caller must hold &cfg80211_drv_mutex */
 int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
-                      const char *alpha2, struct ieee80211_regdomain *rd)
+                      const char *alpha2)
 {
         struct regulatory_request *request;
-        char *rd_alpha2;
+        bool intersect = false;
         int r = 0;
 
-        r = ignore_request(wiphy, set_by, (char *) alpha2, rd);
-        if (r)
-                return r;
+        r = ignore_request(wiphy, set_by, alpha2);
 
-        if (rd)
-                rd_alpha2 = rd->alpha2;
-        else
-                rd_alpha2 = (char *) alpha2;
+        if (r == REG_INTERSECT)
+                intersect = true;
+        else if (r)
+                return r;
 
         switch (set_by) {
         case REGDOM_SET_BY_CORE:
@@ -601,18 +704,18 @@ int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
         case REGDOM_SET_BY_DRIVER:
         case REGDOM_SET_BY_USER:
                 request = kzalloc(sizeof(struct regulatory_request),
-                        GFP_KERNEL);
+                                  GFP_KERNEL);
                 if (!request)
                         return -ENOMEM;
 
-                request->alpha2[0] = rd_alpha2[0];
-                request->alpha2[1] = rd_alpha2[1];
+                request->alpha2[0] = alpha2[0];
+                request->alpha2[1] = alpha2[1];
                 request->initiator = set_by;
                 request->wiphy = wiphy;
+                request->intersect = intersect;
 
-                list_add_tail(&request->list, &regulatory_requests);
-                if (rd)
-                        break;
+                kfree(last_request);
+                last_request = request;
                 r = call_crda(alpha2);
 #ifndef CONFIG_WIRELESS_OLD_REGULATORY
                 if (r)
@@ -627,26 +730,13 @@ int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
         return r;
 }
 
-/* If rd is not NULL and if this call fails the caller must free it */
-int regulatory_hint(struct wiphy *wiphy, const char *alpha2,
-        struct ieee80211_regdomain *rd)
+void regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 {
-        int r;
-        BUG_ON(!rd && !alpha2);
+        BUG_ON(!alpha2);
 
         mutex_lock(&cfg80211_drv_mutex);
-
-        r = __regulatory_hint(wiphy, REGDOM_SET_BY_DRIVER, alpha2, rd);
-        if (r || !rd)
-                goto unlock_and_exit;
-
-        /* If the driver passed a regulatory domain we skipped asking
-         * userspace for one so we can now go ahead and set it */
-        r = set_regdom(rd);
-
-unlock_and_exit:
+        __regulatory_hint(wiphy, REGDOM_SET_BY_DRIVER, alpha2);
         mutex_unlock(&cfg80211_drv_mutex);
-        return r;
 }
 EXPORT_SYMBOL(regulatory_hint);
 
@@ -705,21 +795,21 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
         print_rd_rules(rd);
 }
 
-void print_regdomain_info(const struct ieee80211_regdomain *rd)
+static void print_regdomain_info(const struct ieee80211_regdomain *rd)
 {
         printk(KERN_INFO "cfg80211: Regulatory domain: %c%c\n",
                 rd->alpha2[0], rd->alpha2[1]);
         print_rd_rules(rd);
 }
 
+/* Takes ownership of rd only if it doesn't fail */
 static int __set_regdom(const struct ieee80211_regdomain *rd)
 {
-        struct regulatory_request *request = NULL;
-
+        const struct ieee80211_regdomain *intersected_rd = NULL;
         /* Some basic sanity checks first */
 
         if (is_world_regdom(rd->alpha2)) {
-                if (WARN_ON(!__reg_is_valid_request(rd->alpha2, &request)))
+                if (WARN_ON(!reg_is_valid_request(rd->alpha2)))
                         return -EINVAL;
                 update_world_regdomain(rd);
                 return 0;
@@ -729,7 +819,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                         !is_unknown_alpha2(rd->alpha2))
                 return -EINVAL;
 
-        if (list_empty(&regulatory_requests))
+        if (!last_request)
                 return -EINVAL;
 
         /* allow overriding the static definitions if CRDA is present */
@@ -742,13 +832,13 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
          * to review or adjust their own settings based on their own
          * internal EEPROM data */
 
-        if (WARN_ON(!__reg_is_valid_request(rd->alpha2, &request)))
+        if (WARN_ON(!reg_is_valid_request(rd->alpha2)))
                 return -EINVAL;
 
         reset_regdomains();
 
         /* Country IE parsing coming soon */
-        switch (request->initiator) {
+        switch (last_request->initiator) {
         case REGDOM_SET_BY_CORE:
         case REGDOM_SET_BY_DRIVER:
         case REGDOM_SET_BY_USER:
@@ -765,9 +855,16 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 return -EOPNOTSUPP;
         }
 
+        if (unlikely(last_request->intersect)) {
+                intersected_rd = regdom_intersect(rd, cfg80211_regdomain);
+                if (!intersected_rd)
+                        return -EINVAL;
+                kfree(rd);
+                rd = intersected_rd;
+        }
+
         /* Tada! */
         cfg80211_regdomain = rd;
-        request->granted = 1;
 
         return 0;
 }
@@ -775,46 +872,23 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
 
 /* Use this call to set the current regulatory domain. Conflicts with
  * multiple drivers can be ironed out later. Caller must've already
- * kmalloc'd the rd structure. If this calls fails you should kfree()
- * the passed rd. Caller must hold cfg80211_drv_mutex */
+ * kmalloc'd the rd structure. Caller must hold cfg80211_drv_mutex */
 int set_regdom(const struct ieee80211_regdomain *rd)
 {
-        struct regulatory_request *this_request = NULL, *prev_request = NULL;
         int r;
 
-        if (!list_empty(&regulatory_requests))
-                prev_request = list_first_entry(&regulatory_requests,
-                        struct regulatory_request, list);
-
         /* Note that this doesn't update the wiphys, this is done below */
         r = __set_regdom(rd);
-        if (r)
+        if (r) {
+                kfree(rd);
                 return r;
-
-        BUG_ON((!__reg_is_valid_request(rd->alpha2, &this_request)));
-
-        /* The initial standard core update of the world regulatory domain, no
-         * need to keep that request info around if it didn't fail. */
-        if (is_world_regdom(rd->alpha2) &&
-                        this_request->initiator == REGDOM_SET_BY_CORE &&
-                        this_request->granted) {
-                list_del(&this_request->list);
-                kfree(this_request);
-                this_request = NULL;
-        }
-
-        /* Remove old requests, we only leave behind the last one */
-        if (prev_request) {
-                list_del(&prev_request->list);
-                kfree(prev_request);
-                prev_request = NULL;
         }
 
         /* This would make this whole thing pointless */
         BUG_ON(rd != cfg80211_regdomain);
 
         /* update all wiphys now with the new established regulatory domain */
-        update_all_wiphy_regulatory(this_request->initiator);
+        update_all_wiphy_regulatory(last_request->initiator);
 
         print_regdomain(rd);
 
@@ -838,13 +912,13 @@ int regulatory_init(void)
          * you have CRDA you get it updated, otherwise you get
          * stuck with the static values. We ignore "EU" code as
          * that is not a valid ISO / IEC 3166 alpha2 */
-        if (ieee80211_regdom[0] != 'E' && ieee80211_regdom[1] != 'U')
+        if (ieee80211_regdom[0] != 'E' || ieee80211_regdom[1] != 'U')
                 err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
-                                        ieee80211_regdom, NULL);
+                                        ieee80211_regdom);
 #else
         cfg80211_regdomain = cfg80211_world_regdom;
 
-        err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE, "00", NULL);
+        err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE, "00");
         if (err)
                 printk(KERN_ERR "cfg80211: calling CRDA failed - "
                        "unable to update world regulatory domain, "
@@ -856,16 +930,12 @@ int regulatory_init(void)
 
 void regulatory_exit(void)
 {
-        struct regulatory_request *req, *req_tmp;
-
         mutex_lock(&cfg80211_drv_mutex);
 
         reset_regdomains();
 
-        list_for_each_entry_safe(req, req_tmp, &regulatory_requests, list) {
-                list_del(&req->list);
-                kfree(req);
-        }
+        kfree(last_request);
+
         platform_device_unregister(reg_pdev);
 
         mutex_unlock(&cfg80211_drv_mutex);
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index a33362872f3c..c9b6b6358bbe 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -1,7 +1,6 @@
 #ifndef __NET_WIRELESS_REG_H
 #define __NET_WIRELESS_REG_H
 
-extern struct mutex cfg80211_reg_mutex;
 bool is_world_regdom(const char *alpha2);
 bool reg_is_valid_request(const char *alpha2);
 
@@ -10,4 +9,23 @@ void regulatory_exit(void);
 
 int set_regdom(const struct ieee80211_regdomain *rd);
 
+/**
+ * __regulatory_hint - hint to the wireless core a regulatory domain
+ * @wiphy: if the hint comes from country information from an AP, this
+ *      is required to be set to the wiphy that received the information
+ * @alpha2: the ISO/IEC 3166 alpha2 being claimed the regulatory domain
+ *      should be in.
+ *
+ * The Wireless subsystem can use this function to hint to the wireless core
+ * what it believes should be the current regulatory domain by
+ * giving it an ISO/IEC 3166 alpha2 country code it knows its regulatory
+ * domain should be in.
+ *
+ * Returns zero if all went fine, %-EALREADY if a regulatory domain had
+ * already been set or other standard error codes.
+ *
+ */
+extern int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
+                             const char *alpha2);
+
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/util.c b/net/wireless/util.c
index f54424693a38..e76cc28b0345 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -7,6 +7,25 @@
 #include <asm/bitops.h>
 #include "core.h"
 
+struct ieee80211_rate *
+ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
+                            u64 basic_rates, int bitrate)
+{
+        struct ieee80211_rate *result = &sband->bitrates[0];
+        int i;
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if (!(basic_rates & BIT(i)))
+                        continue;
+                if (sband->bitrates[i].bitrate > bitrate)
+                        continue;
+                result = &sband->bitrates[i];
+        }
+
+        return result;
+}
+EXPORT_SYMBOL(ieee80211_get_response_rate);
+
 int ieee80211_channel_to_frequency(int chan)
 {
         if (chan < 14)
diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
index 6ebda25c24e9..a5d3416522de 100644
--- a/net/x25/sysctl_net_x25.c
+++ b/net/x25/sysctl_net_x25.c
@@ -24,8 +24,8 @@ static struct ctl_table x25_table[] = {
                 .data =         &sysctl_x25_restart_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy =     &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
@@ -35,8 +35,8 @@ static struct ctl_table x25_table[] = {
                 .data =         &sysctl_x25_call_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy =     &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
@@ -46,8 +46,8 @@ static struct ctl_table x25_table[] = {
                 .data =         &sysctl_x25_reset_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy =     &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
@@ -57,8 +57,8 @@ static struct ctl_table x25_table[] = {
                 .data =         &sysctl_x25_clear_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy =     &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
@@ -68,8 +68,8 @@ static struct ctl_table x25_table[] = {
                 .data =         &sysctl_x25_ack_holdback_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
-                .proc_handler = &proc_dointvec_minmax,
-                .strategy =     &sysctl_intvec,
+                .proc_handler = proc_dointvec_minmax,
+                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
@@ -79,7 +79,7 @@ static struct ctl_table x25_table[] = {
                 .data =         &sysctl_x25_forward,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
-                .proc_handler = &proc_dointvec,
+                .proc_handler = proc_dointvec,
         },
         { 0, },
 };
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 058f04f54b90..17854884f6ff 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -521,7 +521,7 @@ static DECLARE_WORK(xfrm_hash_work, xfrm_hash_resize);
 
 /* Generate new index... KAME seems to generate them ordered by cost
  * of an absolute inpredictability of ordering of rules. This will not pass. */
-static u32 xfrm_gen_index(u8 type, int dir)
+static u32 xfrm_gen_index(int dir)
 {
         static u32 idx_generator;
 
@@ -608,7 +608,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                 list_del(&delpol->walk.all);
                 xfrm_policy_count[dir]--;
         }
-        policy->index = delpol ? delpol->index : xfrm_gen_index(policy->type, dir);
+        policy->index = delpol ? delpol->index : xfrm_gen_index(dir);
         hlist_add_head(&policy->byidx, xfrm_policy_byidx+idx_hash(policy->index));
         policy->curlft.add_time = get_seconds();
         policy->curlft.use_time = 0;
@@ -1138,7 +1138,7 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
         sk->sk_policy[dir] = pol;
         if (pol) {
                 pol->curlft.add_time = get_seconds();
-                pol->index = xfrm_gen_index(pol->type, XFRM_POLICY_MAX+dir);
+                pol->index = xfrm_gen_index(XFRM_POLICY_MAX+dir);
                 __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
         }
         if (old_pol)
@@ -2381,9 +2381,7 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void
 }
 
 static struct notifier_block xfrm_dev_notifier = {
-        xfrm_dev_event,
-        NULL,
-        0
+        .notifier_call  = xfrm_dev_event,
 };
 
 #ifdef CONFIG_XFRM_STATISTICS
@@ -2457,25 +2455,21 @@ static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
 
         switch(sel->family) {
         case AF_INET:
-                audit_log_format(audit_buf, " src=" NIPQUAD_FMT,
-                                 NIPQUAD(sel->saddr.a4));
+                audit_log_format(audit_buf, " src=%pI4", &sel->saddr.a4);
                 if (sel->prefixlen_s != 32)
                         audit_log_format(audit_buf, " src_prefixlen=%d",
                                          sel->prefixlen_s);
-                audit_log_format(audit_buf, " dst=" NIPQUAD_FMT,
-                                 NIPQUAD(sel->daddr.a4));
+                audit_log_format(audit_buf, " dst=%pI4", &sel->daddr.a4);
                 if (sel->prefixlen_d != 32)
                         audit_log_format(audit_buf, " dst_prefixlen=%d",
                                          sel->prefixlen_d);
                 break;
         case AF_INET6:
-                audit_log_format(audit_buf, " src=" NIP6_FMT,
-                                 NIP6(*(struct in6_addr *)sel->saddr.a6));
+                audit_log_format(audit_buf, " src=%pI6", sel->saddr.a6);
                 if (sel->prefixlen_s != 128)
                         audit_log_format(audit_buf, " src_prefixlen=%d",
                                          sel->prefixlen_s);
-                audit_log_format(audit_buf, " dst=" NIP6_FMT,
-                                 NIP6(*(struct in6_addr *)sel->daddr.a6));
+                audit_log_format(audit_buf, " dst=%pI6", sel->daddr.a6);
                 if (sel->prefixlen_d != 128)
                         audit_log_format(audit_buf, " dst_prefixlen=%d",
                                          sel->prefixlen_d);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 508337f97249..cd9d9171ded7 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2109,16 +2109,12 @@ static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
 
         switch(x->props.family) {
         case AF_INET:
-                audit_log_format(audit_buf,
-                                 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
-                                 NIPQUAD(x->props.saddr.a4),
-                                 NIPQUAD(x->id.daddr.a4));
+                audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
+                                 &x->props.saddr.a4, &x->id.daddr.a4);
                 break;
         case AF_INET6:
-                audit_log_format(audit_buf,
-                                 " src=" NIP6_FMT " dst=" NIP6_FMT,
-                                 NIP6(*(struct in6_addr *)x->props.saddr.a6),
-                                 NIP6(*(struct in6_addr *)x->id.daddr.a6));
+                audit_log_format(audit_buf, " src=%pI6 dst=%pI6",
+                                 x->props.saddr.a6, x->id.daddr.a6);
                 break;
         }
 
@@ -2134,18 +2130,14 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
         switch (family) {
         case AF_INET:
                 iph4 = ip_hdr(skb);
-                audit_log_format(audit_buf,
-                                 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
-                                 NIPQUAD(iph4->saddr),
-                                 NIPQUAD(iph4->daddr));
+                audit_log_format(audit_buf, " src=%pI4 dst=%pI4",
+                                 &iph4->saddr, &iph4->daddr);
                 break;
         case AF_INET6:
                 iph6 = ipv6_hdr(skb);
                 audit_log_format(audit_buf,
-                                 " src=" NIP6_FMT " dst=" NIP6_FMT
-                                 " flowlbl=0x%x%02x%02x",
-                                 NIP6(iph6->saddr),
-                                 NIP6(iph6->daddr),
+                                 " src=%pI6 dst=%pI6 flowlbl=0x%x%02x%02x",
+                                 &iph6->saddr,&iph6->daddr,
                                  iph6->flow_lbl[0] & 0x0f,
                                  iph6->flow_lbl[1],
                                  iph6->flow_lbl[2]);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a278a6f3b991..ee15d5dd6544 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2503,6 +2503,57 @@ static int xfrm_send_report(u8 proto, struct xfrm_selector *sel,
         return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_REPORT, GFP_ATOMIC);
 }
 
+static inline size_t xfrm_mapping_msgsize(void)
+{
+        return NLMSG_ALIGN(sizeof(struct xfrm_user_mapping));
+}
+
+static int build_mapping(struct sk_buff *skb, struct xfrm_state *x,
+                         xfrm_address_t *new_saddr, __be16 new_sport)
+{
+        struct xfrm_user_mapping *um;
+        struct nlmsghdr *nlh;
+
+        nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MAPPING, sizeof(*um), 0);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        um = nlmsg_data(nlh);
+
+        memcpy(&um->id.daddr, &x->id.daddr, sizeof(um->id.daddr));
+        um->id.spi = x->id.spi;
+        um->id.family = x->props.family;
+        um->id.proto = x->id.proto;
+        memcpy(&um->new_saddr, new_saddr, sizeof(um->new_saddr));
+        memcpy(&um->old_saddr, &x->props.saddr, sizeof(um->old_saddr));
+        um->new_sport = new_sport;
+        um->old_sport = x->encap->encap_sport;
+        um->reqid = x->props.reqid;
+
+        return nlmsg_end(skb, nlh);
+}
+
+static int xfrm_send_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
+                             __be16 sport)
+{
+        struct sk_buff *skb;
+
+        if (x->id.proto != IPPROTO_ESP)
+                return -EINVAL;
+
+        if (!x->encap)
+                return -EINVAL;
+
+        skb = nlmsg_new(xfrm_mapping_msgsize(), GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        if (build_mapping(skb, x, ipaddr, sport) < 0)
+                BUG();
+
+        return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_MAPPING, GFP_ATOMIC);
+}
+
 static struct xfrm_mgr netlink_mgr = {
         .id             = "netlink",
         .notify         = xfrm_send_state_notify,
@@ -2511,6 +2562,7 @@ static struct xfrm_mgr netlink_mgr = {
         .notify_policy  = xfrm_send_policy_notify,
         .report         = xfrm_send_report,
         .migrate        = xfrm_send_migrate,
+        .new_mapping    = xfrm_send_mapping,
 };
 
 static int __init xfrm_user_init(void)