211 files changed, 7242 insertions, 2697 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index a1f16303703a..8836575f9d79 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -330,12 +330,13 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
                 snprintf(name, IFNAMSIZ, "vlan%.4i", vlan_id);
         }
 
-        new_dev = alloc_netdev(sizeof(struct vlan_dev_info), name,
-                               vlan_setup);
+        new_dev = alloc_netdev_mq(sizeof(struct vlan_dev_info), name,
+                                  vlan_setup, real_dev->num_tx_queues);
 
         if (new_dev == NULL)
                 return -ENOBUFS;
 
+        new_dev->real_num_tx_queues = real_dev->real_num_tx_queues;
         dev_net_set(new_dev, net);
         /* need 4 bytes for extra VLAN header info,
          * hope the underlying device can handle it.
@@ -391,6 +392,9 @@ static void vlan_transfer_features(struct net_device *dev,
         vlandev->features &= ~dev->vlan_features;
         vlandev->features |= dev->features & dev->vlan_features;
         vlandev->gso_max_size = dev->gso_max_size;
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
+#endif
 
         if (old_features != vlandev->features)
                 netdev_features_change(vlandev);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 96bad8f233e2..4198ec5c8abc 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -288,10 +288,14 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
         return rc;
 }
 
-static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
+                                            struct net_device *dev)
 {
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        int i = skb_get_queue_mapping(skb);
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
         struct vlan_ethhdr *veth = (struct vlan_ethhdr *)(skb->data);
+        unsigned int len;
+        int ret;
 
         /* Handle non-VLAN frames if they are sent to us, for example by DHCP.
          *
@@ -317,29 +321,43 @@ static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         vlan_dev_info(dev)->cnt_inc_headroom_on_tx++;
         }
 
-        txq->tx_packets++;
-        txq->tx_bytes += skb->len;
 
         skb->dev = vlan_dev_info(dev)->real_dev;
-        dev_queue_xmit(skb);
+        len = skb->len;
+        ret = dev_queue_xmit(skb);
+
+        if (likely(ret == NET_XMIT_SUCCESS)) {
+                txq->tx_packets++;
+                txq->tx_bytes += len;
+        } else
+                txq->tx_dropped++;
+
         return NETDEV_TX_OK;
 }
 
-static int vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb,
-                                            struct net_device *dev)
+static netdev_tx_t vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb,
+                                                    struct net_device *dev)
 {
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        int i = skb_get_queue_mapping(skb);
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
         u16 vlan_tci;
+        unsigned int len;
+        int ret;
 
         vlan_tci = vlan_dev_info(dev)->vlan_id;
         vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
         skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
 
-        txq->tx_packets++;
-        txq->tx_bytes += skb->len;
-
         skb->dev = vlan_dev_info(dev)->real_dev;
-        dev_queue_xmit(skb);
+        len = skb->len;
+        ret = dev_queue_xmit(skb);
+
+        if (likely(ret == NET_XMIT_SUCCESS)) {
+                txq->tx_packets++;
+                txq->tx_bytes += len;
+        } else
+                txq->tx_dropped++;
+
         return NETDEV_TX_OK;
 }
 
@@ -561,6 +579,55 @@ static int vlan_dev_neigh_setup(struct net_device *dev, struct neigh_parms *pa)
         return err;
 }
 
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+static int vlan_dev_fcoe_ddp_setup(struct net_device *dev, u16 xid,
+                                   struct scatterlist *sgl, unsigned int sgc)
+{
+        struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
+        int rc = 0;
+
+        if (ops->ndo_fcoe_ddp_setup)
+                rc = ops->ndo_fcoe_ddp_setup(real_dev, xid, sgl, sgc);
+
+        return rc;
+}
+
+static int vlan_dev_fcoe_ddp_done(struct net_device *dev, u16 xid)
+{
+        struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
+        int len = 0;
+
+        if (ops->ndo_fcoe_ddp_done)
+                len = ops->ndo_fcoe_ddp_done(real_dev, xid);
+
+        return len;
+}
+
+static int vlan_dev_fcoe_enable(struct net_device *dev)
+{
+        struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
+        int rc = -EINVAL;
+
+        if (ops->ndo_fcoe_enable)
+                rc = ops->ndo_fcoe_enable(real_dev);
+        return rc;
+}
+
+static int vlan_dev_fcoe_disable(struct net_device *dev)
+{
+        struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
+        int rc = -EINVAL;
+
+        if (ops->ndo_fcoe_disable)
+                rc = ops->ndo_fcoe_disable(real_dev);
+        return rc;
+}
+#endif
+
 static void vlan_dev_change_rx_flags(struct net_device *dev, int change)
 {
         struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
@@ -635,6 +702,10 @@ static int vlan_dev_init(struct net_device *dev)
         if (is_zero_ether_addr(dev->broadcast))
                 memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
 
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
+#endif
+
         if (real_dev->features & NETIF_F_HW_VLAN_TX) {
                 dev->header_ops      = real_dev->header_ops;
                 dev->hard_header_len = real_dev->hard_header_len;
@@ -715,6 +786,12 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
         .ndo_do_ioctl           = vlan_dev_ioctl,
         .ndo_neigh_setup        = vlan_dev_neigh_setup,
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
+        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
+        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
+        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+#endif
 };
 
 static const struct net_device_ops vlan_netdev_accel_ops = {
@@ -731,6 +808,12 @@ static const struct net_device_ops vlan_netdev_accel_ops = {
         .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
         .ndo_do_ioctl           = vlan_dev_ioctl,
         .ndo_neigh_setup        = vlan_dev_neigh_setup,
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
+        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
+        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
+        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+#endif
 };
 
 void vlan_setup(struct net_device *dev)
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index e9c91dcecc9b..343146e1bceb 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -100,6 +100,25 @@ static int vlan_changelink(struct net_device *dev,
         return 0;
 }
 
+static int vlan_get_tx_queues(struct net *net,
+                              struct nlattr *tb[],
+                              unsigned int *num_tx_queues,
+                              unsigned int *real_num_tx_queues)
+{
+        struct net_device *real_dev;
+
+        if (!tb[IFLA_LINK])
+                return -EINVAL;
+
+        real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK]));
+        if (!real_dev)
+                return -ENODEV;
+
+        *num_tx_queues      = real_dev->num_tx_queues;
+        *real_num_tx_queues = real_dev->real_num_tx_queues;
+        return 0;
+}
+
 static int vlan_newlink(struct net_device *dev,
                         struct nlattr *tb[], struct nlattr *data[])
 {
@@ -216,6 +235,7 @@ struct rtnl_link_ops vlan_link_ops __read_mostly = {
         .maxtype        = IFLA_VLAN_MAX,
         .policy         = vlan_policy,
         .priv_size      = sizeof(struct vlan_dev_info),
+        .get_tx_queues  = vlan_get_tx_queues,
         .setup          = vlan_setup,
         .validate       = vlan_validate,
         .newlink        = vlan_newlink,
diff --git a/net/9p/client.c b/net/9p/client.c
index dd43a8289b0d..787ccddb85ea 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -117,9 +117,6 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                 }
         }
 
-        if (!clnt->trans_mod)
-                clnt->trans_mod = v9fs_get_default_trans();
-
         kfree(options);
         return ret;
 }
@@ -689,6 +686,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         if (err < 0)
                 goto error;
 
+        if (!clnt->trans_mod)
+                clnt->trans_mod = v9fs_get_default_trans();
+
         if (clnt->trans_mod == NULL) {
                 err = -EPROTONOSUPPORT;
                 P9_DPRINTK(P9_DEBUG_ERROR,
@@ -1098,7 +1098,6 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
 
         if (data) {
                 memmove(data, dataptr, count);
-                data += count;
         }
 
         if (udata) {
@@ -1192,9 +1191,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
 
         err = p9pdu_readf(req->rc, clnt->dotu, "wS", &ignored, ret);
         if (err) {
-                ret = ERR_PTR(err);
                 p9pdu_dump(1, req->rc);
-                goto free_and_error;
+                p9_free_req(clnt, req);
+                goto error;
         }
 
         P9_DPRINTK(P9_DEBUG_9P,
@@ -1211,8 +1210,6 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
         p9_free_req(clnt, req);
         return ret;
 
-free_and_error:
-        p9_free_req(clnt, req);
 error:
         kfree(ret);
         return ERR_PTR(err);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 590b83963622..0d42d5da50ad 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -54,6 +54,7 @@
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/if_arp.h>
+#include <linux/smp_lock.h>
 #include <linux/termios.h>      /* For TIOCOUTQ/INQ */
 #include <net/datalink.h>
 #include <net/psnap.h>
@@ -1237,6 +1238,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                         return -ENOBUFS;
 
         *uaddr_len = sizeof(struct sockaddr_at);
+        memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
 
         if (peer) {
                 if (sk->sk_state != TCP_ESTABLISHED)
@@ -1398,7 +1400,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         __u16 len_hops;
 
         if (!net_eq(dev_net(dev), &init_net))
-                goto freeit;
+                goto drop;
 
         /* Don't mangle buffer if shared */
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
@@ -1406,7 +1408,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
 
         /* Size check and make sure header is contiguous */
         if (!pskb_may_pull(skb, sizeof(*ddp)))
-                goto freeit;
+                goto drop;
 
         ddp = ddp_hdr(skb);
 
@@ -1424,7 +1426,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         if (skb->len < sizeof(*ddp) || skb->len < (len_hops & 1023)) {
                 pr_debug("AppleTalk: dropping corrupted frame (deh_len=%u, "
                          "skb->len=%u)\n", len_hops & 1023, skb->len);
-                goto freeit;
+                goto drop;
         }
 
         /*
@@ -1434,7 +1436,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         if (ddp->deh_sum &&
             atalk_checksum(skb, len_hops & 1023) != ddp->deh_sum)
                 /* Not a valid AppleTalk frame - dustbin time */
-                goto freeit;
+                goto drop;
 
         /* Check the packet is aimed at us */
         if (!ddp->deh_dnet)     /* Net 0 is 'this network' */
@@ -1447,7 +1449,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
                  * AppleTalk iface
                  */
                 atalk_route_packet(skb, dev, ddp, len_hops, origlen);
-                goto out;
+                return NET_RX_SUCCESS;
         }
 
         /* if IP over DDP is not selected this code will be optimized out */
@@ -1463,18 +1465,21 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
 
         sock = atalk_search_socket(&tosat, atif);
         if (!sock) /* But not one of our sockets */
-                goto freeit;
+                goto drop;
 
         /* Queue packet (standard) */
         skb->sk = sock;
 
         if (sock_queue_rcv_skb(sock, skb) < 0)
-                goto freeit;
-out:
-        return 0;
-freeit:
+                goto drop;
+
+        return NET_RX_SUCCESS;
+
+drop:
         kfree_skb(skb);
-        goto out;
+out:
+        return NET_RX_DROP;
+
 }
 
 /*
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 848af113ba2a..26a646d4eb32 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -69,7 +69,7 @@ struct br2684_vcc {
         struct net_device *device;
         /* keep old push, pop functions for chaining */
         void (*old_push) (struct atm_vcc * vcc, struct sk_buff * skb);
-        /* void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb); */
+        void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
         enum br2684_encaps encaps;
         struct list_head brvccs;
 #ifdef CONFIG_ATM_BR2684_IPFILTER
@@ -142,6 +142,22 @@ static struct net_device *br2684_find_dev(const struct br2684_if_spec *s)
         return NULL;
 }
 
+/* chained vcc->pop function.  Check if we should wake the netif_queue */
+static void br2684_pop(struct atm_vcc *vcc, struct sk_buff *skb)
+{
+        struct br2684_vcc *brvcc = BR2684_VCC(vcc);
+        struct net_device *net_dev = skb->dev;
+
+        pr_debug("br2684_pop(vcc %p ; net_dev %p )\n", vcc, net_dev);
+        brvcc->old_pop(vcc, skb);
+
+        if (!net_dev)
+                return;
+
+        if (atm_may_send(vcc, 0))
+                netif_wake_queue(net_dev);
+
+}
 /*
  * Send a packet out a particular vcc.  Not to useful right now, but paves
  * the way for multiple vcc's per itf.  Returns true if we can send,
@@ -200,20 +216,19 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
 
         ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc;
         pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev);
-        if (!atm_may_send(atmvcc, skb->truesize)) {
-                /*
-                 * We free this here for now, because we cannot know in a higher
-                 * layer whether the skb pointer it supplied wasn't freed yet.
-                 * Now, it always is.
-                 */
-                dev_kfree_skb(skb);
-                return 0;
-        }
         atomic_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
         ATM_SKB(skb)->atm_options = atmvcc->atm_options;
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
         atmvcc->send(atmvcc, skb);
+
+        if (!atm_may_send(atmvcc, 0)) {
+                netif_stop_queue(brvcc->device);
+                /*check for race with br2684_pop*/
+                if (atm_may_send(atmvcc, 0))
+                        netif_start_queue(brvcc->device);
+        }
+
         return 1;
 }
 
@@ -223,7 +238,8 @@ static inline struct br2684_vcc *pick_outgoing_vcc(const struct sk_buff *skb,
         return list_empty(&brdev->brvccs) ? NULL : list_entry_brvcc(brdev->brvccs.next);        /* 1 vcc/dev right now */
 }
 
-static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t br2684_start_xmit(struct sk_buff *skb,
+                                     struct net_device *dev)
 {
         struct br2684_dev *brdev = BRPRIV(dev);
         struct br2684_vcc *brvcc;
@@ -503,8 +519,10 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         atmvcc->user_back = brvcc;
         brvcc->encaps = (enum br2684_encaps)be.encaps;
         brvcc->old_push = atmvcc->push;
+        brvcc->old_pop = atmvcc->pop;
         barrier();
         atmvcc->push = br2684_push;
+        atmvcc->pop = br2684_pop;
 
         __skb_queue_head_init(&queue);
         rq = &sk_atm(atmvcc)->sk_receive_queue;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 64910bb86089..64629c354343 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -267,7 +267,7 @@ static void clip_neigh_error(struct neighbour *neigh, struct sk_buff *skb)
         kfree_skb(skb);
 }
 
-static struct neigh_ops clip_neigh_ops = {
+static const struct neigh_ops clip_neigh_ops = {
         .family =               AF_INET,
         .solicit =              clip_neigh_solicit,
         .error_report =         clip_neigh_error,
@@ -360,7 +360,8 @@ static int clip_encap(struct atm_vcc *vcc, int mode)
         return 0;
 }
 
-static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
+                                   struct net_device *dev)
 {
         struct clip_priv *clip_priv = PRIV(dev);
         struct atmarp_entry *entry;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 8e723c2654cb..b2d644560323 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -59,7 +59,8 @@ static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 };
                                  */
 
 static int lec_open(struct net_device *dev);
-static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
+                                  struct net_device *dev);
 static int lec_close(struct net_device *dev);
 static void lec_init(struct net_device *dev);
 static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
@@ -247,7 +248,8 @@ static void lec_tx_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
-static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
+                                  struct net_device *dev)
 {
         struct sk_buff *skb2;
         struct lec_priv *priv = netdev_priv(dev);
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 1ac4b94bf626..38a6cb0863f0 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -73,7 +73,8 @@ static void mpoad_close(struct atm_vcc *vcc);
 static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb);
 
 static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb);
-static int mpc_send_packet(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
+                                         struct net_device *dev);
 static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned long event, void *dev);
 static void mpc_timer_refresh(void);
 static void mpc_cache_check( unsigned long checking_time  );
@@ -528,7 +529,8 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
 /*
  * Probably needs some error checks and locking, not sure...
  */
-static int mpc_send_packet(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
+                                         struct net_device *dev)
 {
         struct mpoa_client *mpc;
         struct ethhdr *eth;
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index 59fdb1d2e8ed..ed371684c133 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -34,6 +34,7 @@ menuconfig BT
 config BT_L2CAP
         tristate "L2CAP protocol support"
         depends on BT
+        select CRC16
         help
           L2CAP (Logical Link Control and Adaptation Protocol) provides
           connection oriented and connection-less data transport.  L2CAP
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index 9c42990126a0..26fb831ef7e0 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -165,7 +165,8 @@ static inline int bnep_net_proto_filter(struct sk_buff *skb, struct bnep_session
 }
 #endif
 
-static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t bnep_net_xmit(struct sk_buff *skb,
+                                 struct net_device *dev)
 {
         struct bnep_session *s = netdev_priv(dev);
         struct sock *sk = s->sock->sk;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index fa47d5d84f5c..a9750984f772 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -246,6 +246,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         if (hdev->notify)
                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 
+        atomic_set(&conn->devref, 0);
+
         hci_conn_init_sysfs(conn);
 
         tasklet_enable(&hdev->tx_task);
@@ -288,7 +290,7 @@ int hci_conn_del(struct hci_conn *conn)
 
         skb_queue_purge(&conn->data_q);
 
-        hci_conn_del_sysfs(conn);
+        hci_conn_put_device(conn);
 
         hci_dev_put(hdev);
 
@@ -583,6 +585,19 @@ void hci_conn_check_pending(struct hci_dev *hdev)
         hci_dev_unlock(hdev);
 }
 
+void hci_conn_hold_device(struct hci_conn *conn)
+{
+        atomic_inc(&conn->devref);
+}
+EXPORT_SYMBOL(hci_conn_hold_device);
+
+void hci_conn_put_device(struct hci_conn *conn)
+{
+        if (atomic_dec_and_test(&conn->devref))
+                hci_conn_del_sysfs(conn);
+}
+EXPORT_SYMBOL(hci_conn_put_device);
+
 int hci_get_conn_list(void __user *arg)
 {
         struct hci_conn_list_req req, *cl;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 406ad07cdea1..e1da8f68759c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -911,7 +911,7 @@ int hci_register_dev(struct hci_dev *hdev)
                 hdev->reassembly[i] = NULL;
 
         init_waitqueue_head(&hdev->req_wait_q);
-        init_MUTEX(&hdev->req_lock);
+        mutex_init(&hdev->req_lock);
 
         inquiry_cache_init(hdev);
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 184ba0a88ec0..e99fe385fba2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -887,6 +887,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 } else
                         conn->state = BT_CONNECTED;
 
+                hci_conn_hold_device(conn);
                 hci_conn_add_sysfs(conn);
 
                 if (test_bit(HCI_AUTH, &hdev->flags))
@@ -1693,6 +1694,7 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                 conn->handle = __le16_to_cpu(ev->handle);
                 conn->state  = BT_CONNECTED;
 
+                hci_conn_hold_device(conn);
                 hci_conn_add_sysfs(conn);
                 break;
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index b18676870d55..09bedeb5579c 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -40,6 +40,7 @@
 
 #include <linux/input.h>
 #include <linux/hid.h>
+#include <linux/hidraw.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -92,10 +93,14 @@ static void __hidp_link_session(struct hidp_session *session)
 {
         __module_get(THIS_MODULE);
         list_add(&session->list, &hidp_session_list);
+
+        hci_conn_hold_device(session->conn);
 }
 
 static void __hidp_unlink_session(struct hidp_session *session)
 {
+        hci_conn_put_device(session->conn);
+
         list_del(&session->list);
         module_put(THIS_MODULE);
 }
@@ -374,6 +379,7 @@ static void hidp_process_hid_control(struct hidp_session *session,
 
                 /* Kill session thread */
                 atomic_inc(&session->terminate);
+                hidp_schedule(session);
         }
 }
 
@@ -573,7 +579,11 @@ static int hidp_session(void *arg)
         if (session->hid) {
                 if (session->hid->claimed & HID_CLAIMED_INPUT)
                         hidinput_disconnect(session->hid);
+                if (session->hid->claimed & HID_CLAIMED_HIDRAW)
+                        hidraw_disconnect(session->hid);
+
                 hid_destroy_device(session->hid);
+                session->hid = NULL;
         }
 
         /* Wakeup user-space polling for socket errors */
@@ -601,25 +611,27 @@ static struct device *hidp_get_device(struct hidp_session *session)
 {
         bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
         bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
+        struct device *device = NULL;
         struct hci_dev *hdev;
-        struct hci_conn *conn;
 
         hdev = hci_get_route(dst, src);
         if (!hdev)
                 return NULL;
 
-        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+        session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+        if (session->conn)
+                device = &session->conn->dev;
 
         hci_dev_put(hdev);
 
-        return conn ? &conn->dev : NULL;
+        return device;
 }
 
 static int hidp_setup_input(struct hidp_session *session,
                                 struct hidp_connadd_req *req)
 {
         struct input_dev *input;
-        int i;
+        int err, i;
 
         input = input_allocate_device();
         if (!input)
@@ -666,7 +678,13 @@ static int hidp_setup_input(struct hidp_session *session,
 
         input->event = hidp_input_event;
 
-        return input_register_device(input);
+        err = input_register_device(input);
+        if (err < 0) {
+                hci_conn_put_device(session->conn);
+                return err;
+        }
+
+        return 0;
 }
 
 static int hidp_open(struct hid_device *hid)
@@ -748,13 +766,11 @@ static int hidp_setup_hid(struct hidp_session *session,
 {
         struct hid_device *hid;
         bdaddr_t src, dst;
-        int ret;
+        int err;
 
         hid = hid_allocate_device();
-        if (IS_ERR(hid)) {
-                ret = PTR_ERR(session->hid);
-                goto err;
-        }
+        if (IS_ERR(hid))
+                return PTR_ERR(session->hid);
 
         session->hid = hid;
         session->req = req;
@@ -776,16 +792,17 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->dev.parent = hidp_get_device(session);
         hid->ll_driver = &hidp_hid_driver;
 
-        ret = hid_add_device(hid);
-        if (ret)
-                goto err_hid;
+        err = hid_add_device(hid);
+        if (err < 0)
+                goto failed;
 
         return 0;
-err_hid:
+
+failed:
         hid_destroy_device(hid);
         session->hid = NULL;
-err:
-        return ret;
+
+        return err;
 }
 
 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
@@ -835,13 +852,13 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
         if (req->rd_size > 0) {
                 err = hidp_setup_hid(session, req);
                 if (err && err != -ENODEV)
-                        goto err_skb;
+                        goto purge;
         }
 
         if (!session->hid) {
                 err = hidp_setup_input(session, req);
                 if (err < 0)
-                        goto err_skb;
+                        goto purge;
         }
 
         __hidp_link_session(session);
@@ -869,13 +886,20 @@ unlink:
 
         __hidp_unlink_session(session);
 
-        if (session->input)
+        if (session->input) {
                 input_unregister_device(session->input);
-        if (session->hid)
+                session->input = NULL;
+        }
+
+        if (session->hid) {
                 hid_destroy_device(session->hid);
-err_skb:
+                session->hid = NULL;
+        }
+
+purge:
         skb_queue_purge(&session->ctrl_transmit);
         skb_queue_purge(&session->intr_transmit);
+
 failed:
         up_write(&hidp_session_sem);
 
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index e503c89057ad..faf3d74c3586 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -126,6 +126,8 @@ int hidp_get_conninfo(struct hidp_conninfo *ci);
 struct hidp_session {
         struct list_head list;
 
+        struct hci_conn *conn;
+
         struct socket *ctrl_sock;
         struct socket *intr_sock;
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index bd0a4c1bced0..b03012564647 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -41,6 +41,7 @@
 #include <linux/list.h>
 #include <linux/device.h>
 #include <linux/uaccess.h>
+#include <linux/crc16.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -50,7 +51,9 @@
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
 
-#define VERSION "2.13"
+#define VERSION "2.14"
+
+static int enable_ertm = 0;
 
 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
 static u8 l2cap_fixed_chan[8] = { 0x02, };
@@ -331,6 +334,48 @@ static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16
         return hci_send_acl(conn->hcon, skb, 0);
 }
 
+static inline int l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
+{
+        struct sk_buff *skb;
+        struct l2cap_hdr *lh;
+        struct l2cap_conn *conn = pi->conn;
+        int count, hlen = L2CAP_HDR_SIZE + 2;
+
+        if (pi->fcs == L2CAP_FCS_CRC16)
+                hlen += 2;
+
+        BT_DBG("pi %p, control 0x%2.2x", pi, control);
+
+        count = min_t(unsigned int, conn->mtu, hlen);
+        control |= L2CAP_CTRL_FRAME_TYPE;
+
+        skb = bt_skb_alloc(count, GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(pi->dcid);
+        put_unaligned_le16(control, skb_put(skb, 2));
+
+        if (pi->fcs == L2CAP_FCS_CRC16) {
+                u16 fcs = crc16(0, (u8 *)lh, count - 2);
+                put_unaligned_le16(fcs, skb_put(skb, 2));
+        }
+
+        return hci_send_acl(pi->conn->hcon, skb, 0);
+}
+
+static inline int l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
+{
+        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY)
+                control |= L2CAP_SUPER_RCV_NOT_READY;
+        else
+                control |= L2CAP_SUPER_RCV_READY;
+
+        return l2cap_send_sframe(pi, control);
+}
+
 static void l2cap_do_start(struct sock *sk)
 {
         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
@@ -364,6 +409,16 @@ static void l2cap_do_start(struct sock *sk)
         }
 }
 
+static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk)
+{
+        struct l2cap_disconn_req req;
+
+        req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
+        l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                        L2CAP_DISCONN_REQ, sizeof(req), &req);
+}
+
 /* ---- L2CAP connections ---- */
 static void l2cap_conn_start(struct l2cap_conn *conn)
 {
@@ -648,15 +703,10 @@ static void __l2cap_sock_close(struct sock *sk, int reason)
         case BT_CONFIG:
                 if (sk->sk_type == SOCK_SEQPACKET) {
                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-                        struct l2cap_disconn_req req;
 
                         sk->sk_state = BT_DISCONN;
                         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
-
-                        req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                        l2cap_send_cmd(conn, l2cap_get_ident(conn),
-                                        L2CAP_DISCONN_REQ, sizeof(req), &req);
+                        l2cap_send_disconn_req(conn, sk);
                 } else
                         l2cap_chan_del(sk, reason);
                 break;
@@ -715,12 +765,16 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 
                 pi->imtu = l2cap_pi(parent)->imtu;
                 pi->omtu = l2cap_pi(parent)->omtu;
+                pi->mode = l2cap_pi(parent)->mode;
+                pi->fcs  = l2cap_pi(parent)->fcs;
                 pi->sec_level = l2cap_pi(parent)->sec_level;
                 pi->role_switch = l2cap_pi(parent)->role_switch;
                 pi->force_reliable = l2cap_pi(parent)->force_reliable;
         } else {
                 pi->imtu = L2CAP_DEFAULT_MTU;
                 pi->omtu = 0;
+                pi->mode = L2CAP_MODE_BASIC;
+                pi->fcs  = L2CAP_FCS_CRC16;
                 pi->sec_level = BT_SECURITY_LOW;
                 pi->role_switch = 0;
                 pi->force_reliable = 0;
@@ -956,6 +1010,19 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
                 goto done;
         }
 
+        switch (l2cap_pi(sk)->mode) {
+        case L2CAP_MODE_BASIC:
+                break;
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                if (enable_ertm)
+                        break;
+                /* fall through */
+        default:
+                err = -ENOTSUPP;
+                goto done;
+        }
+
         switch (sk->sk_state) {
         case BT_CONNECT:
         case BT_CONNECT2:
@@ -1007,6 +1074,19 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
                 goto done;
         }
 
+        switch (l2cap_pi(sk)->mode) {
+        case L2CAP_MODE_BASIC:
+                break;
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                if (enable_ertm)
+                        break;
+                /* fall through */
+        default:
+                err = -ENOTSUPP;
+                goto done;
+        }
+
         if (!l2cap_pi(sk)->psm) {
                 bdaddr_t *src = &bt_sk(sk)->src;
                 u16 psm;
@@ -1117,39 +1197,219 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
         return 0;
 }
 
-static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
+static void l2cap_monitor_timeout(unsigned long arg)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        struct sk_buff *skb, **frag;
-        int err, hlen, count, sent = 0;
-        struct l2cap_hdr *lh;
+        struct sock *sk = (void *) arg;
+        u16 control;
 
-        BT_DBG("sk %p len %d", sk, len);
+        bh_lock_sock(sk);
+        if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
+                l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk);
+                return;
+        }
 
-        /* First fragment (with L2CAP header) */
-        if (sk->sk_type == SOCK_DGRAM)
-                hlen = L2CAP_HDR_SIZE + 2;
-        else
-                hlen = L2CAP_HDR_SIZE;
+        l2cap_pi(sk)->retry_count++;
+        __mod_monitor_timer();
 
-        count = min_t(unsigned int, (conn->mtu - hlen), len);
+        control = L2CAP_CTRL_POLL;
+        l2cap_send_rr_or_rnr(l2cap_pi(sk), control);
+        bh_unlock_sock(sk);
+}
 
-        skb = bt_skb_send_alloc(sk, hlen + count,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
-        if (!skb)
-                return err;
+static void l2cap_retrans_timeout(unsigned long arg)
+{
+        struct sock *sk = (void *) arg;
+        u16 control;
 
-        /* Create L2CAP header */
-        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+        bh_lock_sock(sk);
+        l2cap_pi(sk)->retry_count = 1;
+        __mod_monitor_timer();
+
+        l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
+
+        control = L2CAP_CTRL_POLL;
+        l2cap_send_rr_or_rnr(l2cap_pi(sk), control);
+        bh_unlock_sock(sk);
+}
+
+static void l2cap_drop_acked_frames(struct sock *sk)
+{
+        struct sk_buff *skb;
+
+        while ((skb = skb_peek(TX_QUEUE(sk)))) {
+                if (bt_cb(skb)->tx_seq == l2cap_pi(sk)->expected_ack_seq)
+                        break;
+
+                skb = skb_dequeue(TX_QUEUE(sk));
+                kfree_skb(skb);
+
+                l2cap_pi(sk)->unacked_frames--;
+        }
+
+        if (!l2cap_pi(sk)->unacked_frames)
+                del_timer(&l2cap_pi(sk)->retrans_timer);
 
-        if (sk->sk_type == SOCK_DGRAM)
-                put_unaligned(l2cap_pi(sk)->psm, (__le16 *) skb_put(skb, 2));
+        return;
+}
+
+static inline int l2cap_do_send(struct sock *sk, struct sk_buff *skb)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        int err;
+
+        BT_DBG("sk %p, skb %p len %d", sk, skb, skb->len);
+
+        err = hci_send_acl(pi->conn->hcon, skb, 0);
+        if (err < 0)
+                kfree_skb(skb);
+
+        return err;
+}
+
+static int l2cap_streaming_send(struct sock *sk)
+{
+        struct sk_buff *skb, *tx_skb;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        u16 control, fcs;
+        int err;
+
+        while ((skb = sk->sk_send_head)) {
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
+
+                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+                control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
+                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+
+                if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16) {
+                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
+                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
+                }
+
+                err = l2cap_do_send(sk, tx_skb);
+                if (err < 0) {
+                        l2cap_send_disconn_req(pi->conn, sk);
+                        return err;
+                }
+
+                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
+
+                if (skb_queue_is_last(TX_QUEUE(sk), skb))
+                        sk->sk_send_head = NULL;
+                else
+                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
+
+                skb = skb_dequeue(TX_QUEUE(sk));
+                kfree_skb(skb);
+        }
+        return 0;
+}
+
+static int l2cap_retransmit_frame(struct sock *sk, u8 tx_seq)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct sk_buff *skb, *tx_skb;
+        u16 control, fcs;
+        int err;
+
+        skb = skb_peek(TX_QUEUE(sk));
+        do {
+                if (bt_cb(skb)->tx_seq != tx_seq) {
+                        if (skb_queue_is_last(TX_QUEUE(sk), skb))
+                                break;
+                        skb = skb_queue_next(TX_QUEUE(sk), skb);
+                        continue;
+                }
+
+                if (pi->remote_max_tx &&
+                                bt_cb(skb)->retries == pi->remote_max_tx) {
+                        l2cap_send_disconn_req(pi->conn, sk);
+                        break;
+                }
+
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
+                bt_cb(skb)->retries++;
+                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+                control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                                | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
+                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+
+                if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16) {
+                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
+                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
+                }
+
+                err = l2cap_do_send(sk, tx_skb);
+                if (err < 0) {
+                        l2cap_send_disconn_req(pi->conn, sk);
+                        return err;
+                }
+                break;
+        } while(1);
+        return 0;
+}
+
+static int l2cap_ertm_send(struct sock *sk)
+{
+        struct sk_buff *skb, *tx_skb;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        u16 control, fcs;
+        int err;
+
+        if (pi->conn_state & L2CAP_CONN_WAIT_F)
+                return 0;
+
+        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))
+                        && !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
+
+                if (pi->remote_max_tx &&
+                                bt_cb(skb)->retries == pi->remote_max_tx) {
+                        l2cap_send_disconn_req(pi->conn, sk);
+                        break;
+                }
+
+                bt_cb(skb)->retries++;
+
+                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+                control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                                | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
+                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+
+
+                if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16) {
+                        fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
+                        put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
+                }
+
+                err = l2cap_do_send(sk, tx_skb);
+                if (err < 0) {
+                        l2cap_send_disconn_req(pi->conn, sk);
+                        return err;
+                }
+                __mod_retrans_timer();
+
+                bt_cb(skb)->tx_seq = pi->next_tx_seq;
+                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
+
+                pi->unacked_frames++;
+
+                if (skb_queue_is_last(TX_QUEUE(sk), skb))
+                        sk->sk_send_head = NULL;
+                else
+                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
+        }
+
+        return 0;
+}
+
+static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sk_buff **frag;
+        int err, sent = 0;
 
         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
-                err = -EFAULT;
-                goto fail;
+                return -EFAULT;
         }
 
         sent += count;
@@ -1162,33 +1422,173 @@ static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
 
                 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
                 if (!*frag)
-                        goto fail;
-
-                if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
-                        err = -EFAULT;
-                        goto fail;
-                }
+                        return -EFAULT;
+                if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
+                        return -EFAULT;
 
                 sent += count;
                 len  -= count;
 
                 frag = &(*frag)->next;
         }
-        err = hci_send_acl(conn->hcon, skb, 0);
-        if (err < 0)
-                goto fail;
 
         return sent;
+}
 
-fail:
-        kfree_skb(skb);
-        return err;
+static struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, size_t len)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sk_buff *skb;
+        int err, count, hlen = L2CAP_HDR_SIZE + 2;
+        struct l2cap_hdr *lh;
+
+        BT_DBG("sk %p len %d", sk, (int)len);
+
+        count = min_t(unsigned int, (conn->mtu - hlen), len);
+        skb = bt_skb_send_alloc(sk, count + hlen,
+                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        /* Create L2CAP header */
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+        put_unaligned_le16(l2cap_pi(sk)->psm, skb_put(skb, 2));
+
+        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        if (unlikely(err < 0)) {
+                kfree_skb(skb);
+                return ERR_PTR(err);
+        }
+        return skb;
+}
+
+static struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size_t len)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sk_buff *skb;
+        int err, count, hlen = L2CAP_HDR_SIZE;
+        struct l2cap_hdr *lh;
+
+        BT_DBG("sk %p len %d", sk, (int)len);
+
+        count = min_t(unsigned int, (conn->mtu - hlen), len);
+        skb = bt_skb_send_alloc(sk, count + hlen,
+                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        /* Create L2CAP header */
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+
+        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        if (unlikely(err < 0)) {
+                kfree_skb(skb);
+                return ERR_PTR(err);
+        }
+        return skb;
+}
+
+static struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sk_buff *skb;
+        int err, count, hlen = L2CAP_HDR_SIZE + 2;
+        struct l2cap_hdr *lh;
+
+        BT_DBG("sk %p len %d", sk, (int)len);
+
+        if (sdulen)
+                hlen += 2;
+
+        if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
+                hlen += 2;
+
+        count = min_t(unsigned int, (conn->mtu - hlen), len);
+        skb = bt_skb_send_alloc(sk, count + hlen,
+                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        /* Create L2CAP header */
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+        put_unaligned_le16(control, skb_put(skb, 2));
+        if (sdulen)
+                put_unaligned_le16(sdulen, skb_put(skb, 2));
+
+        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        if (unlikely(err < 0)) {
+                kfree_skb(skb);
+                return ERR_PTR(err);
+        }
+
+        if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
+                put_unaligned_le16(0, skb_put(skb, 2));
+
+        bt_cb(skb)->retries = 0;
+        return skb;
+}
+
+static inline int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct sk_buff *skb;
+        struct sk_buff_head sar_queue;
+        u16 control;
+        size_t size = 0;
+
+        __skb_queue_head_init(&sar_queue);
+        control = L2CAP_SDU_START;
+        skb = l2cap_create_iframe_pdu(sk, msg, pi->max_pdu_size, control, len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        __skb_queue_tail(&sar_queue, skb);
+        len -= pi->max_pdu_size;
+        size +=pi->max_pdu_size;
+        control = 0;
+
+        while (len > 0) {
+                size_t buflen;
+
+                if (len > pi->max_pdu_size) {
+                        control |= L2CAP_SDU_CONTINUE;
+                        buflen = pi->max_pdu_size;
+                } else {
+                        control |= L2CAP_SDU_END;
+                        buflen = len;
+                }
+
+                skb = l2cap_create_iframe_pdu(sk, msg, buflen, control, 0);
+                if (IS_ERR(skb)) {
+                        skb_queue_purge(&sar_queue);
+                        return PTR_ERR(skb);
+                }
+
+                __skb_queue_tail(&sar_queue, skb);
+                len -= buflen;
+                size += buflen;
+                control = 0;
+        }
+        skb_queue_splice_tail(&sar_queue, TX_QUEUE(sk));
+        if (sk->sk_send_head == NULL)
+                sk->sk_send_head = sar_queue.next;
+
+        return size;
 }
 
 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
-        int err = 0;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct sk_buff *skb;
+        u16 control;
+        int err;
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
@@ -1200,16 +1600,73 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                 return -EOPNOTSUPP;
 
         /* Check outgoing MTU */
-        if (sk->sk_type != SOCK_RAW && len > l2cap_pi(sk)->omtu)
+        if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC
+                        && len > pi->omtu)
                 return -EINVAL;
 
         lock_sock(sk);
 
-        if (sk->sk_state == BT_CONNECTED)
-                err = l2cap_do_send(sk, msg, len);
-        else
+        if (sk->sk_state != BT_CONNECTED) {
                 err = -ENOTCONN;
+                goto done;
+        }
+
+        /* Connectionless channel */
+        if (sk->sk_type == SOCK_DGRAM) {
+                skb = l2cap_create_connless_pdu(sk, msg, len);
+                err = l2cap_do_send(sk, skb);
+                goto done;
+        }
+
+        switch (pi->mode) {
+        case L2CAP_MODE_BASIC:
+                /* Create a basic PDU */
+                skb = l2cap_create_basic_pdu(sk, msg, len);
+                if (IS_ERR(skb)) {
+                        err = PTR_ERR(skb);
+                        goto done;
+                }
+
+                err = l2cap_do_send(sk, skb);
+                if (!err)
+                        err = len;
+                break;
+
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                /* Entire SDU fits into one PDU */
+                if (len <= pi->max_pdu_size) {
+                        control = L2CAP_SDU_UNSEGMENTED;
+                        skb = l2cap_create_iframe_pdu(sk, msg, len, control, 0);
+                        if (IS_ERR(skb)) {
+                                err = PTR_ERR(skb);
+                                goto done;
+                        }
+                        __skb_queue_tail(TX_QUEUE(sk), skb);
+                        if (sk->sk_send_head == NULL)
+                                sk->sk_send_head = skb;
+                } else {
+                /* Segment SDU into multiples PDUs */
+                        err = l2cap_sar_segment_sdu(sk, msg, len);
+                        if (err < 0)
+                                goto done;
+                }
+
+                if (pi->mode == L2CAP_MODE_STREAMING)
+                        err = l2cap_streaming_send(sk);
+                else
+                        err = l2cap_ertm_send(sk);
+
+                if (!err)
+                        err = len;
+                break;
+
+        default:
+                BT_DBG("bad state %1.1x", pi->mode);
+                err = -EINVAL;
+        }
 
+done:
         release_sock(sk);
         return err;
 }
@@ -1257,7 +1714,8 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                 opts.imtu     = l2cap_pi(sk)->imtu;
                 opts.omtu     = l2cap_pi(sk)->omtu;
                 opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = L2CAP_MODE_BASIC;
+                opts.mode     = l2cap_pi(sk)->mode;
+                opts.fcs      = l2cap_pi(sk)->fcs;
 
                 len = min_t(unsigned int, sizeof(opts), optlen);
                 if (copy_from_user((char *) &opts, optval, len)) {
@@ -1265,8 +1723,10 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
-                l2cap_pi(sk)->imtu  = opts.imtu;
-                l2cap_pi(sk)->omtu  = opts.omtu;
+                l2cap_pi(sk)->imtu = opts.imtu;
+                l2cap_pi(sk)->omtu = opts.omtu;
+                l2cap_pi(sk)->mode = opts.mode;
+                l2cap_pi(sk)->fcs  = opts.fcs;
                 break;
 
         case L2CAP_LM:
@@ -1379,7 +1839,8 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
                 opts.imtu     = l2cap_pi(sk)->imtu;
                 opts.omtu     = l2cap_pi(sk)->omtu;
                 opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = L2CAP_MODE_BASIC;
+                opts.mode     = l2cap_pi(sk)->mode;
+                opts.fcs      = l2cap_pi(sk)->fcs;
 
                 len = min_t(unsigned int, len, sizeof(opts));
                 if (copy_to_user(optval, (char *) &opts, len))
@@ -1708,16 +2169,108 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
         *ptr += L2CAP_CONF_OPT_SIZE + len;
 }
 
+static int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
+{
+        u32 local_feat_mask = l2cap_feat_mask;
+        if (enable_ertm)
+                local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
+
+        switch (mode) {
+        case L2CAP_MODE_ERTM:
+                return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
+        case L2CAP_MODE_STREAMING:
+                return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
+        default:
+                return 0x00;
+        }
+}
+
+static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
+{
+        switch (mode) {
+        case L2CAP_MODE_STREAMING:
+        case L2CAP_MODE_ERTM:
+                if (l2cap_mode_supported(mode, remote_feat_mask))
+                        return mode;
+                /* fall through */
+        default:
+                return L2CAP_MODE_BASIC;
+        }
+}
+
 static int l2cap_build_conf_req(struct sock *sk, void *data)
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct l2cap_conf_req *req = data;
+        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_ERTM };
         void *ptr = req->data;
 
         BT_DBG("sk %p", sk);
 
-        if (pi->imtu != L2CAP_DEFAULT_MTU)
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
+        if (pi->num_conf_req || pi->num_conf_rsp)
+                goto done;
+
+        switch (pi->mode) {
+        case L2CAP_MODE_STREAMING:
+        case L2CAP_MODE_ERTM:
+                pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
+                if (!l2cap_mode_supported(pi->mode, pi->conn->feat_mask))
+                        l2cap_send_disconn_req(pi->conn, sk);
+                break;
+        default:
+                pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
+                break;
+        }
+
+done:
+        switch (pi->mode) {
+        case L2CAP_MODE_BASIC:
+                if (pi->imtu != L2CAP_DEFAULT_MTU)
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
+                break;
+
+        case L2CAP_MODE_ERTM:
+                rfc.mode            = L2CAP_MODE_ERTM;
+                rfc.txwin_size      = L2CAP_DEFAULT_TX_WINDOW;
+                rfc.max_transmit    = L2CAP_DEFAULT_MAX_TX;
+                rfc.retrans_timeout = 0;
+                rfc.monitor_timeout = 0;
+                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
+
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+
+                if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
+                        break;
+
+                if (pi->fcs == L2CAP_FCS_NONE ||
+                                pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                        pi->fcs = L2CAP_FCS_NONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
+                }
+                break;
+
+        case L2CAP_MODE_STREAMING:
+                rfc.mode            = L2CAP_MODE_STREAMING;
+                rfc.txwin_size      = 0;
+                rfc.max_transmit    = 0;
+                rfc.retrans_timeout = 0;
+                rfc.monitor_timeout = 0;
+                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
+
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+
+                if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
+                        break;
+
+                if (pi->fcs == L2CAP_FCS_NONE ||
+                                pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                        pi->fcs = L2CAP_FCS_NONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
+                }
+                break;
+        }
 
         /* FIXME: Need actual value of the flush timeout */
         //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
@@ -1767,6 +2320,12 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
                                 memcpy(&rfc, (void *) val, olen);
                         break;
 
+                case L2CAP_CONF_FCS:
+                        if (val == L2CAP_FCS_NONE)
+                                pi->conf_state |= L2CAP_CONF_NO_FCS_RECV;
+
+                        break;
+
                 default:
                         if (hint)
                                 break;
@@ -1777,30 +2336,83 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
                 }
         }
 
+        if (pi->num_conf_rsp || pi->num_conf_req)
+                goto done;
+
+        switch (pi->mode) {
+        case L2CAP_MODE_STREAMING:
+        case L2CAP_MODE_ERTM:
+                pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
+                if (!l2cap_mode_supported(pi->mode, pi->conn->feat_mask))
+                        return -ECONNREFUSED;
+                break;
+        default:
+                pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
+                break;
+        }
+
+done:
+        if (pi->mode != rfc.mode) {
+                result = L2CAP_CONF_UNACCEPT;
+                rfc.mode = pi->mode;
+
+                if (pi->num_conf_rsp == 1)
+                        return -ECONNREFUSED;
+
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+        }
+
+
         if (result == L2CAP_CONF_SUCCESS) {
                 /* Configure output options and let the other side know
                  * which ones we don't like. */
 
-                if (rfc.mode == L2CAP_MODE_BASIC) {
-                        if (mtu < pi->omtu)
-                                result = L2CAP_CONF_UNACCEPT;
-                        else {
-                                pi->omtu = mtu;
-                                pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
-                        }
+                if (mtu < L2CAP_DEFAULT_MIN_MTU)
+                        result = L2CAP_CONF_UNACCEPT;
+                else {
+                        pi->omtu = mtu;
+                        pi->conf_state |= L2CAP_CONF_MTU_DONE;
+                }
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
 
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
-                } else {
+                switch (rfc.mode) {
+                case L2CAP_MODE_BASIC:
+                        pi->fcs = L2CAP_FCS_NONE;
+                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        break;
+
+                case L2CAP_MODE_ERTM:
+                        pi->remote_tx_win = rfc.txwin_size;
+                        pi->remote_max_tx = rfc.max_transmit;
+                        pi->max_pdu_size = rfc.max_pdu_size;
+
+                        rfc.retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
+                        rfc.monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+
+                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        break;
+
+                case L2CAP_MODE_STREAMING:
+                        pi->remote_tx_win = rfc.txwin_size;
+                        pi->max_pdu_size = rfc.max_pdu_size;
+
+                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        break;
+
+                default:
                         result = L2CAP_CONF_UNACCEPT;
 
                         memset(&rfc, 0, sizeof(rfc));
-                        rfc.mode = L2CAP_MODE_BASIC;
-
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                                sizeof(rfc), (unsigned long) &rfc);
+                        rfc.mode = pi->mode;
                 }
-        }
 
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+
+                if (result == L2CAP_CONF_SUCCESS)
+                        pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
+        }
         rsp->scid   = cpu_to_le16(pi->dcid);
         rsp->result = cpu_to_le16(result);
         rsp->flags  = cpu_to_le16(0x0000);
@@ -1808,6 +2420,73 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
         return ptr - data;
 }
 
+static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data, u16 *result)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct l2cap_conf_req *req = data;
+        void *ptr = req->data;
+        int type, olen;
+        unsigned long val;
+        struct l2cap_conf_rfc rfc;
+
+        BT_DBG("sk %p, rsp %p, len %d, req %p", sk, rsp, len, data);
+
+        while (len >= L2CAP_CONF_OPT_SIZE) {
+                len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
+
+                switch (type) {
+                case L2CAP_CONF_MTU:
+                        if (val < L2CAP_DEFAULT_MIN_MTU) {
+                                *result = L2CAP_CONF_UNACCEPT;
+                                pi->omtu = L2CAP_DEFAULT_MIN_MTU;
+                        } else
+                                pi->omtu = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                        break;
+
+                case L2CAP_CONF_FLUSH_TO:
+                        pi->flush_to = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
+                                                        2, pi->flush_to);
+                        break;
+
+                case L2CAP_CONF_RFC:
+                        if (olen == sizeof(rfc))
+                                memcpy(&rfc, (void *)val, olen);
+
+                        if ((pi->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
+                                                        rfc.mode != pi->mode)
+                                return -ECONNREFUSED;
+
+                        pi->mode = rfc.mode;
+                        pi->fcs = 0;
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+                        break;
+                }
+        }
+
+        if (*result == L2CAP_CONF_SUCCESS) {
+                switch (rfc.mode) {
+                case L2CAP_MODE_ERTM:
+                        pi->remote_tx_win   = rfc.txwin_size;
+                        pi->retrans_timeout = rfc.retrans_timeout;
+                        pi->monitor_timeout = rfc.monitor_timeout;
+                        pi->max_pdu_size    = le16_to_cpu(rfc.max_pdu_size);
+                        break;
+                case L2CAP_MODE_STREAMING:
+                        pi->max_pdu_size    = le16_to_cpu(rfc.max_pdu_size);
+                        break;
+                }
+        }
+
+        req->dcid   = cpu_to_le16(pi->dcid);
+        req->flags  = cpu_to_le16(0x0000);
+
+        return ptr - data;
+}
+
 static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
 {
         struct l2cap_conf_rsp *rsp = data;
@@ -1994,6 +2673,7 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                         l2cap_build_conf_req(sk, req), req);
+                l2cap_pi(sk)->num_conf_req++;
                 break;
 
         case L2CAP_CR_PEND:
@@ -2052,10 +2732,13 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         /* Complete config. */
         len = l2cap_parse_conf_req(sk, rsp);
-        if (len < 0)
+        if (len < 0) {
+                l2cap_send_disconn_req(conn, sk);
                 goto unlock;
+        }
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
+        l2cap_pi(sk)->num_conf_rsp++;
 
         /* Reset config buffer. */
         l2cap_pi(sk)->conf_len = 0;
@@ -2064,7 +2747,22 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto unlock;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
+                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
+                                || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+
                 sk->sk_state = BT_CONNECTED;
+                l2cap_pi(sk)->next_tx_seq = 0;
+                l2cap_pi(sk)->expected_ack_seq = 0;
+                l2cap_pi(sk)->unacked_frames = 0;
+
+                setup_timer(&l2cap_pi(sk)->retrans_timer,
+                                l2cap_retrans_timeout, (unsigned long) sk);
+                setup_timer(&l2cap_pi(sk)->monitor_timer,
+                                l2cap_monitor_timeout, (unsigned long) sk);
+
+                __skb_queue_head_init(TX_QUEUE(sk));
+                __skb_queue_head_init(SREJ_QUEUE(sk));
                 l2cap_chan_ready(sk);
                 goto unlock;
         }
@@ -2073,6 +2771,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 u8 buf[64];
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                         l2cap_build_conf_req(sk, buf), buf);
+                l2cap_pi(sk)->num_conf_req++;
         }
 
 unlock:
@@ -2102,29 +2801,32 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 break;
 
         case L2CAP_CONF_UNACCEPT:
-                if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
-                        char req[128];
-                        /* It does not make sense to adjust L2CAP parameters
-                         * that are currently defined in the spec. We simply
-                         * resend config request that we sent earlier. It is
-                         * stupid, but it helps qualification testing which
-                         * expects at least some response from us. */
-                        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                                l2cap_build_conf_req(sk, req), req);
-                        goto done;
+                if (l2cap_pi(sk)->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
+                        int len = cmd->len - sizeof(*rsp);
+                        char req[64];
+
+                        /* throw out any old stored conf requests */
+                        result = L2CAP_CONF_SUCCESS;
+                        len = l2cap_parse_conf_rsp(sk, rsp->data,
+                                                        len, req, &result);
+                        if (len < 0) {
+                                l2cap_send_disconn_req(conn, sk);
+                                goto done;
+                        }
+
+                        l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                                                L2CAP_CONF_REQ, len, req);
+                        l2cap_pi(sk)->num_conf_req++;
+                        if (result != L2CAP_CONF_SUCCESS)
+                                goto done;
+                        break;
                 }
 
         default:
                 sk->sk_state = BT_DISCONN;
                 sk->sk_err = ECONNRESET;
                 l2cap_sock_set_timer(sk, HZ * 5);
-                {
-                        struct l2cap_disconn_req req;
-                        req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                        l2cap_send_cmd(conn, l2cap_get_ident(conn),
-                                        L2CAP_DISCONN_REQ, sizeof(req), &req);
-                }
+                l2cap_send_disconn_req(conn, sk);
                 goto done;
         }
 
@@ -2134,7 +2836,16 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
+                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
+                                || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+
                 sk->sk_state = BT_CONNECTED;
+                l2cap_pi(sk)->expected_tx_seq = 0;
+                l2cap_pi(sk)->buffer_seq = 0;
+                l2cap_pi(sk)->num_to_ack = 0;
+                __skb_queue_head_init(TX_QUEUE(sk));
+                __skb_queue_head_init(SREJ_QUEUE(sk));
                 l2cap_chan_ready(sk);
         }
 
@@ -2165,6 +2876,11 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
 
         sk->sk_shutdown = SHUTDOWN_MASK;
 
+        skb_queue_purge(TX_QUEUE(sk));
+        skb_queue_purge(SREJ_QUEUE(sk));
+        del_timer(&l2cap_pi(sk)->retrans_timer);
+        del_timer(&l2cap_pi(sk)->monitor_timer);
+
         l2cap_chan_del(sk, ECONNRESET);
         bh_unlock_sock(sk);
 
@@ -2187,6 +2903,11 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
         if (!sk)
                 return 0;
 
+        skb_queue_purge(TX_QUEUE(sk));
+        skb_queue_purge(SREJ_QUEUE(sk));
+        del_timer(&l2cap_pi(sk)->retrans_timer);
+        del_timer(&l2cap_pi(sk)->monitor_timer);
+
         l2cap_chan_del(sk, 0);
         bh_unlock_sock(sk);
 
@@ -2205,10 +2926,14 @@ static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cm
 
         if (type == L2CAP_IT_FEAT_MASK) {
                 u8 buf[8];
+                u32 feat_mask = l2cap_feat_mask;
                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
                 rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
-                put_unaligned(cpu_to_le32(l2cap_feat_mask), (__le32 *) rsp->data);
+                if (enable_ertm)
+                        feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
+                                                         | L2CAP_FEAT_FCS;
+                put_unaligned_le32(feat_mask, rsp->data);
                 l2cap_send_cmd(conn, cmd->ident,
                                         L2CAP_INFO_RSP, sizeof(buf), buf);
         } else if (type == L2CAP_IT_FIXED_CHAN) {
@@ -2359,9 +3084,374 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *sk
         kfree_skb(skb);
 }
 
+static int l2cap_check_fcs(struct l2cap_pinfo *pi,  struct sk_buff *skb)
+{
+        u16 our_fcs, rcv_fcs;
+        int hdr_size = L2CAP_HDR_SIZE + 2;
+
+        if (pi->fcs == L2CAP_FCS_CRC16) {
+                skb_trim(skb, skb->len - 2);
+                rcv_fcs = get_unaligned_le16(skb->data + skb->len);
+                our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
+
+                if (our_fcs != rcv_fcs)
+                        return -EINVAL;
+        }
+        return 0;
+}
+
+static void l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_seq, u8 sar)
+{
+        struct sk_buff *next_skb;
+
+        bt_cb(skb)->tx_seq = tx_seq;
+        bt_cb(skb)->sar = sar;
+
+        next_skb = skb_peek(SREJ_QUEUE(sk));
+        if (!next_skb) {
+                __skb_queue_tail(SREJ_QUEUE(sk), skb);
+                return;
+        }
+
+        do {
+                if (bt_cb(next_skb)->tx_seq > tx_seq) {
+                        __skb_queue_before(SREJ_QUEUE(sk), next_skb, skb);
+                        return;
+                }
+
+                if (skb_queue_is_last(SREJ_QUEUE(sk), next_skb))
+                        break;
+
+        } while((next_skb = skb_queue_next(SREJ_QUEUE(sk), next_skb)));
+
+        __skb_queue_tail(SREJ_QUEUE(sk), skb);
+}
+
+static int l2cap_sar_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct sk_buff *_skb;
+        int err = -EINVAL;
+
+        switch (control & L2CAP_CTRL_SAR) {
+        case L2CAP_SDU_UNSEGMENTED:
+                if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
+                        kfree_skb(pi->sdu);
+                        break;
+                }
+
+                err = sock_queue_rcv_skb(sk, skb);
+                if (!err)
+                        return 0;
+
+                break;
+
+        case L2CAP_SDU_START:
+                if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
+                        kfree_skb(pi->sdu);
+                        break;
+                }
+
+                pi->sdu_len = get_unaligned_le16(skb->data);
+                skb_pull(skb, 2);
+
+                pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
+                if (!pi->sdu) {
+                        err = -ENOMEM;
+                        break;
+                }
+
+                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+
+                pi->conn_state |= L2CAP_CONN_SAR_SDU;
+                pi->partial_sdu_len = skb->len;
+                err = 0;
+                break;
+
+        case L2CAP_SDU_CONTINUE:
+                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
+                        break;
+
+                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+
+                pi->partial_sdu_len += skb->len;
+                if (pi->partial_sdu_len > pi->sdu_len)
+                        kfree_skb(pi->sdu);
+                else
+                        err = 0;
+
+                break;
+
+        case L2CAP_SDU_END:
+                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
+                        break;
+
+                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+
+                pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
+                pi->partial_sdu_len += skb->len;
+
+                if (pi->partial_sdu_len == pi->sdu_len) {
+                        _skb = skb_clone(pi->sdu, GFP_ATOMIC);
+                        err = sock_queue_rcv_skb(sk, _skb);
+                        if (err < 0)
+                                kfree_skb(_skb);
+                }
+                kfree_skb(pi->sdu);
+                err = 0;
+
+                break;
+        }
+
+        kfree_skb(skb);
+        return err;
+}
+
+static void l2cap_check_srej_gap(struct sock *sk, u8 tx_seq)
+{
+        struct sk_buff *skb;
+        u16 control = 0;
+
+        while((skb = skb_peek(SREJ_QUEUE(sk)))) {
+                if (bt_cb(skb)->tx_seq != tx_seq)
+                        break;
+
+                skb = skb_dequeue(SREJ_QUEUE(sk));
+                control |= bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
+                l2cap_sar_reassembly_sdu(sk, skb, control);
+                l2cap_pi(sk)->buffer_seq_srej =
+                        (l2cap_pi(sk)->buffer_seq_srej + 1) % 64;
+                tx_seq++;
+        }
+}
+
+static void l2cap_resend_srejframe(struct sock *sk, u8 tx_seq)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct srej_list *l, *tmp;
+        u16 control;
+
+        list_for_each_entry_safe(l,tmp, SREJ_LIST(sk), list) {
+                if (l->tx_seq == tx_seq) {
+                        list_del(&l->list);
+                        kfree(l);
+                        return;
+                }
+                control = L2CAP_SUPER_SELECT_REJECT;
+                control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+                l2cap_send_sframe(pi, control);
+                list_del(&l->list);
+                list_add_tail(&l->list, SREJ_LIST(sk));
+        }
+}
+
+static void l2cap_send_srejframe(struct sock *sk, u8 tx_seq)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct srej_list *new;
+        u16 control;
+
+        while (tx_seq != pi->expected_tx_seq) {
+                control = L2CAP_SUPER_SELECT_REJECT;
+                control |= pi->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+                if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
+                        control |= L2CAP_CTRL_POLL;
+                        pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
+                }
+                l2cap_send_sframe(pi, control);
+
+                new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
+                new->tx_seq = pi->expected_tx_seq++;
+                list_add_tail(&new->list, SREJ_LIST(sk));
+        }
+        pi->expected_tx_seq++;
+}
+
+static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        u8 tx_seq = __get_txseq(rx_control);
+        u16 tx_control = 0;
+        u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
+        int err = 0;
+
+        BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
+
+        if (tx_seq == pi->expected_tx_seq)
+                goto expected;
+
+        if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
+                struct srej_list *first;
+
+                first = list_first_entry(SREJ_LIST(sk),
+                                struct srej_list, list);
+                if (tx_seq == first->tx_seq) {
+                        l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
+                        l2cap_check_srej_gap(sk, tx_seq);
+
+                        list_del(&first->list);
+                        kfree(first);
+
+                        if (list_empty(SREJ_LIST(sk))) {
+                                pi->buffer_seq = pi->buffer_seq_srej;
+                                pi->conn_state &= ~L2CAP_CONN_SREJ_SENT;
+                        }
+                } else {
+                        struct srej_list *l;
+                        l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
+
+                        list_for_each_entry(l, SREJ_LIST(sk), list) {
+                                if (l->tx_seq == tx_seq) {
+                                        l2cap_resend_srejframe(sk, tx_seq);
+                                        return 0;
+                                }
+                        }
+                        l2cap_send_srejframe(sk, tx_seq);
+                }
+        } else {
+                pi->conn_state |= L2CAP_CONN_SREJ_SENT;
+
+                INIT_LIST_HEAD(SREJ_LIST(sk));
+                pi->buffer_seq_srej = pi->buffer_seq;
+
+                __skb_queue_head_init(SREJ_QUEUE(sk));
+                l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
+
+                pi->conn_state |= L2CAP_CONN_SEND_PBIT;
+
+                l2cap_send_srejframe(sk, tx_seq);
+        }
+        return 0;
+
+expected:
+        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
+
+        if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
+                l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
+                return 0;
+        }
+
+        pi->buffer_seq = (pi->buffer_seq + 1) % 64;
+
+        err = l2cap_sar_reassembly_sdu(sk, skb, rx_control);
+        if (err < 0)
+                return err;
+
+        pi->num_to_ack = (pi->num_to_ack + 1) % L2CAP_DEFAULT_NUM_TO_ACK;
+        if (pi->num_to_ack == L2CAP_DEFAULT_NUM_TO_ACK - 1) {
+                tx_control |= L2CAP_SUPER_RCV_READY;
+                tx_control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+                l2cap_send_sframe(pi, tx_control);
+        }
+        return 0;
+}
+
+static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        u8 tx_seq = __get_reqseq(rx_control);
+
+        BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
+
+        switch (rx_control & L2CAP_CTRL_SUPERVISE) {
+        case L2CAP_SUPER_RCV_READY:
+                if (rx_control & L2CAP_CTRL_POLL) {
+                        u16 control = L2CAP_CTRL_FINAL;
+                        control |= L2CAP_SUPER_RCV_READY |
+                                (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT);
+                        l2cap_send_sframe(l2cap_pi(sk), control);
+                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+
+                } else if (rx_control & L2CAP_CTRL_FINAL) {
+                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                        pi->expected_ack_seq = tx_seq;
+                        l2cap_drop_acked_frames(sk);
+
+                        if (!(pi->conn_state & L2CAP_CONN_WAIT_F))
+                                break;
+
+                        pi->conn_state &= ~L2CAP_CONN_WAIT_F;
+                        del_timer(&pi->monitor_timer);
+
+                        if (pi->unacked_frames > 0)
+                                __mod_retrans_timer();
+                } else {
+                        pi->expected_ack_seq = tx_seq;
+                        l2cap_drop_acked_frames(sk);
+
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
+                                        && (pi->unacked_frames > 0))
+                                __mod_retrans_timer();
+
+                        l2cap_ertm_send(sk);
+                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                }
+                break;
+
+        case L2CAP_SUPER_REJECT:
+                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+
+                pi->expected_ack_seq = __get_reqseq(rx_control);
+                l2cap_drop_acked_frames(sk);
+
+                sk->sk_send_head = TX_QUEUE(sk)->next;
+                pi->next_tx_seq = pi->expected_ack_seq;
+
+                l2cap_ertm_send(sk);
+
+                break;
+
+        case L2CAP_SUPER_SELECT_REJECT:
+                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+
+                if (rx_control & L2CAP_CTRL_POLL) {
+                        l2cap_retransmit_frame(sk, tx_seq);
+                        pi->expected_ack_seq = tx_seq;
+                        l2cap_drop_acked_frames(sk);
+                        l2cap_ertm_send(sk);
+                        if (pi->conn_state & L2CAP_CONN_WAIT_F) {
+                                pi->srej_save_reqseq = tx_seq;
+                                pi->conn_state |= L2CAP_CONN_SREJ_ACT;
+                        }
+                } else if (rx_control & L2CAP_CTRL_FINAL) {
+                        if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
+                                        pi->srej_save_reqseq == tx_seq)
+                                pi->srej_save_reqseq &= ~L2CAP_CONN_SREJ_ACT;
+                        else
+                                l2cap_retransmit_frame(sk, tx_seq);
+                }
+                else {
+                        l2cap_retransmit_frame(sk, tx_seq);
+                        if (pi->conn_state & L2CAP_CONN_WAIT_F) {
+                                pi->srej_save_reqseq = tx_seq;
+                                pi->conn_state |= L2CAP_CONN_SREJ_ACT;
+                        }
+                }
+                break;
+
+        case L2CAP_SUPER_RCV_NOT_READY:
+                pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
+                pi->expected_ack_seq = tx_seq;
+                l2cap_drop_acked_frames(sk);
+
+                del_timer(&l2cap_pi(sk)->retrans_timer);
+                if (rx_control & L2CAP_CTRL_POLL) {
+                        u16 control = L2CAP_CTRL_FINAL;
+                        l2cap_send_rr_or_rnr(l2cap_pi(sk), control);
+                }
+                break;
+        }
+
+        return 0;
+}
+
 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
 {
         struct sock *sk;
+        struct l2cap_pinfo *pi;
+        u16 control, len;
+        u8 tx_seq;
+        int err;
 
         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
         if (!sk) {
@@ -2369,22 +3459,91 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 goto drop;
         }
 
+        pi = l2cap_pi(sk);
+
         BT_DBG("sk %p, len %d", sk, skb->len);
 
         if (sk->sk_state != BT_CONNECTED)
                 goto drop;
 
-        if (l2cap_pi(sk)->imtu < skb->len)
-                goto drop;
+        switch (pi->mode) {
+        case L2CAP_MODE_BASIC:
+                /* If socket recv buffers overflows we drop data here
+                 * which is *bad* because L2CAP has to be reliable.
+                 * But we don't have any other choice. L2CAP doesn't
+                 * provide flow control mechanism. */
 
-        /* If socket recv buffers overflows we drop data here
-         * which is *bad* because L2CAP has to be reliable.
-         * But we don't have any other choice. L2CAP doesn't
-         * provide flow control mechanism. */
+                if (pi->imtu < skb->len)
+                        goto drop;
+
+                if (!sock_queue_rcv_skb(sk, skb))
+                        goto done;
+                break;
+
+        case L2CAP_MODE_ERTM:
+                control = get_unaligned_le16(skb->data);
+                skb_pull(skb, 2);
+                len = skb->len;
+
+                if (__is_sar_start(control))
+                        len -= 2;
+
+                if (pi->fcs == L2CAP_FCS_CRC16)
+                        len -= 2;
+
+                /*
+                 * We can just drop the corrupted I-frame here.
+                 * Receiver will miss it and start proper recovery
+                 * procedures and ask retransmission.
+                 */
+                if (len > L2CAP_DEFAULT_MAX_PDU_SIZE)
+                        goto drop;
+
+                if (l2cap_check_fcs(pi, skb))
+                        goto drop;
+
+                if (__is_iframe(control))
+                        err = l2cap_data_channel_iframe(sk, control, skb);
+                else
+                        err = l2cap_data_channel_sframe(sk, control, skb);
+
+                if (!err)
+                        goto done;
+                break;
+
+        case L2CAP_MODE_STREAMING:
+                control = get_unaligned_le16(skb->data);
+                skb_pull(skb, 2);
+                len = skb->len;
+
+                if (__is_sar_start(control))
+                        len -= 2;
+
+                if (pi->fcs == L2CAP_FCS_CRC16)
+                        len -= 2;
+
+                if (len > L2CAP_DEFAULT_MAX_PDU_SIZE || __is_sframe(control))
+                        goto drop;
+
+                if (l2cap_check_fcs(pi, skb))
+                        goto drop;
+
+                tx_seq = __get_txseq(control);
+
+                if (pi->expected_tx_seq == tx_seq)
+                        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
+                else
+                        pi->expected_tx_seq = tx_seq + 1;
+
+                err = l2cap_sar_reassembly_sdu(sk, skb, control);
 
-        if (!sock_queue_rcv_skb(sk, skb))
                 goto done;
 
+        default:
+                BT_DBG("sk %p: bad mode 0x%2.2x", sk, l2cap_pi(sk)->mode);
+                break;
+        }
+
 drop:
         kfree_skb(skb);
 
@@ -2433,6 +3592,11 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
         cid = __le16_to_cpu(lh->cid);
         len = __le16_to_cpu(lh->len);
 
+        if (len != skb->len) {
+                kfree_skb(skb);
+                return;
+        }
+
         BT_DBG("len %d, cid 0x%4.4x", len, cid);
 
         switch (cid) {
@@ -2441,7 +3605,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 break;
 
         case L2CAP_CID_CONN_LESS:
-                psm = get_unaligned((__le16 *) skb->data);
+                psm = get_unaligned_le16(skb->data);
                 skb_pull(skb, 2);
                 l2cap_conless_channel(conn, psm, skb);
                 break;
@@ -2828,6 +3992,9 @@ EXPORT_SYMBOL(l2cap_load);
 module_init(l2cap_init);
 module_exit(l2cap_exit);
 
+module_param(enable_ertm, bool, 0644);
+MODULE_PARM_DESC(enable_ertm, "Enable enhanced retransmission mode");
+
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e50566ebf9f9..25692bc0a342 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -244,6 +244,33 @@ static inline int rfcomm_check_security(struct rfcomm_dlc *d)
                                                                 auth_type);
 }
 
+static void rfcomm_session_timeout(unsigned long arg)
+{
+        struct rfcomm_session *s = (void *) arg;
+
+        BT_DBG("session %p state %ld", s, s->state);
+
+        set_bit(RFCOMM_TIMED_OUT, &s->flags);
+        rfcomm_session_put(s);
+        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
+}
+
+static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
+{
+        BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
+
+        if (!mod_timer(&s->timer, jiffies + timeout))
+                rfcomm_session_hold(s);
+}
+
+static void rfcomm_session_clear_timer(struct rfcomm_session *s)
+{
+        BT_DBG("session %p state %ld", s, s->state);
+
+        if (timer_pending(&s->timer) && del_timer(&s->timer))
+                rfcomm_session_put(s);
+}
+
 /* ---- RFCOMM DLCs ---- */
 static void rfcomm_dlc_timeout(unsigned long arg)
 {
@@ -320,6 +347,7 @@ static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 
         rfcomm_session_hold(s);
 
+        rfcomm_session_clear_timer(s);
         rfcomm_dlc_hold(d);
         list_add(&d->list, &s->dlcs);
         d->session = s;
@@ -335,6 +363,9 @@ static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
         d->session = NULL;
         rfcomm_dlc_put(d);
 
+        if (list_empty(&s->dlcs))
+                rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
+
         rfcomm_session_put(s);
 }
 
@@ -567,6 +598,8 @@ static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 
         BT_DBG("session %p sock %p", s, sock);
 
+        setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
+
         INIT_LIST_HEAD(&s->dlcs);
         s->state = state;
         s->sock  = sock;
@@ -598,6 +631,7 @@ static void rfcomm_session_del(struct rfcomm_session *s)
         if (state == BT_CONNECTED)
                 rfcomm_send_disc(s, 0);
 
+        rfcomm_session_clear_timer(s);
         sock_release(s->sock);
         kfree(s);
 
@@ -639,6 +673,7 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
                 __rfcomm_dlc_close(d, err);
         }
 
+        rfcomm_session_clear_timer(s);
         rfcomm_session_put(s);
 }
 
@@ -1879,6 +1914,12 @@ static inline void rfcomm_process_sessions(void)
                 struct rfcomm_session *s;
                 s = list_entry(p, struct rfcomm_session, list);
 
+                if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
+                        s->state = BT_DISCONN;
+                        rfcomm_send_disc(s, 0);
+                        continue;
+                }
+
                 if (s->state == BT_LISTEN) {
                         rfcomm_accept_connection(s);
                         continue;
@@ -2080,28 +2121,43 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
 {
+        int err;
+
         l2cap_load();
 
         hci_register_cb(&rfcomm_cb);
 
         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
         if (IS_ERR(rfcomm_thread)) {
-                hci_unregister_cb(&rfcomm_cb);
-                return PTR_ERR(rfcomm_thread);
+                err = PTR_ERR(rfcomm_thread);
+                goto unregister;
         }
 
         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                 BT_ERR("Failed to create RFCOMM info file");
 
-        rfcomm_init_sockets();
+        err = rfcomm_init_ttys();
+        if (err < 0)
+                goto stop;
 
-#ifdef CONFIG_BT_RFCOMM_TTY
-        rfcomm_init_ttys();
-#endif
+        err = rfcomm_init_sockets();
+        if (err < 0)
+                goto cleanup;
 
         BT_INFO("RFCOMM ver %s", VERSION);
 
         return 0;
+
+cleanup:
+        rfcomm_cleanup_ttys();
+
+stop:
+        kthread_stop(rfcomm_thread);
+
+unregister:
+        hci_unregister_cb(&rfcomm_cb);
+
+        return err;
 }
 
 static void __exit rfcomm_exit(void)
@@ -2112,9 +2168,7 @@ static void __exit rfcomm_exit(void)
 
         kthread_stop(rfcomm_thread);
 
-#ifdef CONFIG_BT_RFCOMM_TTY
         rfcomm_cleanup_ttys();
-#endif
 
         rfcomm_cleanup_sockets();
 }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7f482784e9f7..0b85e8116859 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1132,7 +1132,7 @@ error:
         return err;
 }
 
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
 {
         class_remove_file(bt_class, &class_attr_rfcomm);
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 51ae0c3e470a..13c27f17192c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -359,20 +359,9 @@ static void sco_sock_kill(struct sock *sk)
         sock_put(sk);
 }
 
-/* Close socket.
- * Must be called on unlocked socket.
- */
-static void sco_sock_close(struct sock *sk)
+static void __sco_sock_close(struct sock *sk)
 {
-        struct sco_conn *conn;
-
-        sco_sock_clear_timer(sk);
-
-        lock_sock(sk);
-
-        conn = sco_pi(sk)->conn;
-
-        BT_DBG("sk %p state %d conn %p socket %p", sk, sk->sk_state, conn, sk->sk_socket);
+        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 
         switch (sk->sk_state) {
         case BT_LISTEN:
@@ -390,9 +379,15 @@ static void sco_sock_close(struct sock *sk)
                 sock_set_flag(sk, SOCK_ZAPPED);
                 break;
         }
+}
 
+/* Must be called on unlocked socket. */
+static void sco_sock_close(struct sock *sk)
+{
+        sco_sock_clear_timer(sk);
+        lock_sock(sk);
+        __sco_sock_close(sk);
         release_sock(sk);
-
         sco_sock_kill(sk);
 }
 
@@ -748,6 +743,30 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char
         return err;
 }
 
+static int sco_sock_shutdown(struct socket *sock, int how)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        lock_sock(sk);
+        if (!sk->sk_shutdown) {
+                sk->sk_shutdown = SHUTDOWN_MASK;
+                sco_sock_clear_timer(sk);
+                __sco_sock_close(sk);
+
+                if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+                        err = bt_sock_wait_state(sk, BT_CLOSED,
+                                                        sk->sk_lingertime);
+        }
+        release_sock(sk);
+        return err;
+}
+
 static int sco_sock_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -969,7 +988,7 @@ static const struct proto_ops sco_sock_ops = {
         .ioctl          = bt_sock_ioctl,
         .mmap           = sock_no_mmap,
         .socketpair     = sock_no_socketpair,
-        .shutdown       = sock_no_shutdown,
+        .shutdown       = sco_sock_shutdown,
         .setsockopt     = sco_sock_setsockopt,
         .getsockopt     = sco_sock_getsockopt
 };
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 15d43ba86b53..07a07770c8b6 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -20,7 +20,7 @@
 #include "br_private.h"
 
 /* net device transmit always called with no BH (preempt_disabled) */
-int br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
         const unsigned char *dest = skb->data;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index d2c27c808d3b..bc1704ac6cd9 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -22,7 +22,8 @@
 static inline int should_deliver(const struct net_bridge_port *p,
                                  const struct sk_buff *skb)
 {
-        return (skb->dev != p->dev && p->state == BR_STATE_FORWARDING);
+        return (((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
+                p->state == BR_STATE_FORWARDING);
 }
 
 static inline unsigned packet_length(const struct sk_buff *skb)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index eb404dc3ed6e..e486f1fc3632 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -256,6 +256,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         p->path_cost = port_cost(dev);
         p->priority = 0x8000 >> BR_PORT_BITS;
         p->port_no = index;
+        p->flags = 0;
         br_init_port(p);
         p->state = BR_STATE_DISABLED;
         br_stp_port_timer_init(p);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index d5b5537272b4..2114e45682ea 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -81,6 +81,9 @@ struct net_bridge_port
         struct timer_list               message_age_timer;
         struct kobject                  kobj;
         struct rcu_head                 rcu;
+
+        unsigned long                   flags;
+#define BR_HAIRPIN_MODE         0x00000001
 };
 
 struct net_bridge
@@ -140,7 +143,8 @@ static inline int br_is_root_bridge(const struct net_bridge *br)
 
 /* br_device.c */
 extern void br_dev_setup(struct net_device *dev);
-extern int br_dev_xmit(struct sk_buff *skb, struct net_device *dev);
+extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
+                               struct net_device *dev);
 
 /* br_fdb.c */
 extern int br_fdb_init(void);
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 4a3cdf8f3813..820643a3ba9c 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -143,6 +143,22 @@ static ssize_t store_flush(struct net_bridge_port *p, unsigned long v)
 }
 static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush);
 
+static ssize_t show_hairpin_mode(struct net_bridge_port *p, char *buf)
+{
+        int hairpin_mode = (p->flags & BR_HAIRPIN_MODE) ? 1 : 0;
+        return sprintf(buf, "%d\n", hairpin_mode);
+}
+static ssize_t store_hairpin_mode(struct net_bridge_port *p, unsigned long v)
+{
+        if (v)
+                p->flags |= BR_HAIRPIN_MODE;
+        else
+                p->flags &= ~BR_HAIRPIN_MODE;
+        return 0;
+}
+static BRPORT_ATTR(hairpin_mode, S_IRUGO | S_IWUSR,
+                   show_hairpin_mode, store_hairpin_mode);
+
 static struct brport_attribute *brport_attrs[] = {
         &brport_attr_path_cost,
         &brport_attr_priority,
@@ -159,6 +175,7 @@ static struct brport_attribute *brport_attrs[] = {
         &brport_attr_forward_delay_timer,
         &brport_attr_hold_timer,
         &brport_attr_flush,
+        &brport_attr_hairpin_mode,
         NULL
 };
 
diff --git a/net/can/af_can.c b/net/can/af_can.c
index e733725b11d4..ef1c43a2ed56 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -651,12 +651,16 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
         struct can_frame *cf = (struct can_frame *)skb->data;
         int matches;
 
-        if (dev->type != ARPHRD_CAN || !net_eq(dev_net(dev), &init_net)) {
-                kfree_skb(skb);
-                return 0;
-        }
+        if (!net_eq(dev_net(dev), &init_net))
+                goto drop;
 
-        BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8);
+        if (WARN_ONCE(dev->type != ARPHRD_CAN ||
+                      skb->len != sizeof(struct can_frame) ||
+                      cf->can_dlc > 8,
+                      "PF_CAN: dropped non conform skbuf: "
+                      "dev type %d, len %d, can_dlc %d\n",
+                      dev->type, skb->len, cf->can_dlc))
+                goto drop;
 
         /* update statistics */
         can_stats.rx_frames++;
@@ -682,7 +686,11 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                 can_stats.matches_delta++;
         }
 
-        return 0;
+        return NET_RX_SUCCESS;
+
+drop:
+        kfree_skb(skb);
+        return NET_RX_DROP;
 }
 
 /*
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 72720c710351..597da4f8f888 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -46,6 +46,7 @@
 #include <linux/hrtimer.h>
 #include <linux/list.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/uio.h>
 #include <linux/net.h>
 #include <linux/netdevice.h>
@@ -146,23 +147,18 @@ static char *bcm_proc_getifname(int ifindex)
         return "???";
 }
 
-static int bcm_read_proc(char *page, char **start, off_t off,
-                         int count, int *eof, void *data)
+static int bcm_proc_show(struct seq_file *m, void *v)
 {
-        int len = 0;
-        struct sock *sk = (struct sock *)data;
+        struct sock *sk = (struct sock *)m->private;
         struct bcm_sock *bo = bcm_sk(sk);
         struct bcm_op *op;
 
-        len += snprintf(page + len, PAGE_SIZE - len, ">>> socket %p",
-                        sk->sk_socket);
-        len += snprintf(page + len, PAGE_SIZE - len, " / sk %p", sk);
-        len += snprintf(page + len, PAGE_SIZE - len, " / bo %p", bo);
-        len += snprintf(page + len, PAGE_SIZE - len, " / dropped %lu",
-                        bo->dropped_usr_msgs);
-        len += snprintf(page + len, PAGE_SIZE - len, " / bound %s",
-                        bcm_proc_getifname(bo->ifindex));
-        len += snprintf(page + len, PAGE_SIZE - len, " <<<\n");
+        seq_printf(m, ">>> socket %p", sk->sk_socket);
+        seq_printf(m, " / sk %p", sk);
+        seq_printf(m, " / bo %p", bo);
+        seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
+        seq_printf(m, " / bound %s", bcm_proc_getifname(bo->ifindex));
+        seq_printf(m, " <<<\n");
 
         list_for_each_entry(op, &bo->rx_ops, list) {
 
@@ -172,71 +168,62 @@ static int bcm_read_proc(char *page, char **start, off_t off,
                 if (!op->frames_abs)
                         continue;
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                "rx_op: %03X %-5s ",
+                seq_printf(m, "rx_op: %03X %-5s ",
                                 op->can_id, bcm_proc_getifname(op->ifindex));
-                len += snprintf(page + len, PAGE_SIZE - len, "[%d]%c ",
-                                op->nframes,
+                seq_printf(m, "[%d]%c ", op->nframes,
                                 (op->flags & RX_CHECK_DLC)?'d':' ');
                 if (op->kt_ival1.tv64)
-                        len += snprintf(page + len, PAGE_SIZE - len,
-                                        "timeo=%lld ",
+                        seq_printf(m, "timeo=%lld ",
                                         (long long)
                                         ktime_to_us(op->kt_ival1));
 
                 if (op->kt_ival2.tv64)
-                        len += snprintf(page + len, PAGE_SIZE - len,
-                                        "thr=%lld ",
+                        seq_printf(m, "thr=%lld ",
                                         (long long)
                                         ktime_to_us(op->kt_ival2));
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                "# recv %ld (%ld) => reduction: ",
+                seq_printf(m, "# recv %ld (%ld) => reduction: ",
                                 op->frames_filtered, op->frames_abs);
 
                 reduction = 100 - (op->frames_filtered * 100) / op->frames_abs;
 
-                len += snprintf(page + len, PAGE_SIZE - len, "%s%ld%%\n",
+                seq_printf(m, "%s%ld%%\n",
                                 (reduction == 100)?"near ":"", reduction);
-
-                if (len > PAGE_SIZE - 200) {
-                        /* mark output cut off */
-                        len += snprintf(page + len, PAGE_SIZE - len, "(..)\n");
-                        break;
-                }
         }
 
         list_for_each_entry(op, &bo->tx_ops, list) {
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                "tx_op: %03X %s [%d] ",
+                seq_printf(m, "tx_op: %03X %s [%d] ",
                                 op->can_id, bcm_proc_getifname(op->ifindex),
                                 op->nframes);
 
                 if (op->kt_ival1.tv64)
-                        len += snprintf(page + len, PAGE_SIZE - len, "t1=%lld ",
+                        seq_printf(m, "t1=%lld ",
                                         (long long) ktime_to_us(op->kt_ival1));
 
                 if (op->kt_ival2.tv64)
-                        len += snprintf(page + len, PAGE_SIZE - len, "t2=%lld ",
+                        seq_printf(m, "t2=%lld ",
                                         (long long) ktime_to_us(op->kt_ival2));
 
-                len += snprintf(page + len, PAGE_SIZE - len, "# sent %ld\n",
-                                op->frames_abs);
-
-                if (len > PAGE_SIZE - 100) {
-                        /* mark output cut off */
-                        len += snprintf(page + len, PAGE_SIZE - len, "(..)\n");
-                        break;
-                }
+                seq_printf(m, "# sent %ld\n", op->frames_abs);
         }
+        seq_putc(m, '\n');
+        return 0;
+}
 
-        len += snprintf(page + len, PAGE_SIZE - len, "\n");
-
-        *eof = 1;
-        return len;
+static int bcm_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, bcm_proc_show, PDE(inode)->data);
 }
 
+static const struct file_operations bcm_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = bcm_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
 /*
  * bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface
  *              of the given bcm tx op
@@ -1515,9 +1502,9 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
         if (proc_dir) {
                 /* unique socket address as filename */
                 sprintf(bo->procname, "%p", sock);
-                bo->bcm_proc_read = create_proc_read_entry(bo->procname, 0644,
-                                                           proc_dir,
-                                                           bcm_read_proc, sk);
+                bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
+                                                     proc_dir,
+                                                     &bcm_proc_fops, sk);
         }
 
         return 0;
diff --git a/net/can/proc.c b/net/can/proc.c
index 1463653dbe34..9b9ad29be567 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -196,8 +196,8 @@ void can_stat_update(unsigned long data)
  *
  */
 
-static int can_print_rcvlist(char *page, int len, struct hlist_head *rx_list,
-                             struct net_device *dev)
+static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
+                              struct net_device *dev)
 {
         struct receiver *r;
         struct hlist_node *n;
@@ -208,199 +208,188 @@ static int can_print_rcvlist(char *page, int len, struct hlist_head *rx_list,
                         "   %-5s  %08X  %08x  %08x  %08x  %8ld  %s\n" :
                         "   %-5s     %03X    %08x  %08lx  %08lx  %8ld  %s\n";
 
-                len += snprintf(page + len, PAGE_SIZE - len, fmt,
-                                DNAME(dev), r->can_id, r->mask,
+                seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,
                                 (unsigned long)r->func, (unsigned long)r->data,
                                 r->matches, r->ident);
-
-                /* does a typical line fit into the current buffer? */
-
-                /* 100 Bytes before end of buffer */
-                if (len > PAGE_SIZE - 100) {
-                        /* mark output cut off */
-                        len += snprintf(page + len, PAGE_SIZE - len,
-                                        "   (..)\n");
-                        break;
-                }
         }
         rcu_read_unlock();
-
-        return len;
 }
 
-static int can_print_recv_banner(char *page, int len)
+static void can_print_recv_banner(struct seq_file *m)
 {
         /*
          *                  can1.  00000000  00000000  00000000
          *                 .......          0  tp20
          */
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        "  device   can_id   can_mask  function"
+        seq_puts(m, "  device   can_id   can_mask  function"
                         "  userdata   matches  ident\n");
-
-        return len;
 }
 
-static int can_proc_read_stats(char *page, char **start, off_t off,
-                               int count, int *eof, void *data)
+static int can_stats_proc_show(struct seq_file *m, void *v)
 {
-        int len = 0;
+        seq_putc(m, '\n');
+        seq_printf(m, " %8ld transmitted frames (TXF)\n", can_stats.tx_frames);
+        seq_printf(m, " %8ld received frames (RXF)\n", can_stats.rx_frames);
+        seq_printf(m, " %8ld matched frames (RXMF)\n", can_stats.matches);
 
-        len += snprintf(page + len, PAGE_SIZE - len, "\n");
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        " %8ld transmitted frames (TXF)\n",
-                        can_stats.tx_frames);
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        " %8ld received frames (RXF)\n", can_stats.rx_frames);
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        " %8ld matched frames (RXMF)\n", can_stats.matches);
-
-        len += snprintf(page + len, PAGE_SIZE - len, "\n");
+        seq_putc(m, '\n');
 
         if (can_stattimer.function == can_stat_update) {
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld %% total match ratio (RXMR)\n",
+                seq_printf(m, " %8ld %% total match ratio (RXMR)\n",
                                 can_stats.total_rx_match_ratio);
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld frames/s total tx rate (TXR)\n",
+                seq_printf(m, " %8ld frames/s total tx rate (TXR)\n",
                                 can_stats.total_tx_rate);
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld frames/s total rx rate (RXR)\n",
+                seq_printf(m, " %8ld frames/s total rx rate (RXR)\n",
                                 can_stats.total_rx_rate);
 
-                len += snprintf(page + len, PAGE_SIZE - len, "\n");
+                seq_putc(m, '\n');
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld %% current match ratio (CRXMR)\n",
+                seq_printf(m, " %8ld %% current match ratio (CRXMR)\n",
                                 can_stats.current_rx_match_ratio);
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld frames/s current tx rate (CTXR)\n",
+                seq_printf(m, " %8ld frames/s current tx rate (CTXR)\n",
                                 can_stats.current_tx_rate);
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld frames/s current rx rate (CRXR)\n",
+                seq_printf(m, " %8ld frames/s current rx rate (CRXR)\n",
                                 can_stats.current_rx_rate);
 
-                len += snprintf(page + len, PAGE_SIZE - len, "\n");
+                seq_putc(m, '\n');
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld %% max match ratio (MRXMR)\n",
+                seq_printf(m, " %8ld %% max match ratio (MRXMR)\n",
                                 can_stats.max_rx_match_ratio);
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld frames/s max tx rate (MTXR)\n",
+                seq_printf(m, " %8ld frames/s max tx rate (MTXR)\n",
                                 can_stats.max_tx_rate);
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld frames/s max rx rate (MRXR)\n",
+                seq_printf(m, " %8ld frames/s max rx rate (MRXR)\n",
                                 can_stats.max_rx_rate);
 
-                len += snprintf(page + len, PAGE_SIZE - len, "\n");
+                seq_putc(m, '\n');
         }
 
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        " %8ld current receive list entries (CRCV)\n",
+        seq_printf(m, " %8ld current receive list entries (CRCV)\n",
                         can_pstats.rcv_entries);
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        " %8ld maximum receive list entries (MRCV)\n",
+        seq_printf(m, " %8ld maximum receive list entries (MRCV)\n",
                         can_pstats.rcv_entries_max);
 
         if (can_pstats.stats_reset)
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                "\n %8ld statistic resets (STR)\n",
+                seq_printf(m, "\n %8ld statistic resets (STR)\n",
                                 can_pstats.stats_reset);
 
         if (can_pstats.user_reset)
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                " %8ld user statistic resets (USTR)\n",
+                seq_printf(m, " %8ld user statistic resets (USTR)\n",
                                 can_pstats.user_reset);
 
-        len += snprintf(page + len, PAGE_SIZE - len, "\n");
-
-        *eof = 1;
-        return len;
+        seq_putc(m, '\n');
+        return 0;
 }
 
-static int can_proc_read_reset_stats(char *page, char **start, off_t off,
-                                     int count, int *eof, void *data)
+static int can_stats_proc_open(struct inode *inode, struct file *file)
 {
-        int len = 0;
+        return single_open(file, can_stats_proc_show, NULL);
+}
+
+static const struct file_operations can_stats_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = can_stats_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 
+static int can_reset_stats_proc_show(struct seq_file *m, void *v)
+{
         user_reset = 1;
 
         if (can_stattimer.function == can_stat_update) {
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                "Scheduled statistic reset #%ld.\n",
+                seq_printf(m, "Scheduled statistic reset #%ld.\n",
                                 can_pstats.stats_reset + 1);
 
         } else {
                 if (can_stats.jiffies_init != jiffies)
                         can_init_stats();
 
-                len += snprintf(page + len, PAGE_SIZE - len,
-                                "Performed statistic reset #%ld.\n",
+                seq_printf(m, "Performed statistic reset #%ld.\n",
                                 can_pstats.stats_reset);
         }
+        return 0;
+}
 
-        *eof = 1;
-        return len;
+static int can_reset_stats_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, can_reset_stats_proc_show, NULL);
 }
 
-static int can_proc_read_version(char *page, char **start, off_t off,
-                                 int count, int *eof, void *data)
+static const struct file_operations can_reset_stats_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = can_reset_stats_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int can_version_proc_show(struct seq_file *m, void *v)
 {
-        int len = 0;
+        seq_printf(m, "%s\n", CAN_VERSION_STRING);
+        return 0;
+}
 
-        len += snprintf(page + len, PAGE_SIZE - len, "%s\n",
-                        CAN_VERSION_STRING);
-        *eof = 1;
-        return len;
+static int can_version_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, can_version_proc_show, NULL);
 }
 
-static int can_proc_read_rcvlist(char *page, char **start, off_t off,
-                                 int count, int *eof, void *data)
+static const struct file_operations can_version_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = can_version_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int can_rcvlist_proc_show(struct seq_file *m, void *v)
 {
         /* double cast to prevent GCC warning */
-        int idx = (int)(long)data;
-        int len = 0;
+        int idx = (int)(long)m->private;
         struct dev_rcv_lists *d;
         struct hlist_node *n;
 
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        "\nreceive list '%s':\n", rx_list_name[idx]);
+        seq_printf(m, "\nreceive list '%s':\n", rx_list_name[idx]);
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
 
                 if (!hlist_empty(&d->rx[idx])) {
-                        len = can_print_recv_banner(page, len);
-                        len = can_print_rcvlist(page, len, &d->rx[idx], d->dev);
+                        can_print_recv_banner(m);
+                        can_print_rcvlist(m, &d->rx[idx], d->dev);
                 } else
-                        len += snprintf(page + len, PAGE_SIZE - len,
-                                        "  (%s: no entry)\n", DNAME(d->dev));
-
-                /* exit on end of buffer? */
-                if (len > PAGE_SIZE - 100)
-                        break;
+                        seq_printf(m, "  (%s: no entry)\n", DNAME(d->dev));
         }
         rcu_read_unlock();
 
-        len += snprintf(page + len, PAGE_SIZE - len, "\n");
+        seq_putc(m, '\n');
+        return 0;
+}
 
-        *eof = 1;
-        return len;
+static int can_rcvlist_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, can_rcvlist_proc_show, PDE(inode)->data);
 }
 
-static int can_proc_read_rcvlist_sff(char *page, char **start, off_t off,
-                                     int count, int *eof, void *data)
+static const struct file_operations can_rcvlist_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = can_rcvlist_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int can_rcvlist_sff_proc_show(struct seq_file *m, void *v)
 {
-        int len = 0;
         struct dev_rcv_lists *d;
         struct hlist_node *n;
 
         /* RX_SFF */
-        len += snprintf(page + len, PAGE_SIZE - len,
-                        "\nreceive list 'rx_sff':\n");
+        seq_puts(m, "\nreceive list 'rx_sff':\n");
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
@@ -413,46 +402,38 @@ static int can_proc_read_rcvlist_sff(char *page, char **start, off_t off,
                         }
 
                 if (!all_empty) {
-                        len = can_print_recv_banner(page, len);
+                        can_print_recv_banner(m);
                         for (i = 0; i < 0x800; i++) {
-                                if (!hlist_empty(&d->rx_sff[i]) &&
-                                    len < PAGE_SIZE - 100)
-                                        len = can_print_rcvlist(page, len,
-                                                                &d->rx_sff[i],
-                                                                d->dev);
+                                if (!hlist_empty(&d->rx_sff[i]))
+                                        can_print_rcvlist(m, &d->rx_sff[i],
+                                                          d->dev);
                         }
                 } else
-                        len += snprintf(page + len, PAGE_SIZE - len,
-                                        "  (%s: no entry)\n", DNAME(d->dev));
-
-                /* exit on end of buffer? */
-                if (len > PAGE_SIZE - 100)
-                        break;
+                        seq_printf(m, "  (%s: no entry)\n", DNAME(d->dev));
         }
         rcu_read_unlock();
 
-        len += snprintf(page + len, PAGE_SIZE - len, "\n");
+        seq_putc(m, '\n');
+        return 0;
+}
 
-        *eof = 1;
-        return len;
+static int can_rcvlist_sff_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, can_rcvlist_sff_proc_show, NULL);
 }
 
+static const struct file_operations can_rcvlist_sff_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = can_rcvlist_sff_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
 /*
  * proc utility functions
  */
 
-static struct proc_dir_entry *can_create_proc_readentry(const char *name,
-                                                        mode_t mode,
-                                                        read_proc_t *read_proc,
-                                                        void *data)
-{
-        if (can_dir)
-                return create_proc_read_entry(name, mode, can_dir, read_proc,
-                                              data);
-        else
-                return NULL;
-}
-
 static void can_remove_proc_readentry(const char *name)
 {
         if (can_dir)
@@ -474,24 +455,24 @@ void can_init_proc(void)
         }
 
         /* own procfs entries from the AF_CAN core */
-        pde_version     = can_create_proc_readentry(CAN_PROC_VERSION, 0644,
-                                        can_proc_read_version, NULL);
-        pde_stats       = can_create_proc_readentry(CAN_PROC_STATS, 0644,
-                                        can_proc_read_stats, NULL);
-        pde_reset_stats = can_create_proc_readentry(CAN_PROC_RESET_STATS, 0644,
-                                        can_proc_read_reset_stats, NULL);
-        pde_rcvlist_err = can_create_proc_readentry(CAN_PROC_RCVLIST_ERR, 0644,
-                                        can_proc_read_rcvlist, (void *)RX_ERR);
-        pde_rcvlist_all = can_create_proc_readentry(CAN_PROC_RCVLIST_ALL, 0644,
-                                        can_proc_read_rcvlist, (void *)RX_ALL);
-        pde_rcvlist_fil = can_create_proc_readentry(CAN_PROC_RCVLIST_FIL, 0644,
-                                        can_proc_read_rcvlist, (void *)RX_FIL);
-        pde_rcvlist_inv = can_create_proc_readentry(CAN_PROC_RCVLIST_INV, 0644,
-                                        can_proc_read_rcvlist, (void *)RX_INV);
-        pde_rcvlist_eff = can_create_proc_readentry(CAN_PROC_RCVLIST_EFF, 0644,
-                                        can_proc_read_rcvlist, (void *)RX_EFF);
-        pde_rcvlist_sff = can_create_proc_readentry(CAN_PROC_RCVLIST_SFF, 0644,
-                                        can_proc_read_rcvlist_sff, NULL);
+        pde_version     = proc_create(CAN_PROC_VERSION, 0644, can_dir,
+                                      &can_version_proc_fops);
+        pde_stats       = proc_create(CAN_PROC_STATS, 0644, can_dir,
+                                      &can_stats_proc_fops);
+        pde_reset_stats = proc_create(CAN_PROC_RESET_STATS, 0644, can_dir,
+                                      &can_reset_stats_proc_fops);
+        pde_rcvlist_err = proc_create_data(CAN_PROC_RCVLIST_ERR, 0644, can_dir,
+                                           &can_rcvlist_proc_fops, (void *)RX_ERR);
+        pde_rcvlist_all = proc_create_data(CAN_PROC_RCVLIST_ALL, 0644, can_dir,
+                                           &can_rcvlist_proc_fops, (void *)RX_ALL);
+        pde_rcvlist_fil = proc_create_data(CAN_PROC_RCVLIST_FIL, 0644, can_dir,
+                                           &can_rcvlist_proc_fops, (void *)RX_FIL);
+        pde_rcvlist_inv = proc_create_data(CAN_PROC_RCVLIST_INV, 0644, can_dir,
+                                           &can_rcvlist_proc_fops, (void *)RX_INV);
+        pde_rcvlist_eff = proc_create_data(CAN_PROC_RCVLIST_EFF, 0644, can_dir,
+                                           &can_rcvlist_proc_fops, (void *)RX_EFF);
+        pde_rcvlist_sff = proc_create(CAN_PROC_RCVLIST_SFF, 0644, can_dir,
+                                      &can_rcvlist_sff_proc_fops);
 }
 
 /*
diff --git a/net/can/raw.c b/net/can/raw.c
index f4cc44548bda..db3152df7d2b 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
         if (peer)
                 return -EOPNOTSUPP;
 
+        memset(addr, 0, sizeof(*addr));
         addr->can_family  = AF_CAN;
         addr->can_ifindex = ro->ifindex;
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b0fe69211eef..1c6cf3a1a4f6 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -55,6 +55,7 @@
 #include <net/checksum.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
+#include <trace/events/skb.h>
 
 /*
  *      Is a socket 'connection oriented' ?
@@ -284,6 +285,8 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
         int i, copy = start - offset;
         struct sk_buff *frag_iter;
 
+        trace_skb_copy_datagram_iovec(skb, len);
+
         /* Copy header. */
         if (copy > 0) {
                 if (copy > len)
diff --git a/net/core/dev.c b/net/core/dev.c
index a0bc087616a4..1a6561b1eb90 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -191,7 +191,6 @@ static struct list_head ptype_all __read_mostly;	/* Taps */
  * semaphore held.
  */
 DEFINE_RWLOCK(dev_base_lock);
-
 EXPORT_SYMBOL(dev_base_lock);
 
 #define NETDEV_HASHBITS 8
@@ -248,6 +247,7 @@ static RAW_NOTIFIER_HEAD(netdev_chain);
  */
 
 DEFINE_PER_CPU(struct softnet_data, softnet_data);
+EXPORT_PER_CPU_SYMBOL(softnet_data);
 
 #ifdef CONFIG_LOCKDEP
 /*
@@ -269,7 +269,7 @@ static const unsigned short netdev_lock_type[] =
          ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
          ARPHRD_FCFABRIC, ARPHRD_IEEE802_TR, ARPHRD_IEEE80211,
          ARPHRD_IEEE80211_PRISM, ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET,
-         ARPHRD_PHONET_PIPE, ARPHRD_IEEE802154, ARPHRD_IEEE802154_PHY,
+         ARPHRD_PHONET_PIPE, ARPHRD_IEEE802154,
          ARPHRD_VOID, ARPHRD_NONE};
 
 static const char *const netdev_lock_name[] =
@@ -287,7 +287,7 @@ static const char *const netdev_lock_name[] =
          "_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
          "_xmit_FCFABRIC", "_xmit_IEEE802_TR", "_xmit_IEEE80211",
          "_xmit_IEEE80211_PRISM", "_xmit_IEEE80211_RADIOTAP", "_xmit_PHONET",
-         "_xmit_PHONET_PIPE", "_xmit_IEEE802154", "_xmit_IEEE802154_PHY",
+         "_xmit_PHONET_PIPE", "_xmit_IEEE802154",
          "_xmit_VOID", "_xmit_NONE"};
 
 static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
@@ -381,6 +381,7 @@ void dev_add_pack(struct packet_type *pt)
         }
         spin_unlock_bh(&ptype_lock);
 }
+EXPORT_SYMBOL(dev_add_pack);
 
 /**
  *      __dev_remove_pack        - remove packet handler
@@ -418,6 +419,8 @@ void __dev_remove_pack(struct packet_type *pt)
 out:
         spin_unlock_bh(&ptype_lock);
 }
+EXPORT_SYMBOL(__dev_remove_pack);
+
 /**
  *      dev_remove_pack  - remove packet handler
  *      @pt: packet type declaration
@@ -436,6 +439,7 @@ void dev_remove_pack(struct packet_type *pt)
 
         synchronize_net();
 }
+EXPORT_SYMBOL(dev_remove_pack);
 
 /******************************************************************************
 
@@ -499,6 +503,7 @@ int netdev_boot_setup_check(struct net_device *dev)
         }
         return 0;
 }
+EXPORT_SYMBOL(netdev_boot_setup_check);
 
 
 /**
@@ -591,6 +596,7 @@ struct net_device *__dev_get_by_name(struct net *net, const char *name)
         }
         return NULL;
 }
+EXPORT_SYMBOL(__dev_get_by_name);
 
 /**
  *      dev_get_by_name         - find a device by its name
@@ -615,6 +621,7 @@ struct net_device *dev_get_by_name(struct net *net, const char *name)
         read_unlock(&dev_base_lock);
         return dev;
 }
+EXPORT_SYMBOL(dev_get_by_name);
 
 /**
  *      __dev_get_by_index - find a device by its ifindex
@@ -640,6 +647,7 @@ struct net_device *__dev_get_by_index(struct net *net, int ifindex)
         }
         return NULL;
 }
+EXPORT_SYMBOL(__dev_get_by_index);
 
 
 /**
@@ -664,6 +672,7 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex)
         read_unlock(&dev_base_lock);
         return dev;
 }
+EXPORT_SYMBOL(dev_get_by_index);
 
 /**
  *      dev_getbyhwaddr - find a device by its hardware address
@@ -693,7 +702,6 @@ struct net_device *dev_getbyhwaddr(struct net *net, unsigned short type, char *h
 
         return NULL;
 }
-
 EXPORT_SYMBOL(dev_getbyhwaddr);
 
 struct net_device *__dev_getfirstbyhwtype(struct net *net, unsigned short type)
@@ -707,7 +715,6 @@ struct net_device *__dev_getfirstbyhwtype(struct net *net, unsigned short type)
 
         return NULL;
 }
-
 EXPORT_SYMBOL(__dev_getfirstbyhwtype);
 
 struct net_device *dev_getfirstbyhwtype(struct net *net, unsigned short type)
@@ -721,7 +728,6 @@ struct net_device *dev_getfirstbyhwtype(struct net *net, unsigned short type)
         rtnl_unlock();
         return dev;
 }
-
 EXPORT_SYMBOL(dev_getfirstbyhwtype);
 
 /**
@@ -736,7 +742,8 @@ EXPORT_SYMBOL(dev_getfirstbyhwtype);
  *      dev_put to indicate they have finished with it.
  */
 
-struct net_device * dev_get_by_flags(struct net *net, unsigned short if_flags, unsigned short mask)
+struct net_device *dev_get_by_flags(struct net *net, unsigned short if_flags,
+                                    unsigned short mask)
 {
         struct net_device *dev, *ret;
 
@@ -752,6 +759,7 @@ struct net_device * dev_get_by_flags(struct net *net, unsigned short if_flags, u
         read_unlock(&dev_base_lock);
         return ret;
 }
+EXPORT_SYMBOL(dev_get_by_flags);
 
 /**
  *      dev_valid_name - check if name is okay for network device
@@ -777,6 +785,7 @@ int dev_valid_name(const char *name)
         }
         return 1;
 }
+EXPORT_SYMBOL(dev_valid_name);
 
 /**
  *      __dev_alloc_name - allocate a name for a device
@@ -870,6 +879,7 @@ int dev_alloc_name(struct net_device *dev, const char *name)
                 strlcpy(dev->name, buf, IFNAMSIZ);
         return ret;
 }
+EXPORT_SYMBOL(dev_alloc_name);
 
 
 /**
@@ -906,8 +916,7 @@ int dev_change_name(struct net_device *dev, const char *newname)
                 err = dev_alloc_name(dev, newname);
                 if (err < 0)
                         return err;
-        }
-        else if (__dev_get_by_name(net, newname))
+        } else if (__dev_get_by_name(net, newname))
                 return -EEXIST;
         else
                 strlcpy(dev->name, newname, IFNAMSIZ);
@@ -970,7 +979,7 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
                 return 0;
         }
 
-        dev->ifalias = krealloc(dev->ifalias, len+1, GFP_KERNEL);
+        dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
         if (!dev->ifalias)
                 return -ENOMEM;
 
@@ -1006,6 +1015,7 @@ void netdev_state_change(struct net_device *dev)
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
         }
 }
+EXPORT_SYMBOL(netdev_state_change);
 
 void netdev_bonding_change(struct net_device *dev)
 {
@@ -1034,6 +1044,7 @@ void dev_load(struct net *net, const char *name)
         if (!dev && capable(CAP_SYS_MODULE))
                 request_module("%s", name);
 }
+EXPORT_SYMBOL(dev_load);
 
 /**
  *      dev_open        - prepare an interface for use.
@@ -1118,6 +1129,7 @@ int dev_open(struct net_device *dev)
 
         return ret;
 }
+EXPORT_SYMBOL(dev_open);
 
 /**
  *      dev_close - shutdown an interface.
@@ -1184,6 +1196,7 @@ int dev_close(struct net_device *dev)
 
         return 0;
 }
+EXPORT_SYMBOL(dev_close);
 
 
 /**
@@ -1279,6 +1292,7 @@ rollback:
         raw_notifier_chain_unregister(&netdev_chain, nb);
         goto unlock;
 }
+EXPORT_SYMBOL(register_netdevice_notifier);
 
 /**
  *      unregister_netdevice_notifier - unregister a network notifier block
@@ -1299,6 +1313,7 @@ int unregister_netdevice_notifier(struct notifier_block *nb)
         rtnl_unlock();
         return err;
 }
+EXPORT_SYMBOL(unregister_netdevice_notifier);
 
 /**
  *      call_netdevice_notifiers - call all network notifier blocks
@@ -1321,11 +1336,13 @@ void net_enable_timestamp(void)
 {
         atomic_inc(&netstamp_needed);
 }
+EXPORT_SYMBOL(net_enable_timestamp);
 
 void net_disable_timestamp(void)
 {
         atomic_dec(&netstamp_needed);
 }
+EXPORT_SYMBOL(net_disable_timestamp);
 
 static inline void net_timestamp(struct sk_buff *skb)
 {
@@ -1359,7 +1376,7 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
                 if ((ptype->dev == dev || !ptype->dev) &&
                     (ptype->af_packet_priv == NULL ||
                      (struct sock *)ptype->af_packet_priv != skb->sk)) {
-                        struct sk_buff *skb2= skb_clone(skb, GFP_ATOMIC);
+                        struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
                         if (!skb2)
                                 break;
 
@@ -1527,6 +1544,7 @@ out_set_summed:
 out:
         return ret;
 }
+EXPORT_SYMBOL(skb_checksum_help);
 
 /**
  *      skb_gso_segment - Perform segmentation on skb.
@@ -1589,7 +1607,6 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
 
         return segs;
 }
-
 EXPORT_SYMBOL(skb_gso_segment);
 
 /* Take action when hardware reception checksum errors are detected. */
@@ -1755,7 +1772,7 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
 
         if (skb_rx_queue_recorded(skb)) {
                 hash = skb_get_rx_queue(skb);
-                while (unlikely (hash >= dev->real_num_tx_queues))
+                while (unlikely(hash >= dev->real_num_tx_queues))
                         hash -= dev->real_num_tx_queues;
                 return hash;
         }
@@ -1890,7 +1907,7 @@ gso:
         q = rcu_dereference(txq->qdisc);
 
 #ifdef CONFIG_NET_CLS_ACT
-        skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_EGRESS);
+        skb->tc_verd = SET_TC_AT(skb->tc_verd, AT_EGRESS);
 #endif
         if (q->enqueue) {
                 rc = __dev_xmit_skb(skb, q, dev, txq);
@@ -1917,7 +1934,7 @@ gso:
                         HARD_TX_LOCK(dev, txq, cpu);
 
                         if (!netif_tx_queue_stopped(txq)) {
-                                rc = 0;
+                                rc = NET_XMIT_SUCCESS;
                                 if (!dev_hard_start_xmit(skb, dev, txq)) {
                                         HARD_TX_UNLOCK(dev, txq);
                                         goto out;
@@ -1946,6 +1963,7 @@ out:
         rcu_read_unlock_bh();
         return rc;
 }
+EXPORT_SYMBOL(dev_queue_xmit);
 
 
 /*=======================================================================
@@ -2012,6 +2030,7 @@ enqueue:
         kfree_skb(skb);
         return NET_RX_DROP;
 }
+EXPORT_SYMBOL(netif_rx);
 
 int netif_rx_ni(struct sk_buff *skb)
 {
@@ -2025,7 +2044,6 @@ int netif_rx_ni(struct sk_buff *skb)
 
         return err;
 }
-
 EXPORT_SYMBOL(netif_rx_ni);
 
 static void net_tx_action(struct softirq_action *h)
@@ -2358,6 +2376,7 @@ out:
         rcu_read_unlock();
         return ret;
 }
+EXPORT_SYMBOL(netif_receive_skb);
 
 /* Network device is going away, flush any packets still pending  */
 static void flush_backlog(void *arg)
@@ -2874,7 +2893,7 @@ softnet_break:
         goto out;
 }
 
-static gifconf_func_t * gifconf_list [NPROTO];
+static gifconf_func_t *gifconf_list[NPROTO];
 
 /**
  *      register_gifconf        -       register a SIOCGIF handler
@@ -2885,13 +2904,14 @@ static gifconf_func_t * gifconf_list [NPROTO];
  *      that is passed must not be freed or reused until it has been replaced
  *      by another handler.
  */
-int register_gifconf(unsigned int family, gifconf_func_t * gifconf)
+int register_gifconf(unsigned int family, gifconf_func_t *gifconf)
 {
         if (family >= NPROTO)
                 return -EINVAL;
         gifconf_list[family] = gifconf;
         return 0;
 }
+EXPORT_SYMBOL(register_gifconf);
 
 
 /*
@@ -3102,7 +3122,7 @@ static int softnet_seq_show(struct seq_file *seq, void *v)
         seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
                    s->total, s->dropped, s->time_squeeze, 0,
                    0, 0, 0, 0, /* was fastroute */
-                   s->cpu_collision );
+                   s->cpu_collision);
         return 0;
 }
 
@@ -3338,6 +3358,7 @@ int netdev_set_master(struct net_device *slave, struct net_device *master)
         rtmsg_ifinfo(RTM_NEWLINK, slave, IFF_SLAVE);
         return 0;
 }
+EXPORT_SYMBOL(netdev_set_master);
 
 static void dev_change_rx_flags(struct net_device *dev, int flags)
 {
@@ -3416,6 +3437,7 @@ int dev_set_promiscuity(struct net_device *dev, int inc)
                 dev_set_rx_mode(dev);
         return err;
 }
+EXPORT_SYMBOL(dev_set_promiscuity);
 
 /**
  *      dev_set_allmulti        - update allmulti count on a device
@@ -3459,6 +3481,7 @@ int dev_set_allmulti(struct net_device *dev, int inc)
         }
         return 0;
 }
+EXPORT_SYMBOL(dev_set_allmulti);
 
 /*
  *      Upload unicast and multicast address lists to device and
@@ -3887,10 +3910,12 @@ int dev_unicast_delete(struct net_device *dev, void *addr)
 
         ASSERT_RTNL();
 
+        netif_addr_lock_bh(dev);
         err = __hw_addr_del(&dev->uc, addr, dev->addr_len,
                             NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_delete);
@@ -3911,10 +3936,12 @@ int dev_unicast_add(struct net_device *dev, void *addr)
 
         ASSERT_RTNL();
 
+        netif_addr_lock_bh(dev);
         err = __hw_addr_add(&dev->uc, addr, dev->addr_len,
                             NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_add);
@@ -3973,7 +4000,8 @@ EXPORT_SYMBOL_GPL(__dev_addr_unsync);
  *      @from: source device
  *
  *      Add newly added addresses to the destination device and release
- *      addresses that have no users left.
+ *      addresses that have no users left. The source device must be
+ *      locked by netif_tx_lock_bh.
  *
  *      This function is intended to be called from the dev->set_rx_mode
  *      function of layered software devices.
@@ -3982,14 +4010,14 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
 {
         int err = 0;
 
-        ASSERT_RTNL();
-
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
+        netif_addr_lock_bh(to);
         err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
+        netif_addr_unlock_bh(to);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_sync);
@@ -4005,27 +4033,27 @@ EXPORT_SYMBOL(dev_unicast_sync);
  */
 void dev_unicast_unsync(struct net_device *to, struct net_device *from)
 {
-        ASSERT_RTNL();
-
         if (to->addr_len != from->addr_len)
                 return;
 
+        netif_addr_lock_bh(from);
+        netif_addr_lock(to);
         __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
         __dev_set_rx_mode(to);
+        netif_addr_unlock(to);
+        netif_addr_unlock_bh(from);
 }
 EXPORT_SYMBOL(dev_unicast_unsync);
 
 static void dev_unicast_flush(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
-
+        netif_addr_lock_bh(dev);
         __hw_addr_flush(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
 
 static void dev_unicast_init(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
-
         __hw_addr_init(&dev->uc);
 }
 
@@ -4083,6 +4111,7 @@ unsigned dev_get_flags(const struct net_device *dev)
 
         return flags;
 }
+EXPORT_SYMBOL(dev_get_flags);
 
 /**
  *      dev_change_flags - change device settings
@@ -4133,12 +4162,13 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
         }
 
         if (dev->flags & IFF_UP &&
-            ((old_flags ^ dev->flags) &~ (IFF_UP | IFF_PROMISC | IFF_ALLMULTI |
+            ((old_flags ^ dev->flags) & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI |
                                           IFF_VOLATILE)))
                 call_netdevice_notifiers(NETDEV_CHANGE, dev);
 
         if ((flags ^ dev->gflags) & IFF_PROMISC) {
-                int inc = (flags & IFF_PROMISC) ? +1 : -1;
+                int inc = (flags & IFF_PROMISC) ? 1 : -1;
+
                 dev->gflags ^= IFF_PROMISC;
                 dev_set_promiscuity(dev, inc);
         }
@@ -4148,7 +4178,8 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
            IFF_ALLMULTI is requested not asking us and not reporting.
          */
         if ((flags ^ dev->gflags) & IFF_ALLMULTI) {
-                int inc = (flags & IFF_ALLMULTI) ? +1 : -1;
+                int inc = (flags & IFF_ALLMULTI) ? 1 : -1;
+
                 dev->gflags ^= IFF_ALLMULTI;
                 dev_set_allmulti(dev, inc);
         }
@@ -4160,6 +4191,7 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
 
         return ret;
 }
+EXPORT_SYMBOL(dev_change_flags);
 
 /**
  *      dev_set_mtu - Change maximum transfer unit
@@ -4193,6 +4225,7 @@ int dev_set_mtu(struct net_device *dev, int new_mtu)
                 call_netdevice_notifiers(NETDEV_CHANGEMTU, dev);
         return err;
 }
+EXPORT_SYMBOL(dev_set_mtu);
 
 /**
  *      dev_set_mac_address - Change Media Access Control Address
@@ -4217,6 +4250,7 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
         return err;
 }
+EXPORT_SYMBOL(dev_set_mac_address);
 
 /*
  *      Perform the SIOCxIFxxx calls, inside read_lock(dev_base_lock)
@@ -4230,56 +4264,56 @@ static int dev_ifsioc_locked(struct net *net, struct ifreq *ifr, unsigned int cm
                 return -ENODEV;
 
         switch (cmd) {
-                case SIOCGIFFLAGS:      /* Get interface flags */
-                        ifr->ifr_flags = (short) dev_get_flags(dev);
-                        return 0;
+        case SIOCGIFFLAGS:      /* Get interface flags */
+                ifr->ifr_flags = (short) dev_get_flags(dev);
+                return 0;
 
-                case SIOCGIFMETRIC:     /* Get the metric on the interface
-                                           (currently unused) */
-                        ifr->ifr_metric = 0;
-                        return 0;
+        case SIOCGIFMETRIC:     /* Get the metric on the interface
+                                   (currently unused) */
+                ifr->ifr_metric = 0;
+                return 0;
 
-                case SIOCGIFMTU:        /* Get the MTU of a device */
-                        ifr->ifr_mtu = dev->mtu;
-                        return 0;
+        case SIOCGIFMTU:        /* Get the MTU of a device */
+                ifr->ifr_mtu = dev->mtu;
+                return 0;
 
-                case SIOCGIFHWADDR:
-                        if (!dev->addr_len)
-                                memset(ifr->ifr_hwaddr.sa_data, 0, sizeof ifr->ifr_hwaddr.sa_data);
-                        else
-                                memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr,
-                                       min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
-                        ifr->ifr_hwaddr.sa_family = dev->type;
-                        return 0;
+        case SIOCGIFHWADDR:
+                if (!dev->addr_len)
+                        memset(ifr->ifr_hwaddr.sa_data, 0, sizeof ifr->ifr_hwaddr.sa_data);
+                else
+                        memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr,
+                               min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
+                ifr->ifr_hwaddr.sa_family = dev->type;
+                return 0;
 
-                case SIOCGIFSLAVE:
-                        err = -EINVAL;
-                        break;
+        case SIOCGIFSLAVE:
+                err = -EINVAL;
+                break;
 
-                case SIOCGIFMAP:
-                        ifr->ifr_map.mem_start = dev->mem_start;
-                        ifr->ifr_map.mem_end   = dev->mem_end;
-                        ifr->ifr_map.base_addr = dev->base_addr;
-                        ifr->ifr_map.irq       = dev->irq;
-                        ifr->ifr_map.dma       = dev->dma;
-                        ifr->ifr_map.port      = dev->if_port;
-                        return 0;
+        case SIOCGIFMAP:
+                ifr->ifr_map.mem_start = dev->mem_start;
+                ifr->ifr_map.mem_end   = dev->mem_end;
+                ifr->ifr_map.base_addr = dev->base_addr;
+                ifr->ifr_map.irq       = dev->irq;
+                ifr->ifr_map.dma       = dev->dma;
+                ifr->ifr_map.port      = dev->if_port;
+                return 0;
 
-                case SIOCGIFINDEX:
-                        ifr->ifr_ifindex = dev->ifindex;
-                        return 0;
+        case SIOCGIFINDEX:
+                ifr->ifr_ifindex = dev->ifindex;
+                return 0;
 
-                case SIOCGIFTXQLEN:
-                        ifr->ifr_qlen = dev->tx_queue_len;
-                        return 0;
+        case SIOCGIFTXQLEN:
+                ifr->ifr_qlen = dev->tx_queue_len;
+                return 0;
 
-                default:
-                        /* dev_ioctl() should ensure this case
-                         * is never reached
-                         */
-                        WARN_ON(1);
-                        err = -EINVAL;
-                        break;
+        default:
+                /* dev_ioctl() should ensure this case
+                 * is never reached
+                 */
+                WARN_ON(1);
+                err = -EINVAL;
+                break;
 
         }
         return err;
@@ -4300,92 +4334,91 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
         ops = dev->netdev_ops;
 
         switch (cmd) {
-                case SIOCSIFFLAGS:      /* Set interface flags */
-                        return dev_change_flags(dev, ifr->ifr_flags);
-
-                case SIOCSIFMETRIC:     /* Set the metric on the interface
-                                           (currently unused) */
-                        return -EOPNOTSUPP;
+        case SIOCSIFFLAGS:      /* Set interface flags */
+                return dev_change_flags(dev, ifr->ifr_flags);
 
-                case SIOCSIFMTU:        /* Set the MTU of a device */
-                        return dev_set_mtu(dev, ifr->ifr_mtu);
+        case SIOCSIFMETRIC:     /* Set the metric on the interface
+                                   (currently unused) */
+                return -EOPNOTSUPP;
 
-                case SIOCSIFHWADDR:
-                        return dev_set_mac_address(dev, &ifr->ifr_hwaddr);
+        case SIOCSIFMTU:        /* Set the MTU of a device */
+                return dev_set_mtu(dev, ifr->ifr_mtu);
 
-                case SIOCSIFHWBROADCAST:
-                        if (ifr->ifr_hwaddr.sa_family != dev->type)
-                                return -EINVAL;
-                        memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
-                               min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
-                        call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-                        return 0;
-
-                case SIOCSIFMAP:
-                        if (ops->ndo_set_config) {
-                                if (!netif_device_present(dev))
-                                        return -ENODEV;
-                                return ops->ndo_set_config(dev, &ifr->ifr_map);
-                        }
-                        return -EOPNOTSUPP;
+        case SIOCSIFHWADDR:
+                return dev_set_mac_address(dev, &ifr->ifr_hwaddr);
 
-                case SIOCADDMULTI:
-                        if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
-                            ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
-                                return -EINVAL;
-                        if (!netif_device_present(dev))
-                                return -ENODEV;
-                        return dev_mc_add(dev, ifr->ifr_hwaddr.sa_data,
-                                          dev->addr_len, 1);
+        case SIOCSIFHWBROADCAST:
+                if (ifr->ifr_hwaddr.sa_family != dev->type)
+                        return -EINVAL;
+                memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
+                       min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+                return 0;
 
-                case SIOCDELMULTI:
-                        if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
-                            ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
-                                return -EINVAL;
+        case SIOCSIFMAP:
+                if (ops->ndo_set_config) {
                         if (!netif_device_present(dev))
                                 return -ENODEV;
-                        return dev_mc_delete(dev, ifr->ifr_hwaddr.sa_data,
-                                             dev->addr_len, 1);
+                        return ops->ndo_set_config(dev, &ifr->ifr_map);
+                }
+                return -EOPNOTSUPP;
 
-                case SIOCSIFTXQLEN:
-                        if (ifr->ifr_qlen < 0)
-                                return -EINVAL;
-                        dev->tx_queue_len = ifr->ifr_qlen;
-                        return 0;
+        case SIOCADDMULTI:
+                if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
+                    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+                        return -EINVAL;
+                if (!netif_device_present(dev))
+                        return -ENODEV;
+                return dev_mc_add(dev, ifr->ifr_hwaddr.sa_data,
+                                  dev->addr_len, 1);
+
+        case SIOCDELMULTI:
+                if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
+                    ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
+                        return -EINVAL;
+                if (!netif_device_present(dev))
+                        return -ENODEV;
+                return dev_mc_delete(dev, ifr->ifr_hwaddr.sa_data,
+                                     dev->addr_len, 1);
 
-                case SIOCSIFNAME:
-                        ifr->ifr_newname[IFNAMSIZ-1] = '\0';
-                        return dev_change_name(dev, ifr->ifr_newname);
+        case SIOCSIFTXQLEN:
+                if (ifr->ifr_qlen < 0)
+                        return -EINVAL;
+                dev->tx_queue_len = ifr->ifr_qlen;
+                return 0;
 
-                /*
-                 *      Unknown or private ioctl
-                 */
+        case SIOCSIFNAME:
+                ifr->ifr_newname[IFNAMSIZ-1] = '\0';
+                return dev_change_name(dev, ifr->ifr_newname);
 
-                default:
-                        if ((cmd >= SIOCDEVPRIVATE &&
-                            cmd <= SIOCDEVPRIVATE + 15) ||
-                            cmd == SIOCBONDENSLAVE ||
-                            cmd == SIOCBONDRELEASE ||
-                            cmd == SIOCBONDSETHWADDR ||
-                            cmd == SIOCBONDSLAVEINFOQUERY ||
-                            cmd == SIOCBONDINFOQUERY ||
-                            cmd == SIOCBONDCHANGEACTIVE ||
-                            cmd == SIOCGMIIPHY ||
-                            cmd == SIOCGMIIREG ||
-                            cmd == SIOCSMIIREG ||
-                            cmd == SIOCBRADDIF ||
-                            cmd == SIOCBRDELIF ||
-                            cmd == SIOCSHWTSTAMP ||
-                            cmd == SIOCWANDEV) {
-                                err = -EOPNOTSUPP;
-                                if (ops->ndo_do_ioctl) {
-                                        if (netif_device_present(dev))
-                                                err = ops->ndo_do_ioctl(dev, ifr, cmd);
-                                        else
-                                                err = -ENODEV;
-                                }
-                        } else
-                                err = -EINVAL;
+        /*
+         *      Unknown or private ioctl
+         */
+        default:
+                if ((cmd >= SIOCDEVPRIVATE &&
+                    cmd <= SIOCDEVPRIVATE + 15) ||
+                    cmd == SIOCBONDENSLAVE ||
+                    cmd == SIOCBONDRELEASE ||
+                    cmd == SIOCBONDSETHWADDR ||
+                    cmd == SIOCBONDSLAVEINFOQUERY ||
+                    cmd == SIOCBONDINFOQUERY ||
+                    cmd == SIOCBONDCHANGEACTIVE ||
+                    cmd == SIOCGMIIPHY ||
+                    cmd == SIOCGMIIREG ||
+                    cmd == SIOCSMIIREG ||
+                    cmd == SIOCBRADDIF ||
+                    cmd == SIOCBRDELIF ||
+                    cmd == SIOCSHWTSTAMP ||
+                    cmd == SIOCWANDEV) {
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_do_ioctl) {
+                                if (netif_device_present(dev))
+                                        err = ops->ndo_do_ioctl(dev, ifr, cmd);
+                                else
+                                        err = -ENODEV;
+                        }
+                } else
+                        err = -EINVAL;
 
         }
         return err;
@@ -4442,135 +4475,135 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
          */
 
         switch (cmd) {
-                /*
-                 *      These ioctl calls:
-                 *      - can be done by all.
-                 *      - atomic and do not require locking.
-                 *      - return a value
-                 */
-                case SIOCGIFFLAGS:
-                case SIOCGIFMETRIC:
-                case SIOCGIFMTU:
-                case SIOCGIFHWADDR:
-                case SIOCGIFSLAVE:
-                case SIOCGIFMAP:
-                case SIOCGIFINDEX:
-                case SIOCGIFTXQLEN:
-                        dev_load(net, ifr.ifr_name);
-                        read_lock(&dev_base_lock);
-                        ret = dev_ifsioc_locked(net, &ifr, cmd);
-                        read_unlock(&dev_base_lock);
-                        if (!ret) {
-                                if (colon)
-                                        *colon = ':';
-                                if (copy_to_user(arg, &ifr,
-                                                 sizeof(struct ifreq)))
-                                        ret = -EFAULT;
-                        }
-                        return ret;
+        /*
+         *      These ioctl calls:
+         *      - can be done by all.
+         *      - atomic and do not require locking.
+         *      - return a value
+         */
+        case SIOCGIFFLAGS:
+        case SIOCGIFMETRIC:
+        case SIOCGIFMTU:
+        case SIOCGIFHWADDR:
+        case SIOCGIFSLAVE:
+        case SIOCGIFMAP:
+        case SIOCGIFINDEX:
+        case SIOCGIFTXQLEN:
+                dev_load(net, ifr.ifr_name);
+                read_lock(&dev_base_lock);
+                ret = dev_ifsioc_locked(net, &ifr, cmd);
+                read_unlock(&dev_base_lock);
+                if (!ret) {
+                        if (colon)
+                                *colon = ':';
+                        if (copy_to_user(arg, &ifr,
+                                         sizeof(struct ifreq)))
+                                ret = -EFAULT;
+                }
+                return ret;
 
-                case SIOCETHTOOL:
-                        dev_load(net, ifr.ifr_name);
-                        rtnl_lock();
-                        ret = dev_ethtool(net, &ifr);
-                        rtnl_unlock();
-                        if (!ret) {
-                                if (colon)
-                                        *colon = ':';
-                                if (copy_to_user(arg, &ifr,
-                                                 sizeof(struct ifreq)))
-                                        ret = -EFAULT;
-                        }
-                        return ret;
+        case SIOCETHTOOL:
+                dev_load(net, ifr.ifr_name);
+                rtnl_lock();
+                ret = dev_ethtool(net, &ifr);
+                rtnl_unlock();
+                if (!ret) {
+                        if (colon)
+                                *colon = ':';
+                        if (copy_to_user(arg, &ifr,
+                                         sizeof(struct ifreq)))
+                                ret = -EFAULT;
+                }
+                return ret;
 
-                /*
-                 *      These ioctl calls:
-                 *      - require superuser power.
-                 *      - require strict serialization.
-                 *      - return a value
-                 */
-                case SIOCGMIIPHY:
-                case SIOCGMIIREG:
-                case SIOCSIFNAME:
-                        if (!capable(CAP_NET_ADMIN))
-                                return -EPERM;
-                        dev_load(net, ifr.ifr_name);
-                        rtnl_lock();
-                        ret = dev_ifsioc(net, &ifr, cmd);
-                        rtnl_unlock();
-                        if (!ret) {
-                                if (colon)
-                                        *colon = ':';
-                                if (copy_to_user(arg, &ifr,
-                                                 sizeof(struct ifreq)))
-                                        ret = -EFAULT;
-                        }
-                        return ret;
+        /*
+         *      These ioctl calls:
+         *      - require superuser power.
+         *      - require strict serialization.
+         *      - return a value
+         */
+        case SIOCGMIIPHY:
+        case SIOCGMIIREG:
+        case SIOCSIFNAME:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                dev_load(net, ifr.ifr_name);
+                rtnl_lock();
+                ret = dev_ifsioc(net, &ifr, cmd);
+                rtnl_unlock();
+                if (!ret) {
+                        if (colon)
+                                *colon = ':';
+                        if (copy_to_user(arg, &ifr,
+                                         sizeof(struct ifreq)))
+                                ret = -EFAULT;
+                }
+                return ret;
 
-                /*
-                 *      These ioctl calls:
-                 *      - require superuser power.
-                 *      - require strict serialization.
-                 *      - do not return a value
-                 */
-                case SIOCSIFFLAGS:
-                case SIOCSIFMETRIC:
-                case SIOCSIFMTU:
-                case SIOCSIFMAP:
-                case SIOCSIFHWADDR:
-                case SIOCSIFSLAVE:
-                case SIOCADDMULTI:
-                case SIOCDELMULTI:
-                case SIOCSIFHWBROADCAST:
-                case SIOCSIFTXQLEN:
-                case SIOCSMIIREG:
-                case SIOCBONDENSLAVE:
-                case SIOCBONDRELEASE:
-                case SIOCBONDSETHWADDR:
-                case SIOCBONDCHANGEACTIVE:
-                case SIOCBRADDIF:
-                case SIOCBRDELIF:
-                case SIOCSHWTSTAMP:
-                        if (!capable(CAP_NET_ADMIN))
-                                return -EPERM;
-                        /* fall through */
-                case SIOCBONDSLAVEINFOQUERY:
-                case SIOCBONDINFOQUERY:
+        /*
+         *      These ioctl calls:
+         *      - require superuser power.
+         *      - require strict serialization.
+         *      - do not return a value
+         */
+        case SIOCSIFFLAGS:
+        case SIOCSIFMETRIC:
+        case SIOCSIFMTU:
+        case SIOCSIFMAP:
+        case SIOCSIFHWADDR:
+        case SIOCSIFSLAVE:
+        case SIOCADDMULTI:
+        case SIOCDELMULTI:
+        case SIOCSIFHWBROADCAST:
+        case SIOCSIFTXQLEN:
+        case SIOCSMIIREG:
+        case SIOCBONDENSLAVE:
+        case SIOCBONDRELEASE:
+        case SIOCBONDSETHWADDR:
+        case SIOCBONDCHANGEACTIVE:
+        case SIOCBRADDIF:
+        case SIOCBRDELIF:
+        case SIOCSHWTSTAMP:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                /* fall through */
+        case SIOCBONDSLAVEINFOQUERY:
+        case SIOCBONDINFOQUERY:
+                dev_load(net, ifr.ifr_name);
+                rtnl_lock();
+                ret = dev_ifsioc(net, &ifr, cmd);
+                rtnl_unlock();
+                return ret;
+
+        case SIOCGIFMEM:
+                /* Get the per device memory space. We can add this but
+                 * currently do not support it */
+        case SIOCSIFMEM:
+                /* Set the per device memory buffer space.
+                 * Not applicable in our case */
+        case SIOCSIFLINK:
+                return -EINVAL;
+
+        /*
+         *      Unknown or private ioctl.
+         */
+        default:
+                if (cmd == SIOCWANDEV ||
+                    (cmd >= SIOCDEVPRIVATE &&
+                     cmd <= SIOCDEVPRIVATE + 15)) {
                         dev_load(net, ifr.ifr_name);
                         rtnl_lock();
                         ret = dev_ifsioc(net, &ifr, cmd);
                         rtnl_unlock();
+                        if (!ret && copy_to_user(arg, &ifr,
+                                                 sizeof(struct ifreq)))
+                                ret = -EFAULT;
                         return ret;
-
-                case SIOCGIFMEM:
-                        /* Get the per device memory space. We can add this but
-                         * currently do not support it */
-                case SIOCSIFMEM:
-                        /* Set the per device memory buffer space.
-                         * Not applicable in our case */
-                case SIOCSIFLINK:
-                        return -EINVAL;
-
-                /*
-                 *      Unknown or private ioctl.
-                 */
-                default:
-                        if (cmd == SIOCWANDEV ||
-                            (cmd >= SIOCDEVPRIVATE &&
-                             cmd <= SIOCDEVPRIVATE + 15)) {
-                                dev_load(net, ifr.ifr_name);
-                                rtnl_lock();
-                                ret = dev_ifsioc(net, &ifr, cmd);
-                                rtnl_unlock();
-                                if (!ret && copy_to_user(arg, &ifr,
-                                                         sizeof(struct ifreq)))
-                                        ret = -EFAULT;
-                                return ret;
-                        }
-                        /* Take care of Wireless Extensions */
-                        if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
-                                return wext_handle_ioctl(net, &ifr, cmd, arg);
-                        return -EINVAL;
+                }
+                /* Take care of Wireless Extensions */
+                if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
+                        return wext_handle_ioctl(net, &ifr, cmd, arg);
+                return -EINVAL;
         }
 }
 
@@ -4835,6 +4868,7 @@ err_uninit:
                 dev->netdev_ops->ndo_uninit(dev);
         goto out;
 }
+EXPORT_SYMBOL(register_netdevice);
 
 /**
  *      init_dummy_netdev       - init a dummy network device for NAPI
@@ -5187,6 +5221,7 @@ void free_netdev(struct net_device *dev)
         /* will free via device release */
         put_device(&dev->dev);
 }
+EXPORT_SYMBOL(free_netdev);
 
 /**
  *      synchronize_net -  Synchronize with packet receive processing
@@ -5199,6 +5234,7 @@ void synchronize_net(void)
         might_sleep();
         synchronize_rcu();
 }
+EXPORT_SYMBOL(synchronize_net);
 
 /**
  *      unregister_netdevice - remove device from the kernel
@@ -5219,6 +5255,7 @@ void unregister_netdevice(struct net_device *dev)
         /* Finish processing unregister after unlock */
         net_set_todo(dev);
 }
+EXPORT_SYMBOL(unregister_netdevice);
 
 /**
  *      unregister_netdev - remove device from the kernel
@@ -5237,7 +5274,6 @@ void unregister_netdev(struct net_device *dev)
         unregister_netdevice(dev);
         rtnl_unlock();
 }
-
 EXPORT_SYMBOL(unregister_netdev);
 
 /**
@@ -5427,7 +5463,7 @@ unsigned long netdev_increment_features(unsigned long all, unsigned long one,
                                         unsigned long mask)
 {
         /* If device needs checksumming, downgrade to it. */
-        if (all & NETIF_F_NO_CSUM && !(one & NETIF_F_NO_CSUM))
+        if (all & NETIF_F_NO_CSUM && !(one & NETIF_F_NO_CSUM))
                 all ^= NETIF_F_NO_CSUM | (one & NETIF_F_ALL_CSUM);
         else if (mask & NETIF_F_ALL_CSUM) {
                 /* If one device supports v4/v6 checksumming, set for all. */
@@ -5653,41 +5689,3 @@ static int __init initialize_hashrnd(void)
 
 late_initcall_sync(initialize_hashrnd);
 
-EXPORT_SYMBOL(__dev_get_by_index);
-EXPORT_SYMBOL(__dev_get_by_name);
-EXPORT_SYMBOL(__dev_remove_pack);
-EXPORT_SYMBOL(dev_valid_name);
-EXPORT_SYMBOL(dev_add_pack);
-EXPORT_SYMBOL(dev_alloc_name);
-EXPORT_SYMBOL(dev_close);
-EXPORT_SYMBOL(dev_get_by_flags);
-EXPORT_SYMBOL(dev_get_by_index);
-EXPORT_SYMBOL(dev_get_by_name);
-EXPORT_SYMBOL(dev_open);
-EXPORT_SYMBOL(dev_queue_xmit);
-EXPORT_SYMBOL(dev_remove_pack);
-EXPORT_SYMBOL(dev_set_allmulti);
-EXPORT_SYMBOL(dev_set_promiscuity);
-EXPORT_SYMBOL(dev_change_flags);
-EXPORT_SYMBOL(dev_set_mtu);
-EXPORT_SYMBOL(dev_set_mac_address);
-EXPORT_SYMBOL(free_netdev);
-EXPORT_SYMBOL(netdev_boot_setup_check);
-EXPORT_SYMBOL(netdev_set_master);
-EXPORT_SYMBOL(netdev_state_change);
-EXPORT_SYMBOL(netif_receive_skb);
-EXPORT_SYMBOL(netif_rx);
-EXPORT_SYMBOL(register_gifconf);
-EXPORT_SYMBOL(register_netdevice);
-EXPORT_SYMBOL(register_netdevice_notifier);
-EXPORT_SYMBOL(skb_checksum_help);
-EXPORT_SYMBOL(synchronize_net);
-EXPORT_SYMBOL(unregister_netdevice);
-EXPORT_SYMBOL(unregister_netdevice_notifier);
-EXPORT_SYMBOL(net_enable_timestamp);
-EXPORT_SYMBOL(net_disable_timestamp);
-EXPORT_SYMBOL(dev_get_flags);
-
-EXPORT_SYMBOL(dev_load);
-
-EXPORT_PER_CPU_SYMBOL(softnet_data);
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 9d66fa953ab7..0a113f26bc9f 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -52,6 +52,7 @@ struct per_cpu_dm_data {
 
 struct dm_hw_stat_delta {
         struct net_device *dev;
+        unsigned long last_rx;
         struct list_head list;
         struct rcu_head rcu;
         unsigned long last_drop_val;
@@ -180,17 +181,25 @@ static void trace_napi_poll_hit(struct napi_struct *napi)
         struct dm_hw_stat_delta *new_stat;
 
         /*
-         * Ratelimit our check time to dm_hw_check_delta jiffies
+         * Don't check napi structures with no associated device
          */
-        if (!time_after(jiffies, napi->dev->last_rx + dm_hw_check_delta))
+        if (!napi->dev)
                 return;
 
         rcu_read_lock();
         list_for_each_entry_rcu(new_stat, &hw_stats_list, list) {
+                /*
+                 * only add a note to our monitor buffer if:
+                 * 1) this is the dev we received on
+                 * 2) its after the last_rx delta
+                 * 3) our rx_dropped count has gone up
+                 */
                 if ((new_stat->dev == napi->dev)  &&
+                    (time_after(jiffies, new_stat->last_rx + dm_hw_check_delta)) &&
                     (napi->dev->stats.rx_dropped != new_stat->last_drop_val)) {
                         trace_drop_common(NULL, NULL);
                         new_stat->last_drop_val = napi->dev->stats.rx_dropped;
+                        new_stat->last_rx = jiffies;
                         break;
                 }
         }
@@ -286,6 +295,7 @@ static int dropmon_net_event(struct notifier_block *ev_block,
                         goto out;
 
                 new_stat->dev = dev;
+                new_stat->last_rx = jiffies;
                 INIT_RCU_HEAD(&new_stat->rcu);
                 spin_lock(&trace_state_lock);
                 list_add_rcu(&new_stat->list, &hw_stats_list);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 44e571111d3a..4c12ddb5f5ee 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -898,6 +898,19 @@ static int ethtool_set_value(struct net_device *dev, char __user *useraddr,
         return actor(dev, edata.data);
 }
 
+static int ethtool_flash_device(struct net_device *dev, char __user *useraddr)
+{
+        struct ethtool_flash efl;
+
+        if (copy_from_user(&efl, useraddr, sizeof(efl)))
+                return -EFAULT;
+
+        if (!dev->ethtool_ops->flash_device)
+                return -EOPNOTSUPP;
+
+        return dev->ethtool_ops->flash_device(dev, &efl);
+}
+
 /* The main entry point in this file.  Called from net/core/dev.c */
 
 int dev_ethtool(struct net *net, struct ifreq *ifr)
@@ -1111,6 +1124,9 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_SGRO:
                 rc = ethtool_set_gro(dev, useraddr);
                 break;
+        case ETHTOOL_FLASHDEV:
+                rc = ethtool_flash_device(dev, useraddr);
+                break;
         default:
                 rc = -EOPNOTSUPP;
         }
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 78e5bfc454ae..493775f4f2f1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -81,7 +81,7 @@
 struct gen_estimator
 {
         struct list_head        list;
-        struct gnet_stats_basic *bstats;
+        struct gnet_stats_basic_packed  *bstats;
         struct gnet_stats_rate_est      *rate_est;
         spinlock_t              *stats_lock;
         int                     ewma_log;
@@ -165,7 +165,7 @@ static void gen_add_node(struct gen_estimator *est)
 }
 
 static
-struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
+struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats,
                                     const struct gnet_stats_rate_est *rate_est)
 {
         struct rb_node *p = est_root.rb_node;
@@ -202,7 +202,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
  *
  * NOTE: Called under rtnl_mutex
  */
-int gen_new_estimator(struct gnet_stats_basic *bstats,
+int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                       struct gnet_stats_rate_est *rate_est,
                       spinlock_t *stats_lock,
                       struct nlattr *opt)
@@ -262,7 +262,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
  *
  * NOTE: Called under rtnl_mutex
  */
-void gen_kill_estimator(struct gnet_stats_basic *bstats,
+void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                         struct gnet_stats_rate_est *rate_est)
 {
         struct gen_estimator *e;
@@ -292,7 +292,7 @@ EXPORT_SYMBOL(gen_kill_estimator);
  *
  * Returns 0 on success or a negative error code.
  */
-int gen_replace_estimator(struct gnet_stats_basic *bstats,
+int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                           struct gnet_stats_rate_est *rate_est,
                           spinlock_t *stats_lock, struct nlattr *opt)
 {
@@ -308,7 +308,7 @@ EXPORT_SYMBOL(gen_replace_estimator);
  *
  * Returns true if estimator is active, and false if not.
  */
-bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                           const struct gnet_stats_rate_est *rate_est)
 {
         ASSERT_RTNL();
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index c3d0ffeac243..8569310268ab 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -106,16 +106,21 @@ gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
  * if the room in the socket buffer was not sufficient.
  */
 int
-gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b)
+gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
 {
         if (d->compat_tc_stats) {
                 d->tc_stats.bytes = b->bytes;
                 d->tc_stats.packets = b->packets;
         }
 
-        if (d->tail)
-                return gnet_stats_copy(d, TCA_STATS_BASIC, b, sizeof(*b));
+        if (d->tail) {
+                struct gnet_stats_basic sb;
 
+                memset(&sb, 0, sizeof(sb));
+                sb.bytes = b->bytes;
+                sb.packets = b->packets;
+                return gnet_stats_copy(d, TCA_STATS_BASIC, &sb, sizeof(sb));
+        }
         return 0;
 }
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index ddd2cd2b1775..1c1af2756f38 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -517,7 +517,7 @@ int net_assign_generic(struct net *net, int id, void *data)
          */
 
         ng->len = id;
-        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len);
+        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 
         rcu_assign_pointer(net->gen, ng);
         call_rcu(&old_ng->rcu, net_generic_release);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 0ac309154b0d..0b4d0d35ef40 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -323,6 +323,11 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
 
                         udelay(USEC_PER_POLL);
                 }
+
+                WARN_ONCE(!irqs_disabled(),
+                        "netpoll_send_skb(): %s enabled interrupts in poll (%pF)\n",
+                        dev->name, ops->ndo_start_xmit);
+
                 local_irq_restore(flags);
         }
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 19b8c20e98a4..0bcecbf06581 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -131,6 +131,7 @@
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/capability.h>
+#include <linux/hrtimer.h>
 #include <linux/freezer.h>
 #include <linux/delay.h>
 #include <linux/timer.h>
@@ -162,14 +163,13 @@
 #include <asm/byteorder.h>
 #include <linux/rcupdate.h>
 #include <linux/bitops.h>
-#include <asm/io.h>
+#include <linux/io.h>
+#include <linux/timex.h>
+#include <linux/uaccess.h>
 #include <asm/dma.h>
-#include <asm/uaccess.h>
 #include <asm/div64.h>          /* do_div */
-#include <asm/timex.h>
-
-#define VERSION  "pktgen v2.70: Packet Generator for packet performance testing.\n"
 
+#define VERSION         "2.72"
 #define IP_NAME_SZ 32
 #define MAX_MPLS_LABELS 16 /* This is the max label stack depth */
 #define MPLS_STACK_BOTTOM htonl(0x00000100)
@@ -206,7 +206,7 @@
 #define PKTGEN_MAGIC 0xbe9be955
 #define PG_PROC_DIR "pktgen"
 #define PGCTRL      "pgctrl"
-static struct proc_dir_entry *pg_proc_dir = NULL;
+static struct proc_dir_entry *pg_proc_dir;
 
 #define MAX_CFLOWS  65536
 
@@ -231,9 +231,9 @@ struct pktgen_dev {
          */
         struct proc_dir_entry *entry;   /* proc file */
         struct pktgen_thread *pg_thread;/* the owner */
-        struct list_head list;          /* Used for chaining in the thread's run-queue */
+        struct list_head list;          /* chaining in the thread's run-queue */
 
-        int running;            /* if this changes to false, the test will stop */
+        int running;            /* if false, the test will stop */
 
         /* If min != max, then we will either do a linear iteration, or
          * we will do a random selection from within the range.
@@ -246,33 +246,37 @@ struct pktgen_dev {
         int max_pkt_size;       /* = ETH_ZLEN; */
         int pkt_overhead;       /* overhead for MPLS, VLANs, IPSEC etc */
         int nfrags;
-        __u32 delay_us;         /* Default delay */
-        __u32 delay_ns;
+        u64 delay;              /* nano-seconds */
+
         __u64 count;            /* Default No packets to send */
         __u64 sofar;            /* How many pkts we've sent so far */
         __u64 tx_bytes;         /* How many bytes we've transmitted */
-        __u64 errors;           /* Errors when trying to transmit, pkts will be re-sent */
+        __u64 errors;           /* Errors when trying to transmit,
+                                   pkts will be re-sent */
 
         /* runtime counters relating to clone_skb */
-        __u64 next_tx_us;       /* timestamp of when to tx next */
-        __u32 next_tx_ns;
 
         __u64 allocated_skbs;
         __u32 clone_count;
         int last_ok;            /* Was last skb sent?
-                                 * Or a failed transmit of some sort?  This will keep
-                                 * sequence numbers in order, for example.
+                                 * Or a failed transmit of some sort?
+                                 * This will keep sequence numbers in order
                                  */
-        __u64 started_at;       /* micro-seconds */
-        __u64 stopped_at;       /* micro-seconds */
-        __u64 idle_acc;         /* micro-seconds */
+        ktime_t next_tx;
+        ktime_t started_at;
+        ktime_t stopped_at;
+        u64     idle_acc;       /* nano-seconds */
+
         __u32 seq_num;
 
-        int clone_skb;          /* Use multiple SKBs during packet gen.  If this number
-                                 * is greater than 1, then that many copies of the same
-                                 * packet will be sent before a new packet is allocated.
-                                 * For instance, if you want to send 1024 identical packets
-                                 * before creating a new packet, set clone_skb to 1024.
+        int clone_skb;          /*
+                                 * Use multiple SKBs during packet gen.
+                                 * If this number is greater than 1, then
+                                 * that many copies of the same packet will be
+                                 * sent before a new packet is allocated.
+                                 * If you want to send 1024 identical packets
+                                 * before creating a new packet,
+                                 * set clone_skb to 1024.
                                  */
 
         char dst_min[IP_NAME_SZ];       /* IP, ie 1.2.3.4 */
@@ -304,8 +308,10 @@ struct pktgen_dev {
         __u16 udp_dst_max;      /* exclusive, dest UDP port */
 
         /* DSCP + ECN */
-        __u8 tos;            /* six most significant bits of (former) IPv4 TOS are for dscp codepoint */
-        __u8 traffic_class;  /* ditto for the (former) Traffic Class in IPv6 (see RFC 3260, sec. 4) */
+        __u8 tos;            /* six MSB of (former) IPv4 TOS
+                                are for dscp codepoint */
+        __u8 traffic_class;  /* ditto for the (former) Traffic Class in IPv6
+                                (see RFC 3260, sec. 4) */
 
         /* MPLS */
         unsigned nr_labels;     /* Depth of stack, 0 = no MPLS */
@@ -346,15 +352,17 @@ struct pktgen_dev {
          */
         __u16 pad;              /* pad out the hh struct to an even 16 bytes */
 
-        struct sk_buff *skb;    /* skb we are to transmit next, mainly used for when we
+        struct sk_buff *skb;    /* skb we are to transmit next, used for when we
                                  * are transmitting the same one multiple times
                                  */
-        struct net_device *odev;        /* The out-going device.  Note that the device should
-                                         * have it's pg_info pointer pointing back to this
-                                         * device.  This will be set when the user specifies
-                                         * the out-going device name (not when the inject is
-                                         * started as it used to do.)
-                                         */
+        struct net_device *odev; /* The out-going device.
+                                  * Note that the device should have it's
+                                  * pg_info pointer pointing back to this
+                                  * device.
+                                  * Set when the user specifies the out-going
+                                  * device name (not when the inject is
+                                  * started as it used to do.)
+                                  */
         struct flow_state *flows;
         unsigned cflows;        /* Concurrent flows (config) */
         unsigned lflow;         /* Flow length  (config) */
@@ -379,13 +387,14 @@ struct pktgen_hdr {
 };
 
 struct pktgen_thread {
-        spinlock_t if_lock;
+        spinlock_t if_lock;             /* for list of devices */
         struct list_head if_list;       /* All device here */
         struct list_head th_list;
         struct task_struct *tsk;
         char result[512];
 
-        /* Field for thread to receive "posted" events terminate, stop ifs etc. */
+        /* Field for thread to receive "posted" events terminate,
+           stop ifs etc. */
 
         u32 control;
         int cpu;
@@ -397,24 +406,22 @@ struct pktgen_thread {
 #define REMOVE 1
 #define FIND   0
 
-/** Convert to micro-seconds */
-static inline __u64 tv_to_us(const struct timeval *tv)
+static inline ktime_t ktime_now(void)
 {
-        __u64 us = tv->tv_usec;
-        us += (__u64) tv->tv_sec * (__u64) 1000000;
-        return us;
+        struct timespec ts;
+        ktime_get_ts(&ts);
+
+        return timespec_to_ktime(ts);
 }
 
-static __u64 getCurUs(void)
+/* This works even if 32 bit because of careful byte order choice */
+static inline int ktime_lt(const ktime_t cmp1, const ktime_t cmp2)
 {
-        struct timeval tv;
-        do_gettimeofday(&tv);
-        return tv_to_us(&tv);
+        return cmp1.tv64 < cmp2.tv64;
 }
 
-/* old include end */
-
-static char version[] __initdata = VERSION;
+static const char version[] =
+        "pktgen " VERSION ": Packet Generator for packet performance testing.\n";
 
 static int pktgen_remove_device(struct pktgen_thread *t, struct pktgen_dev *i);
 static int pktgen_add_device(struct pktgen_thread *t, const char *ifname);
@@ -424,7 +431,7 @@ static int pktgen_device_event(struct notifier_block *, unsigned long, void *);
 static void pktgen_run_all_threads(void);
 static void pktgen_reset_all_threads(void);
 static void pktgen_stop_all_threads_ifs(void);
-static int pktgen_stop_device(struct pktgen_dev *pkt_dev);
+
 static void pktgen_stop(struct pktgen_thread *t);
 static void pktgen_clear_counters(struct pktgen_dev *pkt_dev);
 
@@ -432,10 +439,10 @@ static unsigned int scan_ip6(const char *s, char ip[16]);
 static unsigned int fmt_ip6(char *s, const char ip[16]);
 
 /* Module parameters, defaults. */
-static int pg_count_d = 1000;   /* 1000 pkts by default */
-static int pg_delay_d;
-static int pg_clone_skb_d;
-static int debug;
+static int pg_count_d __read_mostly = 1000;
+static int pg_delay_d __read_mostly;
+static int pg_clone_skb_d  __read_mostly;
+static int debug  __read_mostly;
 
 static DEFINE_MUTEX(pktgen_thread_lock);
 static LIST_HEAD(pktgen_threads);
@@ -451,12 +458,12 @@ static struct notifier_block pktgen_notifier_block = {
 
 static int pgctrl_show(struct seq_file *seq, void *v)
 {
-        seq_puts(seq, VERSION);
+        seq_puts(seq, version);
         return 0;
 }
 
-static ssize_t pgctrl_write(struct file *file, const char __user * buf,
-                            size_t count, loff_t * ppos)
+static ssize_t pgctrl_write(struct file *file, const char __user *buf,
+                            size_t count, loff_t *ppos)
 {
         int err = 0;
         char data[128];
@@ -509,10 +516,9 @@ static const struct file_operations pktgen_fops = {
 
 static int pktgen_if_show(struct seq_file *seq, void *v)
 {
-        struct pktgen_dev *pkt_dev = seq->private;
-        __u64 sa;
-        __u64 stopped;
-        __u64 now = getCurUs();
+        const struct pktgen_dev *pkt_dev = seq->private;
+        ktime_t stopped;
+        u64 idle;
 
         seq_printf(seq,
                    "Params: count %llu  min_pkt_size: %u  max_pkt_size: %u\n",
@@ -520,9 +526,8 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
                    pkt_dev->max_pkt_size);
 
         seq_printf(seq,
-                   "     frags: %d  delay: %u  clone_skb: %d  ifname: %s\n",
-                   pkt_dev->nfrags,
-                   1000 * pkt_dev->delay_us + pkt_dev->delay_ns,
+                   "     frags: %d  delay: %llu  clone_skb: %d  ifname: %s\n",
+                   pkt_dev->nfrags, (unsigned long long) pkt_dev->delay,
                    pkt_dev->clone_skb, pkt_dev->odev->name);
 
         seq_printf(seq, "     flows: %u flowlen: %u\n", pkt_dev->cflows,
@@ -549,11 +554,14 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
                            "     daddr: %s  min_daddr: %s  max_daddr: %s\n", b1,
                            b2, b3);
 
-        } else
+        } else {
+                seq_printf(seq,
+                           "     dst_min: %s  dst_max: %s\n",
+                           pkt_dev->dst_min, pkt_dev->dst_max);
                 seq_printf(seq,
-                           "     dst_min: %s  dst_max: %s\n     src_min: %s  src_max: %s\n",
-                           pkt_dev->dst_min, pkt_dev->dst_max, pkt_dev->src_min,
-                           pkt_dev->src_max);
+                           "        src_min: %s  src_max: %s\n",
+                           pkt_dev->src_min, pkt_dev->src_max);
+        }
 
         seq_puts(seq, "     src_mac: ");
 
@@ -565,7 +573,8 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
         seq_printf(seq, "%pM\n", pkt_dev->dst_mac);
 
         seq_printf(seq,
-                   "     udp_src_min: %d  udp_src_max: %d  udp_dst_min: %d  udp_dst_max: %d\n",
+                   "     udp_src_min: %d  udp_src_max: %d"
+                   "  udp_dst_min: %d  udp_dst_max: %d\n",
                    pkt_dev->udp_src_min, pkt_dev->udp_src_max,
                    pkt_dev->udp_dst_min, pkt_dev->udp_dst_max);
 
@@ -581,23 +590,21 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
                                    i == pkt_dev->nr_labels-1 ? "\n" : ", ");
         }
 
-        if (pkt_dev->vlan_id != 0xffff) {
+        if (pkt_dev->vlan_id != 0xffff)
                 seq_printf(seq, "     vlan_id: %u  vlan_p: %u  vlan_cfi: %u\n",
-                           pkt_dev->vlan_id, pkt_dev->vlan_p, pkt_dev->vlan_cfi);
-        }
+                           pkt_dev->vlan_id, pkt_dev->vlan_p,
+                           pkt_dev->vlan_cfi);
 
-        if (pkt_dev->svlan_id != 0xffff) {
+        if (pkt_dev->svlan_id != 0xffff)
                 seq_printf(seq, "     svlan_id: %u  vlan_p: %u  vlan_cfi: %u\n",
-                           pkt_dev->svlan_id, pkt_dev->svlan_p, pkt_dev->svlan_cfi);
-        }
+                           pkt_dev->svlan_id, pkt_dev->svlan_p,
+                           pkt_dev->svlan_cfi);
 
-        if (pkt_dev->tos) {
+        if (pkt_dev->tos)
                 seq_printf(seq, "     tos: 0x%02x\n", pkt_dev->tos);
-        }
 
-        if (pkt_dev->traffic_class) {
+        if (pkt_dev->traffic_class)
                 seq_printf(seq, "     traffic_class: 0x%02x\n", pkt_dev->traffic_class);
-        }
 
         seq_printf(seq, "     Flags: ");
 
@@ -654,17 +661,21 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
 
         seq_puts(seq, "\n");
 
-        sa = pkt_dev->started_at;
-        stopped = pkt_dev->stopped_at;
-        if (pkt_dev->running)
-                stopped = now;  /* not really stopped, more like last-running-at */
+        /* not really stopped, more like last-running-at */
+        stopped = pkt_dev->running ? ktime_now() : pkt_dev->stopped_at;
+        idle = pkt_dev->idle_acc;
+        do_div(idle, NSEC_PER_USEC);
 
         seq_printf(seq,
-                   "Current:\n     pkts-sofar: %llu  errors: %llu\n     started: %lluus  stopped: %lluus idle: %lluus\n",
+                   "Current:\n     pkts-sofar: %llu  errors: %llu\n",
                    (unsigned long long)pkt_dev->sofar,
-                   (unsigned long long)pkt_dev->errors, (unsigned long long)sa,
-                   (unsigned long long)stopped,
-                   (unsigned long long)pkt_dev->idle_acc);
+                   (unsigned long long)pkt_dev->errors);
+
+        seq_printf(seq,
+                   "     started: %lluus  stopped: %lluus idle: %lluus\n",
+                   (unsigned long long) ktime_to_us(pkt_dev->started_at),
+                   (unsigned long long) ktime_to_us(stopped),
+                   (unsigned long long) idle);
 
         seq_printf(seq,
                    "     seq_num: %d  cur_dst_mac_offset: %d  cur_src_mac_offset: %d\n",
@@ -696,7 +707,8 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
 }
 
 
-static int hex32_arg(const char __user *user_buffer, unsigned long maxlen, __u32 *num)
+static int hex32_arg(const char __user *user_buffer, unsigned long maxlen,
+                     __u32 *num)
 {
         int i = 0;
         *num = 0;
@@ -846,9 +858,9 @@ static ssize_t pktgen_if_write(struct file *file,
         /* Read variable name */
 
         len = strn_len(&user_buffer[i], sizeof(name) - 1);
-        if (len < 0) {
+        if (len < 0)
                 return len;
-        }
+
         memset(name, 0, sizeof(name));
         if (copy_from_user(name, &user_buffer[i], len))
                 return -EFAULT;
@@ -872,9 +884,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "min_pkt_size")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value < 14 + 20 + 8)
                         value = 14 + 20 + 8;
@@ -889,9 +901,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "max_pkt_size")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value < 14 + 20 + 8)
                         value = 14 + 20 + 8;
@@ -908,9 +920,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "pkt_size")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value < 14 + 20 + 8)
                         value = 14 + 20 + 8;
@@ -925,9 +937,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "debug")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 debug = value;
                 sprintf(pg_result, "OK: debug=%u", debug);
@@ -936,9 +948,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "frags")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 pkt_dev->nfrags = value;
                 sprintf(pg_result, "OK: frags=%u", pkt_dev->nfrags);
@@ -946,26 +958,24 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "delay")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
-                if (value == 0x7FFFFFFF) {
-                        pkt_dev->delay_us = 0x7FFFFFFF;
-                        pkt_dev->delay_ns = 0;
-                } else {
-                        pkt_dev->delay_us = value / 1000;
-                        pkt_dev->delay_ns = value % 1000;
-                }
-                sprintf(pg_result, "OK: delay=%u",
-                        1000 * pkt_dev->delay_us + pkt_dev->delay_ns);
+                if (value == 0x7FFFFFFF)
+                        pkt_dev->delay = ULLONG_MAX;
+                else
+                        pkt_dev->delay = (u64)value * NSEC_PER_USEC;
+
+                sprintf(pg_result, "OK: delay=%llu",
+                        (unsigned long long) pkt_dev->delay);
                 return count;
         }
         if (!strcmp(name, "udp_src_min")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value != pkt_dev->udp_src_min) {
                         pkt_dev->udp_src_min = value;
@@ -976,9 +986,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "udp_dst_min")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value != pkt_dev->udp_dst_min) {
                         pkt_dev->udp_dst_min = value;
@@ -989,9 +999,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "udp_src_max")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value != pkt_dev->udp_src_max) {
                         pkt_dev->udp_src_max = value;
@@ -1002,9 +1012,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "udp_dst_max")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value != pkt_dev->udp_dst_max) {
                         pkt_dev->udp_dst_max = value;
@@ -1015,9 +1025,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "clone_skb")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 pkt_dev->clone_skb = value;
 
@@ -1026,9 +1036,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "count")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 pkt_dev->count = value;
                 sprintf(pg_result, "OK: count=%llu",
@@ -1037,9 +1047,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "src_mac_count")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (pkt_dev->src_mac_count != value) {
                         pkt_dev->src_mac_count = value;
@@ -1051,9 +1061,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "dst_mac_count")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (pkt_dev->dst_mac_count != value) {
                         pkt_dev->dst_mac_count = value;
@@ -1067,9 +1077,9 @@ static ssize_t pktgen_if_write(struct file *file,
                 char f[32];
                 memset(f, 0, 32);
                 len = strn_len(&user_buffer[i], sizeof(f) - 1);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 if (copy_from_user(f, &user_buffer[i], len))
                         return -EFAULT;
                 i += len;
@@ -1168,9 +1178,8 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "dst_min") || !strcmp(name, "dst")) {
                 len = strn_len(&user_buffer[i], sizeof(pkt_dev->dst_min) - 1);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
 
                 if (copy_from_user(buf, &user_buffer[i], len))
                         return -EFAULT;
@@ -1190,9 +1199,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "dst_max")) {
                 len = strn_len(&user_buffer[i], sizeof(pkt_dev->dst_max) - 1);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
 
                 if (copy_from_user(buf, &user_buffer[i], len))
                         return -EFAULT;
@@ -1303,9 +1312,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "src_min")) {
                 len = strn_len(&user_buffer[i], sizeof(pkt_dev->src_min) - 1);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 if (copy_from_user(buf, &user_buffer[i], len))
                         return -EFAULT;
                 buf[len] = 0;
@@ -1324,9 +1333,9 @@ static ssize_t pktgen_if_write(struct file *file,
         }
         if (!strcmp(name, "src_max")) {
                 len = strn_len(&user_buffer[i], sizeof(pkt_dev->src_max) - 1);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 if (copy_from_user(buf, &user_buffer[i], len))
                         return -EFAULT;
                 buf[len] = 0;
@@ -1350,9 +1359,9 @@ static ssize_t pktgen_if_write(struct file *file,
                 memcpy(old_dmac, pkt_dev->dst_mac, ETH_ALEN);
 
                 len = strn_len(&user_buffer[i], sizeof(valstr) - 1);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 memset(valstr, 0, sizeof(valstr));
                 if (copy_from_user(valstr, &user_buffer[i], len))
                         return -EFAULT;
@@ -1392,9 +1401,9 @@ static ssize_t pktgen_if_write(struct file *file,
                 memcpy(old_smac, pkt_dev->src_mac, ETH_ALEN);
 
                 len = strn_len(&user_buffer[i], sizeof(valstr) - 1);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 memset(valstr, 0, sizeof(valstr));
                 if (copy_from_user(valstr, &user_buffer[i], len))
                         return -EFAULT;
@@ -1435,9 +1444,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "flows")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value > MAX_CFLOWS)
                         value = MAX_CFLOWS;
@@ -1449,9 +1458,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "flowlen")) {
                 len = num_arg(&user_buffer[i], 10, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 pkt_dev->lflow = value;
                 sprintf(pg_result, "OK: flowlen=%u", pkt_dev->lflow);
@@ -1460,9 +1469,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "queue_map_min")) {
                 len = num_arg(&user_buffer[i], 5, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 pkt_dev->queue_map_min = value;
                 sprintf(pg_result, "OK: queue_map_min=%u", pkt_dev->queue_map_min);
@@ -1471,9 +1480,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "queue_map_max")) {
                 len = num_arg(&user_buffer[i], 5, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 pkt_dev->queue_map_max = value;
                 sprintf(pg_result, "OK: queue_map_max=%u", pkt_dev->queue_map_max);
@@ -1505,9 +1514,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "vlan_id")) {
                 len = num_arg(&user_buffer[i], 4, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (value <= 4095) {
                         pkt_dev->vlan_id = value;  /* turn on VLAN */
@@ -1532,9 +1541,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "vlan_p")) {
                 len = num_arg(&user_buffer[i], 1, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if ((value <= 7) && (pkt_dev->vlan_id != 0xffff)) {
                         pkt_dev->vlan_p = value;
@@ -1547,9 +1556,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "vlan_cfi")) {
                 len = num_arg(&user_buffer[i], 1, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if ((value <= 1) && (pkt_dev->vlan_id != 0xffff)) {
                         pkt_dev->vlan_cfi = value;
@@ -1562,9 +1571,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "svlan_id")) {
                 len = num_arg(&user_buffer[i], 4, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if ((value <= 4095) && ((pkt_dev->vlan_id != 0xffff))) {
                         pkt_dev->svlan_id = value;  /* turn on SVLAN */
@@ -1589,9 +1598,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "svlan_p")) {
                 len = num_arg(&user_buffer[i], 1, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if ((value <= 7) && (pkt_dev->svlan_id != 0xffff)) {
                         pkt_dev->svlan_p = value;
@@ -1604,9 +1613,9 @@ static ssize_t pktgen_if_write(struct file *file,
 
         if (!strcmp(name, "svlan_cfi")) {
                 len = num_arg(&user_buffer[i], 1, &value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if ((value <= 1) && (pkt_dev->svlan_id != 0xffff)) {
                         pkt_dev->svlan_cfi = value;
@@ -1620,9 +1629,9 @@ static ssize_t pktgen_if_write(struct file *file,
         if (!strcmp(name, "tos")) {
                 __u32 tmp_value = 0;
                 len = hex32_arg(&user_buffer[i], 2, &tmp_value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (len == 2) {
                         pkt_dev->tos = tmp_value;
@@ -1636,9 +1645,9 @@ static ssize_t pktgen_if_write(struct file *file,
         if (!strcmp(name, "traffic_class")) {
                 __u32 tmp_value = 0;
                 len = hex32_arg(&user_buffer[i], 2, &tmp_value);
-                if (len < 0) {
+                if (len < 0)
                         return len;
-                }
+
                 i += len;
                 if (len == 2) {
                         pkt_dev->traffic_class = tmp_value;
@@ -1670,7 +1679,7 @@ static const struct file_operations pktgen_if_fops = {
 static int pktgen_thread_show(struct seq_file *seq, void *v)
 {
         struct pktgen_thread *t = seq->private;
-        struct pktgen_dev *pkt_dev;
+        const struct pktgen_dev *pkt_dev;
 
         BUG_ON(!t);
 
@@ -1873,8 +1882,10 @@ static void pktgen_change_name(struct net_device *dev)
 
                         remove_proc_entry(pkt_dev->entry->name, pg_proc_dir);
 
-                        pkt_dev->entry = create_proc_entry(dev->name, 0600,
-                                                           pg_proc_dir);
+                        pkt_dev->entry = proc_create_data(dev->name, 0600,
+                                                          pg_proc_dir,
+                                                          &pktgen_if_fops,
+                                                          pkt_dev);
                         if (!pkt_dev->entry)
                                 printk(KERN_ERR "pktgen: can't move proc "
                                        " entry for '%s'\n", dev->name);
@@ -1908,13 +1919,14 @@ static int pktgen_device_event(struct notifier_block *unused,
         return NOTIFY_DONE;
 }
 
-static struct net_device *pktgen_dev_get_by_name(struct pktgen_dev *pkt_dev, const char *ifname)
+static struct net_device *pktgen_dev_get_by_name(struct pktgen_dev *pkt_dev,
+                                                 const char *ifname)
 {
         char b[IFNAMSIZ+5];
         int i = 0;
 
-        for(i=0; ifname[i] != '@'; i++) {
-                if(i == IFNAMSIZ)
+        for (i = 0; ifname[i] != '@'; i++) {
+                if (i == IFNAMSIZ)
                         break;
 
                 b[i] = ifname[i];
@@ -1981,7 +1993,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                 printk(KERN_WARNING "pktgen: WARNING: Requested "
                        "queue_map_min (zero-based) (%d) exceeds valid range "
                        "[0 - %d] for (%d) queues on %s, resetting\n",
-                       pkt_dev->queue_map_min, (ntxq ?: 1)- 1, ntxq,
+                       pkt_dev->queue_map_min, (ntxq ?: 1) - 1, ntxq,
                        pkt_dev->odev->name);
                 pkt_dev->queue_map_min = ntxq - 1;
         }
@@ -1989,7 +2001,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                 printk(KERN_WARNING "pktgen: WARNING: Requested "
                        "queue_map_max (zero-based) (%d) exceeds valid range "
                        "[0 - %d] for (%d) queues on %s, resetting\n",
-                       pkt_dev->queue_map_max, (ntxq ?: 1)- 1, ntxq,
+                       pkt_dev->queue_map_max, (ntxq ?: 1) - 1, ntxq,
                        pkt_dev->odev->name);
                 pkt_dev->queue_map_max = ntxq - 1;
         }
@@ -2030,7 +2042,8 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                          */
 
                         rcu_read_lock();
-                        if ((idev = __in6_dev_get(pkt_dev->odev)) != NULL) {
+                        idev = __in6_dev_get(pkt_dev->odev);
+                        if (idev) {
                                 struct inet6_ifaddr *ifp;
 
                                 read_lock_bh(&idev->lock);
@@ -2089,27 +2102,40 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
         pkt_dev->nflows = 0;
 }
 
-static void spin(struct pktgen_dev *pkt_dev, __u64 spin_until_us)
+
+static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
 {
-        __u64 start;
-        __u64 now;
+        ktime_t start;
+        s32 remaining;
+        struct hrtimer_sleeper t;
+
+        hrtimer_init_on_stack(&t.timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        hrtimer_set_expires(&t.timer, spin_until);
+
+        remaining = ktime_to_us(hrtimer_expires_remaining(&t.timer));
+        if (remaining <= 0)
+                return;
 
-        start = now = getCurUs();
-        while (now < spin_until_us) {
-                /* TODO: optimize sleeping behavior */
-                if (spin_until_us - now > jiffies_to_usecs(1) + 1)
-                        schedule_timeout_interruptible(1);
-                else if (spin_until_us - now > 100) {
-                        if (!pkt_dev->running)
-                                return;
-                        if (need_resched())
+        start = ktime_now();
+        if (remaining < 100)
+                udelay(remaining);      /* really small just spin */
+        else {
+                /* see do_nanosleep */
+                hrtimer_init_sleeper(&t, current);
+                do {
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        hrtimer_start_expires(&t.timer, HRTIMER_MODE_ABS);
+                        if (!hrtimer_active(&t.timer))
+                                t.task = NULL;
+
+                        if (likely(t.task))
                                 schedule();
-                }
 
-                now = getCurUs();
+                        hrtimer_cancel(&t.timer);
+                } while (t.task && pkt_dev->running && !signal_pending(current));
+                __set_current_state(TASK_RUNNING);
         }
-
-        pkt_dev->idle_acc += now - start;
+        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), start));
 }
 
 static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
@@ -2120,13 +2146,9 @@ static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
         pkt_dev->pkt_overhead += SVLAN_TAG_SIZE(pkt_dev);
 }
 
-static inline int f_seen(struct pktgen_dev *pkt_dev, int flow)
+static inline int f_seen(const struct pktgen_dev *pkt_dev, int flow)
 {
-
-        if (pkt_dev->flows[flow].flags & F_INIT)
-                return 1;
-        else
-                return 0;
+        return !!(pkt_dev->flows[flow].flags & F_INIT);
 }
 
 static inline int f_pick(struct pktgen_dev *pkt_dev)
@@ -2174,7 +2196,7 @@ static void get_ipsec_sa(struct pktgen_dev *pkt_dev, int flow)
                 if (x) {
                         pkt_dev->flows[flow].x = x;
                         set_pkt_overhead(pkt_dev);
-                        pkt_dev->pkt_overhead+=x->props.header_len;
+                        pkt_dev->pkt_overhead += x->props.header_len;
                 }
 
         }
@@ -2313,18 +2335,18 @@ static void mod_cur_headers(struct pktgen_dev *pkt_dev)
 
         if (!(pkt_dev->flags & F_IPV6)) {
 
-                if ((imn = ntohl(pkt_dev->saddr_min)) < (imx =
-                                                         ntohl(pkt_dev->
-                                                               saddr_max))) {
+                imn = ntohl(pkt_dev->saddr_min);
+                imx = ntohl(pkt_dev->saddr_max);
+                if (imn < imx) {
                         __u32 t;
                         if (pkt_dev->flags & F_IPSRC_RND)
                                 t = random32() % (imx - imn) + imn;
                         else {
                                 t = ntohl(pkt_dev->cur_saddr);
                                 t++;
-                                if (t > imx) {
+                                if (t > imx)
                                         t = imn;
-                                }
+
                         }
                         pkt_dev->cur_saddr = htonl(t);
                 }
@@ -2435,14 +2457,14 @@ static int pktgen_output_ipsec(struct sk_buff *skb, struct pktgen_dev *pkt_dev)
         if (err)
                 goto error;
 
-        x->curlft.bytes +=skb->len;
+        x->curlft.bytes += skb->len;
         x->curlft.packets++;
 error:
         spin_unlock(&x->lock);
         return err;
 }
 
-static inline void free_SAs(struct pktgen_dev *pkt_dev)
+static void free_SAs(struct pktgen_dev *pkt_dev)
 {
         if (pkt_dev->cflows) {
                 /* let go of the SAs if we have them */
@@ -2457,7 +2479,7 @@ static inline void free_SAs(struct pktgen_dev *pkt_dev)
         }
 }
 
-static inline int process_ipsec(struct pktgen_dev *pkt_dev,
+static int process_ipsec(struct pktgen_dev *pkt_dev,
                               struct sk_buff *skb, __be16 protocol)
 {
         if (pkt_dev->flags & F_IPSEC_ON) {
@@ -2467,11 +2489,11 @@ static inline int process_ipsec(struct pktgen_dev *pkt_dev,
                         int ret;
                         __u8 *eth;
                         nhead = x->props.header_len - skb_headroom(skb);
-                        if (nhead >0) {
+                        if (nhead > 0) {
                                 ret = pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
                                 if (ret < 0) {
                                         printk(KERN_ERR "Error expanding "
-                                               "ipsec packet %d\n",ret);
+                                               "ipsec packet %d\n", ret);
                                         goto err;
                                 }
                         }
@@ -2481,13 +2503,13 @@ static inline int process_ipsec(struct pktgen_dev *pkt_dev,
                         ret = pktgen_output_ipsec(skb, pkt_dev);
                         if (ret) {
                                 printk(KERN_ERR "Error creating ipsec "
-                                       "packet %d\n",ret);
+                                       "packet %d\n", ret);
                                 goto err;
                         }
                         /* restore ll */
                         eth = (__u8 *) skb_push(skb, ETH_HLEN);
                         memcpy(eth, pkt_dev->hh, 12);
-                        *(u16 *) & eth[12] = protocol;
+                        *(u16 *) &eth[12] = protocol;
                 }
         }
         return 1;
@@ -2500,9 +2522,9 @@ err:
 static void mpls_push(__be32 *mpls, struct pktgen_dev *pkt_dev)
 {
         unsigned i;
-        for (i = 0; i < pkt_dev->nr_labels; i++) {
+        for (i = 0; i < pkt_dev->nr_labels; i++)
                 *mpls++ = pkt_dev->labels[i] & ~MPLS_STACK_BOTTOM;
-        }
+
         mpls--;
         *mpls |= MPLS_STACK_BOTTOM;
 }
@@ -2543,8 +2565,9 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         mod_cur_headers(pkt_dev);
 
         datalen = (odev->hard_header_len + 16) & ~0xf;
-        skb = alloc_skb(pkt_dev->cur_pkt_size + 64 + datalen +
-                        pkt_dev->pkt_overhead, GFP_ATOMIC);
+        skb = __netdev_alloc_skb(odev,
+                                 pkt_dev->cur_pkt_size + 64
+                                 + datalen + pkt_dev->pkt_overhead, GFP_NOWAIT);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
                 return NULL;
@@ -2668,8 +2691,9 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
                 }
         }
 
-        /* Stamp the time, and sequence number, convert them to network byte order */
-
+        /* Stamp the time, and sequence number,
+         * convert them to network byte order
+         */
         if (pgh) {
                 struct timeval timestamp;
 
@@ -2882,8 +2906,9 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         queue_map = pkt_dev->cur_queue_map;
         mod_cur_headers(pkt_dev);
 
-        skb = alloc_skb(pkt_dev->cur_pkt_size + 64 + 16 +
-                        pkt_dev->pkt_overhead, GFP_ATOMIC);
+        skb = __netdev_alloc_skb(odev,
+                                 pkt_dev->cur_pkt_size + 64
+                                 + 16 + pkt_dev->pkt_overhead, GFP_NOWAIT);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
                 return NULL;
@@ -2922,7 +2947,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         udph = udp_hdr(skb);
 
         memcpy(eth, pkt_dev->hh, 12);
-        *(__be16 *) & eth[12] = protocol;
+        *(__be16 *) &eth[12] = protocol;
 
         /* Eth + IPh + UDPh + mpls */
         datalen = pkt_dev->cur_pkt_size - 14 -
@@ -3016,8 +3041,10 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                 }
         }
 
-        /* Stamp the time, and sequence number, convert them to network byte order */
-        /* should we update cloned packets too ? */
+        /* Stamp the time, and sequence number,
+         * convert them to network byte order
+         * should we update cloned packets too ?
+         */
         if (pgh) {
                 struct timeval timestamp;
 
@@ -3033,8 +3060,8 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         return skb;
 }
 
-static inline struct sk_buff *fill_packet(struct net_device *odev,
-                                          struct pktgen_dev *pkt_dev)
+static struct sk_buff *fill_packet(struct net_device *odev,
+                                   struct pktgen_dev *pkt_dev)
 {
         if (pkt_dev->flags & F_IPV6)
                 return fill_packet_ipv6(odev, pkt_dev);
@@ -3072,9 +3099,9 @@ static void pktgen_run(struct pktgen_thread *t)
                         pktgen_clear_counters(pkt_dev);
                         pkt_dev->running = 1;   /* Cranke yeself! */
                         pkt_dev->skb = NULL;
-                        pkt_dev->started_at = getCurUs();
-                        pkt_dev->next_tx_us = getCurUs();       /* Transmit immediately */
-                        pkt_dev->next_tx_ns = 0;
+                        pkt_dev->started_at =
+                                pkt_dev->next_tx = ktime_now();
+
                         set_pkt_overhead(pkt_dev);
 
                         strcpy(pkt_dev->result, "Starting");
@@ -3101,17 +3128,14 @@ static void pktgen_stop_all_threads_ifs(void)
         mutex_unlock(&pktgen_thread_lock);
 }
 
-static int thread_is_running(struct pktgen_thread *t)
+static int thread_is_running(const struct pktgen_thread *t)
 {
-        struct pktgen_dev *pkt_dev;
-        int res = 0;
+        const struct pktgen_dev *pkt_dev;
 
         list_for_each_entry(pkt_dev, &t->if_list, list)
-                if (pkt_dev->running) {
-                        res = 1;
-                        break;
-                }
-        return res;
+                if (pkt_dev->running)
+                        return 1;
+        return 0;
 }
 
 static int pktgen_wait_thread_run(struct pktgen_thread *t)
@@ -3168,7 +3192,8 @@ static void pktgen_run_all_threads(void)
 
         mutex_unlock(&pktgen_thread_lock);
 
-        schedule_timeout_interruptible(msecs_to_jiffies(125));  /* Propagate thread->control  */
+        /* Propagate thread->control  */
+        schedule_timeout_interruptible(msecs_to_jiffies(125));
 
         pktgen_wait_all_threads_run();
 }
@@ -3186,35 +3211,29 @@ static void pktgen_reset_all_threads(void)
 
         mutex_unlock(&pktgen_thread_lock);
 
-        schedule_timeout_interruptible(msecs_to_jiffies(125));  /* Propagate thread->control  */
+        /* Propagate thread->control  */
+        schedule_timeout_interruptible(msecs_to_jiffies(125));
 
         pktgen_wait_all_threads_run();
 }
 
 static void show_results(struct pktgen_dev *pkt_dev, int nr_frags)
 {
-        __u64 total_us, bps, mbps, pps, idle;
+        __u64 bps, mbps, pps;
         char *p = pkt_dev->result;
-
-        total_us = pkt_dev->stopped_at - pkt_dev->started_at;
-
-        idle = pkt_dev->idle_acc;
-
-        p += sprintf(p, "OK: %llu(c%llu+d%llu) usec, %llu (%dbyte,%dfrags)\n",
-                     (unsigned long long)total_us,
-                     (unsigned long long)(total_us - idle),
-                     (unsigned long long)idle,
+        ktime_t elapsed = ktime_sub(pkt_dev->stopped_at,
+                                    pkt_dev->started_at);
+        ktime_t idle = ns_to_ktime(pkt_dev->idle_acc);
+
+        p += sprintf(p, "OK: %llu(c%llu+d%llu) nsec, %llu (%dbyte,%dfrags)\n",
+                     (unsigned long long)ktime_to_us(elapsed),
+                     (unsigned long long)ktime_to_us(ktime_sub(elapsed, idle)),
+                     (unsigned long long)ktime_to_us(idle),
                      (unsigned long long)pkt_dev->sofar,
                      pkt_dev->cur_pkt_size, nr_frags);
 
-        pps = pkt_dev->sofar * USEC_PER_SEC;
-
-        while ((total_us >> 32) != 0) {
-                pps >>= 1;
-                total_us >>= 1;
-        }
-
-        do_div(pps, total_us);
+        pps = div64_u64(pkt_dev->sofar * NSEC_PER_SEC,
+                        ktime_to_ns(elapsed));
 
         bps = pps * 8 * pkt_dev->cur_pkt_size;
 
@@ -3228,7 +3247,6 @@ static void show_results(struct pktgen_dev *pkt_dev, int nr_frags)
 }
 
 /* Set stopped-at timer, remove from running list, do counters & statistics */
-
 static int pktgen_stop_device(struct pktgen_dev *pkt_dev)
 {
         int nr_frags = pkt_dev->skb ? skb_shinfo(pkt_dev->skb)->nr_frags : -1;
@@ -3239,7 +3257,9 @@ static int pktgen_stop_device(struct pktgen_dev *pkt_dev)
                 return -EINVAL;
         }
 
-        pkt_dev->stopped_at = getCurUs();
+        kfree_skb(pkt_dev->skb);
+        pkt_dev->skb = NULL;
+        pkt_dev->stopped_at = ktime_now();
         pkt_dev->running = 0;
 
         show_results(pkt_dev, nr_frags);
@@ -3258,7 +3278,7 @@ static struct pktgen_dev *next_to_run(struct pktgen_thread *t)
                         continue;
                 if (best == NULL)
                         best = pkt_dev;
-                else if (pkt_dev->next_tx_us < best->next_tx_us)
+                else if (ktime_lt(pkt_dev->next_tx, best->next_tx))
                         best = pkt_dev;
         }
         if_unlock(t);
@@ -3275,9 +3295,6 @@ static void pktgen_stop(struct pktgen_thread *t)
 
         list_for_each_entry(pkt_dev, &t->if_list, list) {
                 pktgen_stop_device(pkt_dev);
-                kfree_skb(pkt_dev->skb);
-
-                pkt_dev->skb = NULL;
         }
 
         if_unlock(t);
@@ -3348,30 +3365,37 @@ static void pktgen_rem_thread(struct pktgen_thread *t)
         mutex_unlock(&pktgen_thread_lock);
 }
 
-static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
+static void idle(struct pktgen_dev *pkt_dev)
+{
+        ktime_t idle_start = ktime_now();
+
+        if (need_resched())
+                schedule();
+        else
+                cpu_relax();
+
+        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), idle_start));
+}
+
+
+static void pktgen_xmit(struct pktgen_dev *pkt_dev)
 {
         struct net_device *odev = pkt_dev->odev;
-        int (*xmit)(struct sk_buff *, struct net_device *)
+        netdev_tx_t (*xmit)(struct sk_buff *, struct net_device *)
                 = odev->netdev_ops->ndo_start_xmit;
         struct netdev_queue *txq;
-        __u64 idle_start = 0;
         u16 queue_map;
         int ret;
 
-        if (pkt_dev->delay_us || pkt_dev->delay_ns) {
-                u64 now;
-
-                now = getCurUs();
-                if (now < pkt_dev->next_tx_us)
-                        spin(pkt_dev, pkt_dev->next_tx_us);
+        if (pkt_dev->delay) {
+                spin(pkt_dev, pkt_dev->next_tx);
 
                 /* This is max DELAY, this has special meaning of
                  * "never transmit"
                  */
-                if (pkt_dev->delay_us == 0x7FFFFFFF) {
-                        pkt_dev->next_tx_us = getCurUs() + pkt_dev->delay_us;
-                        pkt_dev->next_tx_ns = pkt_dev->delay_ns;
-                        goto out;
+                if (pkt_dev->delay == ULLONG_MAX) {
+                        pkt_dev->next_tx = ktime_add_ns(ktime_now(), ULONG_MAX);
+                        return;
                 }
         }
 
@@ -3383,47 +3407,32 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
         }
 
         txq = netdev_get_tx_queue(odev, queue_map);
-        if (netif_tx_queue_stopped(txq) ||
-            netif_tx_queue_frozen(txq) ||
-            need_resched()) {
-                idle_start = getCurUs();
-
-                if (!netif_running(odev)) {
+        /* Did we saturate the queue already? */
+        if (netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)) {
+                /* If device is down, then all queues are permnantly frozen */
+                if (netif_running(odev))
+                        idle(pkt_dev);
+                else
                         pktgen_stop_device(pkt_dev);
-                        kfree_skb(pkt_dev->skb);
-                        pkt_dev->skb = NULL;
-                        goto out;
-                }
-                if (need_resched())
-                        schedule();
-
-                pkt_dev->idle_acc += getCurUs() - idle_start;
-
-                if (netif_tx_queue_stopped(txq) ||
-                    netif_tx_queue_frozen(txq)) {
-                        pkt_dev->next_tx_us = getCurUs();       /* TODO */
-                        pkt_dev->next_tx_ns = 0;
-                        goto out;       /* Try the next interface */
-                }
+                return;
         }
 
-        if (pkt_dev->last_ok || !pkt_dev->skb) {
-                if ((++pkt_dev->clone_count >= pkt_dev->clone_skb)
-                    || (!pkt_dev->skb)) {
-                        /* build a new pkt */
-                        kfree_skb(pkt_dev->skb);
+        if (!pkt_dev->skb || (pkt_dev->last_ok &&
+                              ++pkt_dev->clone_count >= pkt_dev->clone_skb)) {
+                /* build a new pkt */
+                kfree_skb(pkt_dev->skb);
 
-                        pkt_dev->skb = fill_packet(odev, pkt_dev);
-                        if (pkt_dev->skb == NULL) {
-                                printk(KERN_ERR "pktgen: ERROR: couldn't "
-                                       "allocate skb in fill_packet.\n");
-                                schedule();
-                                pkt_dev->clone_count--; /* back out increment, OOM */
-                                goto out;
-                        }
-                        pkt_dev->allocated_skbs++;
-                        pkt_dev->clone_count = 0;       /* reset counter */
+                pkt_dev->skb = fill_packet(odev, pkt_dev);
+                if (pkt_dev->skb == NULL) {
+                        printk(KERN_ERR "pktgen: ERROR: couldn't "
+                               "allocate skb in fill_packet.\n");
+                        schedule();
+                        pkt_dev->clone_count--; /* back out increment, OOM */
+                        return;
                 }
+
+                pkt_dev->allocated_skbs++;
+                pkt_dev->clone_count = 0;       /* reset counter */
         }
 
         /* fill_packet() might have changed the queue */
@@ -3431,73 +3440,53 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
         txq = netdev_get_tx_queue(odev, queue_map);
 
         __netif_tx_lock_bh(txq);
-        if (!netif_tx_queue_stopped(txq) &&
-            !netif_tx_queue_frozen(txq)) {
-
+        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)))
+                pkt_dev->last_ok = 0;
+        else {
                 atomic_inc(&(pkt_dev->skb->users));
-              retry_now:
+
+        retry_now:
                 ret = (*xmit)(pkt_dev->skb, odev);
-                if (likely(ret == NETDEV_TX_OK)) {
+                switch (ret) {
+                case NETDEV_TX_OK:
                         txq_trans_update(txq);
                         pkt_dev->last_ok = 1;
                         pkt_dev->sofar++;
                         pkt_dev->seq_num++;
                         pkt_dev->tx_bytes += pkt_dev->cur_pkt_size;
-
-                } else if (ret == NETDEV_TX_LOCKED
-                           && (odev->features & NETIF_F_LLTX)) {
+                        break;
+                case NETDEV_TX_LOCKED:
                         cpu_relax();
                         goto retry_now;
-                } else {        /* Retry it next time */
-
-                        atomic_dec(&(pkt_dev->skb->users));
-
-                        if (debug && net_ratelimit())
-                                printk(KERN_INFO "pktgen: Hard xmit error\n");
-
+                default: /* Drivers are not supposed to return other values! */
+                        if (net_ratelimit())
+                                pr_info("pktgen: %s xmit error: %d\n",
+                                        odev->name, ret);
                         pkt_dev->errors++;
+                        /* fallthru */
+                case NETDEV_TX_BUSY:
+                        /* Retry it next time */
+                        atomic_dec(&(pkt_dev->skb->users));
                         pkt_dev->last_ok = 0;
                 }
 
-                pkt_dev->next_tx_us = getCurUs();
-                pkt_dev->next_tx_ns = 0;
-
-                pkt_dev->next_tx_us += pkt_dev->delay_us;
-                pkt_dev->next_tx_ns += pkt_dev->delay_ns;
-
-                if (pkt_dev->next_tx_ns > 1000) {
-                        pkt_dev->next_tx_us++;
-                        pkt_dev->next_tx_ns -= 1000;
-                }
+                if (pkt_dev->delay)
+                        pkt_dev->next_tx = ktime_add_ns(ktime_now(),
+                                                        pkt_dev->delay);
         }
-
-        else {                  /* Retry it next time */
-                pkt_dev->last_ok = 0;
-                pkt_dev->next_tx_us = getCurUs();       /* TODO */
-                pkt_dev->next_tx_ns = 0;
-        }
-
         __netif_tx_unlock_bh(txq);
 
         /* If pkt_dev->count is zero, then run forever */
         if ((pkt_dev->count != 0) && (pkt_dev->sofar >= pkt_dev->count)) {
-                if (atomic_read(&(pkt_dev->skb->users)) != 1) {
-                        idle_start = getCurUs();
-                        while (atomic_read(&(pkt_dev->skb->users)) != 1) {
-                                if (signal_pending(current)) {
-                                        break;
-                                }
-                                schedule();
-                        }
-                        pkt_dev->idle_acc += getCurUs() - idle_start;
+                while (atomic_read(&(pkt_dev->skb->users)) != 1) {
+                        if (signal_pending(current))
+                                break;
+                        idle(pkt_dev);
                 }
 
                 /* Done with this */
                 pktgen_stop_device(pkt_dev);
-                kfree_skb(pkt_dev->skb);
-                pkt_dev->skb = NULL;
         }
-out:;
 }
 
 /*
@@ -3516,7 +3505,8 @@ static int pktgen_thread_worker(void *arg)
         init_waitqueue_head(&t->queue);
         complete(&t->start_done);
 
-        pr_debug("pktgen: starting pktgen/%d:  pid=%d\n", cpu, task_pid_nr(current));
+        pr_debug("pktgen: starting pktgen/%d:  pid=%d\n",
+                 cpu, task_pid_nr(current));
 
         set_current_state(TASK_INTERRUPTIBLE);
 
@@ -3651,8 +3641,7 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         pkt_dev->max_pkt_size = ETH_ZLEN;
         pkt_dev->nfrags = 0;
         pkt_dev->clone_skb = pg_clone_skb_d;
-        pkt_dev->delay_us = pg_delay_d / 1000;
-        pkt_dev->delay_ns = pg_delay_d % 1000;
+        pkt_dev->delay = pg_delay_d;
         pkt_dev->count = pg_count_d;
         pkt_dev->sofar = 0;
         pkt_dev->udp_src_min = 9;       /* sink port */
@@ -3864,10 +3853,15 @@ static void __exit pg_cleanup(void)
 module_init(pg_init);
 module_exit(pg_cleanup);
 
-MODULE_AUTHOR("Robert Olsson <robert.olsson@its.uu.se");
+MODULE_AUTHOR("Robert Olsson <robert.olsson@its.uu.se>");
 MODULE_DESCRIPTION("Packet Generator tool");
 MODULE_LICENSE("GPL");
+MODULE_VERSION(VERSION);
 module_param(pg_count_d, int, 0);
+MODULE_PARM_DESC(pg_count_d, "Default number of packets to inject");
 module_param(pg_delay_d, int, 0);
+MODULE_PARM_DESC(pg_delay_d, "Default delay between packets (nanoseconds)");
 module_param(pg_clone_skb_d, int, 0);
+MODULE_PARM_DESC(pg_clone_skb_d, "Default number of copies of the same packet");
 module_param(debug, int, 0);
+MODULE_PARM_DESC(debug, "Enable debugging of pktgen module");
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b44775f9f2bf..eb42873f2a3a 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -606,7 +606,6 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                             int type, u32 pid, u32 seq, u32 change,
                             unsigned int flags)
 {
-        struct netdev_queue *txq;
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
         const struct net_device_stats *stats;
@@ -637,9 +636,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         if (dev->master)
                 NLA_PUT_U32(skb, IFLA_MASTER, dev->master->ifindex);
 
-        txq = netdev_get_tx_queue(dev, 0);
-        if (txq->qdisc_sleeping)
-                NLA_PUT_STRING(skb, IFLA_QDISC, txq->qdisc_sleeping->ops->id);
+        if (dev->qdisc)
+                NLA_PUT_STRING(skb, IFLA_QDISC, dev->qdisc->ops->id);
 
         if (dev->ifalias)
                 NLA_PUT_STRING(skb, IFLA_IFALIAS, dev->ifalias);
@@ -974,12 +972,20 @@ struct net_device *rtnl_create_link(struct net *net, char *ifname,
 {
         int err;
         struct net_device *dev;
+        unsigned int num_queues = 1;
+        unsigned int real_num_queues = 1;
 
+        if (ops->get_tx_queues) {
+                err = ops->get_tx_queues(net, tb, &num_queues, &real_num_queues);
+                if (err)
+                        goto err;
+        }
         err = -ENOMEM;
-        dev = alloc_netdev(ops->priv_size, ifname, ops->setup);
+        dev = alloc_netdev_mq(ops->priv_size, ifname, ops->setup, num_queues);
         if (!dev)
                 goto err;
 
+        dev->real_num_tx_queues = real_num_queues;
         if (strchr(dev->name, '%')) {
                 err = dev_alloc_name(dev, dev->name);
                 if (err < 0)
diff --git a/net/core/sock.c b/net/core/sock.c
index 3ac34ea6ec05..30d5446512f9 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1035,6 +1035,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
                 sk->sk_prot = sk->sk_prot_creator = prot;
                 sock_lock_init(sk);
                 sock_net_set(sk, get_net(net));
+                atomic_set(&sk->sk_wmem_alloc, 1);
         }
 
         return sk;
@@ -1882,7 +1883,6 @@ void sock_init_data(struct socket *sock, struct sock *sk)
          */
         smp_wmb();
         atomic_set(&sk->sk_refcnt, 1);
-        atomic_set(&sk->sk_wmem_alloc, 1);
         atomic_set(&sk->sk_drops, 0);
 }
 EXPORT_SYMBOL(sock_init_data);
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 8379496de82b..e0879bfb7dd5 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -64,6 +64,7 @@ static struct nla_policy dcbnl_rtnl_policy[DCB_ATTR_MAX + 1] = {
         [DCB_ATTR_CAP]         = {.type = NLA_NESTED},
         [DCB_ATTR_PFC_STATE]   = {.type = NLA_U8},
         [DCB_ATTR_BCN]         = {.type = NLA_NESTED},
+        [DCB_ATTR_APP]         = {.type = NLA_NESTED},
 };
 
 /* DCB priority flow control to User Priority nested attributes */
@@ -158,6 +159,13 @@ static struct nla_policy dcbnl_bcn_nest[DCB_BCN_ATTR_MAX + 1] = {
         [DCB_BCN_ATTR_ALL]          = {.type = NLA_FLAG},
 };
 
+/* DCB APP nested attributes. */
+static struct nla_policy dcbnl_app_nest[DCB_APP_ATTR_MAX + 1] = {
+        [DCB_APP_ATTR_IDTYPE]       = {.type = NLA_U8},
+        [DCB_APP_ATTR_ID]           = {.type = NLA_U16},
+        [DCB_APP_ATTR_PRIORITY]     = {.type = NLA_U8},
+};
+
 /* standard netlink reply call */
 static int dcbnl_reply(u8 value, u8 event, u8 cmd, u8 attr, u32 pid,
                        u32 seq, u16 flags)
@@ -536,6 +544,120 @@ static int dcbnl_setpfcstate(struct net_device *netdev, struct nlattr **tb,
         return ret;
 }
 
+static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
+                        u32 pid, u32 seq, u16 flags)
+{
+        struct sk_buff *dcbnl_skb;
+        struct nlmsghdr *nlh;
+        struct dcbmsg *dcb;
+        struct nlattr *app_nest;
+        struct nlattr *app_tb[DCB_APP_ATTR_MAX + 1];
+        u16 id;
+        u8 up, idtype;
+        int ret = -EINVAL;
+
+        if (!tb[DCB_ATTR_APP] || !netdev->dcbnl_ops->getapp)
+                goto out;
+
+        ret = nla_parse_nested(app_tb, DCB_APP_ATTR_MAX, tb[DCB_ATTR_APP],
+                               dcbnl_app_nest);
+        if (ret)
+                goto out;
+
+        ret = -EINVAL;
+        /* all must be non-null */
+        if ((!app_tb[DCB_APP_ATTR_IDTYPE]) ||
+            (!app_tb[DCB_APP_ATTR_ID]))
+                goto out;
+
+        /* either by eth type or by socket number */
+        idtype = nla_get_u8(app_tb[DCB_APP_ATTR_IDTYPE]);
+        if ((idtype != DCB_APP_IDTYPE_ETHTYPE) &&
+            (idtype != DCB_APP_IDTYPE_PORTNUM))
+                goto out;
+
+        id = nla_get_u16(app_tb[DCB_APP_ATTR_ID]);
+        up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+
+        /* send this back */
+        dcbnl_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!dcbnl_skb)
+                goto out;
+
+        nlh = NLMSG_NEW(dcbnl_skb, pid, seq, RTM_GETDCB, sizeof(*dcb), flags);
+        dcb = NLMSG_DATA(nlh);
+        dcb->dcb_family = AF_UNSPEC;
+        dcb->cmd = DCB_CMD_GAPP;
+
+        app_nest = nla_nest_start(dcbnl_skb, DCB_ATTR_APP);
+        ret = nla_put_u8(dcbnl_skb, DCB_APP_ATTR_IDTYPE, idtype);
+        if (ret)
+                goto out_cancel;
+
+        ret = nla_put_u16(dcbnl_skb, DCB_APP_ATTR_ID, id);
+        if (ret)
+                goto out_cancel;
+
+        ret = nla_put_u8(dcbnl_skb, DCB_APP_ATTR_PRIORITY, up);
+        if (ret)
+                goto out_cancel;
+
+        nla_nest_end(dcbnl_skb, app_nest);
+        nlmsg_end(dcbnl_skb, nlh);
+
+        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
+        if (ret)
+                goto nlmsg_failure;
+
+        goto out;
+
+out_cancel:
+        nla_nest_cancel(dcbnl_skb, app_nest);
+nlmsg_failure:
+        kfree_skb(dcbnl_skb);
+out:
+        return ret;
+}
+
+static int dcbnl_setapp(struct net_device *netdev, struct nlattr **tb,
+                        u32 pid, u32 seq, u16 flags)
+{
+        int ret = -EINVAL;
+        u16 id;
+        u8 up, idtype;
+        struct nlattr *app_tb[DCB_APP_ATTR_MAX + 1];
+
+        if (!tb[DCB_ATTR_APP] || !netdev->dcbnl_ops->setapp)
+                goto out;
+
+        ret = nla_parse_nested(app_tb, DCB_APP_ATTR_MAX, tb[DCB_ATTR_APP],
+                               dcbnl_app_nest);
+        if (ret)
+                goto out;
+
+        ret = -EINVAL;
+        /* all must be non-null */
+        if ((!app_tb[DCB_APP_ATTR_IDTYPE]) ||
+            (!app_tb[DCB_APP_ATTR_ID]) ||
+            (!app_tb[DCB_APP_ATTR_PRIORITY]))
+                goto out;
+
+        /* either by eth type or by socket number */
+        idtype = nla_get_u8(app_tb[DCB_APP_ATTR_IDTYPE]);
+        if ((idtype != DCB_APP_IDTYPE_ETHTYPE) &&
+            (idtype != DCB_APP_IDTYPE_PORTNUM))
+                goto out;
+
+        id = nla_get_u16(app_tb[DCB_APP_ATTR_ID]);
+        up = nla_get_u8(app_tb[DCB_APP_ATTR_PRIORITY]);
+
+        ret = dcbnl_reply(netdev->dcbnl_ops->setapp(netdev, idtype, id, up),
+                          RTM_SETDCB, DCB_CMD_SAPP, DCB_ATTR_APP,
+                          pid, seq, flags);
+out:
+        return ret;
+}
+
 static int __dcbnl_pg_getcfg(struct net_device *netdev, struct nlattr **tb,
                              u32 pid, u32 seq, u16 flags, int dir)
 {
@@ -1093,6 +1215,14 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 ret = dcbnl_bcn_setcfg(netdev, tb, pid, nlh->nlmsg_seq,
                                        nlh->nlmsg_flags);
                 goto out;
+        case DCB_CMD_GAPP:
+                ret = dcbnl_getapp(netdev, tb, pid, nlh->nlmsg_seq,
+                                   nlh->nlmsg_flags);
+                goto out;
+        case DCB_CMD_SAPP:
+                ret = dcbnl_setapp(netdev, tb, pid, nlh->nlmsg_seq,
+                                   nlh->nlmsg_flags);
+                goto out;
         default:
                 goto errout;
         }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index a0a36c9e6cce..d01c00de1ad0 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -880,7 +880,7 @@ discard_and_relse:
         goto discard_it;
 }
 
-static struct inet_connection_sock_af_ops dccp_ipv4_af_ops = {
+static const struct inet_connection_sock_af_ops dccp_ipv4_af_ops = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = dccp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 3e70faab2989..64f011cc4491 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -35,8 +35,8 @@
 
 /* The per-net dccp.v6_ctl_sk is used for sending RSTs and ACKs */
 
-static struct inet_connection_sock_af_ops dccp_ipv6_mapped;
-static struct inet_connection_sock_af_ops dccp_ipv6_af_ops;
+static const struct inet_connection_sock_af_ops dccp_ipv6_mapped;
+static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops;
 
 static void dccp_v6_hash(struct sock *sk)
 {
@@ -1055,7 +1055,7 @@ failure:
         return err;
 }
 
-static struct inet_connection_sock_af_ops dccp_ipv6_af_ops = {
+static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = dccp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
@@ -1076,7 +1076,7 @@ static struct inet_connection_sock_af_ops dccp_ipv6_af_ops = {
 /*
  *      DCCP over IPv4 via INET6 API
  */
-static struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
+static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = dccp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 37b3b4293ef4..923db06c7e55 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1066,7 +1066,7 @@ static int __init dccp_init(void)
                        (dccp_hashinfo.ehash_size - 1))
                         dccp_hashinfo.ehash_size--;
                 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
-                        __get_free_pages(GFP_ATOMIC, ehash_order);
+                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
         } while (!dccp_hashinfo.ehash && --ehash_order > 0);
 
         if (!dccp_hashinfo.ehash) {
@@ -1091,7 +1091,7 @@ static int __init dccp_init(void)
                     bhash_order > 0)
                         continue;
                 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
-                        __get_free_pages(GFP_ATOMIC, bhash_order);
+                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
         } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
 
         if (!dccp_hashinfo.bhash) {
@@ -1159,6 +1159,7 @@ static void __exit dccp_fini(void)
         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
         dccp_ackvec_exit();
         dccp_sysctl_exit();
+        percpu_counter_destroy(&dccp_orphan_count);
 }
 
 module_init(dccp_init);
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index 923786bd6d01..794b5bf95af1 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -59,7 +59,7 @@ static int dn_phase3_output(struct sk_buff *);
 /*
  * For talking to broadcast devices: Ethernet & PPP
  */
-static struct neigh_ops dn_long_ops = {
+static const struct neigh_ops dn_long_ops = {
         .family =               AF_DECnet,
         .error_report =         dn_long_error_report,
         .output =               dn_long_output,
@@ -71,7 +71,7 @@ static struct neigh_ops dn_long_ops = {
 /*
  * For talking to pointopoint and multidrop devices: DDCMP and X.25
  */
-static struct neigh_ops dn_short_ops = {
+static const struct neigh_ops dn_short_ops = {
         .family =               AF_DECnet,
         .error_report =         dn_short_error_report,
         .output =               dn_short_output,
@@ -83,7 +83,7 @@ static struct neigh_ops dn_short_ops = {
 /*
  * For talking to DECnet phase III nodes
  */
-static struct neigh_ops dn_phase3_ops = {
+static const struct neigh_ops dn_phase3_ops = {
         .family =               AF_DECnet,
         .error_report =         dn_short_error_report, /* Can use short version here */
         .output =               dn_phase3_output,
diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
index 41055f33d28a..4b0ea0540442 100644
--- a/net/dsa/dsa_priv.h
+++ b/net/dsa/dsa_priv.h
@@ -169,13 +169,13 @@ struct net_device *dsa_slave_create(struct dsa_switch *ds,
                                     int port, char *name);
 
 /* tag_dsa.c */
-int dsa_xmit(struct sk_buff *skb, struct net_device *dev);
+netdev_tx_t dsa_xmit(struct sk_buff *skb, struct net_device *dev);
 
 /* tag_edsa.c */
-int edsa_xmit(struct sk_buff *skb, struct net_device *dev);
+netdev_tx_t edsa_xmit(struct sk_buff *skb, struct net_device *dev);
 
 /* tag_trailer.c */
-int trailer_xmit(struct sk_buff *skb, struct net_device *dev);
+netdev_tx_t trailer_xmit(struct sk_buff *skb, struct net_device *dev);
 
 
 #endif
diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c
index 8fa25bafe6ca..cdf2d28a0297 100644
--- a/net/dsa/tag_dsa.c
+++ b/net/dsa/tag_dsa.c
@@ -15,7 +15,7 @@
 
 #define DSA_HLEN        4
 
-int dsa_xmit(struct sk_buff *skb, struct net_device *dev)
+netdev_tx_t dsa_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct dsa_slave_priv *p = netdev_priv(dev);
         u8 *dsa_header;
diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c
index 815607bd286f..8f53948cff4f 100644
--- a/net/dsa/tag_edsa.c
+++ b/net/dsa/tag_edsa.c
@@ -16,7 +16,7 @@
 #define DSA_HLEN        4
 #define EDSA_HLEN       8
 
-int edsa_xmit(struct sk_buff *skb, struct net_device *dev)
+netdev_tx_t edsa_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct dsa_slave_priv *p = netdev_priv(dev);
         u8 *edsa_header;
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index 1c3e30c38b86..a85c829853c0 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -13,7 +13,7 @@
 #include <linux/netdevice.h>
 #include "dsa_priv.h"
 
-int trailer_xmit(struct sk_buff *skb, struct net_device *dev)
+netdev_tx_t trailer_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct dsa_slave_priv *p = netdev_priv(dev);
         struct sk_buff *nskb;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index e114da7ca9b8..0e0254fd767d 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -520,6 +520,7 @@ static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
         if (peer)
                 return -EOPNOTSUPP;
 
+        memset(sec, 0, sizeof(*sec));
         mutex_lock(&econet_mutex);
 
         sk = sock->sk;
diff --git a/net/ieee802154/Makefile b/net/ieee802154/Makefile
index f99338a26100..4068a9f5113e 100644
--- a/net/ieee802154/Makefile
+++ b/net/ieee802154/Makefile
@@ -1,4 +1,4 @@
-obj-$(CONFIG_IEEE802154) +=     nl802154.o af_802154.o
+obj-$(CONFIG_IEEE802154) +=     nl802154.o af_802154.o wpan-class.o
 nl802154-y              := netlink.o nl_policy.o
 af_802154-y             := af_ieee802154.o raw.o dgram.o
 
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 69c8d9207aa7..cd949d5e451b 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -136,7 +136,7 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
                 unsigned int cmd)
 {
         struct ifreq ifr;
-        int ret = -EINVAL;
+        int ret = -ENOIOCTLCMD;
         struct net_device *dev;
 
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
@@ -146,8 +146,8 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
 
         dev_load(sock_net(sk), ifr.ifr_name);
         dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
-        if (dev->type == ARPHRD_IEEE802154 ||
-            dev->type == ARPHRD_IEEE802154_PHY)
+
+        if (dev->type == ARPHRD_IEEE802154 && dev->netdev_ops->ndo_do_ioctl)
                 ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
 
         if (!ret && copy_to_user(arg, &ifr, sizeof(struct ifreq)))
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 53dd912d52b4..77ae6852b93d 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -40,9 +40,11 @@ static DEFINE_RWLOCK(dgram_lock);
 struct dgram_sock {
         struct sock sk;
 
-        int bound;
         struct ieee802154_addr src_addr;
         struct ieee802154_addr dst_addr;
+
+        unsigned bound:1;
+        unsigned want_ack:1;
 };
 
 static inline struct dgram_sock *dgram_sk(const struct sock *sk)
@@ -50,7 +52,6 @@ static inline struct dgram_sock *dgram_sk(const struct sock *sk)
         return container_of(sk, struct dgram_sock, sk);
 }
 
-
 static void dgram_hash(struct sock *sk)
 {
         write_lock_bh(&dgram_lock);
@@ -73,6 +74,7 @@ static int dgram_init(struct sock *sk)
 
         ro->dst_addr.addr_type = IEEE802154_ADDR_LONG;
         ro->dst_addr.pan_id = 0xffff;
+        ro->want_ack = 1;
         memset(&ro->dst_addr.hwaddr, 0xff, sizeof(ro->dst_addr.hwaddr));
         return 0;
 }
@@ -86,18 +88,18 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
 {
         struct sockaddr_ieee802154 *addr = (struct sockaddr_ieee802154 *)uaddr;
         struct dgram_sock *ro = dgram_sk(sk);
-        int err = 0;
+        int err = -EINVAL;
         struct net_device *dev;
 
+        lock_sock(sk);
+
         ro->bound = 0;
 
         if (len < sizeof(*addr))
-                return -EINVAL;
+                goto out;
 
         if (addr->family != AF_IEEE802154)
-                return -EINVAL;
-
-        lock_sock(sk);
+                goto out;
 
         dev = ieee802154_get_dev(sock_net(sk), &addr->addr);
         if (!dev) {
@@ -113,6 +115,7 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
         memcpy(&ro->src_addr, &addr->addr, sizeof(struct ieee802154_addr));
 
         ro->bound = 1;
+        err = 0;
 out_put:
         dev_put(dev);
 out:
@@ -235,7 +238,10 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         skb_reset_network_header(skb);
 
-        mac_cb(skb)->flags = IEEE802154_FC_TYPE_DATA | MAC_CB_FLAG_ACKREQ;
+        mac_cb(skb)->flags = IEEE802154_FC_TYPE_DATA;
+        if (ro->want_ack)
+                mac_cb(skb)->flags |= MAC_CB_FLAG_ACKREQ;
+
         mac_cb(skb)->seq = ieee802154_mlme_ops(dev)->get_dsn(dev);
         err = dev_hard_header(skb, dev, ETH_P_IEEE802154, &ro->dst_addr,
                         ro->bound ? &ro->src_addr : NULL, size);
@@ -377,6 +383,64 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
         return ret;
 }
 
+static int dgram_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        struct dgram_sock *ro = dgram_sk(sk);
+
+        int val, len;
+
+        if (level != SOL_IEEE802154)
+                return -EOPNOTSUPP;
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        len = min_t(unsigned int, len, sizeof(int));
+
+        switch (optname) {
+        case WPAN_WANTACK:
+                val = ro->want_ack;
+                break;
+        default:
+                return -ENOPROTOOPT;
+        }
+
+        if (put_user(len, optlen))
+                return -EFAULT;
+        if (copy_to_user(optval, &val, len))
+                return -EFAULT;
+        return 0;
+}
+
+static int dgram_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        struct dgram_sock *ro = dgram_sk(sk);
+        int val;
+        int err = 0;
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+
+        if (get_user(val, (int __user *)optval))
+                return -EFAULT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case WPAN_WANTACK:
+                ro->want_ack = !!val;
+                break;
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
 struct proto ieee802154_dgram_prot = {
         .name           = "IEEE-802.15.4-MAC",
         .owner          = THIS_MODULE,
@@ -391,5 +455,7 @@ struct proto ieee802154_dgram_prot = {
         .connect        = dgram_connect,
         .disconnect     = dgram_disconnect,
         .ioctl          = dgram_ioctl,
+        .getsockopt     = dgram_getsockopt,
+        .setsockopt     = dgram_setsockopt,
 };
 
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index a615b9d13212..2106ecbf0308 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -19,6 +19,7 @@
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
  */
 
 #include <linux/kernel.h>
@@ -26,9 +27,11 @@
 #include <linux/netdevice.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
+#include <net/sock.h>
 #include <linux/nl802154.h>
 #include <net/af_ieee802154.h>
 #include <net/nl802154.h>
+#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
 
 static unsigned int ieee802154_seq_num;
@@ -73,7 +76,7 @@ static int ieee802154_nl_finish(struct sk_buff *msg)
         /* XXX: nlh is right at the start of msg */
         void *hdr = genlmsg_data(NLMSG_DATA(msg->data));
 
-        if (!genlmsg_end(msg, hdr))
+        if (genlmsg_end(msg, hdr) < 0)
                 goto out;
 
         return genlmsg_multicast(msg, 0, ieee802154_coord_mcgrp.id,
@@ -229,7 +232,7 @@ nla_put_failure:
 EXPORT_SYMBOL(ieee802154_nl_beacon_indic);
 
 int ieee802154_nl_scan_confirm(struct net_device *dev,
-                u8 status, u8 scan_type, u32 unscanned,
+                u8 status, u8 scan_type, u32 unscanned, u8 page,
                 u8 *edl/* , struct list_head *pan_desc_list */)
 {
         struct sk_buff *msg;
@@ -248,6 +251,7 @@ int ieee802154_nl_scan_confirm(struct net_device *dev,
         NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
         NLA_PUT_U8(msg, IEEE802154_ATTR_SCAN_TYPE, scan_type);
         NLA_PUT_U32(msg, IEEE802154_ATTR_CHANNELS, unscanned);
+        NLA_PUT_U8(msg, IEEE802154_ATTR_PAGE, page);
 
         if (edl)
                 NLA_PUT(msg, IEEE802154_ATTR_ED_LIST, 27, edl);
@@ -260,6 +264,60 @@ nla_put_failure:
 }
 EXPORT_SYMBOL(ieee802154_nl_scan_confirm);
 
+int ieee802154_nl_start_confirm(struct net_device *dev, u8 status)
+{
+        struct sk_buff *msg;
+
+        pr_debug("%s\n", __func__);
+
+        msg = ieee802154_nl_create(0, IEEE802154_START_CONF);
+        if (!msg)
+                return -ENOBUFS;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                        dev->dev_addr);
+
+        NLA_PUT_U8(msg, IEEE802154_ATTR_STATUS, status);
+
+        return ieee802154_nl_finish(msg);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+EXPORT_SYMBOL(ieee802154_nl_start_confirm);
+
+static int ieee802154_nl_fill_iface(struct sk_buff *msg, u32 pid,
+        u32 seq, int flags, struct net_device *dev)
+{
+        void *hdr;
+
+        pr_debug("%s\n", __func__);
+
+        hdr = genlmsg_put(msg, 0, seq, &ieee802154_coordinator_family, flags,
+                IEEE802154_LIST_IFACE);
+        if (!hdr)
+                goto out;
+
+        NLA_PUT_STRING(msg, IEEE802154_ATTR_DEV_NAME, dev->name);
+        NLA_PUT_U32(msg, IEEE802154_ATTR_DEV_INDEX, dev->ifindex);
+
+        NLA_PUT(msg, IEEE802154_ATTR_HW_ADDR, IEEE802154_ADDR_LEN,
+                dev->dev_addr);
+        NLA_PUT_U16(msg, IEEE802154_ATTR_SHORT_ADDR,
+                ieee802154_mlme_ops(dev)->get_short_addr(dev));
+        NLA_PUT_U16(msg, IEEE802154_ATTR_PAN_ID,
+                ieee802154_mlme_ops(dev)->get_pan_id(dev));
+        return genlmsg_end(msg, hdr);
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+out:
+        return -EMSGSIZE;
+}
+
 /* Requests from userspace */
 static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
 {
@@ -272,7 +330,7 @@ static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
                 dev = dev_get_by_name(&init_net, name);
         } else if (info->attrs[IEEE802154_ATTR_DEV_INDEX])
                 dev = dev_get_by_index(&init_net,
-                                nla_get_u32(info->attrs[IEEE802154_ATTR_DEV_INDEX]));
+                        nla_get_u32(info->attrs[IEEE802154_ATTR_DEV_INDEX]));
         else
                 return NULL;
 
@@ -292,6 +350,7 @@ static int ieee802154_associate_req(struct sk_buff *skb,
 {
         struct net_device *dev;
         struct ieee802154_addr addr;
+        u8 page;
         int ret = -EINVAL;
 
         if (!info->attrs[IEEE802154_ATTR_CHANNEL] ||
@@ -317,8 +376,14 @@ static int ieee802154_associate_req(struct sk_buff *skb,
         }
         addr.pan_id = nla_get_u16(info->attrs[IEEE802154_ATTR_COORD_PAN_ID]);
 
+        if (info->attrs[IEEE802154_ATTR_PAGE])
+                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
+        else
+                page = 0;
+
         ret = ieee802154_mlme_ops(dev)->assoc_req(dev, &addr,
                         nla_get_u8(info->attrs[IEEE802154_ATTR_CHANNEL]),
+                        page,
                         nla_get_u8(info->attrs[IEEE802154_ATTR_CAPABILITY]));
 
         dev_put(dev);
@@ -401,6 +466,7 @@ static int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
         struct ieee802154_addr addr;
 
         u8 channel, bcn_ord, sf_ord;
+        u8 page;
         int pan_coord, blx, coord_realign;
         int ret;
 
@@ -431,7 +497,19 @@ static int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
         blx = nla_get_u8(info->attrs[IEEE802154_ATTR_BAT_EXT]);
         coord_realign = nla_get_u8(info->attrs[IEEE802154_ATTR_COORD_REALIGN]);
 
-        ret = ieee802154_mlme_ops(dev)->start_req(dev, &addr, channel,
+        if (info->attrs[IEEE802154_ATTR_PAGE])
+                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
+        else
+                page = 0;
+
+
+        if (addr.short_addr == IEEE802154_ADDR_BROADCAST) {
+                ieee802154_nl_start_confirm(dev, IEEE802154_NO_SHORT_ADDRESS);
+                dev_put(dev);
+                return -EINVAL;
+        }
+
+        ret = ieee802154_mlme_ops(dev)->start_req(dev, &addr, channel, page,
                 bcn_ord, sf_ord, pan_coord, blx, coord_realign);
 
         dev_put(dev);
@@ -445,6 +523,7 @@ static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
         u8 type;
         u32 channels;
         u8 duration;
+        u8 page;
 
         if (!info->attrs[IEEE802154_ATTR_SCAN_TYPE] ||
             !info->attrs[IEEE802154_ATTR_CHANNELS] ||
@@ -459,13 +538,80 @@ static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
         channels = nla_get_u32(info->attrs[IEEE802154_ATTR_CHANNELS]);
         duration = nla_get_u8(info->attrs[IEEE802154_ATTR_DURATION]);
 
-        ret = ieee802154_mlme_ops(dev)->scan_req(dev, type, channels,
+        if (info->attrs[IEEE802154_ATTR_PAGE])
+                page = nla_get_u8(info->attrs[IEEE802154_ATTR_PAGE]);
+        else
+                page = 0;
+
+
+        ret = ieee802154_mlme_ops(dev)->scan_req(dev, type, channels, page,
                         duration);
 
         dev_put(dev);
         return ret;
 }
 
+static int ieee802154_list_iface(struct sk_buff *skb,
+        struct genl_info *info)
+{
+        /* Request for interface name, index, type, IEEE address,
+           PAN Id, short address */
+        struct sk_buff *msg;
+        struct net_device *dev = NULL;
+        int rc = -ENOBUFS;
+
+        pr_debug("%s\n", __func__);
+
+        dev = ieee802154_nl_get_dev(info);
+        if (!dev)
+                return -ENODEV;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                goto out_dev;
+
+        rc = ieee802154_nl_fill_iface(msg, info->snd_pid, info->snd_seq,
+                        0, dev);
+        if (rc < 0)
+                goto out_free;
+
+        dev_put(dev);
+
+        return genlmsg_unicast(&init_net, msg, info->snd_pid);
+out_free:
+        nlmsg_free(msg);
+out_dev:
+        dev_put(dev);
+        return rc;
+
+}
+
+static int ieee802154_dump_iface(struct sk_buff *skb,
+        struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        int idx;
+        int s_idx = cb->args[0];
+
+        pr_debug("%s\n", __func__);
+
+        idx = 0;
+        for_each_netdev(net, dev) {
+                if (idx < s_idx || (dev->type != ARPHRD_IEEE802154))
+                        goto cont;
+
+                if (ieee802154_nl_fill_iface(skb, NETLINK_CB(cb->skb).pid,
+                        cb->nlh->nlmsg_seq, NLM_F_MULTI, dev) < 0)
+                        break;
+cont:
+                idx++;
+        }
+        cb->args[0] = idx;
+
+        return skb->len;
+}
+
 #define IEEE802154_OP(_cmd, _func)                      \
         {                                               \
                 .cmd    = _cmd,                         \
@@ -475,12 +621,22 @@ static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
                 .flags  = GENL_ADMIN_PERM,              \
         }
 
+#define IEEE802154_DUMP(_cmd, _func, _dump)             \
+        {                                               \
+                .cmd    = _cmd,                         \
+                .policy = ieee802154_policy,            \
+                .doit   = _func,                        \
+                .dumpit = _dump,                        \
+        }
+
 static struct genl_ops ieee802154_coordinator_ops[] = {
         IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
         IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
         IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
         IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
         IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
+        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
+                                                        ieee802154_dump_iface),
 };
 
 static int __init ieee802154_nl_init(void)
diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
index c7d71d1adcac..2363ebee02e7 100644
--- a/net/ieee802154/nl_policy.c
+++ b/net/ieee802154/nl_policy.c
@@ -24,7 +24,7 @@
 
 #define NLA_HW_ADDR NLA_U64
 
-struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
+const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_DEV_NAME] = { .type = NLA_STRING, },
         [IEEE802154_ATTR_DEV_INDEX] = { .type = NLA_U32, },
 
@@ -33,6 +33,7 @@ struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_HW_ADDR] = { .type = NLA_HW_ADDR, },
         [IEEE802154_ATTR_PAN_ID] = { .type = NLA_U16, },
         [IEEE802154_ATTR_CHANNEL] = { .type = NLA_U8, },
+        [IEEE802154_ATTR_PAGE] = { .type = NLA_U8, },
         [IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, },
         [IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, },
         [IEEE802154_ATTR_COORD_PAN_ID] = { .type = NLA_U16, },
@@ -50,3 +51,4 @@ struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
         [IEEE802154_ATTR_DURATION] = { .type = NLA_U8, },
         [IEEE802154_ATTR_ED_LIST] = { .len = 27 },
 };
+
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index ea8d1f15206e..4681501aae93 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -74,8 +74,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int len)
                 goto out;
         }
 
-        if (dev->type != ARPHRD_IEEE802154_PHY &&
-            dev->type != ARPHRD_IEEE802154) {
+        if (dev->type != ARPHRD_IEEE802154) {
                 err = -ENODEV;
                 goto out_put;
         }
@@ -238,6 +237,18 @@ void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
         read_unlock(&raw_lock);
 }
 
+static int raw_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+
+static int raw_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
+
 struct proto ieee802154_raw_prot = {
         .name           = "IEEE-802.15.4-RAW",
         .owner          = THIS_MODULE,
@@ -250,5 +261,7 @@ struct proto ieee802154_raw_prot = {
         .unhash         = raw_unhash,
         .connect        = raw_connect,
         .disconnect     = raw_disconnect,
+        .getsockopt     = raw_getsockopt,
+        .setsockopt     = raw_setsockopt,
 };
 
diff --git a/net/ieee802154/wpan-class.c b/net/ieee802154/wpan-class.c
new file mode 100644
index 000000000000..f306604da67a
--- /dev/null
+++ b/net/ieee802154/wpan-class.c
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/device.h>
+
+#include <net/wpan-phy.h>
+
+#define MASTER_SHOW_COMPLEX(name, format_string, args...)               \
+static ssize_t name ## _show(struct device *dev,                        \
+                            struct device_attribute *attr, char *buf)   \
+{                                                                       \
+        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev); \
+        int ret;                                                        \
+                                                                        \
+        mutex_lock(&phy->pib_lock);                                     \
+        ret = sprintf(buf, format_string "\n", args);                   \
+        mutex_unlock(&phy->pib_lock);                                   \
+        return ret;                                                     \
+}
+
+#define MASTER_SHOW(field, format_string)                               \
+        MASTER_SHOW_COMPLEX(field, format_string, phy->field)
+
+MASTER_SHOW(current_channel, "%d");
+MASTER_SHOW(current_page, "%d");
+MASTER_SHOW(channels_supported, "%#x");
+MASTER_SHOW_COMPLEX(transmit_power, "%d +- %d dB",
+        ((signed char) (phy->transmit_power << 2)) >> 2,
+        (phy->transmit_power >> 6) ? (phy->transmit_power >> 6) * 3 : 1 );
+MASTER_SHOW(cca_mode, "%d");
+
+static struct device_attribute pmib_attrs[] = {
+        __ATTR_RO(current_channel),
+        __ATTR_RO(current_page),
+        __ATTR_RO(channels_supported),
+        __ATTR_RO(transmit_power),
+        __ATTR_RO(cca_mode),
+        {},
+};
+
+static void wpan_phy_release(struct device *d)
+{
+        struct wpan_phy *phy = container_of(d, struct wpan_phy, dev);
+        kfree(phy);
+}
+
+static struct class wpan_phy_class = {
+        .name = "ieee802154",
+        .dev_release = wpan_phy_release,
+        .dev_attrs = pmib_attrs,
+};
+
+static DEFINE_MUTEX(wpan_phy_mutex);
+static int wpan_phy_idx;
+
+static int wpan_phy_match(struct device *dev, void *data)
+{
+        return !strcmp(dev_name(dev), (const char *)data);
+}
+
+struct wpan_phy *wpan_phy_find(const char *str)
+{
+        struct device *dev;
+
+        if (WARN_ON(!str))
+                return NULL;
+
+        dev = class_find_device(&wpan_phy_class, NULL,
+                        (void *)str, wpan_phy_match);
+        if (!dev)
+                return NULL;
+
+        return container_of(dev, struct wpan_phy, dev);
+}
+EXPORT_SYMBOL(wpan_phy_find);
+
+static int wpan_phy_idx_valid(int idx)
+{
+        return idx >= 0;
+}
+
+struct wpan_phy *wpan_phy_alloc(size_t priv_size)
+{
+        struct wpan_phy *phy = kzalloc(sizeof(*phy) + priv_size,
+                        GFP_KERNEL);
+
+        mutex_lock(&wpan_phy_mutex);
+        phy->idx = wpan_phy_idx++;
+        if (unlikely(!wpan_phy_idx_valid(phy->idx))) {
+                wpan_phy_idx--;
+                mutex_unlock(&wpan_phy_mutex);
+                kfree(phy);
+                return NULL;
+        }
+        mutex_unlock(&wpan_phy_mutex);
+
+        mutex_init(&phy->pib_lock);
+
+        device_initialize(&phy->dev);
+        dev_set_name(&phy->dev, "wpan-phy%d", phy->idx);
+
+        phy->dev.class = &wpan_phy_class;
+
+        return phy;
+}
+EXPORT_SYMBOL(wpan_phy_alloc);
+
+int wpan_phy_register(struct device *parent, struct wpan_phy *phy)
+{
+        phy->dev.parent = parent;
+
+        return device_add(&phy->dev);
+}
+EXPORT_SYMBOL(wpan_phy_register);
+
+void wpan_phy_unregister(struct wpan_phy *phy)
+{
+        device_del(&phy->dev);
+}
+EXPORT_SYMBOL(wpan_phy_unregister);
+
+void wpan_phy_free(struct wpan_phy *phy)
+{
+        put_device(&phy->dev);
+}
+EXPORT_SYMBOL(wpan_phy_free);
+
+static int __init wpan_phy_class_init(void)
+{
+        return class_register(&wpan_phy_class);
+}
+subsys_initcall(wpan_phy_class_init);
+
+static void __exit wpan_phy_class_exit(void)
+{
+        class_unregister(&wpan_phy_class);
+}
+module_exit(wpan_phy_class_exit);
+
+MODULE_DESCRIPTION("IEEE 802.15.4 device class");
+MODULE_LICENSE("GPL v2");
+
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 197d024b2536..6c30a73f03f5 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -124,7 +124,6 @@ static struct list_head inetsw[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw_lock);
 
 struct ipv4_config ipv4_config;
-
 EXPORT_SYMBOL(ipv4_config);
 
 /* New destruction routine */
@@ -139,12 +138,12 @@ void inet_sock_destruct(struct sock *sk)
         sk_mem_reclaim(sk);
 
         if (sk->sk_type == SOCK_STREAM && sk->sk_state != TCP_CLOSE) {
-                printk("Attempt to release TCP socket in state %d %p\n",
+                pr_err("Attempt to release TCP socket in state %d %p\n",
                        sk->sk_state, sk);
                 return;
         }
         if (!sock_flag(sk, SOCK_DEAD)) {
-                printk("Attempt to release alive inet socket %p\n", sk);
+                pr_err("Attempt to release alive inet socket %p\n", sk);
                 return;
         }
 
@@ -157,6 +156,7 @@ void inet_sock_destruct(struct sock *sk)
         dst_release(sk->sk_dst_cache);
         sk_refcnt_debug_dec(sk);
 }
+EXPORT_SYMBOL(inet_sock_destruct);
 
 /*
  *      The routines beyond this point handle the behaviour of an AF_INET
@@ -219,6 +219,7 @@ out:
         release_sock(sk);
         return err;
 }
+EXPORT_SYMBOL(inet_listen);
 
 u32 inet_ehash_secret __read_mostly;
 EXPORT_SYMBOL(inet_ehash_secret);
@@ -435,9 +436,11 @@ int inet_release(struct socket *sock)
         }
         return 0;
 }
+EXPORT_SYMBOL(inet_release);
 
 /* It is off by default, see below. */
 int sysctl_ip_nonlocal_bind __read_mostly;
+EXPORT_SYMBOL(sysctl_ip_nonlocal_bind);
 
 int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
@@ -519,6 +522,7 @@ out_release_sock:
 out:
         return err;
 }
+EXPORT_SYMBOL(inet_bind);
 
 int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
                        int addr_len, int flags)
@@ -532,6 +536,7 @@ int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
                 return -EAGAIN;
         return sk->sk_prot->connect(sk, (struct sockaddr *)uaddr, addr_len);
 }
+EXPORT_SYMBOL(inet_dgram_connect);
 
 static long inet_wait_for_connect(struct sock *sk, long timeo)
 {
@@ -641,6 +646,7 @@ sock_error:
                 sock->state = SS_DISCONNECTING;
         goto out;
 }
+EXPORT_SYMBOL(inet_stream_connect);
 
 /*
  *      Accept a pending connection. The TCP layer now gives BSD semantics.
@@ -668,6 +674,7 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
 do_err:
         return err;
 }
+EXPORT_SYMBOL(inet_accept);
 
 
 /*
@@ -699,6 +706,7 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr,
         *uaddr_len = sizeof(*sin);
         return 0;
 }
+EXPORT_SYMBOL(inet_getname);
 
 int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                  size_t size)
@@ -711,9 +719,11 @@ int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 
         return sk->sk_prot->sendmsg(iocb, sk, msg, size);
 }
+EXPORT_SYMBOL(inet_sendmsg);
 
 
-static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
+static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
+                             size_t size, int flags)
 {
         struct sock *sk = sock->sk;
 
@@ -780,6 +790,7 @@ int inet_shutdown(struct socket *sock, int how)
         release_sock(sk);
         return err;
 }
+EXPORT_SYMBOL(inet_shutdown);
 
 /*
  *      ioctl() calls you can issue on an INET socket. Most of these are
@@ -798,44 +809,45 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         struct net *net = sock_net(sk);
 
         switch (cmd) {
-                case SIOCGSTAMP:
-                        err = sock_get_timestamp(sk, (struct timeval __user *)arg);
-                        break;
-                case SIOCGSTAMPNS:
-                        err = sock_get_timestampns(sk, (struct timespec __user *)arg);
-                        break;
-                case SIOCADDRT:
-                case SIOCDELRT:
-                case SIOCRTMSG:
-                        err = ip_rt_ioctl(net, cmd, (void __user *)arg);
-                        break;
-                case SIOCDARP:
-                case SIOCGARP:
-                case SIOCSARP:
-                        err = arp_ioctl(net, cmd, (void __user *)arg);
-                        break;
-                case SIOCGIFADDR:
-                case SIOCSIFADDR:
-                case SIOCGIFBRDADDR:
-                case SIOCSIFBRDADDR:
-                case SIOCGIFNETMASK:
-                case SIOCSIFNETMASK:
-                case SIOCGIFDSTADDR:
-                case SIOCSIFDSTADDR:
-                case SIOCSIFPFLAGS:
-                case SIOCGIFPFLAGS:
-                case SIOCSIFFLAGS:
-                        err = devinet_ioctl(net, cmd, (void __user *)arg);
-                        break;
-                default:
-                        if (sk->sk_prot->ioctl)
-                                err = sk->sk_prot->ioctl(sk, cmd, arg);
-                        else
-                                err = -ENOIOCTLCMD;
-                        break;
+        case SIOCGSTAMP:
+                err = sock_get_timestamp(sk, (struct timeval __user *)arg);
+                break;
+        case SIOCGSTAMPNS:
+                err = sock_get_timestampns(sk, (struct timespec __user *)arg);
+                break;
+        case SIOCADDRT:
+        case SIOCDELRT:
+        case SIOCRTMSG:
+                err = ip_rt_ioctl(net, cmd, (void __user *)arg);
+                break;
+        case SIOCDARP:
+        case SIOCGARP:
+        case SIOCSARP:
+                err = arp_ioctl(net, cmd, (void __user *)arg);
+                break;
+        case SIOCGIFADDR:
+        case SIOCSIFADDR:
+        case SIOCGIFBRDADDR:
+        case SIOCSIFBRDADDR:
+        case SIOCGIFNETMASK:
+        case SIOCSIFNETMASK:
+        case SIOCGIFDSTADDR:
+        case SIOCSIFDSTADDR:
+        case SIOCSIFPFLAGS:
+        case SIOCGIFPFLAGS:
+        case SIOCSIFFLAGS:
+                err = devinet_ioctl(net, cmd, (void __user *)arg);
+                break;
+        default:
+                if (sk->sk_prot->ioctl)
+                        err = sk->sk_prot->ioctl(sk, cmd, arg);
+                else
+                        err = -ENOIOCTLCMD;
+                break;
         }
         return err;
 }
+EXPORT_SYMBOL(inet_ioctl);
 
 const struct proto_ops inet_stream_ops = {
         .family            = PF_INET,
@@ -862,6 +874,7 @@ const struct proto_ops inet_stream_ops = {
         .compat_getsockopt = compat_sock_common_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(inet_stream_ops);
 
 const struct proto_ops inet_dgram_ops = {
         .family            = PF_INET,
@@ -887,6 +900,7 @@ const struct proto_ops inet_dgram_ops = {
         .compat_getsockopt = compat_sock_common_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(inet_dgram_ops);
 
 /*
  * For SOCK_RAW sockets; should be the same as inet_dgram_ops but without
@@ -1016,6 +1030,7 @@ out_illegal:
                p->type);
         goto out;
 }
+EXPORT_SYMBOL(inet_register_protosw);
 
 void inet_unregister_protosw(struct inet_protosw *p)
 {
@@ -1031,6 +1046,7 @@ void inet_unregister_protosw(struct inet_protosw *p)
                 synchronize_net();
         }
 }
+EXPORT_SYMBOL(inet_unregister_protosw);
 
 /*
  *      Shall we try to damage output packets if routing dev changes?
@@ -1141,7 +1157,6 @@ int inet_sk_rebuild_header(struct sock *sk)
 
         return err;
 }
-
 EXPORT_SYMBOL(inet_sk_rebuild_header);
 
 static int inet_gso_send_check(struct sk_buff *skb)
@@ -1369,7 +1384,6 @@ int inet_ctl_sock_create(struct sock **sk, unsigned short family,
         }
         return rc;
 }
-
 EXPORT_SYMBOL_GPL(inet_ctl_sock_create);
 
 unsigned long snmp_fold_field(void *mib[], int offt)
@@ -1676,19 +1690,3 @@ static int __init ipv4_proc_init(void)
 
 MODULE_ALIAS_NETPROTO(PF_INET);
 
-EXPORT_SYMBOL(inet_accept);
-EXPORT_SYMBOL(inet_bind);
-EXPORT_SYMBOL(inet_dgram_connect);
-EXPORT_SYMBOL(inet_dgram_ops);
-EXPORT_SYMBOL(inet_getname);
-EXPORT_SYMBOL(inet_ioctl);
-EXPORT_SYMBOL(inet_listen);
-EXPORT_SYMBOL(inet_register_protosw);
-EXPORT_SYMBOL(inet_release);
-EXPORT_SYMBOL(inet_sendmsg);
-EXPORT_SYMBOL(inet_shutdown);
-EXPORT_SYMBOL(inet_sock_destruct);
-EXPORT_SYMBOL(inet_stream_connect);
-EXPORT_SYMBOL(inet_stream_ops);
-EXPORT_SYMBOL(inet_unregister_protosw);
-EXPORT_SYMBOL(sysctl_ip_nonlocal_bind);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 090e9991ac2a..4e80f336c0cf 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -130,7 +130,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb);
 static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb);
 static void parp_redo(struct sk_buff *skb);
 
-static struct neigh_ops arp_generic_ops = {
+static const struct neigh_ops arp_generic_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
@@ -140,7 +140,7 @@ static struct neigh_ops arp_generic_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-static struct neigh_ops arp_hh_ops = {
+static const struct neigh_ops arp_hh_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
@@ -150,7 +150,7 @@ static struct neigh_ops arp_hh_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-static struct neigh_ops arp_direct_ops = {
+static const struct neigh_ops arp_direct_ops = {
         .family =               AF_INET,
         .output =               dev_queue_xmit,
         .connected_output =     dev_queue_xmit,
@@ -158,7 +158,7 @@ static struct neigh_ops arp_direct_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-struct neigh_ops arp_broken_ops = {
+const struct neigh_ops arp_broken_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index fe3c846b99a6..291bdf50a21f 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -48,7 +48,7 @@
  *              Patrick McHardy <kaber@trash.net>
  */
 
-#define VERSION "0.408"
+#define VERSION "0.409"
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -325,10 +325,7 @@ static inline void check_tnode(const struct tnode *tn)
 static const int halve_threshold = 25;
 static const int inflate_threshold = 50;
 static const int halve_threshold_root = 15;
-static const int inflate_threshold_root = 25;
-
-static int inflate_threshold_root_fix;
-#define INFLATE_FIX_MAX 10      /* a comment in resize() */
+static const int inflate_threshold_root = 30;
 
 static void __alias_free_mem(struct rcu_head *head)
 {
@@ -516,14 +513,14 @@ static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n,
         rcu_assign_pointer(tn->child[i], n);
 }
 
+#define MAX_WORK 10
 static struct node *resize(struct trie *t, struct tnode *tn)
 {
         int i;
-        int err = 0;
         struct tnode *old_tn;
         int inflate_threshold_use;
         int halve_threshold_use;
-        int max_resize;
+        int max_work;
 
         if (!tn)
                 return NULL;
@@ -538,18 +535,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         }
         /* One child */
         if (tn->empty_children == tnode_child_length(tn) - 1)
-                for (i = 0; i < tnode_child_length(tn); i++) {
-                        struct node *n;
-
-                        n = tn->child[i];
-                        if (!n)
-                                continue;
-
-                        /* compress one level */
-                        node_set_parent(n, NULL);
-                        tnode_free_safe(tn);
-                        return n;
-                }
+                goto one_child;
         /*
          * Double as long as the resulting node has a number of
          * nonempty nodes that are above the threshold.
@@ -618,15 +604,17 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 
         /* Keep root node larger  */
 
-        if (!tn->parent)
-                inflate_threshold_use = inflate_threshold_root +
-                                        inflate_threshold_root_fix;
-        else
+        if (!node_parent((struct node*) tn)) {
+                inflate_threshold_use = inflate_threshold_root;
+                halve_threshold_use = halve_threshold_root;
+        }
+        else {
                 inflate_threshold_use = inflate_threshold;
+                halve_threshold_use = halve_threshold;
+        }
 
-        err = 0;
-        max_resize = 10;
-        while ((tn->full_children > 0 &&  max_resize-- &&
+        max_work = MAX_WORK;
+        while ((tn->full_children > 0 &&  max_work-- &&
                 50 * (tn->full_children + tnode_child_length(tn)
                       - tn->empty_children)
                 >= inflate_threshold_use * tnode_child_length(tn))) {
@@ -643,47 +631,19 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                 }
         }
 
-        if (max_resize < 0) {
-                if (!tn->parent) {
-                        /*
-                         * It was observed that during large updates even
-                         * inflate_threshold_root = 35 might be needed to avoid
-                         * this warning; but it should be temporary, so let's
-                         * try to handle this automatically.
-                         */
-                        if (inflate_threshold_root_fix < INFLATE_FIX_MAX)
-                                inflate_threshold_root_fix++;
-                        else
-                                pr_warning("Fix inflate_threshold_root."
-                                           " Now=%d size=%d bits fix=%d\n",
-                                           inflate_threshold_root, tn->bits,
-                                           inflate_threshold_root_fix);
-                } else {
-                        pr_warning("Fix inflate_threshold."
-                                   " Now=%d size=%d bits\n",
-                                   inflate_threshold, tn->bits);
-                }
-        } else if (max_resize > 3 && !tn->parent && inflate_threshold_root_fix)
-                inflate_threshold_root_fix--;
-
         check_tnode(tn);
 
+        /* Return if at least one inflate is run */
+        if( max_work != MAX_WORK)
+                return (struct node *) tn;
+
         /*
          * Halve as long as the number of empty children in this
          * node is above threshold.
          */
 
-
-        /* Keep root node larger  */
-
-        if (!tn->parent)
-                halve_threshold_use = halve_threshold_root;
-        else
-                halve_threshold_use = halve_threshold;
-
-        err = 0;
-        max_resize = 10;
-        while (tn->bits > 1 &&  max_resize-- &&
+        max_work = MAX_WORK;
+        while (tn->bits > 1 &&  max_work-- &&
                100 * (tnode_child_length(tn) - tn->empty_children) <
                halve_threshold_use * tnode_child_length(tn)) {
 
@@ -698,19 +658,10 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                 }
         }
 
-        if (max_resize < 0) {
-                if (!tn->parent)
-                        pr_warning("Fix halve_threshold_root."
-                                   " Now=%d size=%d bits\n",
-                                   halve_threshold_root, tn->bits);
-                else
-                        pr_warning("Fix halve_threshold."
-                                   " Now=%d size=%d bits\n",
-                                   halve_threshold, tn->bits);
-        }
 
         /* Only one child remains */
-        if (tn->empty_children == tnode_child_length(tn) - 1)
+        if (tn->empty_children == tnode_child_length(tn) - 1) {
+one_child:
                 for (i = 0; i < tnode_child_length(tn); i++) {
                         struct node *n;
 
@@ -724,7 +675,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                         tnode_free_safe(tn);
                         return n;
                 }
-
+        }
         return (struct node *) tn;
 }
 
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 61283f928825..13f0781f35cd 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -218,8 +218,8 @@ void inet_twdr_hangman(unsigned long data)
                 /* We purged the entire slot, anything left?  */
                 if (twdr->tw_count)
                         need_timer = 1;
+                twdr->slot = ((twdr->slot + 1) & (INET_TWDR_TWKILL_SLOTS - 1));
         }
-        twdr->slot = ((twdr->slot + 1) & (INET_TWDR_TWKILL_SLOTS - 1));
         if (need_timer)
                 mod_timer(&twdr->tw_timer, jiffies + twdr->period);
 out:
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index b902ef55be7f..533afaadefd4 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -662,7 +662,7 @@ drop_nolock:
         return(0);
 }
 
-static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct net_device_stats *stats = &tunnel->dev->stats;
@@ -951,7 +951,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                         addend += 4;
         }
         dev->needed_headroom = addend + hlen;
-        mtu -= dev->hard_header_len - addend;
+        mtu -= dev->hard_header_len + addend;
 
         if (mtu < 68)
                 mtu = 68;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7d0821054729..afae0cbabbf9 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1302,7 +1302,7 @@ int ip_push_pending_frames(struct sock *sk)
         err = ip_local_out(skb);
         if (err) {
                 if (err > 0)
-                        err = inet->recverr ? net_xmit_errno(err) : 0;
+                        err = net_xmit_errno(err);
                 if (err)
                         goto error;
         }
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 98075b6d619c..62548cb0923c 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -387,7 +387,7 @@ static int ipip_rcv(struct sk_buff *skb)
  *      and that skb is filled properly by that function.
  */
 
-static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct net_device_stats *stats = &tunnel->dev->stats;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 06c33fb6b321..65d421cf5bc7 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -201,7 +201,7 @@ failure:
 
 #ifdef CONFIG_IP_PIMSM
 
-static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct net *net = dev_net(dev);
 
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index ea50da0649fd..a2e5fc0a15e1 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -22,26 +22,11 @@
  *              as published by the Free Software Foundation; either version
  *              2 of the License, or (at your option) any later version.
  */
-
-#include <asm/uaccess.h>
-#include <asm/system.h>
+#include <linux/cache.h>
 #include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/socket.h>
-#include <linux/in.h>
-#include <linux/inet.h>
 #include <linux/netdevice.h>
-#include <linux/timer.h>
-#include <net/ip.h>
+#include <linux/spinlock.h>
 #include <net/protocol.h>
-#include <linux/skbuff.h>
-#include <net/sock.h>
-#include <net/icmp.h>
-#include <net/udp.h>
-#include <net/ipip.h>
-#include <linux/igmp.h>
 
 struct net_protocol *inet_protos[MAX_INET_PROTOS] ____cacheline_aligned_in_smp;
 static DEFINE_SPINLOCK(inet_proto_lock);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 2979f14bb188..ebb1e5848bc6 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -375,7 +375,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         err = NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
                       dst_output);
         if (err > 0)
-                err = inet->recverr ? net_xmit_errno(err) : 0;
+                err = net_xmit_errno(err);
         if (err)
                 goto error;
 out:
@@ -386,6 +386,8 @@ error_fault:
         kfree_skb(skb);
 error:
         IP_INC_STATS(net, IPSTATS_MIB_OUTDISCARDS);
+        if (err == -ENOBUFS && !inet->recverr)
+                err = 0;
         return err;
 }
 
@@ -576,8 +578,11 @@ back_from_confirm:
                                         &ipc, &rt, msg->msg_flags);
                 if (err)
                         ip_flush_pending_frames(sk);
-                else if (!(msg->msg_flags & MSG_MORE))
+                else if (!(msg->msg_flags & MSG_MORE)) {
                         err = ip_push_pending_frames(sk);
+                        if (err == -ENOBUFS && !inet->recverr)
+                                err = 0;
+                }
                 release_sock(sk);
         }
 done:
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index fafbe163e2b5..91867d3e6328 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1514,13 +1514,17 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
 void ip_rt_send_redirect(struct sk_buff *skb)
 {
         struct rtable *rt = skb_rtable(skb);
-        struct in_device *in_dev = in_dev_get(rt->u.dst.dev);
+        struct in_device *in_dev;
+        int log_martians;
 
-        if (!in_dev)
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(rt->u.dst.dev);
+        if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
+                rcu_read_unlock();
                 return;
-
-        if (!IN_DEV_TX_REDIRECTS(in_dev))
-                goto out;
+        }
+        log_martians = IN_DEV_LOG_MARTIANS(in_dev);
+        rcu_read_unlock();
 
         /* No redirected packets during ip_rt_redirect_silence;
          * reset the algorithm.
@@ -1533,7 +1537,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
          */
         if (rt->u.dst.rate_tokens >= ip_rt_redirect_number) {
                 rt->u.dst.rate_last = jiffies;
-                goto out;
+                return;
         }
 
         /* Check for load limit; set rate_last to the latest sent
@@ -1547,7 +1551,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                 rt->u.dst.rate_last = jiffies;
                 ++rt->u.dst.rate_tokens;
 #ifdef CONFIG_IP_ROUTE_VERBOSE
-                if (IN_DEV_LOG_MARTIANS(in_dev) &&
+                if (log_martians &&
                     rt->u.dst.rate_tokens == ip_rt_redirect_number &&
                     net_ratelimit())
                         printk(KERN_WARNING "host %pI4/if%d ignores redirects for %pI4 to %pI4.\n",
@@ -1555,8 +1559,6 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                                 &rt->rt_dst, &rt->rt_gateway);
 #endif
         }
-out:
-        in_dev_put(in_dev);
 }
 
 static int ip_error(struct sk_buff *skb)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 91145244ea63..edeea060db44 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1839,7 +1839,7 @@ void tcp_close(struct sock *sk, long timeout)
                 /* Unread data was tossed, zap the connection. */
                 NET_INC_STATS_USER(sock_net(sk), LINUX_MIB_TCPABORTONCLOSE);
                 tcp_set_state(sk, TCP_CLOSE);
-                tcp_send_active_reset(sk, GFP_KERNEL);
+                tcp_send_active_reset(sk, sk->sk_allocation);
         } else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
                 /* Check zero linger _after_ checking for unread data. */
                 sk->sk_prot->disconnect(sk, 0);
@@ -2336,13 +2336,13 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 val = !!(tp->nonagle&TCP_NAGLE_CORK);
                 break;
         case TCP_KEEPIDLE:
-                val = (tp->keepalive_time ? : sysctl_tcp_keepalive_time) / HZ;
+                val = keepalive_time_when(tp) / HZ;
                 break;
         case TCP_KEEPINTVL:
-                val = (tp->keepalive_intvl ? : sysctl_tcp_keepalive_intvl) / HZ;
+                val = keepalive_intvl_when(tp) / HZ;
                 break;
         case TCP_KEEPCNT:
-                val = tp->keepalive_probes ? : sysctl_tcp_keepalive_probes;
+                val = keepalive_probes(tp);
                 break;
         case TCP_SYNCNT:
                 val = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
@@ -2658,7 +2658,7 @@ void tcp_free_md5sig_pool(void)
 
 EXPORT_SYMBOL(tcp_free_md5sig_pool);
 
-static struct tcp_md5sig_pool **__tcp_alloc_md5sig_pool(void)
+static struct tcp_md5sig_pool **__tcp_alloc_md5sig_pool(struct sock *sk)
 {
         int cpu;
         struct tcp_md5sig_pool **pool;
@@ -2671,7 +2671,7 @@ static struct tcp_md5sig_pool **__tcp_alloc_md5sig_pool(void)
                 struct tcp_md5sig_pool *p;
                 struct crypto_hash *hash;
 
-                p = kzalloc(sizeof(*p), GFP_KERNEL);
+                p = kzalloc(sizeof(*p), sk->sk_allocation);
                 if (!p)
                         goto out_free;
                 *per_cpu_ptr(pool, cpu) = p;
@@ -2688,7 +2688,7 @@ out_free:
         return NULL;
 }
 
-struct tcp_md5sig_pool **tcp_alloc_md5sig_pool(void)
+struct tcp_md5sig_pool **tcp_alloc_md5sig_pool(struct sock *sk)
 {
         struct tcp_md5sig_pool **pool;
         int alloc = 0;
@@ -2709,7 +2709,7 @@ retry:
 
         if (alloc) {
                 /* we cannot hold spinlock here because this may sleep. */
-                struct tcp_md5sig_pool **p = __tcp_alloc_md5sig_pool();
+                struct tcp_md5sig_pool **p = __tcp_alloc_md5sig_pool(sk);
                 spin_lock_bh(&tcp_md5sig_pool_lock);
                 if (!p) {
                         tcp_md5sig_users--;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2bdb0da237e6..af6d6fa00db1 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -685,7 +685,7 @@ static inline void tcp_set_rto(struct sock *sk)
          *    is invisible. Actually, Linux-2.4 also generates erratic
          *    ACKs in some circumstances.
          */
-        inet_csk(sk)->icsk_rto = (tp->srtt >> 3) + tp->rttvar;
+        inet_csk(sk)->icsk_rto = __tcp_set_rto(tp);
 
         /* 2. Fixups made earlier cannot be right.
          *    If we do not estimate RTO correctly without them,
@@ -696,8 +696,7 @@ static inline void tcp_set_rto(struct sock *sk)
         /* NOTE: clamping at TCP_RTO_MIN is not required, current algo
          * guarantees that rto is higher.
          */
-        if (inet_csk(sk)->icsk_rto > TCP_RTO_MAX)
-                inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
+        tcp_bound_rto(sk);
 }
 
 /* Save metrics learned by this TCP session.
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6d88219c5e22..0543561da999 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -328,26 +328,29 @@ static void do_pmtu_discovery(struct sock *sk, struct iphdr *iph, u32 mtu)
  *
  */
 
-void tcp_v4_err(struct sk_buff *skb, u32 info)
+void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 {
-        struct iphdr *iph = (struct iphdr *)skb->data;
-        struct tcphdr *th = (struct tcphdr *)(skb->data + (iph->ihl << 2));
+        struct iphdr *iph = (struct iphdr *)icmp_skb->data;
+        struct tcphdr *th = (struct tcphdr *)(icmp_skb->data + (iph->ihl << 2));
+        struct inet_connection_sock *icsk;
         struct tcp_sock *tp;
         struct inet_sock *inet;
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
+        const int type = icmp_hdr(icmp_skb)->type;
+        const int code = icmp_hdr(icmp_skb)->code;
         struct sock *sk;
+        struct sk_buff *skb;
         __u32 seq;
+        __u32 remaining;
         int err;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(icmp_skb->dev);
 
-        if (skb->len < (iph->ihl << 2) + 8) {
+        if (icmp_skb->len < (iph->ihl << 2) + 8) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
 
         sk = inet_lookup(net, &tcp_hashinfo, iph->daddr, th->dest,
-                        iph->saddr, th->source, inet_iif(skb));
+                        iph->saddr, th->source, inet_iif(icmp_skb));
         if (!sk) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
@@ -367,6 +370,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        icsk = inet_csk(sk);
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
@@ -393,6 +397,39 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 }
 
                 err = icmp_err_convert[code].errno;
+                /* check if icmp_skb allows revert of backoff
+                 * (see draft-zimmermann-tcp-lcd) */
+                if (code != ICMP_NET_UNREACH && code != ICMP_HOST_UNREACH)
+                        break;
+                if (seq != tp->snd_una  || !icsk->icsk_retransmits ||
+                    !icsk->icsk_backoff)
+                        break;
+
+                icsk->icsk_backoff--;
+                inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
+                                         icsk->icsk_backoff;
+                tcp_bound_rto(sk);
+
+                skb = tcp_write_queue_head(sk);
+                BUG_ON(!skb);
+
+                remaining = icsk->icsk_rto - min(icsk->icsk_rto,
+                                tcp_time_stamp - TCP_SKB_CB(skb)->when);
+
+                if (remaining) {
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                                                  remaining, TCP_RTO_MAX);
+                } else if (sock_owned_by_user(sk)) {
+                        /* RTO revert clocked out retransmission,
+                         * but socket is locked. Will defer. */
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                                                  HZ/20, TCP_RTO_MAX);
+                } else {
+                        /* RTO revert clocked out retransmission.
+                         * Will retransmit now */
+                        tcp_retransmit_timer(sk);
+                }
+
                 break;
         case ICMP_TIME_EXCEEDED:
                 err = EHOSTUNREACH;
@@ -849,7 +886,7 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                         }
                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
                 }
-                if (tcp_alloc_md5sig_pool() == NULL) {
+                if (tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
@@ -970,8 +1007,9 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
 
         if (!tcp_sk(sk)->md5sig_info) {
                 struct tcp_sock *tp = tcp_sk(sk);
-                struct tcp_md5sig_info *p = kzalloc(sizeof(*p), GFP_KERNEL);
+                struct tcp_md5sig_info *p;
 
+                p = kzalloc(sizeof(*p), sk->sk_allocation);
                 if (!p)
                         return -EINVAL;
 
@@ -979,7 +1017,7 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
 
-        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
+        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, sk->sk_allocation);
         if (!newkey)
                 return -ENOMEM;
         return tcp_v4_md5_do_add(sk, sin->sin_addr.s_addr,
@@ -1158,7 +1196,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
+static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
 };
@@ -1717,7 +1755,7 @@ int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
         return 0;
 }
 
-struct inet_connection_sock_af_ops ipv4_specific = {
+const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
@@ -1737,7 +1775,7 @@ struct inet_connection_sock_af_ops ipv4_specific = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
+static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
         .md5_lookup             = tcp_v4_md5_lookup,
         .calc_md5_hash          = tcp_v4_md5_hash_skb,
         .md5_add                = tcp_v4_md5_add_func,
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index f8d67ccc64f3..e48c37d74d77 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -322,7 +322,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                         if (key != NULL) {
                                 memcpy(&tcptw->tw_md5_key, key->key, key->keylen);
                                 tcptw->tw_md5_keylen = key->keylen;
-                                if (tcp_alloc_md5sig_pool() == NULL)
+                                if (tcp_alloc_md5sig_pool(sk) == NULL)
                                         BUG();
                         }
                 } while (0);
@@ -657,29 +657,6 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
         if (child == NULL)
                 goto listen_overflow;
-#ifdef CONFIG_TCP_MD5SIG
-        else {
-                /* Copy over the MD5 key from the original socket */
-                struct tcp_md5sig_key *key;
-                struct tcp_sock *tp = tcp_sk(sk);
-                key = tp->af_specific->md5_lookup(sk, child);
-                if (key != NULL) {
-                        /*
-                         * We're using one, so create a matching key on the
-                         * newsk structure. If we fail to get memory then we
-                         * end up not copying the key across. Shucks.
-                         */
-                        char *newkey = kmemdup(key->key, key->keylen,
-                                               GFP_ATOMIC);
-                        if (newkey) {
-                                if (!tcp_alloc_md5sig_pool())
-                                        BUG();
-                                tp->af_specific->md5_add(child, child, newkey,
-                                                         key->keylen);
-                        }
-                }
-        }
-#endif
 
         inet_csk_reqsk_queue_unlink(sk, req, prev);
         inet_csk_reqsk_queue_removed(sk, req);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 4e004424d400..5200aab0ca97 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2135,7 +2135,8 @@ void tcp_send_fin(struct sock *sk)
         } else {
                 /* Socket is locked, keep trying until memory is available. */
                 for (;;) {
-                        skb = alloc_skb_fclone(MAX_TCP_HEADER, GFP_KERNEL);
+                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
+                                               sk->sk_allocation);
                         if (skb)
                                 break;
                         yield();
@@ -2388,7 +2389,7 @@ int tcp_connect(struct sock *sk)
         sk->sk_wmem_queued += buff->truesize;
         sk_mem_charge(sk, buff->truesize);
         tp->packets_out += tcp_skb_pcount(buff);
-        tcp_transmit_skb(sk, buff, 1, GFP_KERNEL);
+        tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
 
         /* We change tp->snd_nxt after the tcp_transmit_skb() call
          * in order to make this packet get counted in tcpOutSegs.
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index b144a26359bc..cdb2ca7684d4 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -137,13 +137,14 @@ static int tcp_write_timeout(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         int retry_until;
+        bool do_reset;
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
                         dst_negative_advice(&sk->sk_dst_cache);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
         } else {
-                if (icsk->icsk_retransmits >= sysctl_tcp_retries1) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
@@ -155,13 +156,15 @@ static int tcp_write_timeout(struct sock *sk)
                         const int alive = (icsk->icsk_rto < TCP_RTO_MAX);
 
                         retry_until = tcp_orphan_retries(sk, alive);
+                        do_reset = alive ||
+                                   !retransmits_timed_out(sk, retry_until);
 
-                        if (tcp_out_of_resources(sk, alive || icsk->icsk_retransmits < retry_until))
+                        if (tcp_out_of_resources(sk, do_reset))
                                 return 1;
                 }
         }
 
-        if (icsk->icsk_retransmits >= retry_until) {
+        if (retransmits_timed_out(sk, retry_until)) {
                 /* Has it gone just too far? */
                 tcp_write_err(sk);
                 return 1;
@@ -279,7 +282,7 @@ static void tcp_probe_timer(struct sock *sk)
  *      The TCP retransmit timer.
  */
 
-static void tcp_retransmit_timer(struct sock *sk)
+void tcp_retransmit_timer(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
@@ -385,7 +388,7 @@ static void tcp_retransmit_timer(struct sock *sk)
 out_reset_timer:
         icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (icsk->icsk_retransmits > sysctl_tcp_retries1)
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
                 __sk_dst_reset(sk);
 
 out:;
@@ -499,8 +502,7 @@ static void tcp_keepalive_timer (unsigned long data)
         elapsed = tcp_time_stamp - tp->rcv_tstamp;
 
         if (elapsed >= keepalive_time_when(tp)) {
-                if ((!tp->keepalive_probes && icsk->icsk_probes_out >= sysctl_tcp_keepalive_probes) ||
-                     (tp->keepalive_probes && icsk->icsk_probes_out >= tp->keepalive_probes)) {
+                if (icsk->icsk_probes_out >= keepalive_probes(tp)) {
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                         tcp_write_err(sk);
                         goto out;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 29ebb0d27a1e..ebaaa7f973d7 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -561,12 +561,18 @@ static int udp_push_pending_frames(struct sock *sk)
 
 send:
         err = ip_push_pending_frames(sk);
+        if (err) {
+                if (err == -ENOBUFS && !inet->recverr) {
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                           UDP_MIB_SNDBUFERRORS, is_udplite);
+                        err = 0;
+                }
+        } else
+                UDP_INC_STATS_USER(sock_net(sk),
+                                   UDP_MIB_OUTDATAGRAMS, is_udplite);
 out:
         up->len = 0;
         up->pending = 0;
-        if (!err)
-                UDP_INC_STATS_USER(sock_net(sk),
-                                UDP_MIB_OUTDATAGRAMS, is_udplite);
         return err;
 }
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index bf85d5f97032..a123a328aeb3 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -306,8 +306,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                     v4addr != htonl(INADDR_ANY) &&
                     chk_addr_ret != RTN_LOCAL &&
                     chk_addr_ret != RTN_MULTICAST &&
-                    chk_addr_ret != RTN_BROADCAST)
+                    chk_addr_ret != RTN_BROADCAST) {
+                        err = -EADDRNOTAVAIL;
                         goto out;
+                }
         } else {
                 if (addr_type != IPV6_ADDR_ANY) {
                         struct net_device *dev = NULL;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index eab62a7a8f06..e2325f6a05fb 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -323,7 +323,7 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         int iif = 0;
         int addr_type = 0;
         int len;
-        int hlimit, tclass;
+        int hlimit;
         int err = 0;
 
         if ((u8 *)hdr < skb->head ||
@@ -469,10 +469,6 @@ route_done:
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        tclass = np->tclass;
-        if (tclass < 0)
-                tclass = 0;
-
         msg.skb = skb;
         msg.offset = skb_network_offset(skb);
         msg.type = type;
@@ -488,8 +484,8 @@ route_done:
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
                               len + sizeof(struct icmp6hdr),
-                              sizeof(struct icmp6hdr),
-                              hlimit, tclass, NULL, &fl, (struct rt6_info*)dst,
+                              sizeof(struct icmp6hdr), hlimit,
+                              np->tclass, NULL, &fl, (struct rt6_info*)dst,
                               MSG_DONTWAIT);
         if (err) {
                 ip6_flush_pending_frames(sk);
@@ -522,7 +518,6 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         struct dst_entry *dst;
         int err = 0;
         int hlimit;
-        int tclass;
 
         saddr = &ipv6_hdr(skb)->daddr;
 
@@ -562,10 +557,6 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        tclass = np->tclass;
-        if (tclass < 0)
-                tclass = 0;
-
         idev = in6_dev_get(skb->dev);
 
         msg.skb = skb;
@@ -573,7 +564,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         msg.type = ICMPV6_ECHO_REPLY;
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
-                                sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl,
+                                sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl,
                                 (struct rt6_info*)dst, MSG_DONTWAIT);
 
         if (err) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 93beee944657..cd48801a8d6f 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -194,7 +194,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         struct ipv6hdr *hdr;
         u8  proto = fl->proto;
         int seg_len = skb->len;
-        int hlimit, tclass;
+        int hlimit = -1;
+        int tclass = 0;
         u32 mtu;
 
         if (opt) {
@@ -237,19 +238,13 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         /*
          *      Fill in the IPv6 header
          */
-
-        hlimit = -1;
-        if (np)
+        if (np) {
+                tclass = np->tclass;
                 hlimit = np->hop_limit;
+        }
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        tclass = -1;
-        if (np)
-                tclass = np->tclass;
-        if (tclass < 0)
-                tclass = 0;
-
         *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
 
         hdr->payload_len = htons(seg_len);
@@ -1516,7 +1511,7 @@ int ip6_push_pending_frames(struct sock *sk)
         err = ip6_local_out(skb);
         if (err) {
                 if (err > 0)
-                        err = np->recverr ? net_xmit_errno(err) : 0;
+                        err = net_xmit_errno(err);
                 if (err)
                         goto error;
         }
@@ -1525,6 +1520,7 @@ out:
         ip6_cork_release(inet, np);
         return err;
 error:
+        IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
         goto out;
 }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a1d6045c4694..7d25bbe32110 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1036,7 +1036,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
-static int
+static netdev_tx_t
 ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 07ded5075b33..5c8d73730c75 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -204,7 +204,7 @@ static int ip6mr_vif_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations ip6mr_vif_seq_ops = {
+static const struct seq_operations ip6mr_vif_seq_ops = {
         .start = ip6mr_vif_seq_start,
         .next  = ip6mr_vif_seq_next,
         .stop  = ip6mr_vif_seq_stop,
@@ -217,7 +217,7 @@ static int ip6mr_vif_open(struct inode *inode, struct file *file)
                             sizeof(struct ipmr_vif_iter));
 }
 
-static struct file_operations ip6mr_vif_fops = {
+static const struct file_operations ip6mr_vif_fops = {
         .owner   = THIS_MODULE,
         .open    = ip6mr_vif_open,
         .read    = seq_read,
@@ -341,7 +341,7 @@ static int ipmr_mfc_open(struct inode *inode, struct file *file)
                             sizeof(struct ipmr_mfc_iter));
 }
 
-static struct file_operations ip6mr_mfc_fops = {
+static const struct file_operations ip6mr_mfc_fops = {
         .owner   = THIS_MODULE,
         .open    = ipmr_mfc_open,
         .read    = seq_read,
@@ -416,7 +416,8 @@ static struct inet6_protocol pim6_protocol = {
 
 /* Service routines creating virtual interfaces: PIMREG */
 
-static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
+                                      struct net_device *dev)
 {
         struct net *net = dev_net(dev);
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index a7fdf9a27f15..f5e0682b402d 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -315,6 +315,9 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                         goto e_inval;
                 if (val < -1 || val > 0xff)
                         goto e_inval;
+                /* RFC 3542, 6.5: default traffic class of 0x0 */
+                if (val == -1)
+                        val = 0;
                 np->tclass = val;
                 retv = 0;
                 break;
@@ -1037,8 +1040,6 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
         case IPV6_TCLASS:
                 val = np->tclass;
-                if (val < 0)
-                        val = 0;
                 break;
 
         case IPV6_RECVTCLASS:
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 9eb68e92cc18..7015478797f6 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -98,7 +98,7 @@ static int pndisc_constructor(struct pneigh_entry *n);
 static void pndisc_destructor(struct pneigh_entry *n);
 static void pndisc_redo(struct sk_buff *skb);
 
-static struct neigh_ops ndisc_generic_ops = {
+static const struct neigh_ops ndisc_generic_ops = {
         .family =               AF_INET6,
         .solicit =              ndisc_solicit,
         .error_report =         ndisc_error_report,
@@ -108,7 +108,7 @@ static struct neigh_ops ndisc_generic_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-static struct neigh_ops ndisc_hh_ops = {
+static const struct neigh_ops ndisc_hh_ops = {
         .family =               AF_INET6,
         .solicit =              ndisc_solicit,
         .error_report =         ndisc_error_report,
@@ -119,7 +119,7 @@ static struct neigh_ops ndisc_hh_ops = {
 };
 
 
-static struct neigh_ops ndisc_direct_ops = {
+static const struct neigh_ops ndisc_direct_ops = {
         .family =               AF_INET6,
         .output =               dev_queue_xmit,
         .connected_output =     dev_queue_xmit,
@@ -955,8 +955,8 @@ static void ndisc_recv_na(struct sk_buff *skb)
                  */
                 if (skb->pkt_type != PACKET_LOOPBACK)
                         ND_PRINTK1(KERN_WARNING
-                           "ICMPv6 NA: someone advertises our address on %s!\n",
-                           ifp->idev->dev->name);
+                           "ICMPv6 NA: someone advertises our address %pI6 on %s!\n",
+                           &ifp->addr, ifp->idev->dev->name);
                 in6_ifa_put(ifp);
                 return;
         }
@@ -1151,10 +1151,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                            skb->dev->name);
                 return;
         }
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra) {
-                in6_dev_put(in6_dev);
-                return;
-        }
 
         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
                 in6_dev_put(in6_dev);
@@ -1163,6 +1159,10 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                 return;
         }
 
+        /* skip route and link configuration on routers */
+        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+                goto skip_linkparms;
+
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
         /* skip link-specific parameters from interior routers */
         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
@@ -1283,9 +1283,7 @@ skip_defrtr:
                 }
         }
 
-#ifdef CONFIG_IPV6_NDISC_NODETYPE
 skip_linkparms:
-#endif
 
         /*
          *      Process options.
@@ -1312,6 +1310,10 @@ skip_linkparms:
                              NEIGH_UPDATE_F_ISROUTER);
         }
 
+        /* skip route and link configuration on routers */
+        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+                goto out;
+
 #ifdef CONFIG_IPV6_ROUTE_INFO
         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
                 struct nd_opt_hdr *p;
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 9ab789159913..568864f722ca 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -20,20 +20,9 @@
  *      - Removed unused variable 'inet6_protocol_base'
  *      - Modified inet6_del_protocol() to correctly maintain copy bit.
  */
-
-#include <linux/errno.h>
-#include <linux/types.h>
-#include <linux/socket.h>
-#include <linux/sockios.h>
-#include <linux/net.h>
-#include <linux/in6.h>
+#include <linux/module.h>
 #include <linux/netdevice.h>
-#include <linux/if_arp.h>
-
-#include <net/sock.h>
-#include <net/snmp.h>
-
-#include <net/ipv6.h>
+#include <linux/spinlock.h>
 #include <net/protocol.h>
 
 struct inet6_protocol *inet6_protos[MAX_INET_PROTOS];
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d6c3c1c34b2d..7d675b8d82d3 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -642,7 +642,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
                       dst_output);
         if (err > 0)
-                err = np->recverr ? net_xmit_errno(err) : 0;
+                err = net_xmit_errno(err);
         if (err)
                 goto error;
 out:
@@ -653,6 +653,8 @@ error_fault:
         kfree_skb(skb);
 error:
         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
+        if (err == -ENOBUFS && !np->recverr)
+                err = 0;
         return err;
 }
 
@@ -877,11 +879,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                         hlimit = ip6_dst_hoplimit(dst);
         }
 
-        if (tclass < 0) {
+        if (tclass < 0)
                 tclass = np->tclass;
-                if (tclass < 0)
-                        tclass = 0;
-        }
 
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1473ee0a1f51..9ccfef345560 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -665,7 +665,7 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *dad
                                 net->ipv6.sysctl.ip6_rt_gc_elasticity = 1;
                                 net->ipv6.sysctl.ip6_rt_gc_min_interval = 0;
 
-                                ip6_dst_gc(net->ipv6.ip6_dst_ops);
+                                ip6_dst_gc(&net->ipv6.ip6_dst_ops);
 
                                 net->ipv6.sysctl.ip6_rt_gc_elasticity =
                                         saved_rt_elasticity;
@@ -970,7 +970,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         if (unlikely(idev == NULL))
                 return NULL;
 
-        rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
         if (unlikely(rt == NULL)) {
                 in6_dev_put(idev);
                 goto out;
@@ -1060,7 +1060,7 @@ static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
 static int ip6_dst_gc(struct dst_ops *ops)
 {
         unsigned long now = jiffies;
-        struct net *net = ops->dst_net;
+        struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
         int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
         int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
         int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
@@ -1154,7 +1154,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 goto out;
         }
 
-        rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
 
         if (rt == NULL) {
                 err = -ENOMEM;
@@ -1643,7 +1643,7 @@ out:
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 {
         struct net *net = dev_net(ort->rt6i_dev);
-        struct rt6_info *rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
 
         if (rt) {
                 rt->u.dst.input = ort->u.dst.input;
@@ -1923,7 +1923,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                     int anycast)
 {
         struct net *net = dev_net(idev->dev);
-        struct rt6_info *rt = ip6_dst_alloc(net->ipv6.ip6_dst_ops);
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
         struct neighbour *neigh;
 
         if (rt == NULL)
@@ -2501,7 +2501,7 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
                    net->ipv6.rt6_stats->fib_rt_alloc,
                    net->ipv6.rt6_stats->fib_rt_entries,
                    net->ipv6.rt6_stats->fib_rt_cache,
-                   atomic_read(&net->ipv6.ip6_dst_ops->entries),
+                   atomic_read(&net->ipv6.ip6_dst_ops.entries),
                    net->ipv6.rt6_stats->fib_discarded_routes);
 
         return 0;
@@ -2637,7 +2637,7 @@ struct ctl_table *ipv6_route_sysctl_init(struct net *net)
 
         if (table) {
                 table[0].data = &net->ipv6.sysctl.flush_delay;
-                table[1].data = &net->ipv6.ip6_dst_ops->gc_thresh;
+                table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
                 table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
                 table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
                 table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;
@@ -2655,12 +2655,8 @@ static int ip6_route_net_init(struct net *net)
 {
         int ret = -ENOMEM;
 
-        net->ipv6.ip6_dst_ops = kmemdup(&ip6_dst_ops_template,
-                                        sizeof(*net->ipv6.ip6_dst_ops),
-                                        GFP_KERNEL);
-        if (!net->ipv6.ip6_dst_ops)
-                goto out;
-        net->ipv6.ip6_dst_ops->dst_net = hold_net(net);
+        memcpy(&net->ipv6.ip6_dst_ops, &ip6_dst_ops_template,
+               sizeof(net->ipv6.ip6_dst_ops));
 
         net->ipv6.ip6_null_entry = kmemdup(&ip6_null_entry_template,
                                            sizeof(*net->ipv6.ip6_null_entry),
@@ -2669,7 +2665,7 @@ static int ip6_route_net_init(struct net *net)
                 goto out_ip6_dst_ops;
         net->ipv6.ip6_null_entry->u.dst.path =
                 (struct dst_entry *)net->ipv6.ip6_null_entry;
-        net->ipv6.ip6_null_entry->u.dst.ops = net->ipv6.ip6_dst_ops;
+        net->ipv6.ip6_null_entry->u.dst.ops = &net->ipv6.ip6_dst_ops;
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
@@ -2679,7 +2675,7 @@ static int ip6_route_net_init(struct net *net)
                 goto out_ip6_null_entry;
         net->ipv6.ip6_prohibit_entry->u.dst.path =
                 (struct dst_entry *)net->ipv6.ip6_prohibit_entry;
-        net->ipv6.ip6_prohibit_entry->u.dst.ops = net->ipv6.ip6_dst_ops;
+        net->ipv6.ip6_prohibit_entry->u.dst.ops = &net->ipv6.ip6_dst_ops;
 
         net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
                                                sizeof(*net->ipv6.ip6_blk_hole_entry),
@@ -2688,7 +2684,7 @@ static int ip6_route_net_init(struct net *net)
                 goto out_ip6_prohibit_entry;
         net->ipv6.ip6_blk_hole_entry->u.dst.path =
                 (struct dst_entry *)net->ipv6.ip6_blk_hole_entry;
-        net->ipv6.ip6_blk_hole_entry->u.dst.ops = net->ipv6.ip6_dst_ops;
+        net->ipv6.ip6_blk_hole_entry->u.dst.ops = &net->ipv6.ip6_dst_ops;
 #endif
 
         net->ipv6.sysctl.flush_delay = 0;
@@ -2717,8 +2713,6 @@ out_ip6_null_entry:
         kfree(net->ipv6.ip6_null_entry);
 #endif
 out_ip6_dst_ops:
-        release_net(net->ipv6.ip6_dst_ops->dst_net);
-        kfree(net->ipv6.ip6_dst_ops);
         goto out;
 }
 
@@ -2733,8 +2727,6 @@ static void ip6_route_net_exit(struct net *net)
         kfree(net->ipv6.ip6_prohibit_entry);
         kfree(net->ipv6.ip6_blk_hole_entry);
 #endif
-        release_net(net->ipv6.ip6_dst_ops->dst_net);
-        kfree(net->ipv6.ip6_dst_ops);
 }
 
 static struct pernet_operations ip6_route_net_ops = {
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index d335a306a4db..0ae4f6448187 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -609,7 +609,8 @@ static inline __be32 try_6to4(struct in6_addr *v6dst)
  *      and that skb is filled properly by that function.
  */
 
-static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
+                                     struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct net_device_stats *stats = &tunnel->dev->stats;
@@ -778,7 +779,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         iph->version            =       4;
         iph->ihl                =       sizeof(struct iphdr)>>2;
         if (mtu > IPV6_MIN_MTU)
-                iph->frag_off   =       htons(IP_DF);
+                iph->frag_off   =       tiph->frag_off;
         else
                 iph->frag_off   =       0;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index d849dd53b788..3aae0f217d61 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -75,11 +75,11 @@ static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 
-static struct inet_connection_sock_af_ops ipv6_mapped;
-static struct inet_connection_sock_af_ops ipv6_specific;
+static const struct inet_connection_sock_af_ops ipv6_mapped;
+static const struct inet_connection_sock_af_ops ipv6_specific;
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
-static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
+static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
+static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
 #else
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
                                                    struct in6_addr *addr)
@@ -591,7 +591,7 @@ static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
                         }
                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
                 }
-                if (tcp_alloc_md5sig_pool() == NULL) {
+                if (tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
@@ -894,7 +894,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
+static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 };
@@ -1003,6 +1003,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 
         t1 = (struct tcphdr *) skb_push(buff, tot_len);
+        skb_reset_transport_header(skb);
 
         /* Swap the send and the receive. */
         memset(t1, 0, sizeof(*t1));
@@ -1760,7 +1761,7 @@ static int tcp_v6_remember_stamp(struct sock *sk)
         return 0;
 }
 
-static struct inet_connection_sock_af_ops ipv6_specific = {
+static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
@@ -1780,7 +1781,7 @@ static struct inet_connection_sock_af_ops ipv6_specific = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
+static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
         .md5_lookup     =       tcp_v6_md5_lookup,
         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
         .md5_add        =       tcp_v6_md5_add_func,
@@ -1792,7 +1793,7 @@ static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
  *      TCP over IPv4 via INET6 API
  */
 
-static struct inet_connection_sock_af_ops ipv6_mapped = {
+static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
@@ -1812,7 +1813,7 @@ static struct inet_connection_sock_af_ops ipv6_mapped = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
+static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
         .md5_lookup     =       tcp_v4_md5_lookup,
         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
         .md5_add        =       tcp_v6_md5_add_func,
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d79fa6724451..164040613c2e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -724,12 +724,18 @@ static int udp_v6_push_pending_frames(struct sock *sk)
 
 send:
         err = ip6_push_pending_frames(sk);
+        if (err) {
+                if (err == -ENOBUFS && !inet6_sk(sk)->recverr) {
+                        UDP6_INC_STATS_USER(sock_net(sk),
+                                            UDP_MIB_SNDBUFERRORS, is_udplite);
+                        err = 0;
+                }
+        } else
+                UDP6_INC_STATS_USER(sock_net(sk),
+                                    UDP_MIB_OUTDATAGRAMS, is_udplite);
 out:
         up->len = 0;
         up->pending = 0;
-        if (!err)
-                UDP6_INC_STATS_USER(sock_net(sk),
-                                UDP_MIB_OUTDATAGRAMS, is_udplite);
         return err;
 }
 
@@ -946,11 +952,8 @@ do_udp_sendmsg:
                         hlimit = ip6_dst_hoplimit(dst);
         }
 
-        if (tclass < 0) {
+        if (tclass < 0)
                 tclass = np->tclass;
-                if (tclass < 0)
-                        tclass = 0;
-        }
 
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 417b0e309495..f1118d92a191 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -41,6 +41,7 @@
 #include <linux/netdevice.h>
 #include <linux/uio.h>
 #include <linux/skbuff.h>
+#include <linux/smp_lock.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/string.h>
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index cb762c8723ea..50b43c57d5d8 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -45,6 +45,7 @@
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/smp_lock.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/init.h>
@@ -714,6 +715,7 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
 
+        memset(&saddr, 0, sizeof(saddr));
         if (peer) {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -ENOTCONN;
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 64230cffcfee..7b6b631f647f 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -41,7 +41,8 @@
 
 static int  irlan_eth_open(struct net_device *dev);
 static int  irlan_eth_close(struct net_device *dev);
-static int  irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t  irlan_eth_xmit(struct sk_buff *skb,
+                                         struct net_device *dev);
 static void irlan_eth_set_multicast_list( struct net_device *dev);
 static struct net_device_stats *irlan_eth_get_stats(struct net_device *dev);
 
@@ -162,7 +163,8 @@ static int irlan_eth_close(struct net_device *dev)
  *    Transmits ethernet frames over IrDA link.
  *
  */
-static int irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
+                                        struct net_device *dev)
 {
         struct irlan_cb *self = netdev_priv(dev);
         int ret;
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index bccf4d0059f0..b001c361ad30 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -241,7 +241,6 @@
 #include <linux/module.h>
 
 #include <linux/kernel.h>
-#include <linux/smp_lock.h>
 #include <linux/skbuff.h>
 #include <linux/tty.h>
 #include <linux/proc_fs.h>
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 6d8ae03c14f5..68cbcb19cbd8 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -13,6 +13,7 @@
  *      2) as a control channel (write commands, read events)
  */
 
+#include <linux/smp_lock.h>
 #include "irnet_ppp.h"          /* Private header */
 /* Please put other headers in irnet.h - Thanks */
 
diff --git a/net/irda/irnet/irnet_ppp.h b/net/irda/irnet/irnet_ppp.h
index d9f8bd4ebd05..b5df2418f90c 100644
--- a/net/irda/irnet/irnet_ppp.h
+++ b/net/irda/irnet/irnet_ppp.h
@@ -95,7 +95,7 @@ static int
 /**************************** VARIABLES ****************************/
 
 /* Filesystem callbacks (to call us) */
-static struct file_operations irnet_device_fops =
+static const struct file_operations irnet_device_fops =
 {
         .owner          = THIS_MODULE,
         .read           = dev_irnet_read,
diff --git a/net/irda/irproc.c b/net/irda/irproc.c
index 8ff1861649e8..318766e5dbdf 100644
--- a/net/irda/irproc.c
+++ b/net/irda/irproc.c
@@ -34,21 +34,21 @@
 #include <net/irda/irlap.h>
 #include <net/irda/irlmp.h>
 
-extern struct file_operations discovery_seq_fops;
-extern struct file_operations irlap_seq_fops;
-extern struct file_operations irlmp_seq_fops;
-extern struct file_operations irttp_seq_fops;
-extern struct file_operations irias_seq_fops;
+extern const struct file_operations discovery_seq_fops;
+extern const struct file_operations irlap_seq_fops;
+extern const struct file_operations irlmp_seq_fops;
+extern const struct file_operations irttp_seq_fops;
+extern const struct file_operations irias_seq_fops;
 
 struct irda_entry {
         const char *name;
-        struct file_operations *fops;
+        const struct file_operations *fops;
 };
 
 struct proc_dir_entry *proc_irda;
 EXPORT_SYMBOL(proc_irda);
 
-static struct irda_entry irda_dirs[] = {
+static const struct irda_entry irda_dirs[] = {
         {"discovery",   &discovery_seq_fops},
         {"irttp",       &irttp_seq_fops},
         {"irlmp",       &irlmp_seq_fops},
diff --git a/net/key/af_key.c b/net/key/af_key.c
index dba9abd27f90..4e98193dfa0f 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3705,7 +3705,7 @@ static void pfkey_seq_stop(struct seq_file *f, void *v)
         read_unlock(&pfkey_table_lock);
 }
 
-static struct seq_operations pfkey_seq_ops = {
+static const struct seq_operations pfkey_seq_ops = {
         .start  = pfkey_seq_start,
         .next   = pfkey_seq_next,
         .stop   = pfkey_seq_stop,
@@ -3718,7 +3718,7 @@ static int pfkey_seq_open(struct inode *inode, struct file *file)
                             sizeof(struct seq_net_private));
 }
 
-static struct file_operations pfkey_proc_ops = {
+static const struct file_operations pfkey_proc_ops = {
         .open    = pfkey_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 9208cf5f2bd5..c45eee1c0e8d 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -914,6 +914,7 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
         struct llc_sock *llc = llc_sk(sk);
         int rc = 0;
 
+        memset(&sllc, 0, sizeof(sllc));
         lock_sock(sk);
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 7dd77b6d4c9a..4d5543af3123 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -13,8 +13,7 @@ config MAC80211
 comment "CFG80211 needs to be enabled for MAC80211"
         depends on CFG80211=n
 
-menu "Rate control algorithm selection"
-        depends on MAC80211 != n
+if MAC80211 != n
 
 config MAC80211_RC_PID
         bool "PID controller based rate control algorithm" if EMBEDDED
@@ -61,17 +60,17 @@ config MAC80211_RC_DEFAULT
         default "pid" if MAC80211_RC_DEFAULT_PID
         default ""
 
-endmenu
+endif
 
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
-        depends on BROKEN
         ---help---
          This options enables support of Draft 802.11s mesh networking.
-         The implementation is based on Draft 1.08 of the Mesh Networking
-         amendment. For more information visit http://o11s.org/.
-
+         The implementation is based on Draft 2.08 of the Mesh Networking
+         amendment.  However, no compliance with that draft is claimed or even
+         possible, as drafts leave a number of identifiers to be defined after
+         ratification.  For more information visit http://o11s.org/.
 
 config MAC80211_LEDS
         bool "Enable LED triggers"
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 1958c7c42cd9..bd765f30dba2 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -381,6 +381,14 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
                 &local->hw, queue,
                 IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 
+        if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK))
+                return;
+
+        if (WARN(!sta->ampdu_mlme.tid_tx[tid],
+                 "TID %d gone but expected when splicing aggregates from"
+                 "the pending queue\n", tid))
+                return;
+
         if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 /* copy over remaining packets */
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4bbf5007799b..5608f6c68413 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -323,6 +323,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        sinfo->generation = sdata->local->sta_generation;
+
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
                         STATION_INFO_RX_BYTES |
                         STATION_INFO_TX_BYTES |
@@ -909,6 +911,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         else
                 memset(next_hop, 0, ETH_ALEN);
 
+        pinfo->generation = mesh_paths_generation;
+
         pinfo->filled = MPATH_INFO_FRAME_QLEN |
                         MPATH_INFO_DSN |
                         MPATH_INFO_METRIC |
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index e9ec6cae2d39..61234e79022b 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -116,6 +116,8 @@ IEEE80211_IF_FILE(peer, u.wds.remote_addr, MAC);
 
 #ifdef CONFIG_MAC80211_MESH
 /* Mesh stats attributes */
+IEEE80211_IF_FILE(fwded_mcast, u.mesh.mshstats.fwded_mcast, DEC);
+IEEE80211_IF_FILE(fwded_unicast, u.mesh.mshstats.fwded_unicast, DEC);
 IEEE80211_IF_FILE(fwded_frames, u.mesh.mshstats.fwded_frames, DEC);
 IEEE80211_IF_FILE(dropped_frames_ttl, u.mesh.mshstats.dropped_frames_ttl, DEC);
 IEEE80211_IF_FILE(dropped_frames_no_route,
@@ -205,6 +207,8 @@ static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
 {
         sdata->mesh_stats_dir = debugfs_create_dir("mesh_stats",
                                 sdata->debugfsdir);
+        MESHSTATS_ADD(fwded_mcast);
+        MESHSTATS_ADD(fwded_unicast);
         MESHSTATS_ADD(fwded_frames);
         MESHSTATS_ADD(dropped_frames_ttl);
         MESHSTATS_ADD(dropped_frames_no_route);
@@ -327,6 +331,8 @@ static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
 
 static void del_mesh_stats(struct ieee80211_sub_if_data *sdata)
 {
+        MESHSTATS_DEL(fwded_mcast);
+        MESHSTATS_DEL(fwded_unicast);
         MESHSTATS_DEL(fwded_frames);
         MESHSTATS_DEL(dropped_frames_ttl);
         MESHSTATS_DEL(dropped_frames_no_route);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 4100c361a99d..020a94a31106 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -12,7 +12,11 @@ static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
 
 static inline int drv_start(struct ieee80211_local *local)
 {
-        int ret = local->ops->start(&local->hw);
+        int ret;
+
+        local->started = true;
+        smp_mb();
+        ret = local->ops->start(&local->hw);
         trace_drv_start(local, ret);
         return ret;
 }
@@ -21,6 +25,14 @@ static inline void drv_stop(struct ieee80211_local *local)
 {
         local->ops->stop(&local->hw);
         trace_drv_stop(local);
+
+        /* sync away all work on the tasklet before clearing started */
+        tasklet_disable(&local->tasklet);
+        tasklet_enable(&local->tasklet);
+
+        barrier();
+
+        local->started = false;
 }
 
 static inline int drv_add_interface(struct ieee80211_local *local,
@@ -55,16 +67,32 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
         trace_drv_bss_info_changed(local, vif, info, changed);
 }
 
+static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
+                                        int mc_count,
+                                        struct dev_addr_list *mc_list)
+{
+        u64 ret = 0;
+
+        if (local->ops->prepare_multicast)
+                ret = local->ops->prepare_multicast(&local->hw, mc_count,
+                                                    mc_list);
+
+        trace_drv_prepare_multicast(local, mc_count, ret);
+
+        return ret;
+}
+
 static inline void drv_configure_filter(struct ieee80211_local *local,
                                         unsigned int changed_flags,
                                         unsigned int *total_flags,
-                                        int mc_count,
-                                        struct dev_addr_list *mc_list)
+                                        u64 multicast)
 {
+        might_sleep();
+
         local->ops->configure_filter(&local->hw, changed_flags, total_flags,
-                                     mc_count, mc_list);
+                                     multicast);
         trace_drv_configure_filter(local, changed_flags, total_flags,
-                                            mc_count);
+                                   multicast);
 }
 
 static inline int drv_set_tim(struct ieee80211_local *local,
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 5a10da2d70fd..37b9051afcf3 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -191,31 +191,55 @@ TRACE_EVENT(drv_bss_info_changed,
         )
 );
 
+TRACE_EVENT(drv_prepare_multicast,
+        TP_PROTO(struct ieee80211_local *local, int mc_count, u64 ret),
+
+        TP_ARGS(local, mc_count, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, mc_count)
+                __field(u64, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->mc_count = mc_count;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " prepare mc (%d): %llx",
+                LOCAL_PR_ARG, __entry->mc_count,
+                (unsigned long long) __entry->ret
+        )
+);
+
 TRACE_EVENT(drv_configure_filter,
         TP_PROTO(struct ieee80211_local *local,
                  unsigned int changed_flags,
                  unsigned int *total_flags,
-                 int mc_count),
+                 u64 multicast),
 
-        TP_ARGS(local, changed_flags, total_flags, mc_count),
+        TP_ARGS(local, changed_flags, total_flags, multicast),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 __field(unsigned int, changed)
                 __field(unsigned int, total)
-                __field(int, mc)
+                __field(u64, multicast)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 __entry->changed = changed_flags;
                 __entry->total = *total_flags;
-                __entry->mc = mc_count;
+                __entry->multicast = multicast;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " changed:%#x total:%#x mc:%d",
-                LOCAL_PR_ARG, __entry->changed, __entry->total, __entry->mc
+                LOCAL_PR_FMT " changed:%#x total:%#x",
+                LOCAL_PR_ARG, __entry->changed, __entry->total
         )
 );
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 630a438180fd..588005c84a6d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -212,7 +212,9 @@ struct ieee80211_if_vlan {
 };
 
 struct mesh_stats {
-        __u32 fwded_frames;             /* Mesh forwarded frames */
+        __u32 fwded_mcast;              /* Mesh forwarded multicast frames */
+        __u32 fwded_unicast;            /* Mesh forwarded unicast frames */
+        __u32 fwded_frames;             /* Mesh total forwarded frames */
         __u32 dropped_frames_ttl;       /* Not transmitted since mesh_ttl == 0*/
         __u32 dropped_frames_no_route;  /* Not transmitted, no route found */
         atomic_t estab_plinks;
@@ -284,6 +286,7 @@ struct ieee80211_if_managed {
 
         struct mutex mtx;
         struct ieee80211_bss *associated;
+        struct ieee80211_mgd_work *old_associate_work;
         struct list_head work_list;
 
         u8 bssid[ETH_ALEN];
@@ -354,7 +357,7 @@ struct ieee80211_if_mesh {
 
         unsigned long timers_running;
 
-        bool housekeeping;
+        unsigned long wrkq_flags;
 
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
         size_t mesh_id_len;
@@ -364,6 +367,10 @@ struct ieee80211_if_mesh {
         u8 mesh_pm_id[4];
         /* Congestion Control Mode Identifier */
         u8 mesh_cc_id[4];
+        /* Synchronization Protocol Identifier */
+        u8 mesh_sp_id[4];
+        /* Authentication Protocol Identifier */
+        u8 mesh_auth_id[4];
         /* Local mesh Destination Sequence Number */
         u32 dsn;
         /* Last used PREQ ID */
@@ -505,6 +512,8 @@ struct ieee80211_sub_if_data {
 #ifdef CONFIG_MAC80211_MESH
         struct dentry *mesh_stats_dir;
         struct {
+                struct dentry *fwded_mcast;
+                struct dentry *fwded_unicast;
                 struct dentry *fwded_frames;
                 struct dentry *dropped_frames_ttl;
                 struct dentry *dropped_frames_no_route;
@@ -635,6 +644,9 @@ struct ieee80211_local {
         /* protects the aggregated multicast list and filter calls */
         spinlock_t filter_lock;
 
+        /* used for uploading changed mc list */
+        struct work_struct reconfig_filter;
+
         /* aggregated multicast list */
         struct dev_addr_list *mc_list;
         int mc_count;
@@ -655,6 +667,9 @@ struct ieee80211_local {
          */
         bool quiescing;
 
+        /* device is started */
+        bool started;
+
         int tx_headroom; /* required headroom for hardware/radiotap */
 
         /* Tasklet and skb queue to process calls from IRQ mode. All frames
@@ -677,6 +692,7 @@ struct ieee80211_local {
         struct list_head sta_list;
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
+        int sta_generation;
 
         struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
@@ -713,7 +729,7 @@ struct ieee80211_local {
         struct mutex scan_mtx;
         unsigned long scanning;
         struct cfg80211_ssid scan_ssid;
-        struct cfg80211_scan_request int_scan_req;
+        struct cfg80211_scan_request *int_scan_req;
         struct cfg80211_scan_request *scan_req;
         struct ieee80211_channel *scan_channel;
         const u8 *orig_ies;
@@ -1034,8 +1050,10 @@ void ieee80211_recalc_idle(struct ieee80211_local *local);
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
-int ieee80211_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
-int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
+netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
+                                         struct net_device *dev);
+netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+                                       struct net_device *dev);
 
 /* HT */
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
@@ -1073,6 +1091,7 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
 
 /* Suspend/resume and hw reconfiguration */
 int ieee80211_reconfig(struct ieee80211_local *local);
+void ieee80211_stop_device(struct ieee80211_local *local);
 
 #ifdef CONFIG_PM
 int __ieee80211_suspend(struct ieee80211_hw *hw);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index e8fb03b91a44..f6005adcbf90 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -227,9 +227,7 @@ static int ieee80211_open(struct net_device *dev)
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss++;
 
-                spin_lock_bh(&local->filter_lock);
                 ieee80211_configure_filter(local);
-                spin_unlock_bh(&local->filter_lock);
                 break;
         default:
                 conf.vif = &sdata->vif;
@@ -241,17 +239,13 @@ static int ieee80211_open(struct net_device *dev)
 
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
                         local->fif_other_bss++;
-                        spin_lock_bh(&local->filter_lock);
                         ieee80211_configure_filter(local);
-                        spin_unlock_bh(&local->filter_lock);
 
                         ieee80211_start_mesh(sdata);
                 } else if (sdata->vif.type == NL80211_IFTYPE_AP) {
                         local->fif_pspoll++;
 
-                        spin_lock_bh(&local->filter_lock);
                         ieee80211_configure_filter(local);
-                        spin_unlock_bh(&local->filter_lock);
                 }
 
                 changed |= ieee80211_reset_erp_info(sdata);
@@ -283,11 +277,6 @@ static int ieee80211_open(struct net_device *dev)
                 }
         }
 
-        if (local->open_count == 0) {
-                tasklet_enable(&local->tx_pending_tasklet);
-                tasklet_enable(&local->tasklet);
-        }
-
         /*
          * set_multicast_list will be invoked by the networking core
          * which will check whether any increments here were done in
@@ -404,10 +393,11 @@ static int ieee80211_stop(struct net_device *dev)
         spin_lock_bh(&local->filter_lock);
         __dev_addr_unsync(&local->mc_list, &local->mc_count,
                           &dev->mc_list, &dev->mc_count);
-        ieee80211_configure_filter(local);
         spin_unlock_bh(&local->filter_lock);
         netif_addr_unlock_bh(dev);
 
+        ieee80211_configure_filter(local);
+
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
@@ -458,9 +448,7 @@ static int ieee80211_stop(struct net_device *dev)
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss--;
 
-                spin_lock_bh(&local->filter_lock);
                 ieee80211_configure_filter(local);
-                spin_unlock_bh(&local->filter_lock);
                 break;
         case NL80211_IFTYPE_STATION:
                 del_timer_sync(&sdata->u.mgd.chswitch_timer);
@@ -503,38 +491,14 @@ static int ieee80211_stop(struct net_device *dev)
                         local->fif_other_bss--;
                         atomic_dec(&local->iff_allmultis);
 
-                        spin_lock_bh(&local->filter_lock);
                         ieee80211_configure_filter(local);
-                        spin_unlock_bh(&local->filter_lock);
 
                         ieee80211_stop_mesh(sdata);
                 }
                 /* fall through */
         default:
-                if (local->scan_sdata == sdata) {
-                        if (!local->ops->hw_scan)
-                                cancel_delayed_work_sync(&local->scan_work);
-                        /*
-                         * The software scan can no longer run now, so we can
-                         * clear out the scan_sdata reference. However, the
-                         * hardware scan may still be running. The complete
-                         * function must be prepared to handle a NULL value.
-                         */
-                        local->scan_sdata = NULL;
-                        /*
-                         * The memory barrier guarantees that another CPU
-                         * that is hardware-scanning will now see the fact
-                         * that this interface is gone.
-                         */
-                        smp_mb();
-                        /*
-                         * If software scanning, complete the scan but since
-                         * the scan_sdata is NULL already don't send out a
-                         * scan event to userspace -- the scan is incomplete.
-                         */
-                        if (test_bit(SCAN_SW_SCANNING, &local->scanning))
-                                ieee80211_scan_completed(&local->hw, true);
-                }
+                if (local->scan_sdata == sdata)
+                        ieee80211_scan_cancel(local);
 
                 /*
                  * Disable beaconing for AP and mesh, IBSS can't
@@ -561,14 +525,8 @@ static int ieee80211_stop(struct net_device *dev)
         ieee80211_recalc_ps(local, -1);
 
         if (local->open_count == 0) {
-                drv_stop(local);
-
-                ieee80211_led_radio(local, false);
-
-                flush_workqueue(local->workqueue);
-
-                tasklet_disable(&local->tx_pending_tasklet);
-                tasklet_disable(&local->tasklet);
+                ieee80211_clear_tx_pending(local);
+                ieee80211_stop_device(local);
 
                 /* no reconfiguring after stop! */
                 hw_reconf_flags = 0;
@@ -622,8 +580,8 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
         spin_lock_bh(&local->filter_lock);
         __dev_addr_sync(&local->mc_list, &local->mc_count,
                         &dev->mc_list, &dev->mc_count);
-        ieee80211_configure_filter(local);
         spin_unlock_bh(&local->filter_lock);
+        ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 }
 
 /*
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0c4f8e122ed6..797f53942e5f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -50,9 +50,9 @@ struct ieee80211_tx_status_rtap_hdr {
 } __attribute__ ((packed));
 
 
-/* must be called under mdev tx lock */
 void ieee80211_configure_filter(struct ieee80211_local *local)
 {
+        u64 mc;
         unsigned int changed_flags;
         unsigned int new_flags = 0;
 
@@ -62,7 +62,7 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         if (atomic_read(&local->iff_allmultis))
                 new_flags |= FIF_ALLMULTI;
 
-        if (local->monitors)
+        if (local->monitors || local->scanning)
                 new_flags |= FIF_BCN_PRBRESP_PROMISC;
 
         if (local->fif_fcsfail)
@@ -80,20 +80,30 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         if (local->fif_pspoll)
                 new_flags |= FIF_PSPOLL;
 
+        spin_lock_bh(&local->filter_lock);
         changed_flags = local->filter_flags ^ new_flags;
 
+        mc = drv_prepare_multicast(local, local->mc_count, local->mc_list);
+        spin_unlock_bh(&local->filter_lock);
+
         /* be a bit nasty */
         new_flags |= (1<<31);
 
-        drv_configure_filter(local, changed_flags, &new_flags,
-                             local->mc_count,
-                             local->mc_list);
+        drv_configure_filter(local, changed_flags, &new_flags, mc);
 
         WARN_ON(new_flags & (1<<31));
 
         local->filter_flags = new_flags & ~(1<<31);
 }
 
+static void ieee80211_reconfig_filter(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, reconfig_filter);
+
+        ieee80211_configure_filter(local);
+}
+
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
         struct ieee80211_channel *chan, *scan_chan;
@@ -231,9 +241,6 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 
         drv_bss_info_changed(local, &sdata->vif,
                              &sdata->vif.bss_conf, changed);
-
-        /* DEPRECATED */
-        local->hw.conf.beacon_int = sdata->vif.bss_conf.beacon_int;
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
@@ -475,6 +482,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 }
 
                 rate_control_tx_status(local, sband, sta, skb);
+                if (ieee80211_vif_is_mesh(&sta->sdata->vif))
+                        ieee80211s_update_metric(local, sta, skb);
         }
 
         rcu_read_unlock();
@@ -677,7 +686,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.max_rates = 1;
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
-        local->hw.conf.radio_enabled = true;
         local->user_power_level = -1;
 
         INIT_LIST_HEAD(&local->interfaces);
@@ -692,6 +700,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         INIT_WORK(&local->restart_work, ieee80211_restart_work);
 
+        INIT_WORK(&local->reconfig_filter, ieee80211_reconfig_filter);
+
         INIT_WORK(&local->dynamic_ps_enable_work,
                   ieee80211_dynamic_ps_enable_work);
         INIT_WORK(&local->dynamic_ps_disable_work,
@@ -705,12 +715,10 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                 skb_queue_head_init(&local->pending[i]);
         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
                      (unsigned long)local);
-        tasklet_disable(&local->tx_pending_tasklet);
 
         tasklet_init(&local->tasklet,
                      ieee80211_tasklet_handler,
                      (unsigned long) local);
-        tasklet_disable(&local->tasklet);
 
         skb_queue_head_init(&local->skb_queue);
         skb_queue_head_init(&local->skb_queue_unreliable);
@@ -765,9 +773,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 supp_ht = supp_ht || sband->ht_cap.ht_supported;
         }
 
-        local->int_scan_req.n_channels = channels;
-        local->int_scan_req.channels = kzalloc(sizeof(void *) * channels, GFP_KERNEL);
-        if (!local->int_scan_req.channels)
+        local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
+                                      sizeof(void *) * channels, GFP_KERNEL);
+        if (!local->int_scan_req)
                 return -ENOMEM;
 
         /* if low-level driver supports AP, we also support VLAN */
@@ -882,13 +890,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         /* alloc internal scan request */
         i = 0;
-        local->int_scan_req.ssids = &local->scan_ssid;
-        local->int_scan_req.n_ssids = 1;
+        local->int_scan_req->ssids = &local->scan_ssid;
+        local->int_scan_req->n_ssids = 1;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (!hw->wiphy->bands[band])
                         continue;
                 for (j = 0; j < hw->wiphy->bands[band]->n_channels; j++) {
-                        local->int_scan_req.channels[i] =
+                        local->int_scan_req->channels[i] =
                                 &hw->wiphy->bands[band]->channels[j];
                         i++;
                 }
@@ -920,7 +928,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
  fail_workqueue:
         wiphy_unregister(local->hw.wiphy);
  fail_wiphy_register:
-        kfree(local->int_scan_req.channels);
+        kfree(local->int_scan_req);
         return result;
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
@@ -946,6 +954,8 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
+        cancel_work_sync(&local->reconfig_filter);
+
         ieee80211_clear_tx_pending(local);
         sta_info_stop(local);
         rate_control_deinitialize(local);
@@ -962,7 +972,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
-        kfree(local->int_scan_req.channels);
+        kfree(local->int_scan_req);
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 2f4f518ab45c..f7364e56f1ee 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -18,8 +18,11 @@
 #define PP_OFFSET       1               /* Path Selection Protocol */
 #define PM_OFFSET       5               /* Path Selection Metric   */
 #define CC_OFFSET       9               /* Congestion Control Mode */
-#define CAPAB_OFFSET 17
-#define ACCEPT_PLINKS 0x80
+#define SP_OFFSET       13              /* Synchronization Protocol */
+#define AUTH_OFFSET     17              /* Authentication Protocol */
+#define CAPAB_OFFSET    22
+#define CAPAB_ACCEPT_PLINKS 0x80
+#define CAPAB_FORWARDING    0x10
 
 #define TMR_RUNNING_HK  0
 #define TMR_RUNNING_MP  1
@@ -47,14 +50,14 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        ifmsh->housekeeping = true;
+        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
 
         if (local->quiescing) {
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
                 return;
         }
 
-        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
 /**
@@ -84,7 +87,9 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
                 memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
                 memcmp(ifmsh->mesh_pp_id, ie->mesh_config + PP_OFFSET, 4) == 0 &&
                 memcmp(ifmsh->mesh_pm_id, ie->mesh_config + PM_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_cc_id, ie->mesh_config + CC_OFFSET, 4) == 0)
+                memcmp(ifmsh->mesh_cc_id, ie->mesh_config + CC_OFFSET, 4) == 0 &&
+                memcmp(ifmsh->mesh_sp_id, ie->mesh_config + SP_OFFSET, 4) == 0 &&
+                memcmp(ifmsh->mesh_auth_id, ie->mesh_config + AUTH_OFFSET, 4) == 0)
                 return true;
 
         return false;
@@ -97,7 +102,7 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
  */
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
 {
-        return (*(ie->mesh_config + CAPAB_OFFSET) & ACCEPT_PLINKS) != 0;
+        return (*(ie->mesh_config + CAPAB_OFFSET) & CAPAB_ACCEPT_PLINKS) != 0;
 }
 
 /**
@@ -123,11 +128,18 @@ void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
 
 void mesh_ids_set_default(struct ieee80211_if_mesh *sta)
 {
-        u8 def_id[4] = {0x00, 0x0F, 0xAC, 0xff};
-
-        memcpy(sta->mesh_pp_id, def_id, 4);
-        memcpy(sta->mesh_pm_id, def_id, 4);
-        memcpy(sta->mesh_cc_id, def_id, 4);
+        u8 oui[3] = {0x00, 0x0F, 0xAC};
+
+        memcpy(sta->mesh_pp_id, oui, sizeof(oui));
+        memcpy(sta->mesh_pm_id, oui, sizeof(oui));
+        memcpy(sta->mesh_cc_id, oui, sizeof(oui));
+        memcpy(sta->mesh_sp_id, oui, sizeof(oui));
+        memcpy(sta->mesh_auth_id, oui, sizeof(oui));
+        sta->mesh_pp_id[sizeof(oui)] = 0;
+        sta->mesh_pm_id[sizeof(oui)] = 0;
+        sta->mesh_cc_id[sizeof(oui)] = 0xff;
+        sta->mesh_sp_id[sizeof(oui)] = 0xff;
+        sta->mesh_auth_id[sizeof(oui)] = 0x0;
 }
 
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
@@ -245,7 +257,7 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         if (sdata->u.mesh.mesh_id_len)
                 memcpy(pos, sdata->u.mesh.mesh_id, sdata->u.mesh.mesh_id_len);
 
-        pos = skb_put(skb, 21);
+        pos = skb_put(skb, 2 + IEEE80211_MESH_CONFIG_LEN);
         *pos++ = WLAN_EID_MESH_CONFIG;
         *pos++ = IEEE80211_MESH_CONFIG_LEN;
         /* Version */
@@ -263,15 +275,22 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         memcpy(pos, sdata->u.mesh.mesh_cc_id, 4);
         pos += 4;
 
-        /* Channel precedence:
-         * Not running simple channel unification protocol
-         */
-        memset(pos, 0x00, 4);
+        /* Synchronization protocol identifier */
+        memcpy(pos, sdata->u.mesh.mesh_sp_id, 4);
         pos += 4;
 
+        /* Authentication Protocol identifier */
+        memcpy(pos, sdata->u.mesh.mesh_auth_id, 4);
+        pos += 4;
+
+        /* Mesh Formation Info */
+        memset(pos, 0x00, 1);
+        pos += 1;
+
         /* Mesh capability */
         sdata->u.mesh.accepting_plinks = mesh_plink_availables(sdata);
-        *pos++ = sdata->u.mesh.accepting_plinks ? ACCEPT_PLINKS : 0x00;
+        *pos = CAPAB_FORWARDING;
+        *pos++ |= sdata->u.mesh.accepting_plinks ? CAPAB_ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
         return;
@@ -320,30 +339,6 @@ struct mesh_table *mesh_table_alloc(int size_order)
         return newtbl;
 }
 
-static void __mesh_table_free(struct mesh_table *tbl)
-{
-        kfree(tbl->hash_buckets);
-        kfree(tbl->hashwlock);
-        kfree(tbl);
-}
-
-void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
-{
-        struct hlist_head *mesh_hash;
-        struct hlist_node *p, *q;
-        int i;
-
-        mesh_hash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++) {
-                spin_lock(&tbl->hashwlock[i]);
-                hlist_for_each_safe(p, q, &mesh_hash[i]) {
-                        tbl->free_node(p, free_leafs);
-                        atomic_dec(&tbl->entries);
-                }
-                spin_unlock(&tbl->hashwlock[i]);
-        }
-        __mesh_table_free(tbl);
-}
 
 static void ieee80211_mesh_path_timer(unsigned long data)
 {
@@ -357,63 +352,79 @@ static void ieee80211_mesh_path_timer(unsigned long data)
                 return;
         }
 
-        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
-struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
-{
-        struct mesh_table *newtbl;
-        struct hlist_head *oldhash;
-        struct hlist_node *p, *q;
-        int i;
-
-        if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
-                goto endgrow;
-
-        newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl)
-                goto endgrow;
-
-        newtbl->free_node = tbl->free_node;
-        newtbl->mean_chain_len = tbl->mean_chain_len;
-        newtbl->copy_node = tbl->copy_node;
-        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
-
-        oldhash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++)
-                hlist_for_each(p, &oldhash[i])
-                        if (tbl->copy_node(p, newtbl) < 0)
-                                goto errcopy;
-
-        return newtbl;
-
-errcopy:
-        for (i = 0; i <= newtbl->hash_mask; i++) {
-                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
-                        tbl->free_node(p, 0);
+/**
+ * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
+ * @hdr:        802.11 frame header
+ * @fc:         frame control field
+ * @meshda:     destination address in the mesh
+ * @meshsa:     source address address in the mesh.  Same as TA, as frame is
+ *              locally originated.
+ *
+ * Return the length of the 802.11 (does not include a mesh control header)
+ */
+int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc, char
+                *meshda, char *meshsa) {
+        if (is_multicast_ether_addr(meshda)) {
+                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+                /* DA TA SA */
+                memcpy(hdr->addr1, meshda, ETH_ALEN);
+                memcpy(hdr->addr2, meshsa, ETH_ALEN);
+                memcpy(hdr->addr3, meshsa, ETH_ALEN);
+                return 24;
+        } else {
+                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
+                                IEEE80211_FCTL_TODS);
+                /* RA TA DA SA */
+                memset(hdr->addr1, 0, ETH_ALEN);   /* RA is resolved later */
+                memcpy(hdr->addr2, meshsa, ETH_ALEN);
+                memcpy(hdr->addr3, meshda, ETH_ALEN);
+                memcpy(hdr->addr4, meshsa, ETH_ALEN);
+                return 30;
         }
-        __mesh_table_free(newtbl);
-endgrow:
-        return NULL;
 }
 
 /**
  * ieee80211_new_mesh_header - create a new mesh header
  * @meshhdr:    uninitialized mesh header
  * @sdata:      mesh interface to be used
+ * @addr4:      addr4 of the mesh frame (1st in ae header)
+ *              may be NULL
+ * @addr5:      addr5 of the mesh frame (1st or 2nd in ae header)
+ *              may be NULL unless addr6 is present
+ * @addr6:      addr6 of the mesh frame (2nd or 3rd in ae header)
+ *              may be NULL unless addr5 is present
  *
  * Return the header length.
  */
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
-                struct ieee80211_sub_if_data *sdata)
+                struct ieee80211_sub_if_data *sdata, char *addr4,
+                char *addr5, char *addr6)
 {
-        meshhdr->flags = 0;
+        int aelen = 0;
+        memset(meshhdr, 0, sizeof(meshhdr));
         meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
         put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
         sdata->u.mesh.mesh_seqnum++;
-
-        return 6;
+        if (addr4) {
+                meshhdr->flags |= MESH_FLAGS_AE_A4;
+                aelen += ETH_ALEN;
+                memcpy(meshhdr->eaddr1, addr4, ETH_ALEN);
+        }
+        if (addr5 && addr6) {
+                meshhdr->flags |= MESH_FLAGS_AE_A5_A6;
+                aelen += 2 * ETH_ALEN;
+                if (!addr4) {
+                        memcpy(meshhdr->eaddr1, addr5, ETH_ALEN);
+                        memcpy(meshhdr->eaddr2, addr6, ETH_ALEN);
+                } else {
+                        memcpy(meshhdr->eaddr2, addr5, ETH_ALEN);
+                        memcpy(meshhdr->eaddr3, addr6, ETH_ALEN);
+                }
+        }
+        return 6 + aelen;
 }
 
 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
@@ -433,7 +444,6 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
         if (free_plinks != sdata->u.mesh.accepting_plinks)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 
-        ifmsh->housekeeping = false;
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
 }
@@ -470,10 +480,12 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
 
-        ifmsh->housekeeping = true;
-        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
+        sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
-                                                BSS_CHANGED_BEACON_ENABLED);
+                                                BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_BEACON_INT);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
@@ -608,7 +620,13 @@ static void ieee80211_mesh_work(struct work_struct *work)
                        ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
                 mesh_path_start_discovery(sdata);
 
-        if (ifmsh->housekeeping)
+        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
+                mesh_mpath_table_grow();
+
+        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
+                mesh_mpp_table_grow();
+
+        if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
                 ieee80211_mesh_housekeeping(sdata, ifmsh);
 }
 
@@ -619,7 +637,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
                 if (ieee80211_vif_is_mesh(&sdata->vif))
-                        ieee80211_queue_work(local->hw.workqueue, &sdata->u.mesh.work);
+                        ieee80211_queue_work(&local->hw, &sdata->u.mesh.work);
         rcu_read_unlock();
 }
 
@@ -692,7 +710,7 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
                 skb_queue_tail(&ifmsh->skb_queue, skb);
-                ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
                 return RX_QUEUED;
         }
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 2a2ed182cb7e..dd1c19319f0a 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -44,6 +44,23 @@ enum mesh_path_flags {
 };
 
 /**
+ * enum mesh_deferred_task_flags - mac80211 mesh deferred tasks
+ *
+ *
+ *
+ * @MESH_WORK_HOUSEKEEPING: run the periodic mesh housekeeping tasks
+ * @MESH_WORK_GROW_MPATH_TABLE: the mesh path table is full and needs
+ * to grow.
+ * @MESH_WORK_GROW_MPP_TABLE: the mesh portals table is full and needs to
+ * grow
+ */
+enum mesh_deferred_task_flags {
+        MESH_WORK_HOUSEKEEPING,
+        MESH_WORK_GROW_MPATH_TABLE,
+        MESH_WORK_GROW_MPP_TABLE,
+};
+
+/**
  * struct mesh_path - mac80211 mesh path structure
  *
  * @dst: mesh path destination mac address
@@ -61,7 +78,7 @@ enum mesh_path_flags {
  *      retry
  * @discovery_retries: number of discovery retries
  * @flags: mesh path flags, as specified on &enum mesh_path_flags
- * @state_lock: mesh pat state lock
+ * @state_lock: mesh path state lock
  *
  *
  * The combination of dst and sdata is unique in the mesh path table. Since the
@@ -174,6 +191,7 @@ struct mesh_rmc {
  */
 #define MESH_PATH_REFRESH_TIME                  1000
 #define MESH_MIN_DISCOVERY_TIMEOUT (2 * MESH_DIAM_TRAVERSAL_TIME)
+#define MESH_DEFAULT_BEACON_INTERVAL            1000    /* in 1024 us units */
 
 #define MESH_MAX_PREQ_RETRIES 4
 #define MESH_PATH_EXPIRE (600 * HZ)
@@ -193,8 +211,11 @@ struct mesh_rmc {
 
 /* Public interfaces */
 /* Various */
+int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
+                char *da, char *sa);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
-                struct ieee80211_sub_if_data *sdata);
+                struct ieee80211_sub_if_data *sdata, char *addr4,
+                char *addr5, char *addr6);
 int mesh_rmc_check(u8 *addr, struct ieee80211s_hdr *mesh_hdr,
                 struct ieee80211_sub_if_data *sdata);
 bool mesh_matches_local(struct ieee802_11_elems *ie,
@@ -205,6 +226,8 @@ void mesh_mgmt_ies_add(struct sk_buff *skb,
 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_init(void);
+void ieee80211s_update_metric(struct ieee80211_local *local,
+                struct sta_info *stainfo, struct sk_buff *skb);
 void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
@@ -246,7 +269,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
 /* Mesh tables */
 struct mesh_table *mesh_table_alloc(int size_order);
 void mesh_table_free(struct mesh_table *tbl, bool free_leafs);
-struct mesh_table *mesh_table_grow(struct mesh_table *tbl);
+void mesh_mpath_table_grow(void);
+void mesh_mpp_table_grow(void);
 u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
                 struct mesh_table *tbl);
 /* Mesh paths */
@@ -265,6 +289,8 @@ void mesh_path_discard_frame(struct sk_buff *skb,
 void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
 void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
 
+extern int mesh_paths_generation;
+
 #ifdef CONFIG_MAC80211_MESH
 extern int mesh_allocated;
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 11ab71a68ff9..e12a786e26b8 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -201,6 +201,24 @@ int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
         return 0;
 }
 
+void ieee80211s_update_metric(struct ieee80211_local *local,
+                struct sta_info *stainfo, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        int failed;
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return;
+
+        failed = !(txinfo->flags & IEEE80211_TX_STAT_ACK);
+
+        /* moving average, scaled to 100 */
+        stainfo->fail_avg = ((80 * stainfo->fail_avg + 5) / 100 + 20 * failed);
+        if (stainfo->fail_avg > 95)
+                mesh_plink_broken(stainfo);
+}
+
 static u32 airtime_link_metric_get(struct ieee80211_local *local,
                                    struct sta_info *sta)
 {
@@ -397,7 +415,8 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
 static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
-                                    u8 *preq_elem, u32 metric) {
+                                    u8 *preq_elem, u32 metric)
+{
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
         u8 *dst_addr, *orig_addr;
@@ -430,7 +449,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         if ((!(mpath->flags & MESH_PATH_DSN_VALID)) ||
                                         DSN_LT(mpath->dsn, dst_dsn)) {
                                 mpath->dsn = dst_dsn;
-                                mpath->flags &= MESH_PATH_DSN_VALID;
+                                mpath->flags |= MESH_PATH_DSN_VALID;
                         } else if ((!(dst_flags & MP_F_DO)) &&
                                         (mpath->flags & MESH_PATH_ACTIVE)) {
                                 reply = true;
@@ -478,6 +497,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                 hopcount, ttl, cpu_to_le32(lifetime),
                                 cpu_to_le32(metric), cpu_to_le32(preq_id),
                                 sdata);
+                ifmsh->mshstats.fwded_mcast++;
                 ifmsh->mshstats.fwded_frames++;
         }
 }
@@ -536,6 +556,8 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                 cpu_to_le32(lifetime), cpu_to_le32(metric),
                 0, sdata);
         rcu_read_unlock();
+
+        sdata->u.mesh.mshstats.fwded_unicast++;
         sdata->u.mesh.mshstats.fwded_frames++;
         return;
 
@@ -660,14 +682,14 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         spin_unlock(&ifmsh->mesh_preq_queue_lock);
 
         if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
-                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
 
         else if (time_before(jiffies, ifmsh->last_preq)) {
                 /* avoid long wait if did not send preqs for a long time
                  * and jiffies wrapped around
                  */
                 ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
-                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
         } else
                 mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
                                                 min_preq_int_jiff(sdata));
@@ -791,7 +813,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         }
 
         if (mpath->flags & MESH_PATH_ACTIVE) {
-                if (time_after(jiffies, mpath->exp_time -
+                if (time_after(jiffies, mpath->exp_time +
                         msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time))
                                 && !memcmp(sdata->dev->dev_addr, hdr->addr4,
                                            ETH_ALEN)
@@ -810,10 +832,8 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                 }
 
                 if (skb_queue_len(&mpath->frame_queue) >=
-                                MESH_FRAME_QUEUE_LEN) {
-                        skb_to_free = mpath->frame_queue.next;
-                        skb_unlink(skb_to_free, &mpath->frame_queue);
-                }
+                                MESH_FRAME_QUEUE_LEN)
+                        skb_to_free = skb_dequeue(&mpath->frame_queue);
 
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 skb_queue_tail(&mpath->frame_queue, skb);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 04b9e4d61b8e..751c4d0e2b36 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -38,6 +38,71 @@ struct mpath_node {
 static struct mesh_table *mesh_paths;
 static struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
 
+int mesh_paths_generation;
+static void __mesh_table_free(struct mesh_table *tbl)
+{
+        kfree(tbl->hash_buckets);
+        kfree(tbl->hashwlock);
+        kfree(tbl);
+}
+
+void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
+{
+        struct hlist_head *mesh_hash;
+        struct hlist_node *p, *q;
+        int i;
+
+        mesh_hash = tbl->hash_buckets;
+        for (i = 0; i <= tbl->hash_mask; i++) {
+                spin_lock(&tbl->hashwlock[i]);
+                hlist_for_each_safe(p, q, &mesh_hash[i]) {
+                        tbl->free_node(p, free_leafs);
+                        atomic_dec(&tbl->entries);
+                }
+                spin_unlock(&tbl->hashwlock[i]);
+        }
+        __mesh_table_free(tbl);
+}
+
+static struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
+{
+        struct mesh_table *newtbl;
+        struct hlist_head *oldhash;
+        struct hlist_node *p, *q;
+        int i;
+
+        if (atomic_read(&tbl->entries)
+                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
+                goto endgrow;
+
+        newtbl = mesh_table_alloc(tbl->size_order + 1);
+        if (!newtbl)
+                goto endgrow;
+
+        newtbl->free_node = tbl->free_node;
+        newtbl->mean_chain_len = tbl->mean_chain_len;
+        newtbl->copy_node = tbl->copy_node;
+        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
+
+        oldhash = tbl->hash_buckets;
+        for (i = 0; i <= tbl->hash_mask; i++)
+                hlist_for_each(p, &oldhash[i])
+                        if (tbl->copy_node(p, newtbl) < 0)
+                                goto errcopy;
+
+        return newtbl;
+
+errcopy:
+        for (i = 0; i <= newtbl->hash_mask; i++) {
+                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
+                        tbl->free_node(p, 0);
+        }
+        __mesh_table_free(newtbl);
+endgrow:
+        return NULL;
+}
+
+
 /* This lock will have the grow table function as writer and add / delete nodes
  * as readers. When reading the table (i.e. doing lookups) we are well protected
  * by RCU
@@ -185,6 +250,8 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
  */
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -193,8 +260,6 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        might_sleep();
-
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -206,11 +271,11 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
                 return -ENOSPC;
 
         err = -ENOMEM;
-        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
+        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_ATOMIC);
         if (!new_mpath)
                 goto err_path_alloc;
 
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
         if (!new_node)
                 goto err_node_alloc;
 
@@ -243,23 +308,13 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
                 mesh_paths->mean_chain_len * (mesh_paths->hash_mask + 1))
                 grow = 1;
 
+        mesh_paths_generation++;
+
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
-                struct mesh_table *oldtbl, *newtbl;
-
-                write_lock(&pathtbl_resize_lock);
-                oldtbl = mesh_paths;
-                newtbl = mesh_table_grow(mesh_paths);
-                if (!newtbl) {
-                        write_unlock(&pathtbl_resize_lock);
-                        return 0;
-                }
-                rcu_assign_pointer(mesh_paths, newtbl);
-                write_unlock(&pathtbl_resize_lock);
-
-                synchronize_rcu();
-                mesh_table_free(oldtbl, false);
+                set_bit(MESH_WORK_GROW_MPATH_TABLE,  &ifmsh->wrkq_flags);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
         }
         return 0;
 
@@ -274,9 +329,46 @@ err_path_alloc:
         return err;
 }
 
+void mesh_mpath_table_grow(void)
+{
+        struct mesh_table *oldtbl, *newtbl;
+
+        write_lock(&pathtbl_resize_lock);
+        oldtbl = mesh_paths;
+        newtbl = mesh_table_grow(mesh_paths);
+        if (!newtbl) {
+                write_unlock(&pathtbl_resize_lock);
+                return;
+        }
+        rcu_assign_pointer(mesh_paths, newtbl);
+        write_unlock(&pathtbl_resize_lock);
+
+        synchronize_rcu();
+        mesh_table_free(oldtbl, false);
+}
+
+void mesh_mpp_table_grow(void)
+{
+        struct mesh_table *oldtbl, *newtbl;
+
+        write_lock(&pathtbl_resize_lock);
+        oldtbl = mpp_paths;
+        newtbl = mesh_table_grow(mpp_paths);
+        if (!newtbl) {
+                write_unlock(&pathtbl_resize_lock);
+                return;
+        }
+        rcu_assign_pointer(mpp_paths, newtbl);
+        write_unlock(&pathtbl_resize_lock);
+
+        synchronize_rcu();
+        mesh_table_free(oldtbl, false);
+}
 
 int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -285,8 +377,6 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        might_sleep();
-
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -295,11 +385,11 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
                 return -ENOTSUPP;
 
         err = -ENOMEM;
-        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
+        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_ATOMIC);
         if (!new_mpath)
                 goto err_path_alloc;
 
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
         if (!new_node)
                 goto err_node_alloc;
 
@@ -333,20 +423,8 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         spin_unlock(&mpp_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
-                struct mesh_table *oldtbl, *newtbl;
-
-                write_lock(&pathtbl_resize_lock);
-                oldtbl = mpp_paths;
-                newtbl = mesh_table_grow(mpp_paths);
-                if (!newtbl) {
-                        write_unlock(&pathtbl_resize_lock);
-                        return 0;
-                }
-                rcu_assign_pointer(mpp_paths, newtbl);
-                write_unlock(&pathtbl_resize_lock);
-
-                synchronize_rcu();
-                mesh_table_free(oldtbl, false);
+                set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
         }
         return 0;
 
@@ -484,6 +562,7 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
 
         err = -ENXIO;
 enddel:
+        mesh_paths_generation++;
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         return err;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index cb14253587f1..ffcbad75e09b 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -409,7 +409,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
         if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
                 baseaddr += 4;
-                baselen -= 4;
+                baselen += 4;
         }
         ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
         if (!elems.peer_link) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6d5a1ee0445f..97a278a2f48e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -880,10 +880,11 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_bss *bss,
+                                     struct ieee80211_mgd_work *wk,
                                      u32 bss_info_changed)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss = wk->bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
         /* set timing information */
@@ -896,6 +897,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 bss->cbss.capability, bss->has_erp_value, bss->erp_value);
 
         sdata->u.mgd.associated = bss;
+        sdata->u.mgd.old_associate_work = wk;
         memcpy(sdata->u.mgd.bssid, bss->cbss.bssid, ETH_ALEN);
 
         /* just to be sure */
@@ -1010,7 +1012,8 @@ ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
         return RX_MGMT_NONE;
 }
 
-static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
+                                   bool deauth)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
@@ -1028,6 +1031,16 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
         ifmgd->associated = NULL;
         memset(ifmgd->bssid, 0, ETH_ALEN);
 
+        if (deauth) {
+                kfree(ifmgd->old_associate_work);
+                ifmgd->old_associate_work = NULL;
+        } else {
+                struct ieee80211_mgd_work *wk = ifmgd->old_associate_work;
+
+                wk->state = IEEE80211_MGD_STATE_IDLE;
+                list_add(&wk->list, &ifmgd->work_list);
+        }
+
         /*
          * we need to commit the associated = NULL change because the
          * scan code uses that to determine whether this iface should
@@ -1345,7 +1358,7 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                         sdata->dev->name, bssid, reason_code);
 
         if (!wk) {
-                ieee80211_set_disassoc(sdata);
+                ieee80211_set_disassoc(sdata, true);
         } else {
                 list_del(&wk->list);
                 kfree(wk);
@@ -1378,7 +1391,7 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
                         sdata->dev->name, reason_code);
 
-        ieee80211_set_disassoc(sdata);
+        ieee80211_set_disassoc(sdata, false);
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
@@ -1581,7 +1594,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, wk->bss, changed);
+        /* this will take ownership of wk */
+        ieee80211_set_associated(sdata, wk, changed);
 
         /*
          * Start timer to probe the connection to the AP now.
@@ -1590,7 +1604,6 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
         mod_beacon_timer(sdata);
 
-        kfree(wk);
         return RX_MGMT_CFG80211_ASSOC;
 }
 
@@ -2096,7 +2109,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                         printk(KERN_DEBUG "No probe response from AP %pM"
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
-                        ieee80211_set_disassoc(sdata);
+                        ieee80211_set_disassoc(sdata, true);
                         mutex_unlock(&ifmgd->mtx);
                         /*
                          * must be outside lock due to cfg80211,
@@ -2110,25 +2123,9 @@ static void ieee80211_sta_work(struct work_struct *work)
                 }
         }
 
-        list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (wk->state != IEEE80211_MGD_STATE_IDLE) {
-                        anybusy = true;
-                        break;
-                }
-        }
 
         ieee80211_recalc_idle(local);
 
-        if (!anybusy) {
-                mutex_unlock(&ifmgd->mtx);
-
-                if (test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
-                        ieee80211_queue_delayed_work(&local->hw,
-                                                     &local->scan_work,
-                                                     round_jiffies_relative(0));
-                return;
-        }
-
         list_for_each_entry_safe(wk, tmp, &ifmgd->work_list, list) {
                 if (time_is_after_jiffies(wk->timeout)) {
                         /*
@@ -2174,6 +2171,18 @@ static void ieee80211_sta_work(struct work_struct *work)
                 }
         }
 
+        list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (wk->state != IEEE80211_MGD_STATE_IDLE) {
+                        anybusy = true;
+                        break;
+                }
+        }
+        if (!anybusy &&
+            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
+                ieee80211_queue_delayed_work(&local->hw,
+                                             &local->scan_work,
+                                             round_jiffies_relative(0));
+
         mutex_unlock(&ifmgd->mtx);
 
         list_for_each_entry_safe(wk, tmp, &free_work, list) {
@@ -2500,7 +2509,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 
         if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
                 bssid = req->bss->bssid;
-                ieee80211_set_disassoc(sdata);
+                ieee80211_set_disassoc(sdata, true);
         } else list_for_each_entry(wk, &ifmgd->work_list, list) {
                 if (&wk->bss->cbss == req->bss) {
                         bssid = req->bss->bssid;
@@ -2552,7 +2561,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                 return -ENOLINK;
         }
 
-        ieee80211_set_disassoc(sdata);
+        ieee80211_set_disassoc(sdata, false);
 
         mutex_unlock(&ifmgd->mtx);
 
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index a5d2f1fb4417..e535f1c988fe 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -107,17 +107,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         }
 
         /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
-
-        /*
-         * flush again, in case driver queued work -- it
-         * shouldn't be doing (or cancel everything in the
-         * stop callback) that but better safe than sorry.
-         */
-        flush_workqueue(local->workqueue);
+        if (local->open_count)
+                ieee80211_stop_device(local);
 
         local->suspended = true;
         /* need suspended to be visible before quiescing is false */
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 869fe0ef951d..38bf4168fc3a 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -33,7 +33,6 @@ struct minstrel_rate {
 
         /* per-rate throughput */
         u32 cur_tp;
-        u32 throughput;
 
         u64 succ_hist;
         u64 att_hist;
diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index 98f480708050..a715d9454f64 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -83,7 +83,7 @@ minstrel_stats_open(struct inode *inode, struct file *file)
                 p += sprintf(p, "%3u%s", mr->bitrate / 2,
                                 (mr->bitrate & 1 ? ".5" : "  "));
 
-                tp = ((mr->cur_tp * 96) / 18000) >> 10;
+                tp = mr->cur_tp / ((18000 << 10) / 96);
                 prob = mr->cur_prob / 18;
                 eprob = mr->probability / 18;
 
@@ -139,7 +139,7 @@ minstrel_stats_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static struct file_operations minstrel_stat_fops = {
+static const struct file_operations minstrel_stat_fops = {
         .owner = THIS_MODULE,
         .open = minstrel_stats_open,
         .read = minstrel_stats_read,
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 8c053be9dc24..699d3ed869c4 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -169,19 +169,9 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
          * still a good measurement and copy it. */
         if (unlikely(spinfo->tx_num_xmit == 0))
                 pf = spinfo->last_pf;
-        else {
-                /* XXX: BAD HACK!!! */
-                struct sta_info *si = container_of(sta, struct sta_info, sta);
-
+        else
                 pf = spinfo->tx_num_failed * 100 / spinfo->tx_num_xmit;
 
-                if (ieee80211_vif_is_mesh(&si->sdata->vif) && pf == 100)
-                        mesh_plink_broken(si);
-                pf <<= RC_PID_ARITH_SHIFT;
-                si->fail_avg = ((pf + (spinfo->last_pf << 3)) / 9)
-                                        >> RC_PID_ARITH_SHIFT;
-        }
-
         spinfo->tx_num_xmit = 0;
         spinfo->tx_num_failed = 0;
 
@@ -311,7 +301,6 @@ rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
         struct rc_pid_sta_info *spinfo = priv_sta;
         struct rc_pid_info *pinfo = priv;
         struct rc_pid_rateinfo *rinfo = pinfo->rinfo;
-        struct sta_info *si;
         int i, j, tmp;
         bool s;
 
@@ -348,9 +337,6 @@ rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
         }
 
         spinfo->txrate_idx = rate_lowest_index(sband, sta);
-        /* HACK */
-        si = container_of(sta, struct sta_info, sta);
-        si->fail_avg = 0;
 }
 
 static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index a08a9b530347..a59043fbb0ff 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -198,7 +198,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
 
 #undef RC_PID_PRINT_BUF_SIZE
 
-static struct file_operations rc_pid_fop_events = {
+static const struct file_operations rc_pid_fop_events = {
         .owner = THIS_MODULE,
         .read = rate_control_pid_events_read,
         .poll = rate_control_pid_events_poll,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 25a669c86e14..c01588f9d453 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -489,12 +489,21 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        char *dev_addr = rx->dev->dev_addr;
 
         if (ieee80211_is_data(hdr->frame_control)) {
-                if (!ieee80211_has_a4(hdr->frame_control))
-                        return RX_DROP_MONITOR;
-                if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
-                        return RX_DROP_MONITOR;
+                if (is_multicast_ether_addr(hdr->addr1)) {
+                        if (ieee80211_has_tods(hdr->frame_control) ||
+                                !ieee80211_has_fromds(hdr->frame_control))
+                                return RX_DROP_MONITOR;
+                        if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
+                                return RX_DROP_MONITOR;
+                } else {
+                        if (!ieee80211_has_a4(hdr->frame_control))
+                                return RX_DROP_MONITOR;
+                        if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
+                                return RX_DROP_MONITOR;
+                }
         }
 
         /* If there is not an established peer link and this is not a peer link
@@ -527,7 +536,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
         if (ieee80211_is_data(hdr->frame_control) &&
             is_multicast_ether_addr(hdr->addr1) &&
-            mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
+            mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
                 return RX_DROP_MONITOR;
 #undef msh_h_get
 
@@ -1495,7 +1504,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 /* illegal frame */
                 return RX_DROP_MONITOR;
 
-        if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
+        if (!is_multicast_ether_addr(hdr->addr1) &&
+                        (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6)) {
                 struct mesh_path *mppath;
 
                 rcu_read_lock();
@@ -1512,7 +1522,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 rcu_read_unlock();
         }
 
-        if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
+        /* Frame has reached destination.  Don't forward */
+        if (!is_multicast_ether_addr(hdr->addr1) &&
+                        compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
                 return RX_CONTINUE;
 
         mesh_hdr->ttl--;
@@ -1532,27 +1544,32 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                                                    rx->dev->name);
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
-                        /*
-                         * Save TA to addr1 to send TA a path error if a
-                         * suitable next hop is not found
-                         */
-                        memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
                         memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
                         info = IEEE80211_SKB_CB(fwd_skb);
                         memset(info, 0, sizeof(*info));
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         info->control.vif = &rx->sdata->vif;
                         ieee80211_select_queue(local, fwd_skb);
-                        if (is_multicast_ether_addr(fwd_hdr->addr3))
-                                memcpy(fwd_hdr->addr1, fwd_hdr->addr3,
-                                                ETH_ALEN);
+                        if (is_multicast_ether_addr(fwd_hdr->addr1))
+                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
+                                                                fwded_mcast);
                         else {
-                                int err = mesh_nexthop_lookup(fwd_skb, sdata);
+                                int err;
+                                /*
+                                 * Save TA to addr1 to send TA a path error if a
+                                 * suitable next hop is not found
+                                 */
+                                memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
+                                                ETH_ALEN);
+                                err = mesh_nexthop_lookup(fwd_skb, sdata);
                                 /* Failed to immediately resolve next hop:
                                  * fwded frame was dropped or will be added
                                  * later to the pending skb queue.  */
                                 if (err)
                                         return RX_DROP_MONITOR;
+
+                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
+                                                                fwded_unicast);
                         }
                         IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
                                                      fwded_frames);
@@ -1560,7 +1577,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 }
         }
 
-        if (is_multicast_ether_addr(hdr->addr3) ||
+        if (is_multicast_ether_addr(hdr->addr1) ||
             rx->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;
         else
@@ -2423,24 +2440,20 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
  * This is the receive path handler. It is called by a low level driver when an
  * 802.11 MPDU is received from the hardware.
  */
-void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
+void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate = NULL;
         struct ieee80211_supported_band *sband;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-        if (status->band < 0 ||
-            status->band >= IEEE80211_NUM_BANDS) {
-                WARN_ON(1);
-                return;
-        }
+        if (WARN_ON(status->band < 0 ||
+                    status->band >= IEEE80211_NUM_BANDS))
+                goto drop;
 
         sband = local->hw.wiphy->bands[status->band];
-        if (!sband) {
-                WARN_ON(1);
-                return;
-        }
+        if (WARN_ON(!sband))
+                goto drop;
 
         /*
          * If we're suspending, it is possible although not too likely
@@ -2449,16 +2462,21 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * that might, for example, cause stations to be added or other
          * driver callbacks be invoked.
          */
-        if (unlikely(local->quiescing || local->suspended)) {
-                kfree_skb(skb);
-                return;
-        }
+        if (unlikely(local->quiescing || local->suspended))
+                goto drop;
+
+        /*
+         * The same happens when we're not even started,
+         * but that's worth a warning.
+         */
+        if (WARN_ON(!local->started))
+                goto drop;
 
         if (status->flag & RX_FLAG_HT) {
                 /* rate_idx is MCS index */
                 if (WARN_ON(status->rate_idx < 0 ||
                             status->rate_idx >= 76))
-                        return;
+                        goto drop;
                 /* HT rates are not in the table - use the highest legacy rate
                  * for now since other parts of mac80211 may not yet be fully
                  * MCS aware. */
@@ -2466,7 +2484,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
         } else {
                 if (WARN_ON(status->rate_idx < 0 ||
                             status->rate_idx >= sband->n_bitrates))
-                        return;
+                        goto drop;
                 rate = &sband->bitrates[status->rate_idx];
         }
 
@@ -2505,8 +2523,12 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 __ieee80211_rx_handle_packet(hw, skb, rate);
 
         rcu_read_unlock();
+
+        return;
+ drop:
+        kfree_skb(skb);
 }
-EXPORT_SYMBOL(__ieee80211_rx);
+EXPORT_SYMBOL(ieee80211_rx);
 
 /* This is a version of the rx handler that can be called from hard irq
  * context. Post the skb on the queue and schedule the tasklet */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 244f53f3c8b4..039901109fa1 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -277,9 +277,10 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (test_bit(SCAN_HW_SCANNING, &local->scanning))
                 ieee80211_restore_scan_ies(local);
 
-        if (local->scan_req != &local->int_scan_req)
+        if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
+        local->scan_sdata = NULL;
 
         was_hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
         local->scanning = 0;
@@ -292,13 +293,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (was_hw_scan)
                 goto done;
 
-        spin_lock_bh(&local->filter_lock);
-        local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
-        drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
-                             &local->filter_flags,
-                             local->mc_count,
-                             local->mc_list);
-        spin_unlock_bh(&local->filter_lock);
+        ieee80211_configure_filter(local);
 
         drv_sw_scan_complete(local);
 
@@ -376,13 +371,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
-        spin_lock_bh(&local->filter_lock);
-        local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
-        drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
-                             &local->filter_flags,
-                             local->mc_count,
-                             local->mc_list);
-        spin_unlock_bh(&local->filter_lock);
+        ieee80211_configure_filter(local);
 
         /* TODO: start scan as soon as all nullfunc frames are ACKed */
         ieee80211_queue_delayed_work(&local->hw,
@@ -423,7 +412,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         local->scan_req = req;
         local->scan_sdata = sdata;
 
-        if (req != &local->int_scan_req &&
+        if (req != local->int_scan_req &&
             sdata->vif.type == NL80211_IFTYPE_STATION &&
             !list_empty(&ifmgd->work_list)) {
                 /* actually wait for the work it's doing to finish/time out */
@@ -672,6 +661,7 @@ void ieee80211_scan_work(struct work_struct *work)
                 int rc;
 
                 local->scan_req = NULL;
+                local->scan_sdata = NULL;
 
                 rc = __ieee80211_start_scan(sdata, req);
                 mutex_unlock(&local->scan_mtx);
@@ -743,10 +733,10 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
         if (local->scan_req)
                 goto unlock;
 
-        memcpy(local->int_scan_req.ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
-        local->int_scan_req.ssids[0].ssid_len = ssid_len;
+        memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
+        local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
-        ret = __ieee80211_start_scan(sdata, &sdata->local->int_scan_req);
+        ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
  unlock:
         mutex_unlock(&local->scan_mtx);
         return ret;
@@ -754,7 +744,7 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
 
 void ieee80211_scan_cancel(struct ieee80211_local *local)
 {
-        bool swscan;
+        bool abortscan;
 
         cancel_delayed_work_sync(&local->scan_work);
 
@@ -763,9 +753,10 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
          * queued -- mostly at suspend under RTNL.
          */
         mutex_lock(&local->scan_mtx);
-        swscan = test_bit(SCAN_SW_SCANNING, &local->scanning);
+        abortscan = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+                    (!local->scanning && local->scan_req);
         mutex_unlock(&local->scan_mtx);
 
-        if (swscan)
+        if (abortscan)
                 ieee80211_scan_completed(&local->hw, true);
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a360bceeba59..eec001491e66 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -349,6 +349,7 @@ int sta_info_insert(struct sta_info *sta)
                 goto out_free;
         }
         list_add(&sta->list, &local->sta_list);
+        local->sta_generation++;
         local->num_sta++;
         sta_info_hash_add(local, sta);
 
@@ -485,6 +486,7 @@ static void __sta_info_unlink(struct sta_info **sta)
         }
 
         local->num_sta--;
+        local->sta_generation++;
 
         if (local->ops->sta_notify) {
                 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 7cffaa046b33..5143d203256b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -317,30 +317,30 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (!atomic_read(&tx->sdata->bss->num_sta_ps))
                 return TX_CONTINUE;
 
+        /* buffered in hardware */
+        if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)) {
+                info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+
+                return TX_CONTINUE;
+        }
+
         /* buffered in mac80211 */
-        if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) {
-                if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
-                        purge_old_ps_buffers(tx->local);
-                if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
-                    AP_MAX_BC_BUFFER) {
+        if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
+                purge_old_ps_buffers(tx->local);
+
+        if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >= AP_MAX_BC_BUFFER) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                        if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: BC TX buffer full - "
-                                       "dropping the oldest frame\n",
-                                       tx->dev->name);
-                        }
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: BC TX buffer full - dropping the oldest frame\n",
+                               tx->dev->name);
 #endif
-                        dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
-                } else
-                        tx->local->total_ps_buffered++;
-                skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
-                return TX_QUEUED;
-        }
+                dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
+        } else
+                tx->local->total_ps_buffered++;
 
-        /* buffered in hardware */
-        info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+        skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
 
-        return TX_CONTINUE;
+        return TX_QUEUED;
 }
 
 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
@@ -700,7 +700,6 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
                 /* for pure STA mode without beacons, we can do it */
                 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
                 tx->sdata->sequence_number += 0x10;
-                tx->sdata->sequence_number &= IEEE80211_SCTL_SEQ;
                 return TX_CONTINUE;
         }
 
@@ -844,6 +843,23 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
+{
+        struct sk_buff *skb = tx->skb;
+
+        if (!tx->sta)
+                return TX_CONTINUE;
+
+        tx->sta->tx_packets++;
+        do {
+                tx->sta->tx_fragments++;
+                tx->sta->tx_bytes += skb->len;
+        } while ((skb = skb->next));
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
         if (!tx->key)
@@ -887,23 +903,6 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
-{
-        struct sk_buff *skb = tx->skb;
-
-        if (!tx->sta)
-                return TX_CONTINUE;
-
-        tx->sta->tx_packets++;
-        do {
-                tx->sta->tx_fragments++;
-                tx->sta->tx_bytes += skb->len;
-        } while ((skb = skb->next));
-
-        return TX_CONTINUE;
-}
-
 /* actual transmit path */
 
 /*
@@ -1154,6 +1153,9 @@ static int __ieee80211_tx(struct ieee80211_local *local,
                 next = skb->next;
                 len = skb->len;
 
+                if (next)
+                        info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
+
                 sdata = vif_to_sdata(info->control.vif);
 
                 switch (sdata->vif.type) {
@@ -1210,9 +1212,9 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         CALL_TXH(ieee80211_tx_h_sequence)
         CALL_TXH(ieee80211_tx_h_fragment)
         /* handlers after fragment must be aware of tx info fragmentation! */
+        CALL_TXH(ieee80211_tx_h_stats)
         CALL_TXH(ieee80211_tx_h_encrypt)
         CALL_TXH(ieee80211_tx_h_calculate_duration)
-        CALL_TXH(ieee80211_tx_h_stats)
 #undef CALL_TXH
 
  txh_done:
@@ -1410,16 +1412,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
         info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        if (ieee80211_vif_is_mesh(&sdata->vif) &&
-            ieee80211_is_data(hdr->frame_control)) {
-                if (is_multicast_ether_addr(hdr->addr3))
-                        memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
-                else
-                        if (mesh_nexthop_lookup(skb, sdata)) {
-                                dev_put(sdata->dev);
-                                return;
-                        }
-        } else if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
+        if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
                 int hdrlen;
                 u16 len_rthdr;
 
@@ -1476,13 +1469,22 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
         info->control.vif = &sdata->vif;
 
+        if (ieee80211_vif_is_mesh(&sdata->vif) &&
+            ieee80211_is_data(hdr->frame_control) &&
+                !is_multicast_ether_addr(hdr->addr1))
+                        if (mesh_nexthop_lookup(skb, sdata)) {
+                                /* skb queued: don't free */
+                                dev_put(sdata->dev);
+                                return;
+                        }
+
         ieee80211_select_queue(local, skb);
         ieee80211_tx(sdata, skb, false);
         dev_put(sdata->dev);
 }
 
-int ieee80211_monitor_start_xmit(struct sk_buff *skb,
-                                 struct net_device *dev)
+netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
+                                         struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_channel *chan = local->hw.conf.channel;
@@ -1566,8 +1568,8 @@ fail:
  * encapsulated packet will then be passed to master interface, wlan#.11, for
  * transmission (through low-level driver).
  */
-int ieee80211_subif_start_xmit(struct sk_buff *skb,
-                               struct net_device *dev)
+netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+                                    struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -1617,52 +1619,58 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
-                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
                         /* Do not send frames with mesh_ttl == 0 */
                         sdata->u.mesh.mshstats.dropped_frames_ttl++;
                         ret = NETDEV_TX_OK;
                         goto fail;
                 }
-                memset(&mesh_hdr, 0, sizeof(mesh_hdr));
 
                 if (compare_ether_addr(dev->dev_addr,
                                           skb->data + ETH_ALEN) == 0) {
-                        /* RA TA DA SA */
-                        memset(hdr.addr1, 0, ETH_ALEN);
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
-                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
-                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
+                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
+                                        skb->data, skb->data + ETH_ALEN);
+                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
+                                        sdata, NULL, NULL, NULL);
                 } else {
                         /* packet from other interface */
                         struct mesh_path *mppath;
+                        int is_mesh_mcast = 1;
+                        char *mesh_da;
 
-                        memset(hdr.addr1, 0, ETH_ALEN);
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
-                        memcpy(hdr.addr4, dev->dev_addr, ETH_ALEN);
-
+                        rcu_read_lock();
                         if (is_multicast_ether_addr(skb->data))
-                                memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                                /* DA TA mSA AE:SA */
+                                mesh_da = skb->data;
                         else {
-                                rcu_read_lock();
                                 mppath = mpp_path_lookup(skb->data, sdata);
-                                if (mppath)
-                                        memcpy(hdr.addr3, mppath->mpp, ETH_ALEN);
-                                else
-                                        memset(hdr.addr3, 0xff, ETH_ALEN);
-                                rcu_read_unlock();
+                                if (mppath) {
+                                        /* RA TA mDA mSA AE:DA SA */
+                                        mesh_da = mppath->mpp;
+                                        is_mesh_mcast = 0;
+                                } else
+                                        /* DA TA mSA AE:SA */
+                                        mesh_da = dev->broadcast;
                         }
+                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
+                                        mesh_da, dev->dev_addr);
+                        rcu_read_unlock();
+                        if (is_mesh_mcast)
+                                meshhdrlen =
+                                        ieee80211_new_mesh_header(&mesh_hdr,
+                                                        sdata,
+                                                        skb->data + ETH_ALEN,
+                                                        NULL,
+                                                        NULL);
+                        else
+                                meshhdrlen =
+                                        ieee80211_new_mesh_header(&mesh_hdr,
+                                                        sdata,
+                                                        NULL,
+                                                        skb->data,
+                                                        skb->data + ETH_ALEN);
 
-                        mesh_hdr.flags |= MESH_FLAGS_AE_A5_A6;
-                        mesh_hdr.ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
-                        put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &mesh_hdr.seqnum);
-                        memcpy(mesh_hdr.eaddr1, skb->data, ETH_ALEN);
-                        memcpy(mesh_hdr.eaddr2, skb->data + ETH_ALEN, ETH_ALEN);
-                        sdata->u.mesh.mesh_seqnum++;
-                        meshhdrlen = 18;
                 }
-                hdrlen = 30;
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index e55d57f559ec..dd6564321369 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1007,6 +1007,16 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
         return supp_rates;
 }
 
+void ieee80211_stop_device(struct ieee80211_local *local)
+{
+        ieee80211_led_radio(local, false);
+
+        cancel_work_sync(&local->reconfig_filter);
+        drv_stop(local);
+
+        flush_workqueue(local->workqueue);
+}
+
 int ieee80211_reconfig(struct ieee80211_local *local)
 {
         struct ieee80211_hw *hw = &local->hw;
@@ -1076,9 +1086,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         /* reconfigure hardware */
         ieee80211_hw_config(local, ~0);
 
-        spin_lock_bh(&local->filter_lock);
         ieee80211_configure_filter(local);
-        spin_unlock_bh(&local->filter_lock);
 
         /* Finally also reconfigure all the BSS information */
         list_for_each_entry(sdata, &local->interfaces, list) {
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 43f5676b1af4..d80b8192e0d4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -74,7 +74,7 @@ static unsigned int
 xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         const struct xt_rateest_target_info *info = par->targinfo;
-        struct gnet_stats_basic *stats = &info->est->bstats;
+        struct gnet_stats_basic_packed *stats = &info->est->bstats;
 
         spin_lock_bh(&info->est->lock);
         stats->bytes += skb->len;
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 98fc190e8f0e..390b7d09fe51 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -52,7 +52,7 @@ static bool quota_mt_check(const struct xt_mtchk_param *par)
 
         q->master = kmalloc(sizeof(*q->master), GFP_KERNEL);
         if (q->master == NULL)
-                return -ENOMEM;
+                return false;
 
         q->master->quota = q->quota;
         return true;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 575c64341508..66f6ba0bab11 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -136,7 +136,7 @@ int genl_register_mc_group(struct genl_family *family,
 {
         int id;
         unsigned long *new_groups;
-        int err;
+        int err = 0;
 
         BUG_ON(grp->name[0] == '\0');
 
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ce51ce012cda..ce1a34b99c23 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -847,6 +847,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
                 sax->fsa_ax25.sax25_family = AF_NETROM;
                 sax->fsa_ax25.sax25_ndigis = 1;
                 sax->fsa_ax25.sax25_call   = nr->user_addr;
+                memset(sax->fsa_digipeater, 0, sizeof(sax->fsa_digipeater));
                 sax->fsa_digipeater[0]     = nr->dest_addr;
                 *uaddr_len = sizeof(struct full_sockaddr_ax25);
         } else {
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index c7b7838a0519..7aa11b01b2e2 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -169,7 +169,7 @@ static int nr_close(struct net_device *dev)
         return 0;
 }
 
-static int nr_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t nr_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct net_device_stats *stats = &dev->stats;
         unsigned int len = skb->len;
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index e943c16552a2..4eb1ac9a7679 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -630,23 +630,23 @@ out:
         return dev;
 }
 
-static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters)
+static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
+        ax25_address *digipeaters)
 {
-        static ax25_digi ax25_digi;
         int i;
 
         if (ndigis == 0)
                 return NULL;
 
         for (i = 0; i < ndigis; i++) {
-                ax25_digi.calls[i]    = digipeaters[i];
-                ax25_digi.repeated[i] = 0;
+                digi->calls[i]    = digipeaters[i];
+                digi->repeated[i] = 0;
         }
 
-        ax25_digi.ndigi      = ndigis;
-        ax25_digi.lastrepeat = -1;
+        digi->ndigi      = ndigis;
+        digi->lastrepeat = -1;
 
-        return &ax25_digi;
+        return digi;
 }
 
 /*
@@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
 {
         struct nr_route_struct nr_route;
         struct net_device *dev;
+        ax25_digi digi;
         int ret;
 
         switch (cmd) {
@@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
                         ret = nr_add_node(&nr_route.callsign,
                                 nr_route.mnemonic,
                                 &nr_route.neighbour,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                 dev, nr_route.quality,
                                 nr_route.obs_count);
                         break;
                 case NETROM_NEIGH:
                         ret = nr_add_neigh(&nr_route.callsign,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                 dev, nr_route.quality);
                         break;
                 default:
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 4667af51ed71..d183509d3fa6 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -183,7 +183,7 @@ static int gprs_close(struct net_device *dev)
         return 0;
 }
 
-static int gprs_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t gprs_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct gprs_dev *gp = netdev_priv(dev);
         struct sock *sk = gp->sk;
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index aa1617a7f265..7a4ee397d2f7 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -413,6 +413,7 @@ found:
 }
 EXPORT_SYMBOL(pn_sock_get_port);
 
+#ifdef CONFIG_PROC_FS
 static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
 {
         struct net *net = seq_file_net(seq);
@@ -498,7 +499,8 @@ static const struct seq_operations pn_sock_seq_ops = {
 
 static int pn_sock_open(struct inode *inode, struct file *file)
 {
-        return seq_open(file, &pn_sock_seq_ops);
+        return seq_open_net(inode, file, &pn_sock_seq_ops,
+                                sizeof(struct seq_net_private));
 }
 
 const struct file_operations pn_sock_seq_fops = {
@@ -506,5 +508,6 @@ const struct file_operations pn_sock_seq_fops = {
         .open = pn_sock_open,
         .read = seq_read,
         .llseek = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
+#endif
diff --git a/net/rds/Kconfig b/net/rds/Kconfig
index 796773b5df9b..ec753b3ae72a 100644
--- a/net/rds/Kconfig
+++ b/net/rds/Kconfig
@@ -1,14 +1,28 @@
 
 config RDS
-        tristate "Reliable Datagram Sockets (RDS) (EXPERIMENTAL)"
-        depends on INET && INFINIBAND_IPOIB && EXPERIMENTAL
-        depends on INFINIBAND && INFINIBAND_ADDR_TRANS
+        tristate "The RDS Protocol (EXPERIMENTAL)"
+        depends on INET && EXPERIMENTAL
         ---help---
-          RDS provides reliable, sequenced delivery of datagrams
-          over Infiniband.
+          The RDS (Reliable Datagram Sockets) protocol provides reliable,
+          sequenced delivery of datagrams over Infiniband, iWARP,
+          or TCP.
+
+config RDS_RDMA
+        tristate "RDS over Infiniband and iWARP"
+        depends on RDS && INFINIBAND && INFINIBAND_ADDR_TRANS
+        ---help---
+          Allow RDS to use Infiniband and iWARP as a transport.
+          This transport supports RDMA operations.
+
+config RDS_TCP
+        tristate "RDS over TCP"
+        depends on RDS
+        ---help---
+          Allow RDS to use TCP as a transport.
+          This transport does not support RDMA operations.
 
 config RDS_DEBUG
-        bool "Debugging messages"
+        bool "RDS debugging messages"
         depends on RDS
         default n
 
diff --git a/net/rds/Makefile b/net/rds/Makefile
index 51f27585fa08..b46eca109688 100644
--- a/net/rds/Makefile
+++ b/net/rds/Makefile
@@ -1,13 +1,20 @@
 obj-$(CONFIG_RDS) += rds.o
 rds-y :=        af_rds.o bind.o cong.o connection.o info.o message.o   \
                         recv.o send.o stats.o sysctl.o threads.o transport.o \
-                        loop.o page.o rdma.o \
-                        rdma_transport.o \
+                        loop.o page.o rdma.o
+
+obj-$(CONFIG_RDS_RDMA) += rds_rdma.o
+rds_rdma-objs :=        rdma_transport.o \
                         ib.o ib_cm.o ib_recv.o ib_ring.o ib_send.o ib_stats.o \
                         ib_sysctl.o ib_rdma.o \
                         iw.o iw_cm.o iw_recv.o iw_ring.o iw_send.o iw_stats.o \
                         iw_sysctl.o iw_rdma.o
 
+
+obj-$(CONFIG_RDS_TCP) += rds_tcp.o
+rds_tcp-objs :=         tcp.o tcp_connect.o tcp_listen.o tcp_recv.o \
+                        tcp_send.o tcp_stats.o
+
 ifeq ($(CONFIG_RDS_DEBUG), y)
 EXTRA_CFLAGS += -DDEBUG
 endif
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index b11e7e527864..108ed2e671c5 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -39,7 +39,6 @@
 
 #include "rds.h"
 #include "rdma.h"
-#include "rdma_transport.h"
 
 /* this is just used for stats gathering :/ */
 static DEFINE_SPINLOCK(rds_sock_lock);
@@ -509,7 +508,6 @@ out:
 
 static void __exit rds_exit(void)
 {
-        rds_rdma_exit();
         sock_unregister(rds_family_ops.family);
         proto_unregister(&rds_proto);
         rds_conn_exit();
@@ -549,14 +547,8 @@ static int __init rds_init(void)
         rds_info_register_func(RDS_INFO_SOCKETS, rds_sock_info);
         rds_info_register_func(RDS_INFO_RECV_MESSAGES, rds_sock_inc_info);
 
-        /* ib/iwarp transports currently compiled-in */
-        ret = rds_rdma_init();
-        if (ret)
-                goto out_sock;
         goto out;
 
-out_sock:
-        sock_unregister(rds_family_ops.family);
 out_proto:
         proto_unregister(&rds_proto);
 out_stats:
diff --git a/net/rds/bind.c b/net/rds/bind.c
index c17cc39160ce..5d95fc007f1a 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -187,6 +187,9 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (trans == NULL) {
                 ret = -EADDRNOTAVAIL;
                 rds_remove_bound(rs);
+                if (printk_ratelimit())
+                        printk(KERN_INFO "RDS: rds_bind() could not find a transport, "
+                                "load rds_tcp or rds_rdma?\n");
                 goto out;
         }
 
diff --git a/net/rds/cong.c b/net/rds/cong.c
index 710e4599d76c..dd2711df640b 100644
--- a/net/rds/cong.c
+++ b/net/rds/cong.c
@@ -254,6 +254,7 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask)
                 read_unlock_irqrestore(&rds_cong_monitor_lock, flags);
         }
 }
+EXPORT_SYMBOL_GPL(rds_cong_map_updated);
 
 int rds_cong_updated_since(unsigned long *recent)
 {
diff --git a/net/rds/connection.c b/net/rds/connection.c
index b420a20d84fd..cc8b568c0c84 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -255,12 +255,14 @@ struct rds_connection *rds_conn_create(__be32 laddr, __be32 faddr,
 {
         return __rds_conn_create(laddr, faddr, trans, gfp, 0);
 }
+EXPORT_SYMBOL_GPL(rds_conn_create);
 
 struct rds_connection *rds_conn_create_outgoing(__be32 laddr, __be32 faddr,
                                        struct rds_transport *trans, gfp_t gfp)
 {
         return __rds_conn_create(laddr, faddr, trans, gfp, 1);
 }
+EXPORT_SYMBOL_GPL(rds_conn_create_outgoing);
 
 void rds_conn_destroy(struct rds_connection *conn)
 {
@@ -303,6 +305,7 @@ void rds_conn_destroy(struct rds_connection *conn)
 
         rds_conn_count--;
 }
+EXPORT_SYMBOL_GPL(rds_conn_destroy);
 
 static void rds_conn_message_info(struct socket *sock, unsigned int len,
                                   struct rds_info_iterator *iter,
@@ -406,6 +409,7 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
 
         spin_unlock_irqrestore(&rds_conn_lock, flags);
 }
+EXPORT_SYMBOL_GPL(rds_for_each_conn_info);
 
 static int rds_conn_info_visitor(struct rds_connection *conn,
                                   void *buffer)
@@ -481,6 +485,7 @@ void rds_conn_drop(struct rds_connection *conn)
         atomic_set(&conn->c_state, RDS_CONN_ERROR);
         queue_work(rds_wq, &conn->c_down_w);
 }
+EXPORT_SYMBOL_GPL(rds_conn_drop);
 
 /*
  * An error occurred on the connection
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 868559ac42d7..536ebe5d3f6b 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -282,6 +282,7 @@ struct rds_transport rds_ib_transport = {
         .flush_mrs              = rds_ib_flush_mrs,
         .t_owner                = THIS_MODULE,
         .t_name                 = "infiniband",
+        .t_type                 = RDS_TRANS_IB
 };
 
 int __init rds_ib_init(void)
diff --git a/net/rds/info.c b/net/rds/info.c
index 62aeef37aefe..814a91a6f4a7 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -79,6 +79,7 @@ void rds_info_register_func(int optname, rds_info_func func)
         rds_info_funcs[offset] = func;
         spin_unlock(&rds_info_lock);
 }
+EXPORT_SYMBOL_GPL(rds_info_register_func);
 
 void rds_info_deregister_func(int optname, rds_info_func func)
 {
@@ -91,6 +92,7 @@ void rds_info_deregister_func(int optname, rds_info_func func)
         rds_info_funcs[offset] = NULL;
         spin_unlock(&rds_info_lock);
 }
+EXPORT_SYMBOL_GPL(rds_info_deregister_func);
 
 /*
  * Typically we hold an atomic kmap across multiple rds_info_copy() calls
@@ -137,6 +139,7 @@ void rds_info_copy(struct rds_info_iterator *iter, void *data,
                 }
         }
 }
+EXPORT_SYMBOL_GPL(rds_info_copy);
 
 /*
  * @optval points to the userspace buffer that the information snapshot
diff --git a/net/rds/iw.c b/net/rds/iw.c
index f5e9a29a80a7..db224f7c2937 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -284,6 +284,7 @@ struct rds_transport rds_iw_transport = {
         .flush_mrs              = rds_iw_flush_mrs,
         .t_owner                = THIS_MODULE,
         .t_name                 = "iwarp",
+        .t_type                 = RDS_TRANS_IWARP,
         .t_prefer_loopback      = 1,
 };
 
diff --git a/net/rds/message.c b/net/rds/message.c
index 5a15dc8d0cd7..ca50a8ec9742 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -50,6 +50,7 @@ void rds_message_addref(struct rds_message *rm)
         rdsdebug("addref rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
         atomic_inc(&rm->m_refcount);
 }
+EXPORT_SYMBOL_GPL(rds_message_addref);
 
 /*
  * This relies on dma_map_sg() not touching sg[].page during merging.
@@ -92,6 +93,7 @@ void rds_message_put(struct rds_message *rm)
                 kfree(rm);
         }
 }
+EXPORT_SYMBOL_GPL(rds_message_put);
 
 void rds_message_inc_free(struct rds_incoming *inc)
 {
@@ -108,6 +110,7 @@ void rds_message_populate_header(struct rds_header *hdr, __be16 sport,
         hdr->h_sequence = cpu_to_be64(seq);
         hdr->h_exthdr[0] = RDS_EXTHDR_NONE;
 }
+EXPORT_SYMBOL_GPL(rds_message_populate_header);
 
 int rds_message_add_extension(struct rds_header *hdr,
                 unsigned int type, const void *data, unsigned int len)
@@ -133,6 +136,7 @@ int rds_message_add_extension(struct rds_header *hdr,
         dst[len] = RDS_EXTHDR_NONE;
         return 1;
 }
+EXPORT_SYMBOL_GPL(rds_message_add_extension);
 
 /*
  * If a message has extension headers, retrieve them here.
@@ -208,6 +212,7 @@ int rds_message_add_rdma_dest_extension(struct rds_header *hdr, u32 r_key, u32 o
         ext_hdr.h_rdma_offset = cpu_to_be32(offset);
         return rds_message_add_extension(hdr, RDS_EXTHDR_RDMA_DEST, &ext_hdr, sizeof(ext_hdr));
 }
+EXPORT_SYMBOL_GPL(rds_message_add_rdma_dest_extension);
 
 struct rds_message *rds_message_alloc(unsigned int nents, gfp_t gfp)
 {
@@ -399,4 +404,5 @@ void rds_message_unmapped(struct rds_message *rm)
         if (waitqueue_active(&rds_message_flush_waitq))
                 wake_up(&rds_message_flush_waitq);
 }
+EXPORT_SYMBOL_GPL(rds_message_unmapped);
 
diff --git a/net/rds/page.c b/net/rds/page.c
index c460743a89ad..55c21efdb62e 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -81,6 +81,7 @@ int rds_page_copy_user(struct page *page, unsigned long offset,
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(rds_page_copy_user);
 
 /*
  * Message allocation uses this to build up regions of a message.
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 7a6c748cb56c..9ece910ea394 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -203,6 +203,7 @@ err_iw_init:
 out:
         return ret;
 }
+module_init(rds_rdma_init);
 
 void rds_rdma_exit(void)
 {
@@ -211,4 +212,9 @@ void rds_rdma_exit(void)
         rds_ib_exit();
         rds_iw_exit();
 }
+module_exit(rds_rdma_exit);
+
+MODULE_AUTHOR("Oracle Corporation <rds-devel@oss.oracle.com>");
+MODULE_DESCRIPTION("RDS: IB/iWARP transport");
+MODULE_LICENSE("Dual BSD/GPL");
 
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 290566c69d28..85d6f897ecc7 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -311,11 +311,17 @@ struct rds_notifier {
  *                 flag and header.
  */
 
+#define RDS_TRANS_IB    0
+#define RDS_TRANS_IWARP 1
+#define RDS_TRANS_TCP   2
+#define RDS_TRANS_COUNT 3
+
 struct rds_transport {
         char                    t_name[TRANSNAMSIZ];
         struct list_head        t_item;
         struct module           *t_owner;
         unsigned int            t_prefer_loopback:1;
+        unsigned int            t_type;
 
         int (*laddr_check)(__be32 addr);
         int (*conn_alloc)(struct rds_connection *conn, gfp_t gfp);
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 86bc1a06ebbd..fdff33c7b432 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -46,12 +46,14 @@ void rds_inc_init(struct rds_incoming *inc, struct rds_connection *conn,
         inc->i_saddr = saddr;
         inc->i_rdma_cookie = 0;
 }
+EXPORT_SYMBOL_GPL(rds_inc_init);
 
 void rds_inc_addref(struct rds_incoming *inc)
 {
         rdsdebug("addref inc %p ref %d\n", inc, atomic_read(&inc->i_refcount));
         atomic_inc(&inc->i_refcount);
 }
+EXPORT_SYMBOL_GPL(rds_inc_addref);
 
 void rds_inc_put(struct rds_incoming *inc)
 {
@@ -62,6 +64,7 @@ void rds_inc_put(struct rds_incoming *inc)
                 inc->i_conn->c_trans->inc_free(inc);
         }
 }
+EXPORT_SYMBOL_GPL(rds_inc_put);
 
 static void rds_recv_rcvbuf_delta(struct rds_sock *rs, struct sock *sk,
                                   struct rds_cong_map *map,
@@ -237,6 +240,7 @@ out:
         if (rs)
                 rds_sock_put(rs);
 }
+EXPORT_SYMBOL_GPL(rds_recv_incoming);
 
 /*
  * be very careful here.  This is being called as the condition in
diff --git a/net/rds/send.c b/net/rds/send.c
index a4a7f428cd76..28c88ff3d038 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -439,6 +439,7 @@ void rds_rdma_send_complete(struct rds_message *rm, int status)
                 sock_put(rds_rs_to_sk(rs));
         }
 }
+EXPORT_SYMBOL_GPL(rds_rdma_send_complete);
 
 /*
  * This is the same as rds_rdma_send_complete except we
@@ -494,6 +495,7 @@ out:
 
         return found;
 }
+EXPORT_SYMBOL_GPL(rds_send_get_message);
 
 /*
  * This removes messages from the socket's list if they're on it.  The list
@@ -610,6 +612,7 @@ void rds_send_drop_acked(struct rds_connection *conn, u64 ack,
         /* now remove the messages from the sock list as needed */
         rds_send_remove_from_sock(&list, RDS_RDMA_SUCCESS);
 }
+EXPORT_SYMBOL_GPL(rds_send_drop_acked);
 
 void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
 {
diff --git a/net/rds/stats.c b/net/rds/stats.c
index 91d8c58b8335..7598eb07cfb1 100644
--- a/net/rds/stats.c
+++ b/net/rds/stats.c
@@ -37,6 +37,7 @@
 #include "rds.h"
 
 DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_statistics, rds_stats);
+EXPORT_PER_CPU_SYMBOL_GPL(rds_stats);
 
 /* :.,$s/unsigned long\>.*\<s_\(.*\);/"\1",/g */
 
@@ -90,6 +91,7 @@ void rds_stats_info_copy(struct rds_info_iterator *iter,
                 rds_info_copy(iter, &ctr, sizeof(ctr));
         }
 }
+EXPORT_SYMBOL_GPL(rds_stats_info_copy);
 
 /*
  * This gives global counters across all the transports.  The strings
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
new file mode 100644
index 000000000000..b5198aee45d3
--- /dev/null
+++ b/net/rds/tcp.c
@@ -0,0 +1,320 @@
+/*
+ * Copyright (c) 2006 Oracle.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/in.h>
+#include <net/tcp.h>
+
+#include "rds.h"
+#include "tcp.h"
+
+/* only for info exporting */
+static DEFINE_SPINLOCK(rds_tcp_tc_list_lock);
+static LIST_HEAD(rds_tcp_tc_list);
+unsigned int rds_tcp_tc_count;
+
+/* Track rds_tcp_connection structs so they can be cleaned up */
+static DEFINE_SPINLOCK(rds_tcp_conn_lock);
+static LIST_HEAD(rds_tcp_conn_list);
+
+static struct kmem_cache *rds_tcp_conn_slab;
+
+#define RDS_TCP_DEFAULT_BUFSIZE (128 * 1024)
+
+/* doing it this way avoids calling tcp_sk() */
+void rds_tcp_nonagle(struct socket *sock)
+{
+        mm_segment_t oldfs = get_fs();
+        int val = 1;
+
+        set_fs(KERNEL_DS);
+        sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
+                              sizeof(val));
+        set_fs(oldfs);
+}
+
+void rds_tcp_tune(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+
+        rds_tcp_nonagle(sock);
+
+        /*
+         * We're trying to saturate gigabit with the default,
+         * see svc_sock_setbufsize().
+         */
+        lock_sock(sk);
+        sk->sk_sndbuf = RDS_TCP_DEFAULT_BUFSIZE;
+        sk->sk_rcvbuf = RDS_TCP_DEFAULT_BUFSIZE;
+        sk->sk_userlocks |= SOCK_SNDBUF_LOCK|SOCK_RCVBUF_LOCK;
+        release_sock(sk);
+}
+
+u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc)
+{
+        return tcp_sk(tc->t_sock->sk)->snd_nxt;
+}
+
+u32 rds_tcp_snd_una(struct rds_tcp_connection *tc)
+{
+        return tcp_sk(tc->t_sock->sk)->snd_una;
+}
+
+void rds_tcp_restore_callbacks(struct socket *sock,
+                               struct rds_tcp_connection *tc)
+{
+        rdsdebug("restoring sock %p callbacks from tc %p\n", sock, tc);
+        write_lock_bh(&sock->sk->sk_callback_lock);
+
+        /* done under the callback_lock to serialize with write_space */
+        spin_lock(&rds_tcp_tc_list_lock);
+        list_del_init(&tc->t_list_item);
+        rds_tcp_tc_count--;
+        spin_unlock(&rds_tcp_tc_list_lock);
+
+        tc->t_sock = NULL;
+
+        sock->sk->sk_write_space = tc->t_orig_write_space;
+        sock->sk->sk_data_ready = tc->t_orig_data_ready;
+        sock->sk->sk_state_change = tc->t_orig_state_change;
+        sock->sk->sk_user_data = NULL;
+
+        write_unlock_bh(&sock->sk->sk_callback_lock);
+}
+
+/*
+ * This is the only path that sets tc->t_sock.  Send and receive trust that
+ * it is set.  The RDS_CONN_CONNECTED bit protects those paths from being
+ * called while it isn't set.
+ */
+void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+
+        rdsdebug("setting sock %p callbacks to tc %p\n", sock, tc);
+        write_lock_bh(&sock->sk->sk_callback_lock);
+
+        /* done under the callback_lock to serialize with write_space */
+        spin_lock(&rds_tcp_tc_list_lock);
+        list_add_tail(&tc->t_list_item, &rds_tcp_tc_list);
+        rds_tcp_tc_count++;
+        spin_unlock(&rds_tcp_tc_list_lock);
+
+        /* accepted sockets need our listen data ready undone */
+        if (sock->sk->sk_data_ready == rds_tcp_listen_data_ready)
+                sock->sk->sk_data_ready = sock->sk->sk_user_data;
+
+        tc->t_sock = sock;
+        tc->conn = conn;
+        tc->t_orig_data_ready = sock->sk->sk_data_ready;
+        tc->t_orig_write_space = sock->sk->sk_write_space;
+        tc->t_orig_state_change = sock->sk->sk_state_change;
+
+        sock->sk->sk_user_data = conn;
+        sock->sk->sk_data_ready = rds_tcp_data_ready;
+        sock->sk->sk_write_space = rds_tcp_write_space;
+        sock->sk->sk_state_change = rds_tcp_state_change;
+
+        write_unlock_bh(&sock->sk->sk_callback_lock);
+}
+
+static void rds_tcp_tc_info(struct socket *sock, unsigned int len,
+                            struct rds_info_iterator *iter,
+                            struct rds_info_lengths *lens)
+{
+        struct rds_info_tcp_socket tsinfo;
+        struct rds_tcp_connection *tc;
+        unsigned long flags;
+        struct sockaddr_in sin;
+        int sinlen;
+
+        spin_lock_irqsave(&rds_tcp_tc_list_lock, flags);
+
+        if (len / sizeof(tsinfo) < rds_tcp_tc_count)
+                goto out;
+
+        list_for_each_entry(tc, &rds_tcp_tc_list, t_list_item) {
+
+                sock->ops->getname(sock, (struct sockaddr *)&sin, &sinlen, 0);
+                tsinfo.local_addr = sin.sin_addr.s_addr;
+                tsinfo.local_port = sin.sin_port;
+                sock->ops->getname(sock, (struct sockaddr *)&sin, &sinlen, 1);
+                tsinfo.peer_addr = sin.sin_addr.s_addr;
+                tsinfo.peer_port = sin.sin_port;
+
+                tsinfo.hdr_rem = tc->t_tinc_hdr_rem;
+                tsinfo.data_rem = tc->t_tinc_data_rem;
+                tsinfo.last_sent_nxt = tc->t_last_sent_nxt;
+                tsinfo.last_expected_una = tc->t_last_expected_una;
+                tsinfo.last_seen_una = tc->t_last_seen_una;
+
+                rds_info_copy(iter, &tsinfo, sizeof(tsinfo));
+        }
+
+out:
+        lens->nr = rds_tcp_tc_count;
+        lens->each = sizeof(tsinfo);
+
+        spin_unlock_irqrestore(&rds_tcp_tc_list_lock, flags);
+}
+
+static int rds_tcp_laddr_check(__be32 addr)
+{
+        if (inet_addr_type(&init_net, addr) == RTN_LOCAL)
+                return 0;
+        return -EADDRNOTAVAIL;
+}
+
+static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
+{
+        struct rds_tcp_connection *tc;
+
+        tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);
+        if (tc == NULL)
+                return -ENOMEM;
+
+        tc->t_sock = NULL;
+        tc->t_tinc = NULL;
+        tc->t_tinc_hdr_rem = sizeof(struct rds_header);
+        tc->t_tinc_data_rem = 0;
+
+        conn->c_transport_data = tc;
+
+        spin_lock_irq(&rds_tcp_conn_lock);
+        list_add_tail(&tc->t_tcp_node, &rds_tcp_conn_list);
+        spin_unlock_irq(&rds_tcp_conn_lock);
+
+        rdsdebug("alloced tc %p\n", conn->c_transport_data);
+        return 0;
+}
+
+static void rds_tcp_conn_free(void *arg)
+{
+        struct rds_tcp_connection *tc = arg;
+        rdsdebug("freeing tc %p\n", tc);
+        kmem_cache_free(rds_tcp_conn_slab, tc);
+}
+
+static void rds_tcp_destroy_conns(void)
+{
+        struct rds_tcp_connection *tc, *_tc;
+        LIST_HEAD(tmp_list);
+
+        /* avoid calling conn_destroy with irqs off */
+        spin_lock_irq(&rds_tcp_conn_lock);
+        list_splice(&rds_tcp_conn_list, &tmp_list);
+        INIT_LIST_HEAD(&rds_tcp_conn_list);
+        spin_unlock_irq(&rds_tcp_conn_lock);
+
+        list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) {
+                if (tc->conn->c_passive)
+                        rds_conn_destroy(tc->conn->c_passive);
+                rds_conn_destroy(tc->conn);
+        }
+}
+
+void rds_tcp_exit(void)
+{
+        rds_info_deregister_func(RDS_INFO_TCP_SOCKETS, rds_tcp_tc_info);
+        rds_tcp_listen_stop();
+        rds_tcp_destroy_conns();
+        rds_trans_unregister(&rds_tcp_transport);
+        rds_tcp_recv_exit();
+        kmem_cache_destroy(rds_tcp_conn_slab);
+}
+module_exit(rds_tcp_exit);
+
+struct rds_transport rds_tcp_transport = {
+        .laddr_check            = rds_tcp_laddr_check,
+        .xmit_prepare           = rds_tcp_xmit_prepare,
+        .xmit_complete          = rds_tcp_xmit_complete,
+        .xmit_cong_map          = rds_tcp_xmit_cong_map,
+        .xmit                   = rds_tcp_xmit,
+        .recv                   = rds_tcp_recv,
+        .conn_alloc             = rds_tcp_conn_alloc,
+        .conn_free              = rds_tcp_conn_free,
+        .conn_connect           = rds_tcp_conn_connect,
+        .conn_shutdown          = rds_tcp_conn_shutdown,
+        .inc_copy_to_user       = rds_tcp_inc_copy_to_user,
+        .inc_purge              = rds_tcp_inc_purge,
+        .inc_free               = rds_tcp_inc_free,
+        .stats_info_copy        = rds_tcp_stats_info_copy,
+        .exit                   = rds_tcp_exit,
+        .t_owner                = THIS_MODULE,
+        .t_name                 = "tcp",
+        .t_type                 = RDS_TRANS_TCP,
+        .t_prefer_loopback      = 1,
+};
+
+int __init rds_tcp_init(void)
+{
+        int ret;
+
+        rds_tcp_conn_slab = kmem_cache_create("rds_tcp_connection",
+                                              sizeof(struct rds_tcp_connection),
+                                              0, 0, NULL);
+        if (rds_tcp_conn_slab == NULL) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = rds_tcp_recv_init();
+        if (ret)
+                goto out_slab;
+
+        ret = rds_trans_register(&rds_tcp_transport);
+        if (ret)
+                goto out_recv;
+
+        ret = rds_tcp_listen_init();
+        if (ret)
+                goto out_register;
+
+        rds_info_register_func(RDS_INFO_TCP_SOCKETS, rds_tcp_tc_info);
+
+        goto out;
+
+out_register:
+        rds_trans_unregister(&rds_tcp_transport);
+out_recv:
+        rds_tcp_recv_exit();
+out_slab:
+        kmem_cache_destroy(rds_tcp_conn_slab);
+out:
+        return ret;
+}
+module_init(rds_tcp_init);
+
+MODULE_AUTHOR("Oracle Corporation <rds-devel@oss.oracle.com>");
+MODULE_DESCRIPTION("RDS: TCP transport");
+MODULE_LICENSE("Dual BSD/GPL");
+
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
new file mode 100644
index 000000000000..844fa6b9cf5a
--- /dev/null
+++ b/net/rds/tcp.h
@@ -0,0 +1,93 @@
+#ifndef _RDS_TCP_H
+#define _RDS_TCP_H
+
+#define RDS_TCP_PORT    16385
+
+struct rds_tcp_incoming {
+        struct rds_incoming     ti_inc;
+        struct sk_buff_head     ti_skb_list;
+};
+
+struct rds_tcp_connection {
+
+        struct list_head        t_tcp_node;
+        struct rds_connection   *conn;
+        struct socket           *t_sock;
+        void                    *t_orig_write_space;
+        void                    *t_orig_data_ready;
+        void                    *t_orig_state_change;
+
+        struct rds_tcp_incoming *t_tinc;
+        size_t                  t_tinc_hdr_rem;
+        size_t                  t_tinc_data_rem;
+
+        /* XXX error report? */
+        struct work_struct      t_conn_w;
+        struct work_struct      t_send_w;
+        struct work_struct      t_down_w;
+        struct work_struct      t_recv_w;
+
+        /* for info exporting only */
+        struct list_head        t_list_item;
+        u32                     t_last_sent_nxt;
+        u32                     t_last_expected_una;
+        u32                     t_last_seen_una;
+};
+
+struct rds_tcp_statistics {
+        uint64_t        s_tcp_data_ready_calls;
+        uint64_t        s_tcp_write_space_calls;
+        uint64_t        s_tcp_sndbuf_full;
+        uint64_t        s_tcp_connect_raced;
+        uint64_t        s_tcp_listen_closed_stale;
+};
+
+/* tcp.c */
+int __init rds_tcp_init(void);
+void rds_tcp_exit(void);
+void rds_tcp_tune(struct socket *sock);
+void rds_tcp_nonagle(struct socket *sock);
+void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn);
+void rds_tcp_restore_callbacks(struct socket *sock,
+                               struct rds_tcp_connection *tc);
+u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc);
+u32 rds_tcp_snd_una(struct rds_tcp_connection *tc);
+u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq);
+extern struct rds_transport rds_tcp_transport;
+
+/* tcp_connect.c */
+int rds_tcp_conn_connect(struct rds_connection *conn);
+void rds_tcp_conn_shutdown(struct rds_connection *conn);
+void rds_tcp_state_change(struct sock *sk);
+
+/* tcp_listen.c */
+int __init rds_tcp_listen_init(void);
+void rds_tcp_listen_stop(void);
+void rds_tcp_listen_data_ready(struct sock *sk, int bytes);
+
+/* tcp_recv.c */
+int __init rds_tcp_recv_init(void);
+void rds_tcp_recv_exit(void);
+void rds_tcp_data_ready(struct sock *sk, int bytes);
+int rds_tcp_recv(struct rds_connection *conn);
+void rds_tcp_inc_purge(struct rds_incoming *inc);
+void rds_tcp_inc_free(struct rds_incoming *inc);
+int rds_tcp_inc_copy_to_user(struct rds_incoming *inc, struct iovec *iov,
+                             size_t size);
+
+/* tcp_send.c */
+void rds_tcp_xmit_prepare(struct rds_connection *conn);
+void rds_tcp_xmit_complete(struct rds_connection *conn);
+int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
+                 unsigned int hdr_off, unsigned int sg, unsigned int off);
+void rds_tcp_write_space(struct sock *sk);
+int rds_tcp_xmit_cong_map(struct rds_connection *conn,
+                          struct rds_cong_map *map, unsigned long offset);
+
+/* tcp_stats.c */
+DECLARE_PER_CPU(struct rds_tcp_statistics, rds_tcp_stats);
+#define rds_tcp_stats_inc(member) rds_stats_inc_which(rds_tcp_stats, member)
+unsigned int rds_tcp_stats_info_copy(struct rds_info_iterator *iter,
+                                     unsigned int avail);
+
+#endif
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
new file mode 100644
index 000000000000..211522f9a9a2
--- /dev/null
+++ b/net/rds/tcp_connect.c
@@ -0,0 +1,153 @@
+/*
+ * Copyright (c) 2006 Oracle.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/in.h>
+#include <net/tcp.h>
+
+#include "rds.h"
+#include "tcp.h"
+
+void rds_tcp_state_change(struct sock *sk)
+{
+        void (*state_change)(struct sock *sk);
+        struct rds_connection *conn;
+        struct rds_tcp_connection *tc;
+
+        read_lock(&sk->sk_callback_lock);
+        conn = sk->sk_user_data;
+        if (conn == NULL) {
+                state_change = sk->sk_state_change;
+                goto out;
+        }
+        tc = conn->c_transport_data;
+        state_change = tc->t_orig_state_change;
+
+        rdsdebug("sock %p state_change to %d\n", tc->t_sock, sk->sk_state);
+
+        switch(sk->sk_state) {
+                /* ignore connecting sockets as they make progress */
+                case TCP_SYN_SENT:
+                case TCP_SYN_RECV:
+                        break;
+                case TCP_ESTABLISHED:
+                        rds_connect_complete(conn);
+                        break;
+                case TCP_CLOSE:
+                        rds_conn_drop(conn);
+                default:
+                        break;
+        }
+out:
+        read_unlock(&sk->sk_callback_lock);
+        state_change(sk);
+}
+
+int rds_tcp_conn_connect(struct rds_connection *conn)
+{
+        struct socket *sock = NULL;
+        struct sockaddr_in src, dest;
+        int ret;
+
+        ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP, &sock);
+        if (ret < 0)
+                goto out;
+
+        rds_tcp_tune(sock);
+
+        src.sin_family = AF_INET;
+        src.sin_addr.s_addr = (__force u32)conn->c_laddr;
+        src.sin_port = (__force u16)htons(0);
+
+        ret = sock->ops->bind(sock, (struct sockaddr *)&src, sizeof(src));
+        if (ret) {
+                rdsdebug("bind failed with %d at address %u.%u.%u.%u\n",
+                     ret, NIPQUAD(conn->c_laddr));
+                goto out;
+        }
+
+        dest.sin_family = AF_INET;
+        dest.sin_addr.s_addr = (__force u32)conn->c_faddr;
+        dest.sin_port = (__force u16)htons(RDS_TCP_PORT);
+
+        /*
+         * once we call connect() we can start getting callbacks and they
+         * own the socket
+         */
+        rds_tcp_set_callbacks(sock, conn);
+        ret = sock->ops->connect(sock, (struct sockaddr *)&dest, sizeof(dest),
+                                 O_NONBLOCK);
+        sock = NULL;
+
+        rdsdebug("connect to address %u.%u.%u.%u returned %d\n",
+                 NIPQUAD(conn->c_faddr), ret);
+        if (ret == -EINPROGRESS)
+                ret = 0;
+
+out:
+        if (sock)
+                sock_release(sock);
+        return ret;
+}
+
+/*
+ * Before killing the tcp socket this needs to serialize with callbacks.  The
+ * caller has already grabbed the sending sem so we're serialized with other
+ * senders.
+ *
+ * TCP calls the callbacks with the sock lock so we hold it while we reset the
+ * callbacks to those set by TCP.  Our callbacks won't execute again once we
+ * hold the sock lock.
+ */
+void rds_tcp_conn_shutdown(struct rds_connection *conn)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        struct socket *sock = tc->t_sock;
+
+        rdsdebug("shutting down conn %p tc %p sock %p\n", conn, tc, sock);
+
+        if (sock) {
+                sock->ops->shutdown(sock, RCV_SHUTDOWN | SEND_SHUTDOWN);
+                lock_sock(sock->sk);
+                rds_tcp_restore_callbacks(sock, tc); /* tc->tc_sock = NULL */
+
+                release_sock(sock->sk);
+                sock_release(sock);
+        };
+
+        if (tc->t_tinc) {
+                rds_inc_put(&tc->t_tinc->ti_inc);
+                tc->t_tinc = NULL;
+        }
+        tc->t_tinc_hdr_rem = sizeof(struct rds_header);
+        tc->t_tinc_data_rem = 0;
+}
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
new file mode 100644
index 000000000000..24b743eb0b1b
--- /dev/null
+++ b/net/rds/tcp_listen.c
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2006 Oracle.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/in.h>
+#include <net/tcp.h>
+
+#include "rds.h"
+#include "tcp.h"
+
+/*
+ * cheesy, but simple..
+ */
+static void rds_tcp_accept_worker(struct work_struct *work);
+static DECLARE_WORK(rds_tcp_listen_work, rds_tcp_accept_worker);
+static struct socket *rds_tcp_listen_sock;
+
+static int rds_tcp_accept_one(struct socket *sock)
+{
+        struct socket *new_sock = NULL;
+        struct rds_connection *conn;
+        int ret;
+        struct inet_sock *inet;
+
+        ret = sock_create_lite(sock->sk->sk_family, sock->sk->sk_type,
+                               sock->sk->sk_protocol, &new_sock);
+        if (ret)
+                goto out;
+
+        new_sock->type = sock->type;
+        new_sock->ops = sock->ops;
+        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK);
+        if (ret < 0)
+                goto out;
+
+        rds_tcp_tune(new_sock);
+
+        inet = inet_sk(new_sock->sk);
+
+        rdsdebug("accepted tcp %u.%u.%u.%u:%u -> %u.%u.%u.%u:%u\n",
+                  NIPQUAD(inet->saddr), ntohs(inet->sport),
+                  NIPQUAD(inet->daddr), ntohs(inet->dport));
+
+        conn = rds_conn_create(inet->saddr, inet->daddr, &rds_tcp_transport,
+                               GFP_KERNEL);
+        if (IS_ERR(conn)) {
+                ret = PTR_ERR(conn);
+                goto out;
+        }
+
+        /*
+         * see the comment above rds_queue_delayed_reconnect()
+         */
+        if (!rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING)) {
+                if (rds_conn_state(conn) == RDS_CONN_UP)
+                        rds_tcp_stats_inc(s_tcp_listen_closed_stale);
+                else
+                        rds_tcp_stats_inc(s_tcp_connect_raced);
+                rds_conn_drop(conn);
+                ret = 0;
+                goto out;
+        }
+
+        rds_tcp_set_callbacks(new_sock, conn);
+        rds_connect_complete(conn);
+        new_sock = NULL;
+        ret = 0;
+
+out:
+        if (new_sock)
+                sock_release(new_sock);
+        return ret;
+}
+
+static void rds_tcp_accept_worker(struct work_struct *work)
+{
+        while (rds_tcp_accept_one(rds_tcp_listen_sock) == 0)
+                cond_resched();
+}
+
+void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
+{
+        void (*ready)(struct sock *sk, int bytes);
+
+        rdsdebug("listen data ready sk %p\n", sk);
+
+        read_lock(&sk->sk_callback_lock);
+        ready = sk->sk_user_data;
+        if (ready == NULL) { /* check for teardown race */
+                ready = sk->sk_data_ready;
+                goto out;
+        }
+
+        /*
+         * ->sk_data_ready is also called for a newly established child socket
+         * before it has been accepted and the accepter has set up their
+         * data_ready.. we only want to queue listen work for our listening
+         * socket
+         */
+        if (sk->sk_state == TCP_LISTEN)
+                queue_work(rds_wq, &rds_tcp_listen_work);
+
+out:
+        read_unlock(&sk->sk_callback_lock);
+        ready(sk, bytes);
+}
+
+int __init rds_tcp_listen_init(void)
+{
+        struct sockaddr_in sin;
+        struct socket *sock = NULL;
+        int ret;
+
+        ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP, &sock);
+        if (ret < 0)
+                goto out;
+
+        sock->sk->sk_reuse = 1;
+        rds_tcp_nonagle(sock);
+
+        write_lock_bh(&sock->sk->sk_callback_lock);
+        sock->sk->sk_user_data = sock->sk->sk_data_ready;
+        sock->sk->sk_data_ready = rds_tcp_listen_data_ready;
+        write_unlock_bh(&sock->sk->sk_callback_lock);
+
+        sin.sin_family = PF_INET,
+        sin.sin_addr.s_addr = (__force u32)htonl(INADDR_ANY);
+        sin.sin_port = (__force u16)htons(RDS_TCP_PORT);
+
+        ret = sock->ops->bind(sock, (struct sockaddr *)&sin, sizeof(sin));
+        if (ret < 0)
+                goto out;
+
+        ret = sock->ops->listen(sock, 64);
+        if (ret < 0)
+                goto out;
+
+        rds_tcp_listen_sock = sock;
+        sock = NULL;
+out:
+        if (sock)
+                sock_release(sock);
+        return ret;
+}
+
+void rds_tcp_listen_stop(void)
+{
+        struct socket *sock = rds_tcp_listen_sock;
+        struct sock *sk;
+
+        if (sock == NULL)
+                return;
+
+        sk = sock->sk;
+
+        /* serialize with and prevent further callbacks */
+        lock_sock(sk);
+        write_lock_bh(&sk->sk_callback_lock);
+        if (sk->sk_user_data) {
+                sk->sk_data_ready = sk->sk_user_data;
+                sk->sk_user_data = NULL;
+        }
+        write_unlock_bh(&sk->sk_callback_lock);
+        release_sock(sk);
+
+        /* wait for accepts to stop and close the socket */
+        flush_workqueue(rds_wq);
+        sock_release(sock);
+        rds_tcp_listen_sock = NULL;
+}
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
new file mode 100644
index 000000000000..c00dafffbb5a
--- /dev/null
+++ b/net/rds/tcp_recv.c
@@ -0,0 +1,356 @@
+/*
+ * Copyright (c) 2006 Oracle.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+#include <linux/kernel.h>
+#include <net/tcp.h>
+
+#include "rds.h"
+#include "tcp.h"
+
+static struct kmem_cache *rds_tcp_incoming_slab;
+
+void rds_tcp_inc_purge(struct rds_incoming *inc)
+{
+        struct rds_tcp_incoming *tinc;
+        tinc = container_of(inc, struct rds_tcp_incoming, ti_inc);
+        rdsdebug("purging tinc %p inc %p\n", tinc, inc);
+        skb_queue_purge(&tinc->ti_skb_list);
+}
+
+void rds_tcp_inc_free(struct rds_incoming *inc)
+{
+        struct rds_tcp_incoming *tinc;
+        tinc = container_of(inc, struct rds_tcp_incoming, ti_inc);
+        rds_tcp_inc_purge(inc);
+        rdsdebug("freeing tinc %p inc %p\n", tinc, inc);
+        kmem_cache_free(rds_tcp_incoming_slab, tinc);
+}
+
+/*
+ * this is pretty lame, but, whatever.
+ */
+int rds_tcp_inc_copy_to_user(struct rds_incoming *inc, struct iovec *first_iov,
+                             size_t size)
+{
+        struct rds_tcp_incoming *tinc;
+        struct iovec *iov, tmp;
+        struct sk_buff *skb;
+        unsigned long to_copy, skb_off;
+        int ret = 0;
+
+        if (size == 0)
+                goto out;
+
+        tinc = container_of(inc, struct rds_tcp_incoming, ti_inc);
+        iov = first_iov;
+        tmp = *iov;
+
+        skb_queue_walk(&tinc->ti_skb_list, skb) {
+                skb_off = 0;
+                while (skb_off < skb->len) {
+                        while (tmp.iov_len == 0) {
+                                iov++;
+                                tmp = *iov;
+                        }
+
+                        to_copy = min(tmp.iov_len, size);
+                        to_copy = min(to_copy, skb->len - skb_off);
+
+                        rdsdebug("ret %d size %zu skb %p skb_off %lu "
+                                 "skblen %d iov_base %p iov_len %zu cpy %lu\n",
+                                 ret, size, skb, skb_off, skb->len,
+                                 tmp.iov_base, tmp.iov_len, to_copy);
+
+                        /* modifies tmp as it copies */
+                        if (skb_copy_datagram_iovec(skb, skb_off, &tmp,
+                                                    to_copy)) {
+                                ret = -EFAULT;
+                                goto out;
+                        }
+
+                        size -= to_copy;
+                        ret += to_copy;
+                        skb_off += to_copy;
+                        if (size == 0)
+                                goto out;
+                }
+        }
+out:
+        return ret;
+}
+
+/*
+ * We have a series of skbs that have fragmented pieces of the congestion
+ * bitmap.  They must add up to the exact size of the congestion bitmap.  We
+ * use the skb helpers to copy those into the pages that make up the in-memory
+ * congestion bitmap for the remote address of this connection.  We then tell
+ * the congestion core that the bitmap has been changed so that it can wake up
+ * sleepers.
+ *
+ * This is racing with sending paths which are using test_bit to see if the
+ * bitmap indicates that their recipient is congested.
+ */
+
+static void rds_tcp_cong_recv(struct rds_connection *conn,
+                              struct rds_tcp_incoming *tinc)
+{
+        struct sk_buff *skb;
+        unsigned int to_copy, skb_off;
+        unsigned int map_off;
+        unsigned int map_page;
+        struct rds_cong_map *map;
+        int ret;
+
+        /* catch completely corrupt packets */
+        if (be32_to_cpu(tinc->ti_inc.i_hdr.h_len) != RDS_CONG_MAP_BYTES)
+                return;
+
+        map_page = 0;
+        map_off = 0;
+        map = conn->c_fcong;
+
+        skb_queue_walk(&tinc->ti_skb_list, skb) {
+                skb_off = 0;
+                while (skb_off < skb->len) {
+                        to_copy = min_t(unsigned int, PAGE_SIZE - map_off,
+                                        skb->len - skb_off);
+
+                        BUG_ON(map_page >= RDS_CONG_MAP_PAGES);
+
+                        /* only returns 0 or -error */
+                        ret = skb_copy_bits(skb, skb_off,
+                                (void *)map->m_page_addrs[map_page] + map_off,
+                                to_copy);
+                        BUG_ON(ret != 0);
+
+                        skb_off += to_copy;
+                        map_off += to_copy;
+                        if (map_off == PAGE_SIZE) {
+                                map_off = 0;
+                                map_page++;
+                        }
+                }
+        }
+
+        rds_cong_map_updated(map, ~(u64) 0);
+}
+
+struct rds_tcp_desc_arg {
+        struct rds_connection *conn;
+        gfp_t gfp;
+        enum km_type km;
+};
+
+static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
+                             unsigned int offset, size_t len)
+{
+        struct rds_tcp_desc_arg *arg = desc->arg.data;
+        struct rds_connection *conn = arg->conn;
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        struct rds_tcp_incoming *tinc = tc->t_tinc;
+        struct sk_buff *clone;
+        size_t left = len, to_copy;
+
+        rdsdebug("tcp data tc %p skb %p offset %u len %zu\n", tc, skb, offset,
+                 len);
+
+        /*
+         * tcp_read_sock() interprets partial progress as an indication to stop
+         * processing.
+         */
+        while (left) {
+                if (tinc == NULL) {
+                        tinc = kmem_cache_alloc(rds_tcp_incoming_slab,
+                                                arg->gfp);
+                        if (tinc == NULL) {
+                                desc->error = -ENOMEM;
+                                goto out;
+                        }
+                        tc->t_tinc = tinc;
+                        rdsdebug("alloced tinc %p\n", tinc);
+                        rds_inc_init(&tinc->ti_inc, conn, conn->c_faddr);
+                        /*
+                         * XXX * we might be able to use the __ variants when
+                         * we've already serialized at a higher level.
+                         */
+                        skb_queue_head_init(&tinc->ti_skb_list);
+                }
+
+                if (left && tc->t_tinc_hdr_rem) {
+                        to_copy = min(tc->t_tinc_hdr_rem, left);
+                        rdsdebug("copying %zu header from skb %p\n", to_copy,
+                                 skb);
+                        skb_copy_bits(skb, offset,
+                                      (char *)&tinc->ti_inc.i_hdr +
+                                                sizeof(struct rds_header) -
+                                                tc->t_tinc_hdr_rem,
+                                      to_copy);
+                        tc->t_tinc_hdr_rem -= to_copy;
+                        left -= to_copy;
+                        offset += to_copy;
+
+                        if (tc->t_tinc_hdr_rem == 0) {
+                                /* could be 0 for a 0 len message */
+                                tc->t_tinc_data_rem =
+                                        be32_to_cpu(tinc->ti_inc.i_hdr.h_len);
+                        }
+                }
+
+                if (left && tc->t_tinc_data_rem) {
+                        clone = skb_clone(skb, arg->gfp);
+                        if (clone == NULL) {
+                                desc->error = -ENOMEM;
+                                goto out;
+                        }
+
+                        to_copy = min(tc->t_tinc_data_rem, left);
+                        pskb_pull(clone, offset);
+                        pskb_trim(clone, to_copy);
+                        skb_queue_tail(&tinc->ti_skb_list, clone);
+
+                        rdsdebug("skb %p data %p len %d off %u to_copy %zu -> "
+                                 "clone %p data %p len %d\n",
+                                 skb, skb->data, skb->len, offset, to_copy,
+                                 clone, clone->data, clone->len);
+
+                        tc->t_tinc_data_rem -= to_copy;
+                        left -= to_copy;
+                        offset += to_copy;
+                }
+
+                if (tc->t_tinc_hdr_rem == 0 && tc->t_tinc_data_rem == 0) {
+                        if (tinc->ti_inc.i_hdr.h_flags == RDS_FLAG_CONG_BITMAP)
+                                rds_tcp_cong_recv(conn, tinc);
+                        else
+                                rds_recv_incoming(conn, conn->c_faddr,
+                                                  conn->c_laddr, &tinc->ti_inc,
+                                                  arg->gfp, arg->km);
+
+                        tc->t_tinc_hdr_rem = sizeof(struct rds_header);
+                        tc->t_tinc_data_rem = 0;
+                        tc->t_tinc = NULL;
+                        rds_inc_put(&tinc->ti_inc);
+                        tinc = NULL;
+                }
+        }
+out:
+        rdsdebug("returning len %zu left %zu skb len %d rx queue depth %d\n",
+                 len, left, skb->len,
+                 skb_queue_len(&tc->t_sock->sk->sk_receive_queue));
+        return len - left;
+}
+
+/* the caller has to hold the sock lock */
+int rds_tcp_read_sock(struct rds_connection *conn, gfp_t gfp, enum km_type km)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        struct socket *sock = tc->t_sock;
+        read_descriptor_t desc;
+        struct rds_tcp_desc_arg arg;
+
+        /* It's like glib in the kernel! */
+        arg.conn = conn;
+        arg.gfp = gfp;
+        arg.km = km;
+        desc.arg.data = &arg;
+        desc.error = 0;
+        desc.count = 1; /* give more than one skb per call */
+
+        tcp_read_sock(sock->sk, &desc, rds_tcp_data_recv);
+        rdsdebug("tcp_read_sock for tc %p gfp 0x%x returned %d\n", tc, gfp,
+                 desc.error);
+
+        return desc.error;
+}
+
+/*
+ * We hold the sock lock to serialize our rds_tcp_recv->tcp_read_sock from
+ * data_ready.
+ *
+ * if we fail to allocate we're in trouble.. blindly wait some time before
+ * trying again to see if the VM can free up something for us.
+ */
+int rds_tcp_recv(struct rds_connection *conn)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        struct socket *sock = tc->t_sock;
+        int ret = 0;
+
+        rdsdebug("recv worker conn %p tc %p sock %p\n", conn, tc, sock);
+
+        lock_sock(sock->sk);
+        ret = rds_tcp_read_sock(conn, GFP_KERNEL, KM_USER0);
+        release_sock(sock->sk);
+
+        return ret;
+}
+
+void rds_tcp_data_ready(struct sock *sk, int bytes)
+{
+        void (*ready)(struct sock *sk, int bytes);
+        struct rds_connection *conn;
+        struct rds_tcp_connection *tc;
+
+        rdsdebug("data ready sk %p bytes %d\n", sk, bytes);
+
+        read_lock(&sk->sk_callback_lock);
+        conn = sk->sk_user_data;
+        if (conn == NULL) { /* check for teardown race */
+                ready = sk->sk_data_ready;
+                goto out;
+        }
+
+        tc = conn->c_transport_data;
+        ready = tc->t_orig_data_ready;
+        rds_tcp_stats_inc(s_tcp_data_ready_calls);
+
+        if (rds_tcp_read_sock(conn, GFP_ATOMIC, KM_SOFTIRQ0) == -ENOMEM)
+                queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
+out:
+        read_unlock(&sk->sk_callback_lock);
+        ready(sk, bytes);
+}
+
+int __init rds_tcp_recv_init(void)
+{
+        rds_tcp_incoming_slab = kmem_cache_create("rds_tcp_incoming",
+                                        sizeof(struct rds_tcp_incoming),
+                                        0, 0, NULL);
+        if (rds_tcp_incoming_slab == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+void rds_tcp_recv_exit(void)
+{
+        kmem_cache_destroy(rds_tcp_incoming_slab);
+}
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
new file mode 100644
index 000000000000..ab545e0cd5d6
--- /dev/null
+++ b/net/rds/tcp_send.c
@@ -0,0 +1,263 @@
+/*
+ * Copyright (c) 2006 Oracle.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/in.h>
+#include <net/tcp.h>
+
+#include "rds.h"
+#include "tcp.h"
+
+static void rds_tcp_cork(struct socket *sock, int val)
+{
+        mm_segment_t oldfs;
+
+        oldfs = get_fs();
+        set_fs(KERNEL_DS);
+        sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
+                              sizeof(val));
+        set_fs(oldfs);
+}
+
+void rds_tcp_xmit_prepare(struct rds_connection *conn)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+
+        rds_tcp_cork(tc->t_sock, 1);
+}
+
+void rds_tcp_xmit_complete(struct rds_connection *conn)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+
+        rds_tcp_cork(tc->t_sock, 0);
+}
+
+/* the core send_sem serializes this with other xmit and shutdown */
+int rds_tcp_sendmsg(struct socket *sock, void *data, unsigned int len)
+{
+        struct kvec vec = {
+                .iov_base = data,
+                .iov_len = len,
+        };
+        struct msghdr msg = {
+                .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL,
+        };
+
+        return kernel_sendmsg(sock, &msg, &vec, 1, vec.iov_len);
+}
+
+/* the core send_sem serializes this with other xmit and shutdown */
+int rds_tcp_xmit_cong_map(struct rds_connection *conn,
+                          struct rds_cong_map *map, unsigned long offset)
+{
+        static struct rds_header rds_tcp_map_header = {
+                .h_flags = RDS_FLAG_CONG_BITMAP,
+        };
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        unsigned long i;
+        int ret;
+        int copied = 0;
+
+        /* Some problem claims cpu_to_be32(constant) isn't a constant. */
+        rds_tcp_map_header.h_len = cpu_to_be32(RDS_CONG_MAP_BYTES);
+
+        if (offset < sizeof(struct rds_header)) {
+                ret = rds_tcp_sendmsg(tc->t_sock,
+                                      (void *)&rds_tcp_map_header + offset,
+                                      sizeof(struct rds_header) - offset);
+                if (ret <= 0)
+                        return ret;
+                offset += ret;
+                copied = ret;
+                if (offset < sizeof(struct rds_header))
+                        return ret;
+        }
+
+        offset -= sizeof(struct rds_header);
+        i = offset / PAGE_SIZE;
+        offset = offset % PAGE_SIZE;
+        BUG_ON(i >= RDS_CONG_MAP_PAGES);
+
+        do {
+                ret = tc->t_sock->ops->sendpage(tc->t_sock,
+                                        virt_to_page(map->m_page_addrs[i]),
+                                        offset, PAGE_SIZE - offset,
+                                        MSG_DONTWAIT);
+                if (ret <= 0)
+                        break;
+                copied += ret;
+                offset += ret;
+                if (offset == PAGE_SIZE) {
+                        offset = 0;
+                        i++;
+                }
+        } while (i < RDS_CONG_MAP_PAGES);
+
+        return copied ? copied : ret;
+}
+
+/* the core send_sem serializes this with other xmit and shutdown */
+int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
+                 unsigned int hdr_off, unsigned int sg, unsigned int off)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        int done = 0;
+        int ret = 0;
+
+        if (hdr_off == 0) {
+                /*
+                 * m_ack_seq is set to the sequence number of the last byte of
+                 * header and data.  see rds_tcp_is_acked().
+                 */
+                tc->t_last_sent_nxt = rds_tcp_snd_nxt(tc);
+                rm->m_ack_seq = tc->t_last_sent_nxt +
+                                sizeof(struct rds_header) +
+                                be32_to_cpu(rm->m_inc.i_hdr.h_len) - 1;
+                smp_mb__before_clear_bit();
+                set_bit(RDS_MSG_HAS_ACK_SEQ, &rm->m_flags);
+                tc->t_last_expected_una = rm->m_ack_seq + 1;
+
+                rdsdebug("rm %p tcp nxt %u ack_seq %llu\n",
+                         rm, rds_tcp_snd_nxt(tc),
+                         (unsigned long long)rm->m_ack_seq);
+        }
+
+        if (hdr_off < sizeof(struct rds_header)) {
+                /* see rds_tcp_write_space() */
+                set_bit(SOCK_NOSPACE, &tc->t_sock->sk->sk_socket->flags);
+
+                ret = rds_tcp_sendmsg(tc->t_sock,
+                                      (void *)&rm->m_inc.i_hdr + hdr_off,
+                                      sizeof(rm->m_inc.i_hdr) - hdr_off);
+                if (ret < 0)
+                        goto out;
+                done += ret;
+                if (hdr_off + done != sizeof(struct rds_header))
+                        goto out;
+        }
+
+        while (sg < rm->m_nents) {
+                ret = tc->t_sock->ops->sendpage(tc->t_sock,
+                                                sg_page(&rm->m_sg[sg]),
+                                                rm->m_sg[sg].offset + off,
+                                                rm->m_sg[sg].length - off,
+                                                MSG_DONTWAIT|MSG_NOSIGNAL);
+                rdsdebug("tcp sendpage %p:%u:%u ret %d\n", (void *)sg_page(&rm->m_sg[sg]),
+                         rm->m_sg[sg].offset + off, rm->m_sg[sg].length - off,
+                         ret);
+                if (ret <= 0)
+                        break;
+
+                off += ret;
+                done += ret;
+                if (off == rm->m_sg[sg].length) {
+                        off = 0;
+                        sg++;
+                }
+        }
+
+out:
+        if (ret <= 0) {
+                /* write_space will hit after EAGAIN, all else fatal */
+                if (ret == -EAGAIN) {
+                        rds_tcp_stats_inc(s_tcp_sndbuf_full);
+                        ret = 0;
+                } else {
+                        printk(KERN_WARNING "RDS/tcp: send to %u.%u.%u.%u "
+                               "returned %d, disconnecting and reconnecting\n",
+                               NIPQUAD(conn->c_faddr), ret);
+                        rds_conn_drop(conn);
+                }
+        }
+        if (done == 0)
+                done = ret;
+        return done;
+}
+
+/*
+ * rm->m_ack_seq is set to the tcp sequence number that corresponds to the
+ * last byte of the message, including the header.  This means that the
+ * entire message has been received if rm->m_ack_seq is "before" the next
+ * unacked byte of the TCP sequence space.  We have to do very careful
+ * wrapping 32bit comparisons here.
+ */
+static int rds_tcp_is_acked(struct rds_message *rm, uint64_t ack)
+{
+        if (!test_bit(RDS_MSG_HAS_ACK_SEQ, &rm->m_flags))
+                return 0;
+        return (__s32)((u32)rm->m_ack_seq - (u32)ack) < 0;
+}
+
+void rds_tcp_write_space(struct sock *sk)
+{
+        void (*write_space)(struct sock *sk);
+        struct rds_connection *conn;
+        struct rds_tcp_connection *tc;
+
+        read_lock(&sk->sk_callback_lock);
+        conn = sk->sk_user_data;
+        if (conn == NULL) {
+                write_space = sk->sk_write_space;
+                goto out;
+        }
+
+        tc = conn->c_transport_data;
+        rdsdebug("write_space for tc %p\n", tc);
+        write_space = tc->t_orig_write_space;
+        rds_tcp_stats_inc(s_tcp_write_space_calls);
+
+        rdsdebug("tcp una %u\n", rds_tcp_snd_una(tc));
+        tc->t_last_seen_una = rds_tcp_snd_una(tc);
+        rds_send_drop_acked(conn, rds_tcp_snd_una(tc), rds_tcp_is_acked);
+
+        queue_delayed_work(rds_wq, &conn->c_send_w, 0);
+out:
+        read_unlock(&sk->sk_callback_lock);
+
+        /*
+         * write_space is only called when data leaves tcp's send queue if
+         * SOCK_NOSPACE is set.  We set SOCK_NOSPACE every time we put
+         * data in tcp's send queue because we use write_space to parse the
+         * sequence numbers and notice that rds messages have been fully
+         * received.
+         *
+         * tcp's write_space clears SOCK_NOSPACE if the send queue has more
+         * than a certain amount of space. So we need to set it again *after*
+         * we call tcp's write_space or else we might only get called on the
+         * first of a series of incoming tcp acks.
+         */
+        write_space(sk);
+
+        if (sk->sk_socket)
+                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+}
diff --git a/net/rds/tcp_stats.c b/net/rds/tcp_stats.c
new file mode 100644
index 000000000000..d5898d03cd68
--- /dev/null
+++ b/net/rds/tcp_stats.c
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2006 Oracle.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+#include <linux/percpu.h>
+#include <linux/seq_file.h>
+#include <linux/proc_fs.h>
+
+#include "rds.h"
+#include "tcp.h"
+
+DEFINE_PER_CPU(struct rds_tcp_statistics, rds_tcp_stats)
+        ____cacheline_aligned;
+
+static const char const *rds_tcp_stat_names[] = {
+        "tcp_data_ready_calls",
+        "tcp_write_space_calls",
+        "tcp_sndbuf_full",
+        "tcp_connect_raced",
+        "tcp_listen_closed_stale",
+};
+
+unsigned int rds_tcp_stats_info_copy(struct rds_info_iterator *iter,
+                                     unsigned int avail)
+{
+        struct rds_tcp_statistics stats = {0, };
+        uint64_t *src;
+        uint64_t *sum;
+        size_t i;
+        int cpu;
+
+        if (avail < ARRAY_SIZE(rds_tcp_stat_names))
+                goto out;
+
+        for_each_online_cpu(cpu) {
+                src = (uint64_t *)&(per_cpu(rds_tcp_stats, cpu));
+                sum = (uint64_t *)&stats;
+                for (i = 0; i < sizeof(stats) / sizeof(uint64_t); i++)
+                        *(sum++) += *(src++);
+        }
+
+        rds_stats_info_copy(iter, (uint64_t *)&stats, rds_tcp_stat_names,
+                            ARRAY_SIZE(rds_tcp_stat_names));
+out:
+        return ARRAY_SIZE(rds_tcp_stat_names);
+}
diff --git a/net/rds/threads.c b/net/rds/threads.c
index 828a1bf9ea92..dd7e0cad1e7c 100644
--- a/net/rds/threads.c
+++ b/net/rds/threads.c
@@ -68,6 +68,7 @@
  *      (TCP, IB/RDMA) to provide the necessary synchronisation.
  */
 struct workqueue_struct *rds_wq;
+EXPORT_SYMBOL_GPL(rds_wq);
 
 void rds_connect_complete(struct rds_connection *conn)
 {
@@ -89,6 +90,7 @@ void rds_connect_complete(struct rds_connection *conn)
         queue_delayed_work(rds_wq, &conn->c_send_w, 0);
         queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 }
+EXPORT_SYMBOL_GPL(rds_connect_complete);
 
 /*
  * This random exponential backoff is relied on to eventually resolve racing
diff --git a/net/rds/transport.c b/net/rds/transport.c
index 767da61ad2f3..7e1067901353 100644
--- a/net/rds/transport.c
+++ b/net/rds/transport.c
@@ -37,7 +37,7 @@
 #include "rds.h"
 #include "loop.h"
 
-static LIST_HEAD(rds_transports);
+static struct rds_transport *transports[RDS_TRANS_COUNT];
 static DECLARE_RWSEM(rds_trans_sem);
 
 int rds_trans_register(struct rds_transport *trans)
@@ -46,36 +46,44 @@ int rds_trans_register(struct rds_transport *trans)
 
         down_write(&rds_trans_sem);
 
-        list_add_tail(&trans->t_item, &rds_transports);
-        printk(KERN_INFO "Registered RDS/%s transport\n", trans->t_name);
+        if (transports[trans->t_type])
+                printk(KERN_ERR "RDS Transport type %d already registered\n",
+                        trans->t_type);
+        else {
+                transports[trans->t_type] = trans;
+                printk(KERN_INFO "Registered RDS/%s transport\n", trans->t_name);
+        }
 
         up_write(&rds_trans_sem);
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(rds_trans_register);
 
 void rds_trans_unregister(struct rds_transport *trans)
 {
         down_write(&rds_trans_sem);
 
-        list_del_init(&trans->t_item);
+        transports[trans->t_type] = NULL;
         printk(KERN_INFO "Unregistered RDS/%s transport\n", trans->t_name);
 
         up_write(&rds_trans_sem);
 }
+EXPORT_SYMBOL_GPL(rds_trans_unregister);
 
 struct rds_transport *rds_trans_get_preferred(__be32 addr)
 {
-        struct rds_transport *trans;
         struct rds_transport *ret = NULL;
+        int i;
 
         if (IN_LOOPBACK(ntohl(addr)))
                 return &rds_loop_transport;
 
         down_read(&rds_trans_sem);
-        list_for_each_entry(trans, &rds_transports, t_item) {
-                if (trans->laddr_check(addr) == 0) {
-                        ret = trans;
+        for (i = 0; i < RDS_TRANS_COUNT; i++)
+        {
+                if (transports[i] && (transports[i]->laddr_check(addr) == 0)) {
+                        ret = transports[i];
                         break;
                 }
         }
@@ -97,12 +105,15 @@ unsigned int rds_trans_stats_info_copy(struct rds_info_iterator *iter,
         struct rds_transport *trans;
         unsigned int total = 0;
         unsigned int part;
+        int i;
 
         rds_info_iter_unmap(iter);
         down_read(&rds_trans_sem);
 
-        list_for_each_entry(trans, &rds_transports, t_item) {
-                if (trans->stats_info_copy == NULL)
+        for (i = 0; i < RDS_TRANS_COUNT; i++)
+        {
+                trans = transports[i];
+                if (!trans || !trans->stats_info_copy)
                         continue;
 
                 part = trans->stats_info_copy(iter, avail);
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f0a76f6bca71..e5f478ca3d61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -954,6 +954,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
         struct rose_sock *rose = rose_sk(sk);
         int n;
 
+        memset(srose, 0, sizeof(*srose));
         if (peer != 0) {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -ENOTCONN;
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index c711e2edf5ce..424b893d1450 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -131,7 +131,7 @@ static int rose_close(struct net_device *dev)
         return 0;
 }
 
-static int rose_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t rose_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct net_device_stats *stats = &dev->stats;
 
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 54d950cd4b8d..f14e71bfa58f 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the Linux Traffic Control Unit.
 #
 
-obj-y   := sch_generic.o
+obj-y   := sch_generic.o sch_mq.o
 
 obj-$(CONFIG_NET_SCHED)         += sch_api.o sch_blackhole.o
 obj-$(CONFIG_NET_CLS)           += cls_api.o
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 09cdcdfe7e91..6a536949cdc0 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -168,8 +168,7 @@ replay:
 
         /* Find qdisc */
         if (!parent) {
-                struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, 0);
-                q = dev_queue->qdisc_sleeping;
+                q = dev->qdisc;
                 parent = q->handle;
         } else {
                 q = qdisc_lookup(dev, TC_H_MAJ(t->tcm_parent));
@@ -181,6 +180,9 @@ replay:
         if ((cops = q->ops->cl_ops) == NULL)
                 return -EINVAL;
 
+        if (cops->tcf_chain == NULL)
+                return -EOPNOTSUPP;
+
         /* Do we search for filter, attached to class? */
         if (TC_H_MIN(parent)) {
                 cl = cops->get(q, parent);
@@ -405,7 +407,6 @@ static int tcf_node_dump(struct tcf_proto *tp, unsigned long n,
 static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        struct netdev_queue *dev_queue;
         int t;
         int s_t;
         struct net_device *dev;
@@ -424,15 +425,16 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
         if ((dev = dev_get_by_index(&init_net, tcm->tcm_ifindex)) == NULL)
                 return skb->len;
 
-        dev_queue = netdev_get_tx_queue(dev, 0);
         if (!tcm->tcm_parent)
-                q = dev_queue->qdisc_sleeping;
+                q = dev->qdisc;
         else
                 q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
         if (!q)
                 goto out;
         if ((cops = q->ops->cl_ops) == NULL)
                 goto errout;
+        if (cops->tcf_chain == NULL)
+                goto errout;
         if (TC_H_MIN(tcm->tcm_parent)) {
                 cl = cops->get(q, tcm->tcm_parent);
                 if (cl == 0)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 24d17ce9c294..3af106140f35 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -207,7 +207,7 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 static void qdisc_list_add(struct Qdisc *q)
 {
         if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS))
-                list_add_tail(&q->list, &qdisc_root_sleeping(q)->list);
+                list_add_tail(&q->list, &qdisc_dev(q)->qdisc->list);
 }
 
 void qdisc_list_del(struct Qdisc *q)
@@ -219,17 +219,11 @@ EXPORT_SYMBOL(qdisc_list_del);
 
 struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
 {
-        unsigned int i;
         struct Qdisc *q;
 
-        for (i = 0; i < dev->num_tx_queues; i++) {
-                struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
-                struct Qdisc *txq_root = txq->qdisc_sleeping;
-
-                q = qdisc_match_from_root(txq_root, handle);
-                if (q)
-                        goto out;
-        }
+        q = qdisc_match_from_root(dev->qdisc, handle);
+        if (q)
+                goto out;
 
         q = qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle);
 out:
@@ -616,32 +610,6 @@ static u32 qdisc_alloc_handle(struct net_device *dev)
         return i>0 ? autohandle : 0;
 }
 
-/* Attach toplevel qdisc to device queue. */
-
-static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
-                                     struct Qdisc *qdisc)
-{
-        struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
-        spinlock_t *root_lock;
-
-        root_lock = qdisc_lock(oqdisc);
-        spin_lock_bh(root_lock);
-
-        /* Prune old scheduler */
-        if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
-                qdisc_reset(oqdisc);
-
-        /* ... and graft new one */
-        if (qdisc == NULL)
-                qdisc = &noop_qdisc;
-        dev_queue->qdisc_sleeping = qdisc;
-        rcu_assign_pointer(dev_queue->qdisc, &noop_qdisc);
-
-        spin_unlock_bh(root_lock);
-
-        return oqdisc;
-}
-
 void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n)
 {
         const struct Qdisc_class_ops *cops;
@@ -710,6 +678,11 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                 if (dev->flags & IFF_UP)
                         dev_deactivate(dev);
 
+                if (new && new->ops->attach) {
+                        new->ops->attach(new);
+                        num_q = 0;
+                }
+
                 for (i = 0; i < num_q; i++) {
                         struct netdev_queue *dev_queue = &dev->rx_queue;
 
@@ -720,22 +693,27 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                         if (new && i > 0)
                                 atomic_inc(&new->refcnt);
 
-                        notify_and_destroy(skb, n, classid, old, new);
+                        qdisc_destroy(old);
                 }
 
+                notify_and_destroy(skb, n, classid, dev->qdisc, new);
+                if (new && !new->ops->attach)
+                        atomic_inc(&new->refcnt);
+                dev->qdisc = new ? : &noop_qdisc;
+
                 if (dev->flags & IFF_UP)
                         dev_activate(dev);
         } else {
                 const struct Qdisc_class_ops *cops = parent->ops->cl_ops;
 
-                err = -EINVAL;
-
-                if (cops) {
+                err = -EOPNOTSUPP;
+                if (cops && cops->graft) {
                         unsigned long cl = cops->get(parent, classid);
                         if (cl) {
                                 err = cops->graft(parent, cl, new, &old);
                                 cops->put(parent, cl);
-                        }
+                        } else
+                                err = -ENOENT;
                 }
                 if (!err)
                         notify_and_destroy(skb, n, classid, old, new);
@@ -755,7 +733,8 @@ static struct lock_class_key qdisc_rx_lock;
 
 static struct Qdisc *
 qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
-             u32 parent, u32 handle, struct nlattr **tca, int *errp)
+             struct Qdisc *p, u32 parent, u32 handle,
+             struct nlattr **tca, int *errp)
 {
         int err;
         struct nlattr *kind = tca[TCA_KIND];
@@ -832,24 +811,21 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                 if (tca[TCA_RATE]) {
                         spinlock_t *root_lock;
 
+                        err = -EOPNOTSUPP;
+                        if (sch->flags & TCQ_F_MQROOT)
+                                goto err_out4;
+
                         if ((sch->parent != TC_H_ROOT) &&
-                            !(sch->flags & TCQ_F_INGRESS))
+                            !(sch->flags & TCQ_F_INGRESS) &&
+                            (!p || !(p->flags & TCQ_F_MQROOT)))
                                 root_lock = qdisc_root_sleeping_lock(sch);
                         else
                                 root_lock = qdisc_lock(sch);
 
                         err = gen_new_estimator(&sch->bstats, &sch->rate_est,
                                                 root_lock, tca[TCA_RATE]);
-                        if (err) {
-                                /*
-                                 * Any broken qdiscs that would require
-                                 * a ops->reset() here? The qdisc was never
-                                 * in action so it shouldn't be necessary.
-                                 */
-                                if (ops->destroy)
-                                        ops->destroy(sch);
-                                goto err_out3;
-                        }
+                        if (err)
+                                goto err_out4;
                 }
 
                 qdisc_list_add(sch);
@@ -865,6 +841,15 @@ err_out2:
 err_out:
         *errp = err;
         return NULL;
+
+err_out4:
+        /*
+         * Any broken qdiscs that would require a ops->reset() here?
+         * The qdisc was never in action so it shouldn't be necessary.
+         */
+        if (ops->destroy)
+                ops->destroy(sch);
+        goto err_out3;
 }
 
 static int qdisc_change(struct Qdisc *sch, struct nlattr **tca)
@@ -889,13 +874,16 @@ static int qdisc_change(struct Qdisc *sch, struct nlattr **tca)
         qdisc_put_stab(sch->stab);
         sch->stab = stab;
 
-        if (tca[TCA_RATE])
+        if (tca[TCA_RATE]) {
                 /* NB: ignores errors from replace_estimator
                    because change can't be undone. */
+                if (sch->flags & TCQ_F_MQROOT)
+                        goto out;
                 gen_replace_estimator(&sch->bstats, &sch->rate_est,
                                             qdisc_root_sleeping_lock(sch),
                                             tca[TCA_RATE]);
-
+        }
+out:
         return 0;
 }
 
@@ -974,9 +962,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
                                 q = dev->rx_queue.qdisc_sleeping;
                         }
                 } else {
-                        struct netdev_queue *dev_queue;
-                        dev_queue = netdev_get_tx_queue(dev, 0);
-                        q = dev_queue->qdisc_sleeping;
+                        q = dev->qdisc;
                 }
                 if (!q)
                         return -ENOENT;
@@ -1044,9 +1030,7 @@ replay:
                                 q = dev->rx_queue.qdisc_sleeping;
                         }
                 } else {
-                        struct netdev_queue *dev_queue;
-                        dev_queue = netdev_get_tx_queue(dev, 0);
-                        q = dev_queue->qdisc_sleeping;
+                        q = dev->qdisc;
                 }
 
                 /* It may be default qdisc, ignore it */
@@ -1123,13 +1107,19 @@ create_n_graft:
         if (!(n->nlmsg_flags&NLM_F_CREATE))
                 return -ENOENT;
         if (clid == TC_H_INGRESS)
-                q = qdisc_create(dev, &dev->rx_queue,
+                q = qdisc_create(dev, &dev->rx_queue, p,
                                  tcm->tcm_parent, tcm->tcm_parent,
                                  tca, &err);
-        else
-                q = qdisc_create(dev, netdev_get_tx_queue(dev, 0),
+        else {
+                unsigned int ntx = 0;
+
+                if (p && p->ops->cl_ops && p->ops->cl_ops->select_queue)
+                        ntx = p->ops->cl_ops->select_queue(p, tcm);
+
+                q = qdisc_create(dev, netdev_get_tx_queue(dev, ntx), p,
                                  tcm->tcm_parent, tcm->tcm_handle,
                                  tca, &err);
+        }
         if (q == NULL) {
                 if (err == -EAGAIN)
                         goto replay;
@@ -1291,8 +1281,7 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
                         s_q_idx = 0;
                 q_idx = 0;
 
-                dev_queue = netdev_get_tx_queue(dev, 0);
-                if (tc_dump_qdisc_root(dev_queue->qdisc_sleeping, skb, cb, &q_idx, s_q_idx) < 0)
+                if (tc_dump_qdisc_root(dev->qdisc, skb, cb, &q_idx, s_q_idx) < 0)
                         goto done;
 
                 dev_queue = &dev->rx_queue;
@@ -1323,7 +1312,6 @@ done:
 static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
 {
         struct net *net = sock_net(skb->sk);
-        struct netdev_queue *dev_queue;
         struct tcmsg *tcm = NLMSG_DATA(n);
         struct nlattr *tca[TCA_MAX + 1];
         struct net_device *dev;
@@ -1361,7 +1349,6 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
 
         /* Step 1. Determine qdisc handle X:0 */
 
-        dev_queue = netdev_get_tx_queue(dev, 0);
         if (pid != TC_H_ROOT) {
                 u32 qid1 = TC_H_MAJ(pid);
 
@@ -1372,7 +1359,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
                 } else if (qid1) {
                         qid = qid1;
                 } else if (qid == 0)
-                        qid = dev_queue->qdisc_sleeping->handle;
+                        qid = dev->qdisc->handle;
 
                 /* Now qid is genuine qdisc handle consistent
                    both with parent and child.
@@ -1383,7 +1370,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
                         pid = TC_H_MAKE(qid, pid);
         } else {
                 if (qid == 0)
-                        qid = dev_queue->qdisc_sleeping->handle;
+                        qid = dev->qdisc->handle;
         }
 
         /* OK. Locate qdisc */
@@ -1417,7 +1404,9 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
                                 goto out;
                         break;
                 case RTM_DELTCLASS:
-                        err = cops->delete(q, cl);
+                        err = -EOPNOTSUPP;
+                        if (cops->delete)
+                                err = cops->delete(q, cl);
                         if (err == 0)
                                 tclass_notify(skb, n, q, cl, RTM_DELTCLASS);
                         goto out;
@@ -1431,7 +1420,9 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         }
 
         new_cl = cl;
-        err = cops->change(q, clid, pid, tca, &new_cl);
+        err = -EOPNOTSUPP;
+        if (cops->change)
+                err = cops->change(q, clid, pid, tca, &new_cl);
         if (err == 0)
                 tclass_notify(skb, n, q, new_cl, RTM_NEWTCLASS);
 
@@ -1584,8 +1575,7 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
         s_t = cb->args[0];
         t = 0;
 
-        dev_queue = netdev_get_tx_queue(dev, 0);
-        if (tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb, &t, s_t) < 0)
+        if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t) < 0)
                 goto done;
 
         dev_queue = &dev->rx_queue;
@@ -1705,6 +1695,7 @@ static int __init pktsched_init(void)
 {
         register_qdisc(&pfifo_qdisc_ops);
         register_qdisc(&bfifo_qdisc_ops);
+        register_qdisc(&mq_qdisc_ops);
         proc_net_fops_create(&init_net, "psched", 0, &psched_fops);
 
         rtnl_register(PF_UNSPEC, RTM_NEWQDISC, tc_modify_qdisc, NULL);
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 2a8b83af7c47..ab82f145f689 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -49,7 +49,7 @@ struct atm_flow_data {
         struct socket           *sock;          /* for closing */
         u32                     classid;        /* x:y type ID */
         int                     ref;            /* reference count */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed  bstats;
         struct gnet_stats_queue qstats;
         struct atm_flow_data    *next;
         struct atm_flow_data    *excess;        /* flow for excess traffic;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 23a167670fd5..5b132c473264 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -128,7 +128,7 @@ struct cbq_class
         long                    avgidle;
         long                    deficit;        /* Saved deficit for WRR */
         psched_time_t           penalized;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         struct tc_cbq_xstats    xstats;
@@ -1621,29 +1621,25 @@ static int cbq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 {
         struct cbq_class *cl = (struct cbq_class*)arg;
 
-        if (cl) {
-                if (new == NULL) {
-                        new = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
-                                                &pfifo_qdisc_ops,
-                                                cl->common.classid);
-                        if (new == NULL)
-                                return -ENOBUFS;
-                } else {
+        if (new == NULL) {
+                new = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
+                                        &pfifo_qdisc_ops, cl->common.classid);
+                if (new == NULL)
+                        return -ENOBUFS;
+        } else {
 #ifdef CONFIG_NET_CLS_ACT
-                        if (cl->police == TC_POLICE_RECLASSIFY)
-                                new->reshape_fail = cbq_reshape_fail;
+                if (cl->police == TC_POLICE_RECLASSIFY)
+                        new->reshape_fail = cbq_reshape_fail;
 #endif
-                }
-                sch_tree_lock(sch);
-                *old = cl->q;
-                cl->q = new;
-                qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
-                qdisc_reset(*old);
-                sch_tree_unlock(sch);
-
-                return 0;
         }
-        return -ENOENT;
+        sch_tree_lock(sch);
+        *old = cl->q;
+        cl->q = new;
+        qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+        qdisc_reset(*old);
+        sch_tree_unlock(sch);
+
+        return 0;
 }
 
 static struct Qdisc *
@@ -1651,7 +1647,7 @@ cbq_leaf(struct Qdisc *sch, unsigned long arg)
 {
         struct cbq_class *cl = (struct cbq_class*)arg;
 
-        return cl ? cl->q : NULL;
+        return cl->q;
 }
 
 static void cbq_qlen_notify(struct Qdisc *sch, unsigned long arg)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 7597fe146866..12b2fb04b29b 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -22,7 +22,7 @@ struct drr_class {
         unsigned int                    refcnt;
         unsigned int                    filter_cnt;
 
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed          bstats;
         struct gnet_stats_queue         qstats;
         struct gnet_stats_rate_est      rate_est;
         struct list_head                alist;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 693df7ae33d8..4ae6aa562f2b 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -406,18 +406,38 @@ static const u8 prio2band[TC_PRIO_MAX+1] =
 
 #define PFIFO_FAST_BANDS 3
 
-static inline struct sk_buff_head *prio2list(struct sk_buff *skb,
-                                             struct Qdisc *qdisc)
+/*
+ * Private data for a pfifo_fast scheduler containing:
+ *      - queues for the three band
+ *      - bitmap indicating which of the bands contain skbs
+ */
+struct pfifo_fast_priv {
+        u32 bitmap;
+        struct sk_buff_head q[PFIFO_FAST_BANDS];
+};
+
+/*
+ * Convert a bitmap to the first band number where an skb is queued, where:
+ *      bitmap=0 means there are no skbs on any band.
+ *      bitmap=1 means there is an skb on band 0.
+ *      bitmap=7 means there are skbs on all 3 bands, etc.
+ */
+static const int bitmap2band[] = {-1, 0, 1, 0, 2, 0, 1, 0};
+
+static inline struct sk_buff_head *band2list(struct pfifo_fast_priv *priv,
+                                             int band)
 {
-        struct sk_buff_head *list = qdisc_priv(qdisc);
-        return list + prio2band[skb->priority & TC_PRIO_MAX];
+        return priv->q + band;
 }
 
 static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc* qdisc)
 {
-        struct sk_buff_head *list = prio2list(skb, qdisc);
+        if (skb_queue_len(&qdisc->q) < qdisc_dev(qdisc)->tx_queue_len) {
+                int band = prio2band[skb->priority & TC_PRIO_MAX];
+                struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
+                struct sk_buff_head *list = band2list(priv, band);
 
-        if (skb_queue_len(list) < qdisc_dev(qdisc)->tx_queue_len) {
+                priv->bitmap |= (1 << band);
                 qdisc->q.qlen++;
                 return __qdisc_enqueue_tail(skb, qdisc, list);
         }
@@ -427,14 +447,18 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc* qdisc)
 
 static struct sk_buff *pfifo_fast_dequeue(struct Qdisc* qdisc)
 {
-        int prio;
-        struct sk_buff_head *list = qdisc_priv(qdisc);
+        struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
+        int band = bitmap2band[priv->bitmap];
 
-        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++) {
-                if (!skb_queue_empty(list + prio)) {
-                        qdisc->q.qlen--;
-                        return __qdisc_dequeue_head(qdisc, list + prio);
-                }
+        if (likely(band >= 0)) {
+                struct sk_buff_head *list = band2list(priv, band);
+                struct sk_buff *skb = __qdisc_dequeue_head(qdisc, list);
+
+                qdisc->q.qlen--;
+                if (skb_queue_empty(list))
+                        priv->bitmap &= ~(1 << band);
+
+                return skb;
         }
 
         return NULL;
@@ -442,12 +466,13 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc* qdisc)
 
 static struct sk_buff *pfifo_fast_peek(struct Qdisc* qdisc)
 {
-        int prio;
-        struct sk_buff_head *list = qdisc_priv(qdisc);
+        struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
+        int band = bitmap2band[priv->bitmap];
+
+        if (band >= 0) {
+                struct sk_buff_head *list = band2list(priv, band);
 
-        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++) {
-                if (!skb_queue_empty(list + prio))
-                        return skb_peek(list + prio);
+                return skb_peek(list);
         }
 
         return NULL;
@@ -456,11 +481,12 @@ static struct sk_buff *pfifo_fast_peek(struct Qdisc* qdisc)
 static void pfifo_fast_reset(struct Qdisc* qdisc)
 {
         int prio;
-        struct sk_buff_head *list = qdisc_priv(qdisc);
+        struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
 
         for (prio = 0; prio < PFIFO_FAST_BANDS; prio++)
-                __qdisc_reset_queue(qdisc, list + prio);
+                __qdisc_reset_queue(qdisc, band2list(priv, prio));
 
+        priv->bitmap = 0;
         qdisc->qstats.backlog = 0;
         qdisc->q.qlen = 0;
 }
@@ -480,17 +506,17 @@ nla_put_failure:
 static int pfifo_fast_init(struct Qdisc *qdisc, struct nlattr *opt)
 {
         int prio;
-        struct sk_buff_head *list = qdisc_priv(qdisc);
+        struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
 
         for (prio = 0; prio < PFIFO_FAST_BANDS; prio++)
-                skb_queue_head_init(list + prio);
+                skb_queue_head_init(band2list(priv, prio));
 
         return 0;
 }
 
-static struct Qdisc_ops pfifo_fast_ops __read_mostly = {
+struct Qdisc_ops pfifo_fast_ops __read_mostly = {
         .id             =       "pfifo_fast",
-        .priv_size      =       PFIFO_FAST_BANDS * sizeof(struct sk_buff_head),
+        .priv_size      =       sizeof(struct pfifo_fast_priv),
         .enqueue        =       pfifo_fast_enqueue,
         .dequeue        =       pfifo_fast_dequeue,
         .peek           =       pfifo_fast_peek,
@@ -597,17 +623,29 @@ void qdisc_destroy(struct Qdisc *qdisc)
 }
 EXPORT_SYMBOL(qdisc_destroy);
 
-static bool dev_all_qdisc_sleeping_noop(struct net_device *dev)
+/* Attach toplevel qdisc to device queue. */
+struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
+                              struct Qdisc *qdisc)
 {
-        unsigned int i;
+        struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
+        spinlock_t *root_lock;
 
-        for (i = 0; i < dev->num_tx_queues; i++) {
-                struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
+        root_lock = qdisc_lock(oqdisc);
+        spin_lock_bh(root_lock);
 
-                if (txq->qdisc_sleeping != &noop_qdisc)
-                        return false;
-        }
-        return true;
+        /* Prune old scheduler */
+        if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
+                qdisc_reset(oqdisc);
+
+        /* ... and graft new one */
+        if (qdisc == NULL)
+                qdisc = &noop_qdisc;
+        dev_queue->qdisc_sleeping = qdisc;
+        rcu_assign_pointer(dev_queue->qdisc, &noop_qdisc);
+
+        spin_unlock_bh(root_lock);
+
+        return oqdisc;
 }
 
 static void attach_one_default_qdisc(struct net_device *dev,
@@ -632,6 +670,26 @@ static void attach_one_default_qdisc(struct net_device *dev,
         dev_queue->qdisc_sleeping = qdisc;
 }
 
+static void attach_default_qdiscs(struct net_device *dev)
+{
+        struct netdev_queue *txq;
+        struct Qdisc *qdisc;
+
+        txq = netdev_get_tx_queue(dev, 0);
+
+        if (!netif_is_multiqueue(dev) || dev->tx_queue_len == 0) {
+                netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL);
+                dev->qdisc = txq->qdisc_sleeping;
+                atomic_inc(&dev->qdisc->refcnt);
+        } else {
+                qdisc = qdisc_create_dflt(dev, txq, &mq_qdisc_ops, TC_H_ROOT);
+                if (qdisc) {
+                        qdisc->ops->attach(qdisc);
+                        dev->qdisc = qdisc;
+                }
+        }
+}
+
 static void transition_one_qdisc(struct net_device *dev,
                                  struct netdev_queue *dev_queue,
                                  void *_need_watchdog)
@@ -659,8 +717,8 @@ void dev_activate(struct net_device *dev)
            virtual interfaces
          */
 
-        if (dev_all_qdisc_sleeping_noop(dev))
-                netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL);
+        if (dev->qdisc == &noop_qdisc)
+                attach_default_qdiscs(dev);
 
         if (!netif_carrier_ok(dev))
                 /* Delay activation until next carrier-on event */
@@ -751,6 +809,7 @@ static void dev_init_scheduler_queue(struct net_device *dev,
 
 void dev_init_scheduler(struct net_device *dev)
 {
+        dev->qdisc = &noop_qdisc;
         netdev_for_each_tx_queue(dev, dev_init_scheduler_queue, &noop_qdisc);
         dev_init_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
 
@@ -776,5 +835,8 @@ void dev_shutdown(struct net_device *dev)
 {
         netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
         shutdown_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
+        qdisc_destroy(dev->qdisc);
+        dev->qdisc = &noop_qdisc;
+
         WARN_ON(timer_pending(&dev->watchdog_timer));
 }
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 362c2811b2df..375d64cb1a3d 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -116,7 +116,7 @@ struct hfsc_class
         struct Qdisc_class_common cl_common;
         unsigned int    refcnt;         /* usage count */
 
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         unsigned int    level;          /* class level in hierarchy */
@@ -1203,8 +1203,6 @@ hfsc_graft_class(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 {
         struct hfsc_class *cl = (struct hfsc_class *)arg;
 
-        if (cl == NULL)
-                return -ENOENT;
         if (cl->level > 0)
                 return -EINVAL;
         if (new == NULL) {
@@ -1228,7 +1226,7 @@ hfsc_class_leaf(struct Qdisc *sch, unsigned long arg)
 {
         struct hfsc_class *cl = (struct hfsc_class *)arg;
 
-        if (cl != NULL && cl->level == 0)
+        if (cl->level == 0)
                 return cl->qdisc;
 
         return NULL;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 88cd02626621..85acab9dc6fd 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -74,7 +74,7 @@ enum htb_cmode {
 struct htb_class {
         struct Qdisc_class_common common;
         /* general class parameters */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         struct tc_htb_xstats xstats;    /* our special stats */
@@ -1117,30 +1117,29 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 {
         struct htb_class *cl = (struct htb_class *)arg;
 
-        if (cl && !cl->level) {
-                if (new == NULL &&
-                    (new = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
-                                             &pfifo_qdisc_ops,
-                                             cl->common.classid))
-                    == NULL)
-                        return -ENOBUFS;
-                sch_tree_lock(sch);
-                *old = cl->un.leaf.q;
-                cl->un.leaf.q = new;
-                if (*old != NULL) {
-                        qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
-                        qdisc_reset(*old);
-                }
-                sch_tree_unlock(sch);
-                return 0;
+        if (cl->level)
+                return -EINVAL;
+        if (new == NULL &&
+            (new = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
+                                     &pfifo_qdisc_ops,
+                                     cl->common.classid)) == NULL)
+                return -ENOBUFS;
+
+        sch_tree_lock(sch);
+        *old = cl->un.leaf.q;
+        cl->un.leaf.q = new;
+        if (*old != NULL) {
+                qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+                qdisc_reset(*old);
         }
-        return -ENOENT;
+        sch_tree_unlock(sch);
+        return 0;
 }
 
 static struct Qdisc *htb_leaf(struct Qdisc *sch, unsigned long arg)
 {
         struct htb_class *cl = (struct htb_class *)arg;
-        return (cl && !cl->level) ? cl->un.leaf.q : NULL;
+        return !cl->level ? cl->un.leaf.q : NULL;
 }
 
 static void htb_qlen_notify(struct Qdisc *sch, unsigned long arg)
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 4a2b77374358..a9e646bdb605 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -22,12 +22,6 @@ struct ingress_qdisc_data {
 
 /* ------------------------- Class/flow operations ------------------------- */
 
-static int ingress_graft(struct Qdisc *sch, unsigned long arg,
-                         struct Qdisc *new, struct Qdisc **old)
-{
-        return -EOPNOTSUPP;
-}
-
 static struct Qdisc *ingress_leaf(struct Qdisc *sch, unsigned long arg)
 {
         return NULL;
@@ -48,12 +42,6 @@ static void ingress_put(struct Qdisc *sch, unsigned long cl)
 {
 }
 
-static int ingress_change(struct Qdisc *sch, u32 classid, u32 parent,
-                          struct nlattr **tca, unsigned long *arg)
-{
-        return 0;
-}
-
 static void ingress_walk(struct Qdisc *sch, struct qdisc_walker *walker)
 {
         return;
@@ -123,11 +111,9 @@ nla_put_failure:
 }
 
 static const struct Qdisc_class_ops ingress_class_ops = {
-        .graft          =       ingress_graft,
         .leaf           =       ingress_leaf,
         .get            =       ingress_get,
         .put            =       ingress_put,
-        .change         =       ingress_change,
         .walk           =       ingress_walk,
         .tcf_chain      =       ingress_find_tcf,
         .bind_tcf       =       ingress_bind_filter,
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
new file mode 100644
index 000000000000..dd5ee022f1f7
--- /dev/null
+++ b/net/sched/sch_mq.c
@@ -0,0 +1,235 @@
+/*
+ * net/sched/sch_mq.c           Classful multiqueue dummy scheduler
+ *
+ * Copyright (c) 2009 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+#include <net/netlink.h>
+#include <net/pkt_sched.h>
+
+struct mq_sched {
+        struct Qdisc            **qdiscs;
+};
+
+static void mq_destroy(struct Qdisc *sch)
+{
+        struct net_device *dev = qdisc_dev(sch);
+        struct mq_sched *priv = qdisc_priv(sch);
+        unsigned int ntx;
+
+        if (!priv->qdiscs)
+                return;
+        for (ntx = 0; ntx < dev->num_tx_queues && priv->qdiscs[ntx]; ntx++)
+                qdisc_destroy(priv->qdiscs[ntx]);
+        kfree(priv->qdiscs);
+}
+
+static int mq_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct net_device *dev = qdisc_dev(sch);
+        struct mq_sched *priv = qdisc_priv(sch);
+        struct netdev_queue *dev_queue;
+        struct Qdisc *qdisc;
+        unsigned int ntx;
+
+        if (sch->parent != TC_H_ROOT)
+                return -EOPNOTSUPP;
+
+        if (!netif_is_multiqueue(dev))
+                return -EOPNOTSUPP;
+
+        /* pre-allocate qdiscs, attachment can't fail */
+        priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]),
+                               GFP_KERNEL);
+        if (priv->qdiscs == NULL)
+                return -ENOMEM;
+
+        for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
+                dev_queue = netdev_get_tx_queue(dev, ntx);
+                qdisc = qdisc_create_dflt(dev, dev_queue, &pfifo_fast_ops,
+                                          TC_H_MAKE(TC_H_MAJ(sch->handle),
+                                                    TC_H_MIN(ntx + 1)));
+                if (qdisc == NULL)
+                        goto err;
+                qdisc->flags |= TCQ_F_CAN_BYPASS;
+                priv->qdiscs[ntx] = qdisc;
+        }
+
+        sch->flags |= TCQ_F_MQROOT;
+        return 0;
+
+err:
+        mq_destroy(sch);
+        return -ENOMEM;
+}
+
+static void mq_attach(struct Qdisc *sch)
+{
+        struct net_device *dev = qdisc_dev(sch);
+        struct mq_sched *priv = qdisc_priv(sch);
+        struct Qdisc *qdisc;
+        unsigned int ntx;
+
+        for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
+                qdisc = priv->qdiscs[ntx];
+                qdisc = dev_graft_qdisc(qdisc->dev_queue, qdisc);
+                if (qdisc)
+                        qdisc_destroy(qdisc);
+        }
+        kfree(priv->qdiscs);
+        priv->qdiscs = NULL;
+}
+
+static int mq_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+        struct net_device *dev = qdisc_dev(sch);
+        struct Qdisc *qdisc;
+        unsigned int ntx;
+
+        sch->q.qlen = 0;
+        memset(&sch->bstats, 0, sizeof(sch->bstats));
+        memset(&sch->qstats, 0, sizeof(sch->qstats));
+
+        for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
+                qdisc = netdev_get_tx_queue(dev, ntx)->qdisc_sleeping;
+                spin_lock_bh(qdisc_lock(qdisc));
+                sch->q.qlen             += qdisc->q.qlen;
+                sch->bstats.bytes       += qdisc->bstats.bytes;
+                sch->bstats.packets     += qdisc->bstats.packets;
+                sch->qstats.qlen        += qdisc->qstats.qlen;
+                sch->qstats.backlog     += qdisc->qstats.backlog;
+                sch->qstats.drops       += qdisc->qstats.drops;
+                sch->qstats.requeues    += qdisc->qstats.requeues;
+                sch->qstats.overlimits  += qdisc->qstats.overlimits;
+                spin_unlock_bh(qdisc_lock(qdisc));
+        }
+        return 0;
+}
+
+static struct netdev_queue *mq_queue_get(struct Qdisc *sch, unsigned long cl)
+{
+        struct net_device *dev = qdisc_dev(sch);
+        unsigned long ntx = cl - 1;
+
+        if (ntx >= dev->num_tx_queues)
+                return NULL;
+        return netdev_get_tx_queue(dev, ntx);
+}
+
+static unsigned int mq_select_queue(struct Qdisc *sch, struct tcmsg *tcm)
+{
+        unsigned int ntx = TC_H_MIN(tcm->tcm_parent);
+
+        if (!mq_queue_get(sch, ntx))
+                return 0;
+        return ntx - 1;
+}
+
+static int mq_graft(struct Qdisc *sch, unsigned long cl, struct Qdisc *new,
+                    struct Qdisc **old)
+{
+        struct netdev_queue *dev_queue = mq_queue_get(sch, cl);
+        struct net_device *dev = qdisc_dev(sch);
+
+        if (dev->flags & IFF_UP)
+                dev_deactivate(dev);
+
+        *old = dev_graft_qdisc(dev_queue, new);
+
+        if (dev->flags & IFF_UP)
+                dev_activate(dev);
+        return 0;
+}
+
+static struct Qdisc *mq_leaf(struct Qdisc *sch, unsigned long cl)
+{
+        struct netdev_queue *dev_queue = mq_queue_get(sch, cl);
+
+        return dev_queue->qdisc_sleeping;
+}
+
+static unsigned long mq_get(struct Qdisc *sch, u32 classid)
+{
+        unsigned int ntx = TC_H_MIN(classid);
+
+        if (!mq_queue_get(sch, ntx))
+                return 0;
+        return ntx;
+}
+
+static void mq_put(struct Qdisc *sch, unsigned long cl)
+{
+        return;
+}
+
+static int mq_dump_class(struct Qdisc *sch, unsigned long cl,
+                         struct sk_buff *skb, struct tcmsg *tcm)
+{
+        struct netdev_queue *dev_queue = mq_queue_get(sch, cl);
+
+        tcm->tcm_parent = TC_H_ROOT;
+        tcm->tcm_handle |= TC_H_MIN(cl);
+        tcm->tcm_info = dev_queue->qdisc_sleeping->handle;
+        return 0;
+}
+
+static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+                               struct gnet_dump *d)
+{
+        struct netdev_queue *dev_queue = mq_queue_get(sch, cl);
+
+        sch = dev_queue->qdisc_sleeping;
+        if (gnet_stats_copy_basic(d, &sch->bstats) < 0 ||
+            gnet_stats_copy_queue(d, &sch->qstats) < 0)
+                return -1;
+        return 0;
+}
+
+static void mq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
+{
+        struct net_device *dev = qdisc_dev(sch);
+        unsigned int ntx;
+
+        if (arg->stop)
+                return;
+
+        arg->count = arg->skip;
+        for (ntx = arg->skip; ntx < dev->num_tx_queues; ntx++) {
+                if (arg->fn(sch, ntx + 1, arg) < 0) {
+                        arg->stop = 1;
+                        break;
+                }
+                arg->count++;
+        }
+}
+
+static const struct Qdisc_class_ops mq_class_ops = {
+        .select_queue   = mq_select_queue,
+        .graft          = mq_graft,
+        .leaf           = mq_leaf,
+        .get            = mq_get,
+        .put            = mq_put,
+        .walk           = mq_walk,
+        .dump           = mq_dump_class,
+        .dump_stats     = mq_dump_class_stats,
+};
+
+struct Qdisc_ops mq_qdisc_ops __read_mostly = {
+        .cl_ops         = &mq_class_ops,
+        .id             = "mq",
+        .priv_size      = sizeof(struct mq_sched),
+        .init           = mq_init,
+        .destroy        = mq_destroy,
+        .attach         = mq_attach,
+        .dump           = mq_dump,
+        .owner          = THIS_MODULE,
+};
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 912731203047..069f81c97277 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -298,9 +298,6 @@ static int multiq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
         struct multiq_sched_data *q = qdisc_priv(sch);
         unsigned long band = arg - 1;
 
-        if (band >= q->bands)
-                return -EINVAL;
-
         if (new == NULL)
                 new = &noop_qdisc;
 
@@ -320,9 +317,6 @@ multiq_leaf(struct Qdisc *sch, unsigned long arg)
         struct multiq_sched_data *q = qdisc_priv(sch);
         unsigned long band = arg - 1;
 
-        if (band >= q->bands)
-                return NULL;
-
         return q->queues[band];
 }
 
@@ -348,36 +342,13 @@ static void multiq_put(struct Qdisc *q, unsigned long cl)
         return;
 }
 
-static int multiq_change(struct Qdisc *sch, u32 handle, u32 parent,
-                         struct nlattr **tca, unsigned long *arg)
-{
-        unsigned long cl = *arg;
-        struct multiq_sched_data *q = qdisc_priv(sch);
-
-        if (cl - 1 > q->bands)
-                return -ENOENT;
-        return 0;
-}
-
-static int multiq_delete(struct Qdisc *sch, unsigned long cl)
-{
-        struct multiq_sched_data *q = qdisc_priv(sch);
-        if (cl - 1 > q->bands)
-                return -ENOENT;
-        return 0;
-}
-
-
 static int multiq_dump_class(struct Qdisc *sch, unsigned long cl,
                              struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct multiq_sched_data *q = qdisc_priv(sch);
 
-        if (cl - 1 > q->bands)
-                return -ENOENT;
         tcm->tcm_handle |= TC_H_MIN(cl);
-        if (q->queues[cl-1])
-                tcm->tcm_info = q->queues[cl-1]->handle;
+        tcm->tcm_info = q->queues[cl-1]->handle;
         return 0;
 }
 
@@ -430,8 +401,6 @@ static const struct Qdisc_class_ops multiq_class_ops = {
         .leaf           =       multiq_leaf,
         .get            =       multiq_get,
         .put            =       multiq_put,
-        .change         =       multiq_change,
-        .delete         =       multiq_delete,
         .walk           =       multiq_walk,
         .tcf_chain      =       multiq_find_tcf,
         .bind_tcf       =       multiq_bind,
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 94cecef70145..0f73c412d04b 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -262,9 +262,6 @@ static int prio_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
         struct prio_sched_data *q = qdisc_priv(sch);
         unsigned long band = arg - 1;
 
-        if (band >= q->bands)
-                return -EINVAL;
-
         if (new == NULL)
                 new = &noop_qdisc;
 
@@ -284,9 +281,6 @@ prio_leaf(struct Qdisc *sch, unsigned long arg)
         struct prio_sched_data *q = qdisc_priv(sch);
         unsigned long band = arg - 1;
 
-        if (band >= q->bands)
-                return NULL;
-
         return q->queues[band];
 }
 
@@ -311,35 +305,13 @@ static void prio_put(struct Qdisc *q, unsigned long cl)
         return;
 }
 
-static int prio_change(struct Qdisc *sch, u32 handle, u32 parent, struct nlattr **tca, unsigned long *arg)
-{
-        unsigned long cl = *arg;
-        struct prio_sched_data *q = qdisc_priv(sch);
-
-        if (cl - 1 > q->bands)
-                return -ENOENT;
-        return 0;
-}
-
-static int prio_delete(struct Qdisc *sch, unsigned long cl)
-{
-        struct prio_sched_data *q = qdisc_priv(sch);
-        if (cl - 1 > q->bands)
-                return -ENOENT;
-        return 0;
-}
-
-
 static int prio_dump_class(struct Qdisc *sch, unsigned long cl, struct sk_buff *skb,
                            struct tcmsg *tcm)
 {
         struct prio_sched_data *q = qdisc_priv(sch);
 
-        if (cl - 1 > q->bands)
-                return -ENOENT;
         tcm->tcm_handle |= TC_H_MIN(cl);
-        if (q->queues[cl-1])
-                tcm->tcm_info = q->queues[cl-1]->handle;
+        tcm->tcm_info = q->queues[cl-1]->handle;
         return 0;
 }
 
@@ -392,8 +364,6 @@ static const struct Qdisc_class_ops prio_class_ops = {
         .leaf           =       prio_leaf,
         .get            =       prio_get,
         .put            =       prio_put,
-        .change         =       prio_change,
-        .delete         =       prio_delete,
         .walk           =       prio_walk,
         .tcf_chain      =       prio_find_tcf,
         .bind_tcf       =       prio_bind,
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 2bdf241f6315..072cdf442f8e 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -268,8 +268,6 @@ static int red_dump_class(struct Qdisc *sch, unsigned long cl,
 {
         struct red_sched_data *q = qdisc_priv(sch);
 
-        if (cl != 1)
-                return -ENOENT;
         tcm->tcm_handle |= TC_H_MIN(1);
         tcm->tcm_info = q->qdisc->handle;
         return 0;
@@ -308,17 +306,6 @@ static void red_put(struct Qdisc *sch, unsigned long arg)
         return;
 }
 
-static int red_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
-                            struct nlattr **tca, unsigned long *arg)
-{
-        return -ENOSYS;
-}
-
-static int red_delete(struct Qdisc *sch, unsigned long cl)
-{
-        return -ENOSYS;
-}
-
 static void red_walk(struct Qdisc *sch, struct qdisc_walker *walker)
 {
         if (!walker->stop) {
@@ -331,20 +318,12 @@ static void red_walk(struct Qdisc *sch, struct qdisc_walker *walker)
         }
 }
 
-static struct tcf_proto **red_find_tcf(struct Qdisc *sch, unsigned long cl)
-{
-        return NULL;
-}
-
 static const struct Qdisc_class_ops red_class_ops = {
         .graft          =       red_graft,
         .leaf           =       red_leaf,
         .get            =       red_get,
         .put            =       red_put,
-        .change         =       red_change_class,
-        .delete         =       red_delete,
         .walk           =       red_walk,
-        .tcf_chain      =       red_find_tcf,
         .dump           =       red_dump_class,
 };
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 8706920a6d45..cb21380c0605 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -496,12 +496,6 @@ nla_put_failure:
         return -1;
 }
 
-static int sfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
-                            struct nlattr **tca, unsigned long *arg)
-{
-        return -EOPNOTSUPP;
-}
-
 static unsigned long sfq_get(struct Qdisc *sch, u32 classid)
 {
         return 0;
@@ -560,7 +554,6 @@ static void sfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 
 static const struct Qdisc_class_ops sfq_class_ops = {
         .get            =       sfq_get,
-        .change         =       sfq_change_class,
         .tcf_chain      =       sfq_find_tcf,
         .dump           =       sfq_dump_class,
         .dump_stats     =       sfq_dump_class_stats,
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index e22dfe85e43e..8fb8107ab188 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -368,9 +368,6 @@ static int tbf_dump_class(struct Qdisc *sch, unsigned long cl,
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
 
-        if (cl != 1)    /* only one class */
-                return -ENOENT;
-
         tcm->tcm_handle |= TC_H_MIN(1);
         tcm->tcm_info = q->qdisc->handle;
 
@@ -410,17 +407,6 @@ static void tbf_put(struct Qdisc *sch, unsigned long arg)
 {
 }
 
-static int tbf_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
-                            struct nlattr **tca, unsigned long *arg)
-{
-        return -ENOSYS;
-}
-
-static int tbf_delete(struct Qdisc *sch, unsigned long arg)
-{
-        return -ENOSYS;
-}
-
 static void tbf_walk(struct Qdisc *sch, struct qdisc_walker *walker)
 {
         if (!walker->stop) {
@@ -433,21 +419,13 @@ static void tbf_walk(struct Qdisc *sch, struct qdisc_walker *walker)
         }
 }
 
-static struct tcf_proto **tbf_find_tcf(struct Qdisc *sch, unsigned long cl)
-{
-        return NULL;
-}
-
 static const struct Qdisc_class_ops tbf_class_ops =
 {
         .graft          =       tbf_graft,
         .leaf           =       tbf_leaf,
         .get            =       tbf_get,
         .put            =       tbf_put,
-        .change         =       tbf_change_class,
-        .delete         =       tbf_delete,
         .walk           =       tbf_walk,
-        .tcf_chain      =       tbf_find_tcf,
         .dump           =       tbf_dump_class,
 };
 
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 12434b6c2042..5a002c247231 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -268,7 +268,7 @@ static inline int teql_resolve(struct sk_buff *skb,
         return __teql_resolve(skb, skb_res, dev);
 }
 
-static int teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct teql_master *master = netdev_priv(dev);
         struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
@@ -307,7 +307,7 @@ restart:
 
                                 if (!netif_tx_queue_stopped(slave_txq) &&
                                     !netif_tx_queue_frozen(slave_txq) &&
-                                    slave_ops->ndo_start_xmit(skb, slave) == 0) {
+                                    slave_ops->ndo_start_xmit(skb, slave) == NETDEV_TX_OK) {
                                         txq_trans_update(slave_txq);
                                         __netif_tx_unlock(slave_txq);
                                         master->slaves = NEXT_SLAVE(q);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 525864bf4f07..8450960df24f 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -112,6 +112,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->cookie_life.tv_usec = (sp->assocparams.sasoc_cookie_life % 1000)
                                         * 1000;
         asoc->frag_point = 0;
+        asoc->user_frag = sp->user_frag;
 
         /* Set the association max_retrans and RTO values from the
          * socket values.
@@ -202,6 +203,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->a_rwnd = asoc->rwnd;
 
         asoc->rwnd_over = 0;
+        asoc->rwnd_press = 0;
 
         /* Use my own max window until I learn something better.  */
         asoc->peer.rwnd = SCTP_DEFAULT_MAXWINDOW;
@@ -582,6 +584,33 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
             asoc->addip_last_asconf->transport == peer)
                 asoc->addip_last_asconf->transport = NULL;
 
+        /* If we have something on the transmitted list, we have to
+         * save it off.  The best place is the active path.
+         */
+        if (!list_empty(&peer->transmitted)) {
+                struct sctp_transport *active = asoc->peer.active_path;
+                struct sctp_chunk *ch;
+
+                /* Reset the transport of each chunk on this list */
+                list_for_each_entry(ch, &peer->transmitted,
+                                        transmitted_list) {
+                        ch->transport = NULL;
+                        ch->rtt_in_progress = 0;
+                }
+
+                list_splice_tail_init(&peer->transmitted,
+                                        &active->transmitted);
+
+                /* Start a T3 timer here in case it wasn't running so
+                 * that these migrated packets have a chance to get
+                 * retrnasmitted.
+                 */
+                if (!timer_pending(&active->T3_rtx_timer))
+                        if (!mod_timer(&active->T3_rtx_timer,
+                                        jiffies + active->rto))
+                                sctp_transport_hold(active);
+        }
+
         asoc->peer.transport_count--;
 
         sctp_transport_free(peer);
@@ -651,13 +680,15 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
          */
         peer->param_flags = asoc->param_flags;
 
+        sctp_transport_route(peer, NULL, sp);
+
         /* Initialize the pmtu of the transport. */
-        if (peer->param_flags & SPP_PMTUD_ENABLE)
-                sctp_transport_pmtu(peer);
-        else if (asoc->pathmtu)
-                peer->pathmtu = asoc->pathmtu;
-        else
-                peer->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
+        if (peer->param_flags & SPP_PMTUD_DISABLE) {
+                if (asoc->pathmtu)
+                        peer->pathmtu = asoc->pathmtu;
+                else
+                        peer->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
+        }
 
         /* If this is the first transport addr on this association,
          * initialize the association PMTU to the peer's PMTU.
@@ -673,7 +704,7 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
                           "%d\n", asoc, asoc->pathmtu);
         peer->pmtu_pending = 0;
 
-        asoc->frag_point = sctp_frag_point(sp, asoc->pathmtu);
+        asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
 
         /* The asoc->peer.port might not be meaningful yet, but
          * initialize the packet structure anyway.
@@ -810,11 +841,16 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
                 break;
 
         case SCTP_TRANSPORT_DOWN:
-                /* if the transort was never confirmed, do not transition it
-                 * to inactive state.
+                /* If the transport was never confirmed, do not transition it
+                 * to inactive state.  Also, release the cached route since
+                 * there may be a better route next time.
                  */
                 if (transport->state != SCTP_UNCONFIRMED)
                         transport->state = SCTP_INACTIVE;
+                else {
+                        dst_release(transport->dst);
+                        transport->dst = NULL;
+                }
 
                 spc_state = SCTP_ADDR_UNREACHABLE;
                 break;
@@ -1324,9 +1360,8 @@ void sctp_assoc_sync_pmtu(struct sctp_association *asoc)
         }
 
         if (pmtu) {
-                struct sctp_sock *sp = sctp_sk(asoc->base.sk);
                 asoc->pathmtu = pmtu;
-                asoc->frag_point = sctp_frag_point(sp, pmtu);
+                asoc->frag_point = sctp_frag_point(asoc, pmtu);
         }
 
         SCTP_DEBUG_PRINTK("%s: asoc:%p, pmtu:%d, frag_point:%d\n",
@@ -1369,6 +1404,17 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned len)
                 asoc->rwnd += len;
         }
 
+        /* If we had window pressure, start recovering it
+         * once our rwnd had reached the accumulated pressure
+         * threshold.  The idea is to recover slowly, but up
+         * to the initial advertised window.
+         */
+        if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) {
+                int change = min(asoc->pathmtu, asoc->rwnd_press);
+                asoc->rwnd += change;
+                asoc->rwnd_press -= change;
+        }
+
         SCTP_DEBUG_PRINTK("%s: asoc %p rwnd increased by %d to (%u, %u) "
                           "- %u\n", __func__, asoc, len, asoc->rwnd,
                           asoc->rwnd_over, asoc->a_rwnd);
@@ -1401,17 +1447,38 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned len)
 /* Decrease asoc's rwnd by len. */
 void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
 {
+        int rx_count;
+        int over = 0;
+
         SCTP_ASSERT(asoc->rwnd, "rwnd zero", return);
         SCTP_ASSERT(!asoc->rwnd_over, "rwnd_over not zero", return);
+
+        if (asoc->ep->rcvbuf_policy)
+                rx_count = atomic_read(&asoc->rmem_alloc);
+        else
+                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
+
+        /* If we've reached or overflowed our receive buffer, announce
+         * a 0 rwnd if rwnd would still be positive.  Store the
+         * the pottential pressure overflow so that the window can be restored
+         * back to original value.
+         */
+        if (rx_count >= asoc->base.sk->sk_rcvbuf)
+                over = 1;
+
         if (asoc->rwnd >= len) {
                 asoc->rwnd -= len;
+                if (over) {
+                        asoc->rwnd_press = asoc->rwnd;
+                        asoc->rwnd = 0;
+                }
         } else {
                 asoc->rwnd_over = len - asoc->rwnd;
                 asoc->rwnd = 0;
         }
-        SCTP_DEBUG_PRINTK("%s: asoc %p rwnd decreased by %d to (%u, %u)\n",
+        SCTP_DEBUG_PRINTK("%s: asoc %p rwnd decreased by %d to (%u, %u, %u)\n",
                           __func__, asoc, len, asoc->rwnd,
-                          asoc->rwnd_over);
+                          asoc->rwnd_over, asoc->rwnd_press);
 }
 
 /* Build the bind address list for the association based on info from the
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 6d5944a745d4..13a6fba41077 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -510,9 +510,28 @@ int sctp_in_scope(const union sctp_addr *addr, sctp_scope_t scope)
          * of requested destination address, sender and receiver
          * SHOULD include all of its addresses with level greater
          * than or equal to L.
+         *
+         * Address scoping can be selectively controlled via sysctl
+         * option
          */
-        if (addr_scope <= scope)
+        switch (sctp_scope_policy) {
+        case SCTP_SCOPE_POLICY_DISABLE:
                 return 1;
+        case SCTP_SCOPE_POLICY_ENABLE:
+                if (addr_scope <= scope)
+                        return 1;
+                break;
+        case SCTP_SCOPE_POLICY_PRIVATE:
+                if (addr_scope <= scope || SCTP_SCOPE_PRIVATE == addr_scope)
+                        return 1;
+                break;
+        case SCTP_SCOPE_POLICY_LINK:
+                if (addr_scope <= scope || SCTP_SCOPE_LINK == addr_scope)
+                        return 1;
+                break;
+        default:
+                break;
+        }
 
         return 0;
 }
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 1748ef90950c..acf7c4d128f7 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -59,6 +59,7 @@ static void sctp_datamsg_init(struct sctp_datamsg *msg)
         msg->can_abandon = 0;
         msg->expires_at = 0;
         INIT_LIST_HEAD(&msg->chunks);
+        msg->msg_size = 0;
 }
 
 /* Allocate and initialize datamsg. */
@@ -73,6 +74,19 @@ SCTP_STATIC struct sctp_datamsg *sctp_datamsg_new(gfp_t gfp)
         return msg;
 }
 
+void sctp_datamsg_free(struct sctp_datamsg *msg)
+{
+        struct sctp_chunk *chunk;
+
+        /* This doesn't have to be a _safe vairant because
+         * sctp_chunk_free() only drops the refs.
+         */
+        list_for_each_entry(chunk, &msg->chunks, frag_list)
+                sctp_chunk_free(chunk);
+
+        sctp_datamsg_put(msg);
+}
+
 /* Final destructruction of datamsg memory. */
 static void sctp_datamsg_destroy(struct sctp_datamsg *msg)
 {
@@ -142,6 +156,7 @@ static void sctp_datamsg_assign(struct sctp_datamsg *msg, struct sctp_chunk *chu
 {
         sctp_datamsg_hold(msg);
         chunk->msg = msg;
+        msg->msg_size += chunk->skb->len;
 }
 
 
@@ -158,6 +173,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
 {
         int max, whole, i, offset, over, err;
         int len, first_len;
+        int max_data;
         struct sctp_chunk *chunk;
         struct sctp_datamsg *msg;
         struct list_head *pos, *temp;
@@ -179,8 +195,14 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                                   __func__, msg, msg->expires_at, jiffies);
         }
 
-        max = asoc->frag_point;
+        /* This is the biggest possible DATA chunk that can fit into
+         * the packet
+         */
+        max_data = asoc->pathmtu -
+                sctp_sk(asoc->base.sk)->pf->af->net_header_len -
+                sizeof(struct sctphdr) - sizeof(struct sctp_data_chunk);
 
+        max = asoc->frag_point;
         /* If the the peer requested that we authenticate DATA chunks
          * we need to accound for bundling of the AUTH chunks along with
          * DATA.
@@ -189,23 +211,41 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                 struct sctp_hmac *hmac_desc = sctp_auth_asoc_get_hmac(asoc);
 
                 if (hmac_desc)
-                        max -= WORD_ROUND(sizeof(sctp_auth_chunk_t) +
+                        max_data -= WORD_ROUND(sizeof(sctp_auth_chunk_t) +
                                             hmac_desc->hmac_len);
         }
 
+        /* Now, check if we need to reduce our max */
+        if (max > max_data)
+                max = max_data;
+
         whole = 0;
         first_len = max;
 
+        /* Check to see if we have a pending SACK and try to let it be bundled
+         * with this message.  Do this if we don't have any data queued already.
+         * To check that, look at out_qlen and retransmit list.
+         * NOTE: we will not reduce to account for SACK, if the message would
+         * not have been fragmented.
+         */
+        if (timer_pending(&asoc->timers[SCTP_EVENT_TIMEOUT_SACK]) &&
+            asoc->outqueue.out_qlen == 0 &&
+            list_empty(&asoc->outqueue.retransmit) &&
+            msg_len > max)
+                max_data -= WORD_ROUND(sizeof(sctp_sack_chunk_t));
+
         /* Encourage Cookie-ECHO bundling. */
-        if (asoc->state < SCTP_STATE_COOKIE_ECHOED) {
-                whole = msg_len / (max - SCTP_ARBITRARY_COOKIE_ECHO_LEN);
-
-                /* Account for the DATA to be bundled with the COOKIE-ECHO. */
-                if (whole) {
-                        first_len = max - SCTP_ARBITRARY_COOKIE_ECHO_LEN;
-                        msg_len -= first_len;
-                        whole = 1;
-                }
+        if (asoc->state < SCTP_STATE_COOKIE_ECHOED)
+                max_data -= SCTP_ARBITRARY_COOKIE_ECHO_LEN;
+
+        /* Now that we adjusted completely, reset first_len */
+        if (first_len > max_data)
+                first_len = max_data;
+
+        /* Account for a different sized first fragment */
+        if (msg_len >= first_len) {
+                msg_len -= first_len;
+                whole = 1;
         }
 
         /* How many full sized?  How many bytes leftover? */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index b94c21190566..5cbda8f1ddfd 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -61,8 +61,24 @@
 #include <net/sctp/checksum.h>
 
 /* Forward declarations for private helpers. */
-static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
+static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
                                            struct sctp_chunk *chunk);
+static void sctp_packet_append_data(struct sctp_packet *packet,
+                                           struct sctp_chunk *chunk);
+static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
+                                        struct sctp_chunk *chunk,
+                                        u16 chunk_len);
+
+static void sctp_packet_reset(struct sctp_packet *packet)
+{
+        packet->size = packet->overhead;
+        packet->has_cookie_echo = 0;
+        packet->has_sack = 0;
+        packet->has_data = 0;
+        packet->has_auth = 0;
+        packet->ipfragok = 0;
+        packet->auth = NULL;
+}
 
 /* Config a packet.
  * This appears to be a followup set of initializations.
@@ -75,13 +91,8 @@ struct sctp_packet *sctp_packet_config(struct sctp_packet *packet,
         SCTP_DEBUG_PRINTK("%s: packet:%p vtag:0x%x\n", __func__,
                           packet, vtag);
 
+        sctp_packet_reset(packet);
         packet->vtag = vtag;
-        packet->has_cookie_echo = 0;
-        packet->has_sack = 0;
-        packet->has_auth = 0;
-        packet->has_data = 0;
-        packet->ipfragok = 0;
-        packet->auth = NULL;
 
         if (ecn_capable && sctp_packet_empty(packet)) {
                 chunk = sctp_get_ecne_prepend(packet->transport->asoc);
@@ -119,15 +130,9 @@ struct sctp_packet *sctp_packet_init(struct sctp_packet *packet,
         }
         overhead += sizeof(struct sctphdr);
         packet->overhead = overhead;
-        packet->size = overhead;
+        sctp_packet_reset(packet);
         packet->vtag = 0;
-        packet->has_cookie_echo = 0;
-        packet->has_sack = 0;
-        packet->has_auth = 0;
-        packet->has_data = 0;
-        packet->ipfragok = 0;
         packet->malloced = 0;
-        packet->auth = NULL;
         return packet;
 }
 
@@ -204,7 +209,7 @@ static sctp_xmit_t sctp_packet_bundle_auth(struct sctp_packet *pkt,
         /* See if this is an auth chunk we are bundling or if
          * auth is already bundled.
          */
-        if (chunk->chunk_hdr->type == SCTP_CID_AUTH || pkt->auth)
+        if (chunk->chunk_hdr->type == SCTP_CID_AUTH || pkt->has_auth)
                 return retval;
 
         /* if the peer did not request this chunk to be authenticated,
@@ -234,18 +239,19 @@ static sctp_xmit_t sctp_packet_bundle_sack(struct sctp_packet *pkt,
         if (sctp_chunk_is_data(chunk) && !pkt->has_sack &&
             !pkt->has_cookie_echo) {
                 struct sctp_association *asoc;
+                struct timer_list *timer;
                 asoc = pkt->transport->asoc;
+                timer = &asoc->timers[SCTP_EVENT_TIMEOUT_SACK];
 
-                if (asoc->a_rwnd > asoc->rwnd) {
+                /* If the SACK timer is running, we have a pending SACK */
+                if (timer_pending(timer)) {
                         struct sctp_chunk *sack;
                         asoc->a_rwnd = asoc->rwnd;
                         sack = sctp_make_sack(asoc);
                         if (sack) {
-                                struct timer_list *timer;
                                 retval = sctp_packet_append_chunk(pkt, sack);
                                 asoc->peer.sack_needed = 0;
-                                timer = &asoc->timers[SCTP_EVENT_TIMEOUT_SACK];
-                                if (timer_pending(timer) && del_timer(timer))
+                                if (del_timer(timer))
                                         sctp_association_put(asoc);
                         }
                 }
@@ -261,13 +267,20 @@ sctp_xmit_t sctp_packet_append_chunk(struct sctp_packet *packet,
 {
         sctp_xmit_t retval = SCTP_XMIT_OK;
         __u16 chunk_len = WORD_ROUND(ntohs(chunk->chunk_hdr->length));
-        size_t psize;
-        size_t pmtu;
-        int too_big;
 
         SCTP_DEBUG_PRINTK("%s: packet:%p chunk:%p\n", __func__, packet,
                           chunk);
 
+        /* Data chunks are special.  Before seeing what else we can
+         * bundle into this packet, check to see if we are allowed to
+         * send this DATA.
+         */
+        if (sctp_chunk_is_data(chunk)) {
+                retval = sctp_packet_can_append_data(packet, chunk);
+                if (retval != SCTP_XMIT_OK)
+                        goto finish;
+        }
+
         /* Try to bundle AUTH chunk */
         retval = sctp_packet_bundle_auth(packet, chunk);
         if (retval != SCTP_XMIT_OK)
@@ -278,51 +291,16 @@ sctp_xmit_t sctp_packet_append_chunk(struct sctp_packet *packet,
         if (retval != SCTP_XMIT_OK)
                 goto finish;
 
-        psize = packet->size;
-        pmtu  = ((packet->transport->asoc) ?
-                 (packet->transport->asoc->pathmtu) :
-                 (packet->transport->pathmtu));
-
-        too_big = (psize + chunk_len > pmtu);
-
-        /* Decide if we need to fragment or resubmit later. */
-        if (too_big) {
-                /* It's OK to fragmet at IP level if any one of the following
-                 * is true:
-                 *      1. The packet is empty (meaning this chunk is greater
-                 *         the MTU)
-                 *      2. The chunk we are adding is a control chunk
-                 *      3. The packet doesn't have any data in it yet and data
-                 *      requires authentication.
-                 */
-                if (sctp_packet_empty(packet) || !sctp_chunk_is_data(chunk) ||
-                    (!packet->has_data && chunk->auth)) {
-                        /* We no longer do re-fragmentation.
-                         * Just fragment at the IP layer, if we
-                         * actually hit this condition
-                         */
-                        packet->ipfragok = 1;
-                        goto append;
-
-                } else {
-                        retval = SCTP_XMIT_PMTU_FULL;
-                        goto finish;
-                }
-        }
-
-append:
-        /* We believe that this chunk is OK to add to the packet (as
-         * long as we have the cwnd for it).
-         */
+        /* Check to see if this chunk will fit into the packet */
+        retval = sctp_packet_will_fit(packet, chunk, chunk_len);
+        if (retval != SCTP_XMIT_OK)
+                goto finish;
 
-        /* DATA is a special case since we must examine both rwnd and cwnd
-         * before we send DATA.
-         */
+        /* We believe that this chunk is OK to add to the packet */
         switch (chunk->chunk_hdr->type) {
             case SCTP_CID_DATA:
-                retval = sctp_packet_append_data(packet, chunk);
-                if (SCTP_XMIT_OK != retval)
-                        goto finish;
+                /* Account for the data being in the packet */
+                sctp_packet_append_data(packet, chunk);
                 /* Disallow SACK bundling after DATA. */
                 packet->has_sack = 1;
                 /* Disallow AUTH bundling after DATA */
@@ -598,7 +576,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         (*tp->af_specific->sctp_xmit)(nskb, tp);
 
 out:
-        packet->size = packet->overhead;
+        sctp_packet_reset(packet);
         return err;
 no_route:
         kfree_skb(nskb);
@@ -632,16 +610,15 @@ nomem:
  * 2nd Level Abstractions
  ********************************************************************/
 
-/* This private function handles the specifics of appending DATA chunks.  */
-static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
+/* This private function check to see if a chunk can be added */
+static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
                                            struct sctp_chunk *chunk)
 {
         sctp_xmit_t retval = SCTP_XMIT_OK;
-        size_t datasize, rwnd, inflight;
+        size_t datasize, rwnd, inflight, flight_size;
         struct sctp_transport *transport = packet->transport;
         __u32 max_burst_bytes;
         struct sctp_association *asoc = transport->asoc;
-        struct sctp_sock *sp = sctp_sk(asoc->base.sk);
         struct sctp_outq *q = &asoc->outqueue;
 
         /* RFC 2960 6.1  Transmission of DATA Chunks
@@ -658,7 +635,8 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
          */
 
         rwnd = asoc->peer.rwnd;
-        inflight = asoc->outqueue.outstanding_bytes;
+        inflight = q->outstanding_bytes;
+        flight_size = transport->flight_size;
 
         datasize = sctp_data_size(chunk);
 
@@ -681,8 +659,8 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
          *              cwnd = flightsize + Max.Burst * MTU
          */
         max_burst_bytes = asoc->max_burst * asoc->pathmtu;
-        if ((transport->flight_size + max_burst_bytes) < transport->cwnd) {
-                transport->cwnd = transport->flight_size + max_burst_bytes;
+        if ((flight_size + max_burst_bytes) < transport->cwnd) {
+                transport->cwnd = flight_size + max_burst_bytes;
                 SCTP_DEBUG_PRINTK("%s: cwnd limited by max_burst: "
                                   "transport: %p, cwnd: %d, "
                                   "ssthresh: %d, flight_size: %d, "
@@ -707,7 +685,7 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
          *    ignore the value of cwnd and SHOULD NOT delay retransmission.
          */
         if (chunk->fast_retransmit != SCTP_NEED_FRTX)
-                if (transport->flight_size >= transport->cwnd) {
+                if (flight_size >= transport->cwnd) {
                         retval = SCTP_XMIT_RWND_FULL;
                         goto finish;
                 }
@@ -717,20 +695,36 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
          * if any previously transmitted data on the connection remains
          * unacknowledged.
          */
-        if (!sp->nodelay && sctp_packet_empty(packet) &&
-            q->outstanding_bytes && sctp_state(asoc, ESTABLISHED)) {
-                unsigned len = datasize + q->out_qlen;
+        if (!sctp_sk(asoc->base.sk)->nodelay && sctp_packet_empty(packet) &&
+            inflight && sctp_state(asoc, ESTABLISHED)) {
+                unsigned max = transport->pathmtu - packet->overhead;
+                unsigned len = chunk->skb->len + q->out_qlen;
 
                 /* Check whether this chunk and all the rest of pending
                  * data will fit or delay in hopes of bundling a full
                  * sized packet.
+                 * Don't delay large message writes that may have been
+                 * fragmeneted into small peices.
                  */
-                if (len < asoc->frag_point) {
+                if ((len < max) && (chunk->msg->msg_size < max)) {
                         retval = SCTP_XMIT_NAGLE_DELAY;
                         goto finish;
                 }
         }
 
+finish:
+        return retval;
+}
+
+/* This private function does management things when adding DATA chunk */
+static void sctp_packet_append_data(struct sctp_packet *packet,
+                                struct sctp_chunk *chunk)
+{
+        struct sctp_transport *transport = packet->transport;
+        size_t datasize = sctp_data_size(chunk);
+        struct sctp_association *asoc = transport->asoc;
+        u32 rwnd = asoc->peer.rwnd;
+
         /* Keep track of how many bytes are in flight over this transport. */
         transport->flight_size += datasize;
 
@@ -753,7 +747,45 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
         /* Has been accepted for transmission. */
         if (!asoc->peer.prsctp_capable)
                 chunk->msg->can_abandon = 0;
+}
+
+static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
+                                        struct sctp_chunk *chunk,
+                                        u16 chunk_len)
+{
+        size_t psize;
+        size_t pmtu;
+        int too_big;
+        sctp_xmit_t retval = SCTP_XMIT_OK;
+
+        psize = packet->size;
+        pmtu  = ((packet->transport->asoc) ?
+                (packet->transport->asoc->pathmtu) :
+                (packet->transport->pathmtu));
+
+        too_big = (psize + chunk_len > pmtu);
+
+        /* Decide if we need to fragment or resubmit later. */
+        if (too_big) {
+                /* It's OK to fragmet at IP level if any one of the following
+                 * is true:
+                 *      1. The packet is empty (meaning this chunk is greater
+                 *         the MTU)
+                 *      2. The chunk we are adding is a control chunk
+                 *      3. The packet doesn't have any data in it yet and data
+                 *      requires authentication.
+                 */
+                if (sctp_packet_empty(packet) || !sctp_chunk_is_data(chunk) ||
+                    (!packet->has_data && chunk->auth)) {
+                        /* We no longer do re-fragmentation.
+                         * Just fragment at the IP layer, if we
+                         * actually hit this condition
+                         */
+                        packet->ipfragok = 1;
+                } else {
+                        retval = SCTP_XMIT_PMTU_FULL;
+                }
+        }
 
-finish:
         return retval;
 }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index d765fc53e74d..c9f20e28521b 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -406,8 +406,9 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                          * not be retransmitted
                          */
                         if (!chunk->tsn_gap_acked) {
-                                chunk->transport->flight_size -=
-                                                sctp_data_size(chunk);
+                                if (chunk->transport)
+                                        chunk->transport->flight_size -=
+                                                        sctp_data_size(chunk);
                                 q->outstanding_bytes -= sctp_data_size(chunk);
                                 q->asoc->peer.rwnd += (sctp_data_size(chunk) +
                                                         sizeof(struct sk_buff));
@@ -443,7 +444,8 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                         q->asoc->peer.rwnd += (sctp_data_size(chunk) +
                                                 sizeof(struct sk_buff));
                         q->outstanding_bytes -= sctp_data_size(chunk);
-                        transport->flight_size -= sctp_data_size(chunk);
+                        if (chunk->transport)
+                                transport->flight_size -= sctp_data_size(chunk);
 
                         /* sctpimpguide-05 Section 2.8.2
                          * M5) If a T3-rtx timer expires, the
@@ -1310,6 +1312,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
         __u32 rtt;
         __u8 restart_timer = 0;
         int bytes_acked = 0;
+        int migrate_bytes = 0;
 
         /* These state variables are for coherent debug output. --xguo */
 
@@ -1343,8 +1346,9 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                          * considering it as 'outstanding'.
                          */
                         if (!tchunk->tsn_gap_acked) {
-                                tchunk->transport->flight_size -=
-                                                sctp_data_size(tchunk);
+                                if (tchunk->transport)
+                                        tchunk->transport->flight_size -=
+                                                        sctp_data_size(tchunk);
                                 q->outstanding_bytes -= sctp_data_size(tchunk);
                         }
                         continue;
@@ -1378,6 +1382,20 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                                                   rtt);
                                 }
                         }
+
+                        /* If the chunk hasn't been marked as ACKED,
+                         * mark it and account bytes_acked if the
+                         * chunk had a valid transport (it will not
+                         * have a transport if ASCONF had deleted it
+                         * while DATA was outstanding).
+                         */
+                        if (!tchunk->tsn_gap_acked) {
+                                tchunk->tsn_gap_acked = 1;
+                                bytes_acked += sctp_data_size(tchunk);
+                                if (!tchunk->transport)
+                                        migrate_bytes += sctp_data_size(tchunk);
+                        }
+
                         if (TSN_lte(tsn, sack_ctsn)) {
                                 /* RFC 2960  6.3.2 Retransmission Timer Rules
                                  *
@@ -1391,8 +1409,6 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                 restart_timer = 1;
 
                                 if (!tchunk->tsn_gap_acked) {
-                                        tchunk->tsn_gap_acked = 1;
-                                        bytes_acked += sctp_data_size(tchunk);
                                         /*
                                          * SFR-CACC algorithm:
                                          * 2) If the SACK contains gap acks
@@ -1432,10 +1448,6 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                  * older than that newly acknowledged DATA
                                  * chunk, are qualified as 'Stray DATA chunks'.
                                  */
-                                if (!tchunk->tsn_gap_acked) {
-                                        tchunk->tsn_gap_acked = 1;
-                                        bytes_acked += sctp_data_size(tchunk);
-                                }
                                 list_add_tail(lchunk, &tlist);
                         }
 
@@ -1491,7 +1503,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                                   tsn);
                                 tchunk->tsn_gap_acked = 0;
 
-                                bytes_acked -= sctp_data_size(tchunk);
+                                if (tchunk->transport)
+                                        bytes_acked -= sctp_data_size(tchunk);
 
                                 /* RFC 2960 6.3.2 Retransmission Timer Rules
                                  *
@@ -1561,6 +1574,14 @@ static void sctp_check_transmitted(struct sctp_outq *q,
 #endif /* SCTP_DEBUG */
         if (transport) {
                 if (bytes_acked) {
+                        /* We may have counted DATA that was migrated
+                         * to this transport due to DEL-IP operation.
+                         * Subtract those bytes, since the were never
+                         * send on this transport and shouldn't be
+                         * credited to this transport.
+                         */
+                        bytes_acked -= migrate_bytes;
+
                         /* 8.2. When an outstanding TSN is acknowledged,
                          * the endpoint shall clear the error counter of
                          * the destination transport address to which the
@@ -1589,7 +1610,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         transport->flight_size -= bytes_acked;
                         if (transport->flight_size == 0)
                                 transport->partial_bytes_acked = 0;
-                        q->outstanding_bytes -= bytes_acked;
+                        q->outstanding_bytes -= bytes_acked + migrate_bytes;
                 } else {
                         /* RFC 2960 6.1, sctpimpguide-06 2.15.2
                          * When a sender is doing zero window probing, it
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index f268910620be..d093cbfeaac4 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -512,10 +512,8 @@ int __init sctp_remaddr_proc_init(void)
 {
         struct proc_dir_entry *p;
 
-        p = create_proc_entry("remaddr", S_IRUGO, proc_net_sctp);
+        p = proc_create("remaddr", S_IRUGO, proc_net_sctp, &sctp_remaddr_seq_fops);
         if (!p)
                 return -ENOMEM;
-        p->proc_fops = &sctp_remaddr_seq_fops;
-
         return 0;
 }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 79cbd47f4df7..60093be8385d 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -160,6 +160,7 @@ static void sctp_proc_exit(void)
                 remove_proc_entry("sctp", init_net.proc_net);
         }
 #endif
+        percpu_counter_destroy(&sctp_sockets_allocated);
 }
 
 /* Private helper to extract ipv4 address and stash them in
@@ -430,16 +431,14 @@ static int sctp_v4_available(union sctp_addr *addr, struct sctp_sock *sp)
  * of requested destination address, sender and receiver
  * SHOULD include all of its addresses with level greater
  * than or equal to L.
+ *
+ * IPv4 scoping can be controlled through sysctl option
+ * net.sctp.addr_scope_policy
  */
 static sctp_scope_t sctp_v4_scope(union sctp_addr *addr)
 {
         sctp_scope_t retval;
 
-        /* Should IPv4 scoping be a sysctl configurable option
-         * so users can turn it off (default on) for certain
-         * unconventional networking environments?
-         */
-
         /* Check for unusable SCTP addresses. */
         if (IS_IPV4_UNUSABLE_ADDRESS(addr->v4.sin_addr.s_addr)) {
                 retval =  SCTP_SCOPE_UNUSABLE;
@@ -1258,6 +1257,9 @@ SCTP_STATIC __init int sctp_init(void)
         /* Disable AUTH by default. */
         sctp_auth_enable = 0;
 
+        /* Set SCOPE policy to enabled */
+        sctp_scope_policy = SCTP_SCOPE_POLICY_ENABLE;
+
         sctp_sysctl_register();
 
         INIT_LIST_HEAD(&sctp_address_families);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 61cc6075b0df..9d881a61ac02 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2861,6 +2861,11 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
         addr_param = (union sctp_addr_param *)
                         ((void *)asconf_param + sizeof(sctp_addip_param_t));
 
+        if (asconf_param->param_hdr.type != SCTP_PARAM_ADD_IP &&
+            asconf_param->param_hdr.type != SCTP_PARAM_DEL_IP &&
+            asconf_param->param_hdr.type != SCTP_PARAM_SET_PRIMARY)
+                return SCTP_ERROR_UNKNOWN_PARAM;
+
         switch (addr_param->v4.param_hdr.type) {
         case SCTP_PARAM_IPV6_ADDRESS:
                 if (!asoc->peer.ipv6_address)
@@ -2958,9 +2963,6 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
 
                 sctp_assoc_set_primary(asoc, peer);
                 break;
-        default:
-                return SCTP_ERROR_UNKNOWN_PARAM;
-                break;
         }
 
         return SCTP_ERROR_NO_ERROR;
@@ -3104,7 +3106,7 @@ done:
 }
 
 /* Process a asconf parameter that is successfully acked. */
-static int sctp_asconf_param_success(struct sctp_association *asoc,
+static void sctp_asconf_param_success(struct sctp_association *asoc,
                                      sctp_addip_param_t *asconf_param)
 {
         struct sctp_af *af;
@@ -3113,7 +3115,6 @@ static int sctp_asconf_param_success(struct sctp_association *asoc,
         union sctp_addr_param *addr_param;
         struct sctp_transport *transport;
         struct sctp_sockaddr_entry *saddr;
-        int retval = 0;
 
         addr_param = (union sctp_addr_param *)
                         ((void *)asconf_param + sizeof(sctp_addip_param_t));
@@ -3133,10 +3134,18 @@ static int sctp_asconf_param_success(struct sctp_association *asoc,
                                 saddr->state = SCTP_ADDR_SRC;
                 }
                 local_bh_enable();
+                list_for_each_entry(transport, &asoc->peer.transport_addr_list,
+                                transports) {
+                        if (transport->state == SCTP_ACTIVE)
+                                continue;
+                        dst_release(transport->dst);
+                        sctp_transport_route(transport, NULL,
+                                             sctp_sk(asoc->base.sk));
+                }
                 break;
         case SCTP_PARAM_DEL_IP:
                 local_bh_disable();
-                retval = sctp_del_bind_addr(bp, &addr);
+                sctp_del_bind_addr(bp, &addr);
                 local_bh_enable();
                 list_for_each_entry(transport, &asoc->peer.transport_addr_list,
                                 transports) {
@@ -3148,8 +3157,6 @@ static int sctp_asconf_param_success(struct sctp_association *asoc,
         default:
                 break;
         }
-
-        return retval;
 }
 
 /* Get the corresponding ASCONF response error code from the ASCONF_ACK chunk
@@ -3266,7 +3273,7 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
 
                 switch (err_code) {
                 case SCTP_ERROR_NO_ERROR:
-                        retval = sctp_asconf_param_success(asoc, asconf_param);
+                        sctp_asconf_param_success(asoc, asconf_param);
                         break;
 
                 case SCTP_ERROR_RSRC_LOW:
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 86426aac1600..8674d4919556 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -440,14 +440,26 @@ static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
         /* The check for association's overall error counter exceeding the
          * threshold is done in the state function.
          */
-        /* When probing UNCONFIRMED addresses, the association overall
-         * error count is NOT incremented
+        /* We are here due to a timer expiration.  If the timer was
+         * not a HEARTBEAT, then normal error tracking is done.
+         * If the timer was a heartbeat, we only increment error counts
+         * when we already have an outstanding HEARTBEAT that has not
+         * been acknowledged.
+         * Additionaly, some tranport states inhibit error increments.
          */
-        if (transport->state != SCTP_UNCONFIRMED)
+        if (!is_hb) {
                 asoc->overall_error_count++;
+                if (transport->state != SCTP_INACTIVE)
+                        transport->error_count++;
+         } else if (transport->hb_sent) {
+                if (transport->state != SCTP_UNCONFIRMED)
+                        asoc->overall_error_count++;
+                if (transport->state != SCTP_INACTIVE)
+                        transport->error_count++;
+        }
 
         if (transport->state != SCTP_INACTIVE &&
-            (transport->error_count++ >= transport->pathmaxrxt)) {
+            (transport->error_count > transport->pathmaxrxt)) {
                 SCTP_DEBUG_PRINTK_IPADDR("transport_strike:association %p",
                                          " transport IP: port:%d failed.\n",
                                          asoc,
@@ -931,6 +943,27 @@ static void sctp_cmd_t1_timer_update(struct sctp_association *asoc,
 
 }
 
+/* Send the whole message, chunk by chunk, to the outqueue.
+ * This way the whole message is queued up and bundling if
+ * encouraged for small fragments.
+ */
+static int sctp_cmd_send_msg(struct sctp_association *asoc,
+                                struct sctp_datamsg *msg)
+{
+        struct sctp_chunk *chunk;
+        int error = 0;
+
+        list_for_each_entry(chunk, &msg->chunks, frag_list) {
+                error = sctp_outq_tail(&asoc->outqueue, chunk);
+                if (error)
+                        break;
+        }
+
+        return error;
+}
+
+
+
 /* These three macros allow us to pull the debugging code out of the
  * main flow of sctp_do_sm() to keep attention focused on the real
  * functionality there.
@@ -1500,7 +1533,8 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                 case SCTP_CMD_PROCESS_CTSN:
                         /* Dummy up a SACK for processing. */
                         sackh.cum_tsn_ack = cmd->obj.be32;
-                        sackh.a_rwnd = 0;
+                        sackh.a_rwnd = asoc->peer.rwnd +
+                                        asoc->outqueue.outstanding_bytes;
                         sackh.num_gap_ack_blocks = 0;
                         sackh.num_dup_tsns = 0;
                         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK,
@@ -1575,7 +1609,13 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                 case SCTP_CMD_UPDATE_INITTAG:
                         asoc->peer.i.init_tag = cmd->obj.u32;
                         break;
-
+                case SCTP_CMD_SEND_MSG:
+                        if (!asoc->outqueue.cork) {
+                                sctp_outq_cork(&asoc->outqueue);
+                                local_cork = 1;
+                        }
+                        error = sctp_cmd_send_msg(asoc, cmd->obj.msg);
+                        break;
                 default:
                         printk(KERN_WARNING "Impossible command: %u, %p\n",
                                cmd->verb, cmd->obj.ptr);
@@ -1593,9 +1633,9 @@ out:
          */
         if (asoc && SCTP_EVENT_T_CHUNK == event_type && chunk) {
                 if (chunk->end_of_packet || chunk->singleton)
-                        sctp_outq_uncork(&asoc->outqueue);
+                        error = sctp_outq_uncork(&asoc->outqueue);
         } else if (local_cork)
-                        sctp_outq_uncork(&asoc->outqueue);
+                error = sctp_outq_uncork(&asoc->outqueue);
         return error;
 nomem:
         error = -ENOMEM;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 7288192f7df5..c8fae1983dd1 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -334,6 +334,15 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 
+        /* If the INIT is coming toward a closing socket, we'll send back
+         * and ABORT.  Essentially, this catches the race of INIT being
+         * backloged to the socket at the same time as the user isses close().
+         * Since the socket and all its associations are going away, we
+         * can treat this OOTB
+         */
+        if (sctp_sstate(ep->base.sk, CLOSING))
+                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+
         /* Verify the INIT chunk before processing it. */
         err_chunk = NULL;
         if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
@@ -962,7 +971,7 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
 {
         struct sctp_transport *transport = (struct sctp_transport *) arg;
 
-        if (asoc->overall_error_count > asoc->max_retrans) {
+        if (asoc->overall_error_count >= asoc->max_retrans) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                 SCTP_ERROR(ETIMEDOUT));
                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
@@ -1106,7 +1115,8 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 
         /* Make sure that the HEARTBEAT-ACK chunk has a valid length.  */
-        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
+        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t) +
+                                            sizeof(sctp_sender_hb_info_t)))
                 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
                                                   commands);
 
@@ -2561,6 +2571,12 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
         chunk->subh.shutdown_hdr = sdh;
         ctsn = ntohl(sdh->cum_tsn_ack);
 
+        if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
+                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
+                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
+                return SCTP_DISPOSITION_DISCARD;
+        }
+
         /* If Cumulative TSN Ack beyond the max tsn currently
          * send, terminating the association and respond to the
          * sender with an ABORT.
@@ -2624,6 +2640,7 @@ sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
 {
         struct sctp_chunk *chunk = arg;
         sctp_shutdownhdr_t *sdh;
+        __u32 ctsn;
 
         if (!sctp_vtag_verify(chunk, asoc))
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -2635,12 +2652,19 @@ sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
                                                   commands);
 
         sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
+        ctsn = ntohl(sdh->cum_tsn_ack);
+
+        if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
+                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
+                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
+                return SCTP_DISPOSITION_DISCARD;
+        }
 
         /* If Cumulative TSN Ack beyond the max tsn currently
          * send, terminating the association and respond to the
          * sender with an ABORT.
          */
-        if (!TSN_lt(ntohl(sdh->cum_tsn_ack), asoc->next_tsn))
+        if (!TSN_lt(ctsn, asoc->next_tsn))
                 return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
 
         /* verify, by checking the Cumulative TSN Ack field of the
@@ -2867,6 +2891,9 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
                 goto discard_force;
         case SCTP_IERROR_NO_DATA:
                 goto consume;
+        case SCTP_IERROR_PROTO_VIOLATION:
+                return sctp_sf_abort_violation(ep, asoc, chunk, commands,
+                        (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
         default:
                 BUG();
         }
@@ -2977,6 +3004,9 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
                 break;
         case SCTP_IERROR_NO_DATA:
                 goto consume;
+        case SCTP_IERROR_PROTO_VIOLATION:
+                return sctp_sf_abort_violation(ep, asoc, chunk, commands,
+                        (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
         default:
                 BUG();
         }
@@ -3519,6 +3549,12 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
                 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
                 if (!asconf_ack)
                         return SCTP_DISPOSITION_DISCARD;
+
+                /* Reset the transport so that we select the correct one
+                 * this time around.  This is to make sure that we don't
+                 * accidentally use a stale transport that's been removed.
+                 */
+                asconf_ack->transport = NULL;
         } else {
                 /* ADDIP 5.2 E5) Otherwise, the ASCONF Chunk is discarded since
                  * it must be either a stale packet or from an attacker.
@@ -4546,9 +4582,9 @@ sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
                                        void *arg,
                                        sctp_cmd_seq_t *commands)
 {
-        struct sctp_chunk *chunk = arg;
+        struct sctp_datamsg *msg = arg;
 
-        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
+        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
         return SCTP_DISPOSITION_CONSUME;
 }
 
@@ -5847,6 +5883,9 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         __u32 tsn;
         struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
         struct sock *sk = asoc->base.sk;
+        u16 ssn;
+        u16 sid;
+        u8 ordered = 0;
 
         data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
         skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
@@ -5986,8 +6025,10 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          */
         if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
                 SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS);
-        else
+        else {
                 SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS);
+                ordered = 1;
+        }
 
         /* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
          *
@@ -5997,7 +6038,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
          * and discard the DATA chunk.
          */
-        if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
+        sid = ntohs(data_hdr->stream);
+        if (sid >= asoc->c.sinit_max_instreams) {
                 /* Mark tsn as received even though we drop it */
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
 
@@ -6010,6 +6052,18 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                 return SCTP_IERROR_BAD_STREAM;
         }
 
+        /* Check to see if the SSN is possible for this TSN.
+         * The biggest gap we can record is 4K wide.  Since SSNs wrap
+         * at an unsigned short, there is no way that an SSN can
+         * wrap and for a valid TSN.  We can simply check if the current
+         * SSN is smaller then the next expected one.  If it is, it wrapped
+         * and is invalid.
+         */
+        ssn = ntohs(data_hdr->ssn);
+        if (ordered && SSN_lt(ssn, sctp_ssn_peek(&asoc->ssnmap->in, sid))) {
+                return SCTP_IERROR_PROTO_VIOLATION;
+        }
+
         /* Send the data up to the user.  Note:  Schedule  the
          * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
          * chunk needs the updated rwnd.
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 971890dbfea0..89af37a6c871 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1361,6 +1361,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
 
         sctp_lock_sock(sk);
         sk->sk_shutdown = SHUTDOWN_MASK;
+        sk->sk_state = SCTP_SS_CLOSING;
 
         ep = sctp_sk(sk)->ep;
 
@@ -1813,20 +1814,22 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 sctp_set_owner_w(chunk);
 
                 chunk->transport = chunk_tp;
-
-                /* Send it to the lower layers.  Note:  all chunks
-                 * must either fail or succeed.   The lower layer
-                 * works that way today.  Keep it that way or this
-                 * breaks.
-                 */
-                err = sctp_primitive_SEND(asoc, chunk);
-                /* Did the lower layer accept the chunk? */
-                if (err)
-                        sctp_chunk_free(chunk);
-                SCTP_DEBUG_PRINTK("We sent primitively.\n");
         }
 
-        sctp_datamsg_put(datamsg);
+        /* Send it to the lower layers.  Note:  all chunks
+         * must either fail or succeed.   The lower layer
+         * works that way today.  Keep it that way or this
+         * breaks.
+         */
+        err = sctp_primitive_SEND(asoc, datamsg);
+        /* Did the lower layer accept the chunk? */
+        if (err)
+                sctp_datamsg_free(datamsg);
+        else
+                sctp_datamsg_put(datamsg);
+
+        SCTP_DEBUG_PRINTK("We sent primitively.\n");
+
         if (err)
                 goto out_free;
         else
@@ -2240,7 +2243,7 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
                         sctp_assoc_sync_pmtu(asoc);
                 } else if (asoc) {
                         asoc->pathmtu = params->spp_pathmtu;
-                        sctp_frag_point(sp, params->spp_pathmtu);
+                        sctp_frag_point(asoc, params->spp_pathmtu);
                 } else {
                         sp->pathmtu = params->spp_pathmtu;
                 }
@@ -2877,15 +2880,10 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, int optl
                         val -= sizeof(struct sctphdr) +
                                         sizeof(struct sctp_data_chunk);
                 }
-
-                asoc->frag_point = val;
+                asoc->user_frag = val;
+                asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
         } else {
                 sp->user_frag = val;
-
-                /* Update the frag_point of the existing associations. */
-                list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
-                        asoc->frag_point = sctp_frag_point(sp, asoc->pathmtu);
-                }
         }
 
         return 0;
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 63eabbc71298..ab7151da120f 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -51,6 +51,7 @@ static int timer_max = 86400000; /* ms in one day */
 static int int_max = INT_MAX;
 static int sack_timer_min = 1;
 static int sack_timer_max = 500;
+static int addr_scope_max = 3; /* check sctp_scope_policy_t in include/net/sctp/constants.h for max entries */
 
 extern int sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
@@ -272,6 +273,17 @@ static ctl_table sctp_table[] = {
                 .proc_handler   = proc_dointvec,
                 .strategy       = sysctl_intvec
         },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "addr_scope_policy",
+                .data           = &sctp_scope_policy,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+                .extra2         = &addr_scope_max,
+        },
         { .ctl_name = 0 }
 };
 
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index e5dde45c79d3..c256e4839316 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -503,6 +503,9 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                 transport->ssthresh = max(transport->cwnd/2,
                                           4*transport->asoc->pathmtu);
                 transport->cwnd = transport->asoc->pathmtu;
+
+                /* T3-rtx also clears fast recovery on the transport */
+                transport->fast_recovery = 0;
                 break;
 
         case SCTP_LOWER_CWND_FAST_RTX:
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 5bc2f45bddf0..ebfcf9b89909 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -28,7 +28,6 @@
 #include <linux/kallsyms.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/utsname.h>
 #include <linux/workqueue.h>
 #include <linux/in6.h>
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 1102ce1251f7..8f459abe97cf 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -16,7 +16,6 @@
 #include <linux/slab.h>
 #include <linux/mempool.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 6f33d33cc064..27d44332f017 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -5,6 +5,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/freezer.h>
 #include <linux/kthread.h>
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index a7a36779b9b3..327011fcc407 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -119,7 +119,7 @@ int  tipc_register_media(u32 media_type,
                 warn("Media <%s> rejected, no broadcast address\n", name);
                 goto exit;
         }
-        if ((bearer_priority < TIPC_MIN_LINK_PRI) &&
+        if ((bearer_priority < TIPC_MIN_LINK_PRI) ||
             (bearer_priority > TIPC_MAX_LINK_PRI)) {
                 warn("Media <%s> rejected, illegal priority (%u)\n", name,
                      bearer_priority);
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 466e2d22d256..258daa80ad92 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -48,6 +48,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>       /* support for loadable modules */
 #include <linux/slab.h>         /* kmalloc(), kfree() */
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/string.h>       /* inline mem*, str* functions */
 
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index c6031d5b135f..abf7ca3f9ff9 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -1,6 +1,15 @@
 config CFG80211
-        tristate "Improved wireless configuration API"
+        tristate "cfg80211 - wireless configuration API"
         depends on RFKILL || !RFKILL
+        ---help---
+          cfg80211 is the Linux wireless LAN (802.11) configuration API.
+          Enable this if you have a wireless device.
+
+          For more information refer to documentation on the wireless wiki:
+
+          http://wireless.kernel.org/en/developers/Documentation/cfg80211
+
+          When built as a module it will be called cfg80211.
 
 config NL80211_TESTMODE
         bool "nl80211 testmode command"
@@ -17,12 +26,33 @@ config NL80211_TESTMODE
 
           Say N.
 
+config CFG80211_DEVELOPER_WARNINGS
+        bool "enable developer warnings"
+        depends on CFG80211
+        default n
+        help
+          This option enables some additional warnings that help
+          cfg80211 developers and driver developers, but that can
+          trigger due to races with userspace.
+
+          For example, when a driver reports that it was disconnected
+          from the AP, but the user disconnects manually at the same
+          time, the warning might trigger spuriously due to races.
+
+          Say Y only if you are developing cfg80211 or a driver based
+          on it (or mac80211).
+
+
 config CFG80211_REG_DEBUG
         bool "cfg80211 regulatory debugging"
         depends on CFG80211
         default n
         ---help---
           You can enable this if you want to debug regulatory changes.
+          For more information on cfg80211 regulatory refer to the wireless
+          wiki:
+
+          http://wireless.kernel.org/en/developers/Regulatory
 
           If unsure, say N.
 
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index d74cc77fa57a..3ecaa9179977 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -5,7 +5,8 @@ obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
-cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o ibss.o sme.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o wext-sme.o
 
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
new file mode 100644
index 000000000000..a46ac6c9b365
--- /dev/null
+++ b/net/wireless/chan.c
@@ -0,0 +1,89 @@
+/*
+ * This file contains helper code to handle channel
+ * settings and keeping track of what is possible at
+ * any point in time.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ */
+
+#include <net/cfg80211.h>
+#include "core.h"
+
+struct ieee80211_channel *
+rdev_fixed_channel(struct cfg80211_registered_device *rdev,
+                   struct wireless_dev *for_wdev)
+{
+        struct wireless_dev *wdev;
+        struct ieee80211_channel *result = NULL;
+
+        WARN_ON(!mutex_is_locked(&rdev->devlist_mtx));
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                if (wdev == for_wdev)
+                        continue;
+
+                /*
+                 * Lock manually to tell lockdep about allowed
+                 * nesting here if for_wdev->mtx is held already.
+                 * This is ok as it's all under the rdev devlist
+                 * mutex and as such can only be done once at any
+                 * given time.
+                 */
+                mutex_lock_nested(&wdev->mtx, SINGLE_DEPTH_NESTING);
+                if (wdev->current_bss)
+                        result = wdev->current_bss->pub.channel;
+                wdev_unlock(wdev);
+
+                if (result)
+                        break;
+        }
+
+        return result;
+}
+
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *chan;
+        struct ieee80211_sta_ht_cap *ht_cap;
+        int result;
+
+        if (rdev_fixed_channel(rdev, for_wdev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_channel)
+                return -EOPNOTSUPP;
+
+        chan = ieee80211_get_channel(&rdev->wiphy, freq);
+
+        /* Primary channel not allowed */
+        if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
+                return -EINVAL;
+
+        if (channel_type == NL80211_CHAN_HT40MINUS &&
+            chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                return -EINVAL;
+        else if (channel_type == NL80211_CHAN_HT40PLUS &&
+                 chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                return -EINVAL;
+
+        ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
+
+        if (channel_type != NL80211_CHAN_NO_HT) {
+                if (!ht_cap->ht_supported)
+                        return -EINVAL;
+
+                if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
+                    ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
+                        return -EINVAL;
+        }
+
+        result = rdev->ops->set_channel(&rdev->wiphy, chan, channel_type);
+        if (result)
+                return result;
+
+        rdev->channel = chan;
+
+        return 0;
+}
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 1e189306560d..45b2be3274db 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -12,6 +12,7 @@
 #include <linux/debugfs.h>
 #include <linux/notifier.h>
 #include <linux/device.h>
+#include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
@@ -32,6 +33,7 @@ MODULE_DESCRIPTION("wireless configuration support");
  * only read the list, and that can happen quite
  * often because we need to do it for each command */
 LIST_HEAD(cfg80211_rdev_list);
+int cfg80211_rdev_list_generation;
 
 /*
  * This is used to protect the cfg80211_rdev_list
@@ -292,68 +294,17 @@ static void cfg80211_rfkill_sync_work(struct work_struct *work)
         cfg80211_rfkill_set_block(rdev, rfkill_blocked(rdev->rfkill));
 }
 
-static void cfg80211_process_events(struct wireless_dev *wdev)
-{
-        struct cfg80211_event *ev;
-        unsigned long flags;
-
-        spin_lock_irqsave(&wdev->event_lock, flags);
-        while (!list_empty(&wdev->event_list)) {
-                ev = list_first_entry(&wdev->event_list,
-                                      struct cfg80211_event, list);
-                list_del(&ev->list);
-                spin_unlock_irqrestore(&wdev->event_lock, flags);
-
-                wdev_lock(wdev);
-                switch (ev->type) {
-                case EVENT_CONNECT_RESULT:
-                        __cfg80211_connect_result(
-                                wdev->netdev, ev->cr.bssid,
-                                ev->cr.req_ie, ev->cr.req_ie_len,
-                                ev->cr.resp_ie, ev->cr.resp_ie_len,
-                                ev->cr.status,
-                                ev->cr.status == WLAN_STATUS_SUCCESS,
-                                NULL);
-                        break;
-                case EVENT_ROAMED:
-                        __cfg80211_roamed(wdev, ev->rm.bssid,
-                                          ev->rm.req_ie, ev->rm.req_ie_len,
-                                          ev->rm.resp_ie, ev->rm.resp_ie_len);
-                        break;
-                case EVENT_DISCONNECTED:
-                        __cfg80211_disconnected(wdev->netdev,
-                                                ev->dc.ie, ev->dc.ie_len,
-                                                ev->dc.reason, true);
-                        break;
-                case EVENT_IBSS_JOINED:
-                        __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid);
-                        break;
-                }
-                wdev_unlock(wdev);
-
-                kfree(ev);
-
-                spin_lock_irqsave(&wdev->event_lock, flags);
-        }
-        spin_unlock_irqrestore(&wdev->event_lock, flags);
-}
-
 static void cfg80211_event_work(struct work_struct *work)
 {
         struct cfg80211_registered_device *rdev;
-        struct wireless_dev *wdev;
 
         rdev = container_of(work, struct cfg80211_registered_device,
                             event_work);
 
         rtnl_lock();
         cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
 
-        list_for_each_entry(wdev, &rdev->netdev_list, list)
-                cfg80211_process_events(wdev);
-
-        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_process_rdev_events(rdev);
         cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
 }
@@ -411,6 +362,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.dev.class = &ieee80211_class;
         rdev->wiphy.dev.platform_data = rdev;
 
+        rdev->wiphy.ps_default = CONFIG_CFG80211_DEFAULT_PS_VALUE;
+
         wiphy_net_set(&rdev->wiphy, &init_net);
 
         rdev->rfkill_ops.set_block = cfg80211_rfkill_set_block;
@@ -427,6 +380,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
         INIT_WORK(&rdev->event_work, cfg80211_event_work);
 
+        init_waitqueue_head(&rdev->dev_wait);
+
         /*
          * Initialize wiphy parameters to IEEE 802.11 MIB default values.
          * Fragmentation and RTS threshold are disabled by default with the
@@ -511,6 +466,7 @@ int wiphy_register(struct wiphy *wiphy)
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
 
         list_add(&rdev->list, &cfg80211_rdev_list);
+        cfg80211_rdev_list_generation++;
 
         mutex_unlock(&cfg80211_mutex);
 
@@ -570,7 +526,23 @@ void wiphy_unregister(struct wiphy *wiphy)
         /* protect the device list */
         mutex_lock(&cfg80211_mutex);
 
+        wait_event(rdev->dev_wait, ({
+                int __count;
+                mutex_lock(&rdev->devlist_mtx);
+                __count = rdev->opencount;
+                mutex_unlock(&rdev->devlist_mtx);
+                __count == 0;}));
+
+        mutex_lock(&rdev->devlist_mtx);
         BUG_ON(!list_empty(&rdev->netdev_list));
+        mutex_unlock(&rdev->devlist_mtx);
+
+        /*
+         * First remove the hardware from everywhere, this makes
+         * it impossible to find from userspace.
+         */
+        cfg80211_debugfs_rdev_del(rdev);
+        list_del(&rdev->list);
 
         /*
          * Try to grab rdev->mtx. If a command is still in progress,
@@ -578,29 +550,26 @@ void wiphy_unregister(struct wiphy *wiphy)
          * down the device already. We wait for this command to complete
          * before unlinking the item from the list.
          * Note: as codified by the BUG_ON above we cannot get here if
-         * a virtual interface is still associated. Hence, we can only
-         * get to lock contention here if userspace issues a command
-         * that identified the hardware by wiphy index.
+         * a virtual interface is still present. Hence, we can only get
+         * to lock contention here if userspace issues a command that
+         * identified the hardware by wiphy index.
          */
-        mutex_lock(&rdev->mtx);
-        /* unlock again before freeing */
-        mutex_unlock(&rdev->mtx);
-
-        cfg80211_debugfs_rdev_del(rdev);
+        cfg80211_lock_rdev(rdev);
+        /* nothing */
+        cfg80211_unlock_rdev(rdev);
 
         /* If this device got a regulatory hint tell core its
          * free to listen now to a new shiny device regulatory hint */
         reg_device_remove(wiphy);
 
-        list_del(&rdev->list);
+        cfg80211_rdev_list_generation++;
         device_del(&rdev->wiphy.dev);
         debugfs_remove(rdev->wiphy.debugfsdir);
 
         mutex_unlock(&cfg80211_mutex);
 
+        flush_work(&rdev->scan_done_wk);
         cancel_work_sync(&rdev->conn_work);
-        cancel_work_sync(&rdev->scan_done_wk);
-        kfree(rdev->scan_req);
         flush_work(&rdev->event_work);
 }
 EXPORT_SYMBOL(wiphy_unregister);
@@ -631,6 +600,31 @@ void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked)
 }
 EXPORT_SYMBOL(wiphy_rfkill_set_hw_state);
 
+static void wdev_cleanup_work(struct work_struct *work)
+{
+        struct wireless_dev *wdev;
+        struct cfg80211_registered_device *rdev;
+
+        wdev = container_of(work, struct wireless_dev, cleanup_work);
+        rdev = wiphy_to_dev(wdev->wiphy);
+
+        cfg80211_lock_rdev(rdev);
+
+        if (WARN_ON(rdev->scan_req && rdev->scan_req->dev == wdev->netdev)) {
+                rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, true);
+        }
+
+        cfg80211_unlock_rdev(rdev);
+
+        mutex_lock(&rdev->devlist_mtx);
+        rdev->opencount--;
+        mutex_unlock(&rdev->devlist_mtx);
+        wake_up(&rdev->dev_wait);
+
+        dev_put(wdev->netdev);
+}
+
 static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                          unsigned long state,
                                          void *ndev)
@@ -648,11 +642,18 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
 
         switch (state) {
         case NETDEV_REGISTER:
+                /*
+                 * NB: cannot take rdev->mtx here because this may be
+                 * called within code protected by it when interfaces
+                 * are added with nl80211.
+                 */
                 mutex_init(&wdev->mtx);
+                INIT_WORK(&wdev->cleanup_work, wdev_cleanup_work);
                 INIT_LIST_HEAD(&wdev->event_list);
                 spin_lock_init(&wdev->event_lock);
                 mutex_lock(&rdev->devlist_mtx);
                 list_add(&wdev->list, &rdev->netdev_list);
+                rdev->devlist_generation++;
                 /* can only change netns with wiphy */
                 dev->features |= NETIF_F_NETNS_LOCAL;
 
@@ -670,7 +671,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 wdev->wext.default_key = -1;
                 wdev->wext.default_mgmt_key = -1;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
-                wdev->wext.ps = CONFIG_CFG80211_DEFAULT_PS_VALUE;
+                wdev->wext.ps = wdev->wiphy->ps_default;
                 wdev->wext.ps_timeout = 100;
                 if (rdev->ops->set_power_mgmt)
                         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
@@ -703,9 +704,26 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 }
                 break;
+        case NETDEV_DOWN:
+                dev_hold(dev);
+                schedule_work(&wdev->cleanup_work);
+                break;
         case NETDEV_UP:
+                /*
+                 * If we have a really quick DOWN/UP succession we may
+                 * have this work still pending ... cancel it and see
+                 * if it was pending, in which case we need to account
+                 * for some of the work it would have done.
+                 */
+                if (cancel_work_sync(&wdev->cleanup_work)) {
+                        mutex_lock(&rdev->devlist_mtx);
+                        rdev->opencount--;
+                        mutex_unlock(&rdev->devlist_mtx);
+                        dev_put(dev);
+                }
 #ifdef CONFIG_WIRELESS_EXT
                 cfg80211_lock_rdev(rdev);
+                mutex_lock(&rdev->devlist_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_ADHOC:
@@ -718,10 +736,17 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 }
                 wdev_unlock(wdev);
+                rdev->opencount++;
+                mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
 #endif
                 break;
         case NETDEV_UNREGISTER:
+                /*
+                 * NB: cannot take rdev->mtx here because this may be
+                 * called within code protected by it when interfaces
+                 * are removed with nl80211.
+                 */
                 mutex_lock(&rdev->devlist_mtx);
                 /*
                  * It is possible to get NETDEV_UNREGISTER
@@ -733,7 +758,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 if (!list_empty(&wdev->list)) {
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
                         list_del_init(&wdev->list);
-                        mutex_destroy(&wdev->mtx);
+                        rdev->devlist_generation++;
 #ifdef CONFIG_WIRELESS_EXT
                         kfree(wdev->wext.keys);
 #endif
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 325c17e6198c..2a33d8bc886b 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -49,6 +49,9 @@ struct cfg80211_registered_device {
         /* associate netdev list */
         struct mutex devlist_mtx;
         struct list_head netdev_list;
+        int devlist_generation;
+        int opencount; /* also protected by devlist_mtx */
+        wait_queue_head_t dev_wait;
 
         /* BSSes/scanning */
         spinlock_t bss_lock;
@@ -101,6 +104,7 @@ bool wiphy_idx_valid(int wiphy_idx)
 
 extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_rdev_list;
+extern int cfg80211_rdev_list_generation;
 
 #define assert_cfg80211_lock() WARN_ON(!mutex_is_locked(&cfg80211_mutex))
 
@@ -335,7 +339,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
                        struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys);
+                       struct cfg80211_cached_keys *connkeys,
+                       const u8 *prev_bssid);
 int cfg80211_connect(struct cfg80211_registered_device *rdev,
                      struct net_device *dev,
                      struct cfg80211_connect_params *connect,
@@ -353,6 +358,7 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev);
 
 void cfg80211_conn_work(struct work_struct *work);
+bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev);
 
 /* internal helpers */
 int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
@@ -364,6 +370,29 @@ void cfg80211_sme_scan_done(struct net_device *dev);
 void cfg80211_sme_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
 void cfg80211_sme_disassoc(struct net_device *dev, int idx);
 void __cfg80211_scan_done(struct work_struct *wk);
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak);
 void cfg80211_upload_connect_keys(struct wireless_dev *wdev);
+int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, enum nl80211_iftype ntype,
+                          u32 *flags, struct vif_params *params);
+void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
+
+struct ieee80211_channel *
+rdev_fixed_channel(struct cfg80211_registered_device *rdev,
+                   struct wireless_dev *for_wdev);
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type);
+
+#ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
+#define CFG80211_DEV_WARN_ON(cond)      WARN_ON(cond)
+#else
+/*
+ * Trick to enable using it as a condition,
+ * and also not give a warning when it's
+ * not used that way.
+ */
+#define CFG80211_DEV_WARN_ON(cond)      ({bool __r = (cond); __r; })
+#endif
 
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 4d7a084b35e2..c88338911979 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -22,7 +22,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return;
 
-        if (WARN_ON(!wdev->ssid_len))
+        if (!wdev->ssid_len)
                 return;
 
         bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
@@ -58,6 +58,8 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
         struct cfg80211_event *ev;
         unsigned long flags;
 
+        CFG80211_DEV_WARN_ON(!wdev->ssid_len);
+
         ev = kzalloc(sizeof(*ev), gfp);
         if (!ev)
                 return;
@@ -78,10 +80,15 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                          struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
 
+        chan = rdev_fixed_channel(rdev, wdev);
+        if (chan && chan != params->channel)
+                return -EBUSY;
+
         if (wdev->ssid_len)
                 return -EALREADY;
 
@@ -112,9 +119,11 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = __cfg80211_join_ibss(rdev, dev, params, connkeys);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -264,27 +273,32 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
 
 int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                                struct iw_request_info *info,
-                               struct iw_freq *freq, char *extra)
+                               struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct ieee80211_channel *chan;
-        int err;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct ieee80211_channel *chan = NULL;
+        int err, freq;
 
         /* call only for ibss! */
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
-        chan = cfg80211_wext_freq(wdev->wiphy, freq);
-        if (chan && IS_ERR(chan))
-                return PTR_ERR(chan);
+        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        if (freq < 0)
+                return freq;
 
-        if (chan &&
-            (chan->flags & IEEE80211_CHAN_NO_IBSS ||
-             chan->flags & IEEE80211_CHAN_DISABLED))
-                return -EINVAL;
+        if (freq) {
+                chan = ieee80211_get_channel(wdev->wiphy, freq);
+                if (!chan)
+                        return -EINVAL;
+                if (chan->flags & IEEE80211_CHAN_NO_IBSS ||
+                    chan->flags & IEEE80211_CHAN_DISABLED)
+                        return -EINVAL;
+        }
 
         if (wdev->wext.ibss.channel == chan)
                 return 0;
@@ -292,8 +306,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
         wdev_lock(wdev);
         err = 0;
         if (wdev->ssid_len)
-                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                            dev, true);
+                err = __cfg80211_leave_ibss(rdev, dev, true);
         wdev_unlock(wdev);
 
         if (err)
@@ -307,9 +320,11 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 wdev->wext.ibss.channel_fixed = false;
         }
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
-        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -347,6 +362,7 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
                                 struct iw_point *data, char *ssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         size_t len = data->length;
         int err;
 
@@ -354,14 +370,13 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
         wdev_lock(wdev);
         err = 0;
         if (wdev->ssid_len)
-                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                            dev, true);
+                err = __cfg80211_leave_ibss(rdev, dev, true);
         wdev_unlock(wdev);
 
         if (err)
@@ -375,9 +390,11 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         memcpy(wdev->wext.ibss.ssid, ssid, len);
         wdev->wext.ibss.ssid_len = len;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
-        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -414,6 +431,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
                              struct sockaddr *ap_addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         u8 *bssid = ap_addr->sa_data;
         int err;
 
@@ -421,7 +439,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
         if (ap_addr->sa_family != ARPHRD_ETHER)
@@ -443,8 +461,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         wdev_lock(wdev);
         err = 0;
         if (wdev->ssid_len)
-                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                            dev, true);
+                err = __cfg80211_leave_ibss(rdev, dev, true);
         wdev_unlock(wdev);
 
         if (err)
@@ -456,9 +473,11 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.ibss.bssid = NULL;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
-        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 525e8e247b30..79d2eec54cec 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -67,6 +67,16 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
 
+        /*
+         * This is a bit of a hack, we don't notify userspace of
+         * a (re-)association reply if we tried to send a reassoc
+         * and got a reject -- we only try again with an assoc
+         * frame instead of reassoc.
+         */
+        if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
+            cfg80211_sme_failed_reassoc(wdev))
+                goto out;
+
         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
 
         if (status_code == WLAN_STATUS_SUCCESS) {
@@ -86,6 +96,15 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                 WARN_ON(!bss);
         }
 
+        if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
+                /*
+                 * This is for the userspace SME, the CONNECTING
+                 * state will be changed to CONNECTED by
+                 * __cfg80211_connect_result() below.
+                 */
+                wdev->sme_state = CFG80211_SME_CONNECTING;
+        }
+
         /* this consumes one bss reference (unless bss is NULL) */
         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
                                   status_code,
@@ -97,6 +116,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                 cfg80211_put_bss(&bss->pub);
         }
 
+ out:
         wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
@@ -149,7 +169,7 @@ static void __cfg80211_send_deauth(struct net_device *dev,
 
                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-                from_ap = memcmp(mgmt->da, dev->dev_addr, ETH_ALEN) == 0;
+                from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
@@ -198,7 +218,7 @@ static void __cfg80211_send_disassoc(struct net_device *dev,
                 return;
 
         if (wdev->current_bss &&
-            memcmp(wdev->current_bss, bssid, ETH_ALEN) == 0) {
+            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
                         if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
                                 continue;
@@ -215,7 +235,7 @@ static void __cfg80211_send_disassoc(struct net_device *dev,
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        from_ap = memcmp(mgmt->da, dev->dev_addr, ETH_ALEN) == 0;
+        from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0cd548267d4a..eddab097435c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -408,6 +408,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
+                    cfg80211_rdev_list_generation);
+
         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
                    dev->wiphy.retry_short);
         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
@@ -701,15 +704,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
-                struct ieee80211_channel *chan;
-                struct ieee80211_sta_ht_cap *ht_cap;
                 u32 freq;
 
-                if (!rdev->ops->set_channel) {
-                        result = -EOPNOTSUPP;
-                        goto bad_res;
-                }
-
                 result = -EINVAL;
 
                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
@@ -723,42 +719,12 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 }
 
                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
-                chan = ieee80211_get_channel(&rdev->wiphy, freq);
 
-                /* Primary channel not allowed */
-                if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
-                        goto bad_res;
-
-                if (channel_type == NL80211_CHAN_HT40MINUS &&
-                    (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
-                        goto bad_res;
-                else if (channel_type == NL80211_CHAN_HT40PLUS &&
-                         (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
-                        goto bad_res;
-
-                /*
-                 * At this point we know if that if HT40 was requested
-                 * we are allowed to use it and the extension channel
-                 * exists.
-                 */
-
-                ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
-
-                /* no HT capabilities or intolerant */
-                if (channel_type != NL80211_CHAN_NO_HT) {
-                        if (!ht_cap->ht_supported)
-                                goto bad_res;
-                        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
-                            (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
-                                goto bad_res;
-                }
-
-                result = rdev->ops->set_channel(&rdev->wiphy, chan,
-                                                channel_type);
+                mutex_lock(&rdev->devlist_mtx);
+                result = rdev_set_freq(rdev, NULL, freq, channel_type);
+                mutex_unlock(&rdev->devlist_mtx);
                 if (result)
                         goto bad_res;
-
-                rdev->channel = chan;
         }
 
         changed = 0;
@@ -862,6 +828,11 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
+
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
+                    rdev->devlist_generation ^
+                        (cfg80211_rdev_list_generation << 2));
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -875,12 +846,12 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         int if_idx = 0;
         int wp_start = cb->args[0];
         int if_start = cb->args[1];
-        struct cfg80211_registered_device *dev;
+        struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
 
         mutex_lock(&cfg80211_mutex);
-        list_for_each_entry(dev, &cfg80211_rdev_list, list) {
-                if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
                         continue;
                 if (wp_idx < wp_start) {
                         wp_idx++;
@@ -888,21 +859,21 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 }
                 if_idx = 0;
 
-                mutex_lock(&dev->devlist_mtx);
-                list_for_each_entry(wdev, &dev->netdev_list, list) {
+                mutex_lock(&rdev->devlist_mtx);
+                list_for_each_entry(wdev, &rdev->netdev_list, list) {
                         if (if_idx < if_start) {
                                 if_idx++;
                                 continue;
                         }
                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                               dev, wdev->netdev) < 0) {
-                                mutex_unlock(&dev->devlist_mtx);
+                                               rdev, wdev->netdev) < 0) {
+                                mutex_unlock(&rdev->devlist_mtx);
                                 goto out;
                         }
                         if_idx++;
                 }
-                mutex_unlock(&dev->devlist_mtx);
+                mutex_unlock(&rdev->devlist_mtx);
 
                 wp_idx++;
         }
@@ -1006,12 +977,6 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        if (!rdev->ops->change_virtual_intf ||
-            !(rdev->wiphy.interface_modes & (1 << ntype))) {
-                err = -EOPNOTSUPP;
-                goto unlock;
-        }
-
         if (info->attrs[NL80211_ATTR_MESH_ID]) {
                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
                         err = -EINVAL;
@@ -1037,18 +1002,10 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (change)
-                err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
-                                                    ntype, flags, &params);
+                err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
         else
                 err = 0;
 
-        WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
-
-        if (!err && (ntype != otype)) {
-                if (otype == NL80211_IFTYPE_ADHOC)
-                        cfg80211_clear_ibss(dev, false);
-        }
-
  unlock:
         dev_put(dev);
         cfg80211_unlock_rdev(rdev);
@@ -1653,6 +1610,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
+
         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
         if (!sinfoattr)
                 goto nla_put_failure;
@@ -2138,6 +2097,8 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
+
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
         if (!pinfoattr)
                 goto nla_put_failure;
@@ -2220,7 +2181,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
 
         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
                 err = -EOPNOTSUPP;
-                goto out;
+                goto out_err;
         }
 
         while (1) {
@@ -3027,10 +2988,9 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        request->channels = (void *)((char *)request + sizeof(*request));
         request->n_channels = n_channels;
         if (n_ssids)
-                request->ssids = (void *)(request->channels + n_channels);
+                request->ssids = (void *)&request->channels[n_channels];
         request->n_ssids = n_ssids;
         if (ie_len) {
                 if (request->ssids)
@@ -3127,8 +3087,7 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
-                    rdev->bss_generation);
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
 
         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
@@ -3453,7 +3412,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct cfg80211_crypto_settings crypto;
-        struct ieee80211_channel *chan;
+        struct ieee80211_channel *chan, *fixedchan;
         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
         int err, ssid_len, ie_len = 0;
         bool use_mfp = false;
@@ -3496,6 +3455,15 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
+        mutex_lock(&rdev->devlist_mtx);
+        fixedchan = rdev_fixed_channel(rdev, NULL);
+        if (fixedchan && chan != fixedchan) {
+                err = -EBUSY;
+                mutex_unlock(&rdev->devlist_mtx);
+                goto out;
+        }
+        mutex_unlock(&rdev->devlist_mtx);
+
         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index b3ac0aace0e5..f256dfffbf46 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1018,7 +1018,6 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                         map_regdom_flags(reg_rule->flags) | bw_flags;
                 chan->max_antenna_gain = chan->orig_mag =
                         (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-                chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
                 chan->max_power = chan->orig_mpwr =
                         (int) MBM_TO_DBM(power_rule->max_eirp);
                 return;
@@ -1027,7 +1026,6 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
-        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         if (chan->orig_mpwr)
                 chan->max_power = min(chan->orig_mpwr,
                         (int) MBM_TO_DBM(power_rule->max_eirp));
@@ -1095,17 +1093,18 @@ static void handle_reg_beacon(struct wiphy *wiphy,
 
         chan->beacon_found = true;
 
+        if (wiphy->disable_beacon_hints)
+                return;
+
         chan_before.center_freq = chan->center_freq;
         chan_before.flags = chan->flags;
 
-        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
-            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
                 chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
                 channel_changed = true;
         }
 
-        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
-            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
                 chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
                 channel_changed = true;
         }
@@ -1328,7 +1327,6 @@ static void handle_channel_custom(struct wiphy *wiphy,
 
         chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
         chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
@@ -1426,7 +1424,7 @@ static int ignore_request(struct wiphy *wiphy,
                         if (last_wiphy != wiphy) {
                                 /*
                                  * Two cards with two APs claiming different
-                                 * different Country IE alpha2s. We could
+                                 * Country IE alpha2s. We could
                                  * intersect them, but that seems unlikely
                                  * to be correct. Reject second one for now.
                                  */
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 662a9dad76d5..3362c7c069b2 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -30,7 +30,8 @@ int set_regdom(const struct ieee80211_regdomain *rd);
  * non-radar 5 GHz channels.
  *
  * Drivers do not need to call this, cfg80211 will do it for after a scan
- * on a newly found BSS.
+ * on a newly found BSS. If you cannot make use of this feature you can
+ * set the wiphy->disable_beacon_hints to true.
  */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                         struct ieee80211_channel *beacon_chan,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 67714d7ed5b4..4c210c2debc6 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -18,21 +18,21 @@
 
 #define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
 
-void __cfg80211_scan_done(struct work_struct *wk)
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
-        struct cfg80211_registered_device *rdev;
         struct cfg80211_scan_request *request;
         struct net_device *dev;
 #ifdef CONFIG_WIRELESS_EXT
         union iwreq_data wrqu;
 #endif
 
-        rdev = container_of(wk, struct cfg80211_registered_device,
-                            scan_done_wk);
+        ASSERT_RDEV_LOCK(rdev);
 
-        mutex_lock(&rdev->mtx);
         request = rdev->scan_req;
 
+        if (!request)
+                return;
+
         dev = request->dev;
 
         /*
@@ -43,9 +43,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         cfg80211_sme_scan_done(dev);
 
         if (request->aborted)
-                nl80211_send_scan_aborted(wiphy_to_dev(request->wiphy), dev);
+                nl80211_send_scan_aborted(rdev, dev);
         else
-                nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
+                nl80211_send_scan_done(rdev, dev);
 
 #ifdef CONFIG_WIRELESS_EXT
         if (!request->aborted) {
@@ -57,9 +57,30 @@ void __cfg80211_scan_done(struct work_struct *wk)
 
         dev_put(dev);
 
+        rdev->scan_req = NULL;
+
+        /*
+         * OK. If this is invoked with "leak" then we can't
+         * free this ... but we've cleaned it up anyway. The
+         * driver failed to call the scan_done callback, so
+         * all bets are off, it might still be trying to use
+         * the scan request or not ... if it accesses the dev
+         * in there (it shouldn't anyway) then it may crash.
+         */
+        if (!leak)
+                kfree(request);
+}
+
+void __cfg80211_scan_done(struct work_struct *wk)
+{
+        struct cfg80211_registered_device *rdev;
+
+        rdev = container_of(wk, struct cfg80211_registered_device,
+                            scan_done_wk);
+
+        cfg80211_lock_rdev(rdev);
+        ___cfg80211_scan_done(rdev, false);
         cfg80211_unlock_rdev(rdev);
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
-        kfree(request);
 }
 
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -120,7 +141,7 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
                 dev->bss_generation++;
 }
 
-static u8 *find_ie(u8 num, u8 *ies, size_t len)
+static u8 *find_ie(u8 num, u8 *ies, int len)
 {
         while (len > 2 && ies[0] != num) {
                 len -= ies[1] + 2;
@@ -141,7 +162,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 
         if (!ie1 && !ie2)
                 return 0;
-        if (!ie1)
+        if (!ie1 || !ie2)
                 return -1;
 
         r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
@@ -194,6 +215,8 @@ static bool is_mesh(struct cfg80211_bss *a,
         ie = find_ie(WLAN_EID_MESH_CONFIG,
                      a->information_elements,
                      a->len_information_elements);
+        if (!ie)
+                return false;
         if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
                 return false;
 
@@ -560,6 +583,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
         spin_lock_bh(&dev->bss_lock);
 
         list_del(&bss->list);
+        dev->bss_generation++;
         rb_erase(&bss->rbn, &dev->bss_tree);
 
         spin_unlock_bh(&dev->bss_lock);
@@ -583,6 +607,9 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (!netif_running(dev))
                 return -ENETDOWN;
 
+        if (wrqu->data.length == sizeof(struct iw_scan_req))
+                wreq = (struct iw_scan_req *)extra;
+
         rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
 
         if (IS_ERR(rdev))
@@ -595,9 +622,14 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 
         wiphy = &rdev->wiphy;
 
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
-                if (wiphy->bands[band])
-                        n_channels += wiphy->bands[band]->n_channels;
+        /* Determine number of channels, needed to allocate creq */
+        if (wreq && wreq->num_channels)
+                n_channels = wreq->num_channels;
+        else {
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                        if (wiphy->bands[band])
+                                n_channels += wiphy->bands[band]->n_channels;
+        }
 
         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
                        n_channels * sizeof(void *),
@@ -609,27 +641,46 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 
         creq->wiphy = wiphy;
         creq->dev = dev;
-        creq->ssids = (void *)(creq + 1);
-        creq->channels = (void *)(creq->ssids + 1);
+        /* SSIDs come after channels */
+        creq->ssids = (void *)&creq->channels[n_channels];
         creq->n_channels = n_channels;
         creq->n_ssids = 1;
 
-        /* all channels */
+        /* translate "Scan on frequencies" request */
         i = 0;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 int j;
                 if (!wiphy->bands[band])
                         continue;
                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+
+                        /* If we have a wireless request structure and the
+                         * wireless request specifies frequencies, then search
+                         * for the matching hardware channel.
+                         */
+                        if (wreq && wreq->num_channels) {
+                                int k;
+                                int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
+                                for (k = 0; k < wreq->num_channels; k++) {
+                                        int wext_freq = wreq->channel_list[k].m / 100000;
+                                        if (wext_freq == wiphy_freq)
+                                                goto wext_freq_found;
+                                }
+                                goto wext_freq_not_found;
+                        }
+
+                wext_freq_found:
                         creq->channels[i] = &wiphy->bands[band]->channels[j];
                         i++;
+                wext_freq_not_found: ;
                 }
         }
 
-        /* translate scan request */
-        if (wrqu->data.length == sizeof(struct iw_scan_req)) {
-                wreq = (struct iw_scan_req *)extra;
+        /* Set real number of channels specified in creq->channels[] */
+        creq->n_channels = i;
 
+        /* translate "Scan for SSID" request */
+        if (wreq) {
                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
                         if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
                                 return -EINVAL;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 8a7dcbf90602..68307883ec87 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -27,10 +27,10 @@ struct cfg80211_conn {
                 CFG80211_CONN_ASSOCIATE_NEXT,
                 CFG80211_CONN_ASSOCIATING,
         } state;
-        u8 bssid[ETH_ALEN];
+        u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
         u8 *ie;
         size_t ie_len;
-        bool auto_auth;
+        bool auto_auth, prev_bssid_valid;
 };
 
 
@@ -65,7 +65,6 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         if (!request)
                 return -ENOMEM;
 
-        request->channels = (void *)((char *)request + sizeof(*request));
         if (wdev->conn->params.channel)
                 request->channels[0] = wdev->conn->params.channel;
         else {
@@ -82,7 +81,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
                 }
         }
         request->n_channels = n_channels;
-        request->ssids = (void *)(request->channels + n_channels);
+        request->ssids = (void *)&request->channels[n_channels];
         request->n_ssids = 1;
 
         memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
@@ -110,6 +109,7 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct cfg80211_connect_params *params;
+        const u8 *prev_bssid = NULL;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -135,15 +135,11 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
-                /*
-                 * We could, later, implement roaming here and then actually
-                 * set prev_bssid to non-NULL. But then we need to be aware
-                 * that some APs don't like that -- so we'd need to retry
-                 * the association.
-                 */
+                if (wdev->conn->prev_bssid_valid)
+                        prev_bssid = wdev->conn->prev_bssid;
                 err = __cfg80211_mlme_assoc(rdev, wdev->netdev,
                                             params->channel, params->bssid,
-                                            NULL,
+                                            prev_bssid,
                                             params->ssid, params->ssid_len,
                                             params->ie, params->ie_len,
                                             false, &params->crypto);
@@ -256,9 +252,11 @@ void cfg80211_sme_scan_done(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
+        mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
         wdev_lock(wdev);
         __cfg80211_sme_scan_done(dev);
         wdev_unlock(wdev);
+        mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 }
 
 void cfg80211_sme_rx_auth(struct net_device *dev,
@@ -314,6 +312,28 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
         }
 }
 
+bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev)
+{
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        if (WARN_ON(!wdev->conn))
+                return false;
+
+        if (!wdev->conn->prev_bssid_valid)
+                return false;
+
+        /*
+         * Some stupid APs don't accept reassoc, so we
+         * need to fall back to trying regular assoc.
+         */
+        wdev->conn->prev_bssid_valid = false;
+        wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
+        schedule_work(&rdev->conn_work);
+
+        return true;
+}
+
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *req_ie, size_t req_ie_len,
                                const u8 *resp_ie, size_t resp_ie_len,
@@ -331,15 +351,13 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
                 return;
 
-        if (wdev->sme_state == CFG80211_SME_CONNECTED)
-                nl80211_send_roamed(wiphy_to_dev(wdev->wiphy), dev,
+        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                return;
+
+        nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
                                     bssid, req_ie, req_ie_len,
-                                    resp_ie, resp_ie_len, GFP_KERNEL);
-        else
-                nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
-                                            bssid, req_ie, req_ie_len,
-                                            resp_ie, resp_ie_len,
-                                            status, GFP_KERNEL);
+                                    resp_ie, resp_ie_len,
+                                    status, GFP_KERNEL);
 
 #ifdef CONFIG_WIRELESS_EXT
         if (wextev) {
@@ -357,8 +375,11 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-                if (bssid && status == WLAN_STATUS_SUCCESS)
+                if (bssid && status == WLAN_STATUS_SUCCESS) {
                         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+                        memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
+                        wdev->wext.prev_bssid_valid = true;
+                }
                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
         }
 #endif
@@ -369,18 +390,13 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 wdev->current_bss = NULL;
         }
 
-        if (status == WLAN_STATUS_SUCCESS &&
-            wdev->sme_state == CFG80211_SME_IDLE)
-                goto success;
-
-        if (wdev->sme_state != CFG80211_SME_CONNECTING)
-                return;
-
         if (wdev->conn)
                 wdev->conn->state = CFG80211_CONN_IDLE;
 
         if (status != WLAN_STATUS_SUCCESS) {
                 wdev->sme_state = CFG80211_SME_IDLE;
+                if (wdev->conn)
+                        kfree(wdev->conn->ie);
                 kfree(wdev->conn);
                 wdev->conn = NULL;
                 kfree(wdev->connect_keys);
@@ -389,7 +405,6 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 return;
         }
 
- success:
         if (!bss)
                 bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
                                        wdev->ssid, wdev->ssid_len,
@@ -430,12 +445,15 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         struct cfg80211_event *ev;
         unsigned long flags;
 
+        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTING);
+
         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
         if (!ev)
                 return;
 
         ev->type = EVENT_CONNECT_RESULT;
-        memcpy(ev->cr.bssid, bssid, ETH_ALEN);
+        if (bssid)
+                memcpy(ev->cr.bssid, bssid, ETH_ALEN);
         ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
         ev->cr.req_ie_len = req_ie_len;
         memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
@@ -465,7 +483,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
                 return;
 
-        if (WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED))
+        if (wdev->sme_state != CFG80211_SME_CONNECTED)
                 return;
 
         /* internal error -- how did we get to CONNECTED w/o BSS? */
@@ -509,6 +527,8 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
         memset(&wrqu, 0, sizeof(wrqu));
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
+        wdev->wext.prev_bssid_valid = true;
         wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
 #endif
 }
@@ -522,6 +542,8 @@ void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
         struct cfg80211_event *ev;
         unsigned long flags;
 
+        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED);
+
         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
         if (!ev)
                 return;
@@ -557,7 +579,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
                 return;
 
-        if (WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED))
+        if (wdev->sme_state != CFG80211_SME_CONNECTED)
                 return;
 
         if (wdev->current_bss) {
@@ -570,10 +592,30 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         wdev->ssid_len = 0;
 
         if (wdev->conn) {
+                const u8 *bssid;
+                int ret;
+
                 kfree(wdev->conn->ie);
                 wdev->conn->ie = NULL;
                 kfree(wdev->conn);
                 wdev->conn = NULL;
+
+                /*
+                 * If this disconnect was due to a disassoc, we
+                 * we might still have an auth BSS around. For
+                 * the userspace SME that's currently expected,
+                 * but for the kernel SME (nl80211 CONNECT or
+                 * wireless extensions) we want to clear up all
+                 * state.
+                 */
+                for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (!wdev->auth_bsses[i])
+                                continue;
+                        bssid = wdev->auth_bsses[i]->pub.bssid;
+                        ret = __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
+                                                WLAN_REASON_DEAUTH_LEAVING);
+                        WARN(ret, "deauth failed: %d\n", ret);
+                }
         }
 
         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
@@ -601,6 +643,8 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
         struct cfg80211_event *ev;
         unsigned long flags;
 
+        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED);
+
         ev = kzalloc(sizeof(*ev) + ie_len, gfp);
         if (!ev)
                 return;
@@ -621,9 +665,11 @@ EXPORT_SYMBOL(cfg80211_disconnected);
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
                        struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys)
+                       struct cfg80211_cached_keys *connkeys,
+                       const u8 *prev_bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -631,6 +677,10 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
         if (wdev->sme_state != CFG80211_SME_IDLE)
                 return -EALREADY;
 
+        chan = rdev_fixed_channel(rdev, wdev);
+        if (chan && chan != connect->channel)
+                return -EBUSY;
+
         if (WARN_ON(wdev->connect_keys)) {
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
@@ -638,14 +688,28 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         if (connkeys && connkeys->def >= 0) {
                 int idx;
+                u32 cipher;
 
                 idx = connkeys->def;
+                cipher = connkeys->params[idx].cipher;
                 /* If given a WEP key we may need it for shared key auth */
-                if (connkeys->params[idx].cipher == WLAN_CIPHER_SUITE_WEP40 ||
-                    connkeys->params[idx].cipher == WLAN_CIPHER_SUITE_WEP104) {
+                if (cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                    cipher == WLAN_CIPHER_SUITE_WEP104) {
                         connect->key_idx = idx;
                         connect->key = connkeys->params[idx].key;
                         connect->key_len = connkeys->params[idx].key_len;
+
+                        /*
+                         * If ciphers are not set (e.g. when going through
+                         * iwconfig), we have to set them appropriately here.
+                         */
+                        if (connect->crypto.cipher_group == 0)
+                                connect->crypto.cipher_group = cipher;
+
+                        if (connect->crypto.n_ciphers_pairwise == 0) {
+                                connect->crypto.n_ciphers_pairwise = 1;
+                                connect->crypto.ciphers_pairwise[0] = cipher;
+                        }
                 }
         }
 
@@ -701,6 +765,11 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                 wdev->sme_state = CFG80211_SME_CONNECTING;
                 wdev->connect_keys = connkeys;
 
+                if (prev_bssid) {
+                        memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
+                        wdev->conn->prev_bssid_valid = true;
+                }
+
                 /* we're good if we have both BSSID and channel */
                 if (wdev->conn->params.bssid && wdev->conn->params.channel) {
                         wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
@@ -719,6 +788,7 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                         }
                 }
                 if (err) {
+                        kfree(wdev->conn->ie);
                         kfree(wdev->conn);
                         wdev->conn = NULL;
                         wdev->sme_state = CFG80211_SME_IDLE;
@@ -751,9 +821,11 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
 {
         int err;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_connect(rdev, dev, connect, connkeys);
+        err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -786,6 +858,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                     (wdev->conn->state == CFG80211_CONN_SCANNING ||
                      wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)) {
                         wdev->sme_state = CFG80211_SME_IDLE;
+                        kfree(wdev->conn->ie);
                         kfree(wdev->conn);
                         wdev->conn = NULL;
                         wdev->ssid_len = 0;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ba387d85dcfd..3fc2df86278f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -274,11 +274,11 @@ static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
         switch (ae) {
         case 0:
                 return 6;
-        case 1:
+        case MESH_FLAGS_AE_A4:
                 return 12;
-        case 2:
+        case MESH_FLAGS_AE_A5_A6:
                 return 18;
-        case 3:
+        case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
                 return 24;
         default:
                 return 6;
@@ -333,10 +333,18 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
                 }
                 break;
         case cpu_to_le16(IEEE80211_FCTL_FROMDS):
-                if (iftype != NL80211_IFTYPE_STATION ||
+                if ((iftype != NL80211_IFTYPE_STATION &&
+                    iftype != NL80211_IFTYPE_MESH_POINT) ||
                     (is_multicast_ether_addr(dst) &&
                      !compare_ether_addr(src, addr)))
                         return -1;
+                if (iftype == NL80211_IFTYPE_MESH_POINT) {
+                        struct ieee80211s_hdr *meshdr =
+                                (struct ieee80211s_hdr *) (skb->data + hdrlen);
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        if (meshdr->flags & MESH_FLAGS_AE_A4)
+                                memcpy(src, meshdr->eaddr1, ETH_ALEN);
+                }
                 break;
         case cpu_to_le16(0):
                 if (iftype != NL80211_IFTYPE_ADHOC)
@@ -566,3 +574,111 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
         kfree(wdev->connect_keys);
         wdev->connect_keys = NULL;
 }
+
+static void cfg80211_process_wdev_events(struct wireless_dev *wdev)
+{
+        struct cfg80211_event *ev;
+        unsigned long flags;
+        const u8 *bssid = NULL;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        while (!list_empty(&wdev->event_list)) {
+                ev = list_first_entry(&wdev->event_list,
+                                      struct cfg80211_event, list);
+                list_del(&ev->list);
+                spin_unlock_irqrestore(&wdev->event_lock, flags);
+
+                wdev_lock(wdev);
+                switch (ev->type) {
+                case EVENT_CONNECT_RESULT:
+                        if (!is_zero_ether_addr(ev->cr.bssid))
+                                bssid = ev->cr.bssid;
+                        __cfg80211_connect_result(
+                                wdev->netdev, bssid,
+                                ev->cr.req_ie, ev->cr.req_ie_len,
+                                ev->cr.resp_ie, ev->cr.resp_ie_len,
+                                ev->cr.status,
+                                ev->cr.status == WLAN_STATUS_SUCCESS,
+                                NULL);
+                        break;
+                case EVENT_ROAMED:
+                        __cfg80211_roamed(wdev, ev->rm.bssid,
+                                          ev->rm.req_ie, ev->rm.req_ie_len,
+                                          ev->rm.resp_ie, ev->rm.resp_ie_len);
+                        break;
+                case EVENT_DISCONNECTED:
+                        __cfg80211_disconnected(wdev->netdev,
+                                                ev->dc.ie, ev->dc.ie_len,
+                                                ev->dc.reason, true);
+                        break;
+                case EVENT_IBSS_JOINED:
+                        __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid);
+                        break;
+                }
+                wdev_unlock(wdev);
+
+                kfree(ev);
+
+                spin_lock_irqsave(&wdev->event_lock, flags);
+        }
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+}
+
+void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
+{
+        struct wireless_dev *wdev;
+
+        ASSERT_RTNL();
+        ASSERT_RDEV_LOCK(rdev);
+
+        mutex_lock(&rdev->devlist_mtx);
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list)
+                cfg80211_process_wdev_events(wdev);
+
+        mutex_unlock(&rdev->devlist_mtx);
+}
+
+int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, enum nl80211_iftype ntype,
+                          u32 *flags, struct vif_params *params)
+{
+        int err;
+        enum nl80211_iftype otype = dev->ieee80211_ptr->iftype;
+
+        ASSERT_RDEV_LOCK(rdev);
+
+        /* don't support changing VLANs, you just re-create them */
+        if (otype == NL80211_IFTYPE_AP_VLAN)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->change_virtual_intf ||
+            !(rdev->wiphy.interface_modes & (1 << ntype)))
+                return -EOPNOTSUPP;
+
+        if (ntype != otype) {
+                switch (otype) {
+                case NL80211_IFTYPE_ADHOC:
+                        cfg80211_leave_ibss(rdev, dev, false);
+                        break;
+                case NL80211_IFTYPE_STATION:
+                        cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, true);
+                        break;
+                case NL80211_IFTYPE_MESH_POINT:
+                        /* mesh should be handled? */
+                        break;
+                default:
+                        break;
+                }
+
+                cfg80211_process_rdev_events(rdev);
+        }
+
+        err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
+                                             ntype, flags, params);
+
+        WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
+
+        return err;
+}
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index e4e90e249bab..429dd06a4ecc 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -70,18 +70,8 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
         enum nl80211_iftype type;
         int ret;
 
-        if (!wdev)
-                return -EOPNOTSUPP;
-
         rdev = wiphy_to_dev(wdev->wiphy);
 
-        if (!rdev->ops->change_virtual_intf)
-                return -EOPNOTSUPP;
-
-        /* don't support changing VLANs, you just re-create them */
-        if (wdev->iftype == NL80211_IFTYPE_AP_VLAN)
-                return -EOPNOTSUPP;
-
         switch (*mode) {
         case IW_MODE_INFRA:
                 type = NL80211_IFTYPE_STATION;
@@ -104,9 +94,9 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
 
         memset(&vifparams, 0, sizeof(vifparams));
 
-        ret = rdev->ops->change_virtual_intf(wdev->wiphy, dev, type,
-                                             NULL, &vifparams);
-        WARN_ON(!ret && wdev->iftype != type);
+        cfg80211_lock_rdev(rdev);
+        ret = cfg80211_change_iface(rdev, dev, type, NULL, &vifparams);
+        cfg80211_unlock_rdev(rdev);
 
         return ret;
 }
@@ -267,39 +257,26 @@ EXPORT_SYMBOL_GPL(cfg80211_wext_giwrange);
  * @wiphy: the wiphy
  * @freq: the wext freq encoding
  *
- * Returns a channel, %NULL for auto, or an ERR_PTR for errors!
+ * Returns a frequency, or a negative error code, or 0 for auto.
  */
-struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
-                                             struct iw_freq *freq)
+int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq)
 {
-        struct ieee80211_channel *chan;
-        int f;
-
         /*
-         * Parse frequency - return NULL for auto and
+         * Parse frequency - return 0 for auto and
          * -EINVAL for impossible things.
          */
         if (freq->e == 0) {
                 if (freq->m < 0)
-                        return NULL;
-                f = ieee80211_channel_to_frequency(freq->m);
+                        return 0;
+                return ieee80211_channel_to_frequency(freq->m);
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div <= 0)
-                        return ERR_PTR(-EINVAL);
-                f = freq->m / div;
+                        return -EINVAL;
+                return freq->m / div;
         }
-
-        /*
-         * Look up channel struct and return -EINVAL when
-         * it cannot be found.
-         */
-        chan = ieee80211_get_channel(wiphy, f);
-        if (!chan)
-                return ERR_PTR(-EINVAL);
-        return chan;
 }
 
 int cfg80211_wext_siwrts(struct net_device *dev,
@@ -761,30 +738,27 @@ EXPORT_SYMBOL_GPL(cfg80211_wext_giwencode);
 
 int cfg80211_wext_siwfreq(struct net_device *dev,
                           struct iw_request_info *info,
-                          struct iw_freq *freq, char *extra)
+                          struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        struct ieee80211_channel *chan;
-        int err;
+        int freq, err;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
-                return cfg80211_mgd_wext_siwfreq(dev, info, freq, extra);
+                return cfg80211_mgd_wext_siwfreq(dev, info, wextfreq, extra);
         case NL80211_IFTYPE_ADHOC:
-                return cfg80211_ibss_wext_siwfreq(dev, info, freq, extra);
+                return cfg80211_ibss_wext_siwfreq(dev, info, wextfreq, extra);
         default:
-                chan = cfg80211_wext_freq(wdev->wiphy, freq);
-                if (!chan)
+                freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+                if (freq < 0)
+                        return freq;
+                if (freq == 0)
                         return -EINVAL;
-                if (IS_ERR(chan))
-                        return PTR_ERR(chan);
-                err = rdev->ops->set_channel(wdev->wiphy, chan,
-                                             NL80211_CHAN_NO_HT);
-                if (err)
-                        return err;
-                rdev->channel = chan;
-                return 0;
+                mutex_lock(&rdev->devlist_mtx);
+                err = rdev_set_freq(rdev, NULL, freq, NL80211_CHAN_NO_HT);
+                mutex_unlock(&rdev->devlist_mtx);
+                return err;
         }
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwfreq);
diff --git a/net/wireless/wext-compat.h b/net/wireless/wext-compat.h
index 9a3774749589..20b3daef6964 100644
--- a/net/wireless/wext-compat.h
+++ b/net/wireless/wext-compat.h
@@ -42,8 +42,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
                                struct iw_request_info *info,
                                struct iw_point *data, char *ssid);
 
-struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
-                                             struct iw_freq *freq);
+int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq);
 
 
 extern const struct iw_handler_def cfg80211_wext_handler;
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 7bacbd1c2af6..d16cd9ea4d00 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -15,6 +15,7 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev)
 {
         struct cfg80211_cached_keys *ck = NULL;
+        const u8 *prev_bssid = NULL;
         int err, i;
 
         ASSERT_RDEV_LOCK(rdev);
@@ -42,8 +43,12 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                 for (i = 0; i < 6; i++)
                         ck->params[i].key = ck->data[i];
         }
+
+        if (wdev->wext.prev_bssid_valid)
+                prev_bssid = wdev->wext.prev_bssid;
+
         err = __cfg80211_connect(rdev, wdev->netdev,
-                                 &wdev->wext.connect, ck);
+                                 &wdev->wext.connect, ck, prev_bssid);
         if (err)
                 kfree(ck);
 
@@ -52,25 +57,31 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
 
 int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                               struct iw_request_info *info,
-                              struct iw_freq *freq, char *extra)
+                              struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        struct ieee80211_channel *chan;
-        int err;
+        struct ieee80211_channel *chan = NULL;
+        int err, freq;
 
         /* call only for station! */
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
                 return -EINVAL;
 
-        chan = cfg80211_wext_freq(wdev->wiphy, freq);
-        if (chan && IS_ERR(chan))
-                return PTR_ERR(chan);
+        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        if (freq < 0)
+                return freq;
 
-        if (chan && (chan->flags & IEEE80211_CHAN_DISABLED))
-                return -EINVAL;
+        if (freq) {
+                chan = ieee80211_get_channel(wdev->wiphy, freq);
+                if (!chan)
+                        return -EINVAL;
+                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                        return -EINVAL;
+        }
 
         cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -84,9 +95,8 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                 /* if SSID set, we'll try right again, avoid event */
                 if (wdev->wext.connect.ssid_len)
                         event = false;
-                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
-                                            dev, WLAN_REASON_DEAUTH_LEAVING,
-                                            event);
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
@@ -95,17 +105,15 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         wdev->wext.connect.channel = chan;
 
         /* SSID is not set, we just want to switch channel */
-        if (wdev->wext.connect.ssid_len && chan) {
-                err = -EOPNOTSUPP;
-                if (rdev->ops->set_channel)
-                        err = rdev->ops->set_channel(wdev->wiphy, chan,
-                                                     NL80211_CHAN_NO_HT);
+        if (chan && !wdev->wext.connect.ssid_len) {
+                err = rdev_set_freq(rdev, wdev, freq, NL80211_CHAN_NO_HT);
                 goto out;
         }
 
-        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
 }
@@ -143,6 +151,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
                                struct iw_point *data, char *ssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         size_t len = data->length;
         int err;
 
@@ -157,7 +166,8 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
-        cfg80211_lock_rdev(wiphy_to_dev(wdev->wiphy));
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
 
         err = 0;
@@ -173,23 +183,24 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
                 /* if SSID set now, we'll try to connect, avoid event */
                 if (len)
                         event = false;
-                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
-                                            dev, WLAN_REASON_DEAUTH_LEAVING,
-                                            event);
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
 
+        wdev->wext.prev_bssid_valid = false;
         wdev->wext.connect.ssid = wdev->wext.ssid;
         memcpy(wdev->wext.ssid, ssid, len);
         wdev->wext.connect.ssid_len = len;
 
         wdev->wext.connect.crypto.control_port = false;
 
-        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        cfg80211_unlock_rdev(wiphy_to_dev(wdev->wiphy));
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -206,7 +217,15 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
         data->flags = 0;
 
         wdev_lock(wdev);
-        if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
+        if (wdev->current_bss) {
+                const u8 *ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
+                                                    WLAN_EID_SSID);
+                if (ie) {
+                        data->flags = 1;
+                        data->length = ie[1];
+                        memcpy(ssid, ie + 2, data->length);
+                }
+        } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
                 data->flags = 1;
                 data->length = wdev->wext.connect.ssid_len;
                 memcpy(ssid, wdev->wext.connect.ssid, data->length);
@@ -222,6 +241,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
                             struct sockaddr *ap_addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         u8 *bssid = ap_addr->sa_data;
         int err;
 
@@ -236,7 +256,8 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
                 bssid = NULL;
 
-        cfg80211_lock_rdev(wiphy_to_dev(wdev->wiphy));
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -250,9 +271,8 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
                     compare_ether_addr(bssid, wdev->wext.connect.bssid) == 0)
                         goto out;
 
-                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
-                                            dev, WLAN_REASON_DEAUTH_LEAVING,
-                                            false);
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, false);
                 if (err)
                         goto out;
         }
@@ -263,10 +283,11 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.connect.bssid = NULL;
 
-        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        cfg80211_unlock_rdev(wiphy_to_dev(wdev->wiphy));
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 21cdc872004e..5e6c072c64d3 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -40,6 +40,7 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/timer.h>
 #include <linux/string.h>
 #include <linux/net.h>
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index d401dc8f05ed..e5195c99f71e 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -16,7 +16,7 @@ static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
 
 static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        return ntohl(daddr->a4 ^ saddr->a4);
+        return ntohl(daddr->a4 + saddr->a4);
 }
 
 static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index a2adb51849a9..fef8db553e8d 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -60,7 +60,7 @@ static int xfrm_statistics_seq_open(struct inode *inode, struct file *file)
         return single_open_net(inode, file, xfrm_statistics_seq_show);
 }
 
-static struct file_operations xfrm_statistics_seq_fops = {
+static const struct file_operations xfrm_statistics_seq_fops = {
         .owner   = THIS_MODULE,
         .open    = xfrm_statistics_seq_open,
         .read    = seq_read,